Current lineage
During the first Moon landing the computer began failing. It had been written to fail well.
Minutes from touchdown the Apollo 11 guidance computer threw alarms because it was being asked to do more than it could. It did not stop: the software had been designed to recognise the overload, discard the work that did not matter, restart the work that did — steering the engine, talking to the crew — and keep going. The landing continued.
- Revision: 1
- Published: 2026-08-14
- Updated: 2026-08-14
- By: Space Now, edited by J. S. Nova
Priority scheduling and graceful degradation under overload are now ordinary expectations of critical software. They were being demonstrated in public, for the first time, with two people descending toward the Moon.
The alarms
During the descent the computer raised program alarms — 1201 and 1202. Both meant the same underlying thing: the machine had run out of a resource it needed to schedule new work. The straightforward response would have been to stop and hand control to the crew. That is not what happened, because the failure had been anticipated.
Deciding what not to do
The software had been written to treat overload data as being of secondary importance and to ignore it. When the alarm fired, the computer rebooted, reinitialised, and restarted selected programs near the point they had reached — the descent engine steering, and the display keeping the crew informed. What it did not restart were the erroneously scheduled rendezvous radar jobs that had caused the overload in the first place. The system shed exactly the work that could be shed.
Where the idea went
The team that produced the flight software was led by Margaret Hamilton at the MIT Instrumentation Laboratory; she was later granted a NASA Exceptional Space Act Award for the contribution. The concepts the work established — asynchronous software, priority scheduling, end-to-end testing, and keeping a human in the loop through priority displays — became foundations of ultra-reliable software design, which is where they remain.
Chronology
Generated from dated relations, with the precision of each date stated.
- day precisionProgram alarms 1201 and 1202 occur during the lunar descent; the computer restarts priority work and the landing continues.
Related records
explained by
What does software do when it is asked for more than it can give?
Confidence: high · 1969-07-20 (day precision)
relates to
Both were single points of failure that held.
Confidence: high · 1969-07-20 (day precision)
relates to
The computer and the vehicle it was steering.
Confidence: high · 1969-07-20 (day precision)
Inspect the record2 assertions, each with its source
Every assertion, its source class, and any conflict or uncertainty in the record.
The computer was programmed to recognise overload data as of secondary importance and ignore it; on each 1201 or 1202 alarm it rebooted, reinitialised and restarted selected programs near where they had been — including steering the descent engine and running the crew display — while not restarting the erroneously scheduled rendezvous radar jobs.
Source class: space agency recordNASA — Apollo 11 Lunar Surface Journal: Program AlarmsView the source
Margaret Hamilton led the team that developed the flight software for NASA's Apollo missions and was granted a NASA Exceptional Space Act Award; her concepts of asynchronous software, priority scheduling, end-to-end testing and man-in-the-loop priority displays became foundations for ultra-reliable software design.
Source class: space agency recordNASA Science — Margaret HamiltonView the source
CorrectionsNone recorded
No corrections recordedThis record has not been corrected since it was published.