A four-year-old crashed the Apollo command module simulator by starting the prelaunch program, P01, in the middle of a simulated flight. NASA turned down the fix her mother proposed, and on Apollo 8, in December 1968, an astronaut made the same mistake in real space.
Her mother was Margaret Hamilton, who led the software engineering team at MIT's Instrumentation Lab during Apollo. She died on Sep. 30 at 90, and the MIT News obituary retells the story that became known as "the Lauren error". Below is how that error works, step by step, using the minute-by-minute NASA transcript in the Apollo Flight Journal.
The simulator crash and the "no"
Per MIT News, Lauren was playing with the simulator at the Instrumentation Lab and somehow started P01 while the simulated spacecraft was in flight. The simulator crashed.
Hamilton did two things. She added a warning to the documentation: do not start P01 during flight. And she proposed a change to the software so the error could not happen on a real mission. She was overruled. The reason given was that highly trained astronauts would never make that mistake.
So the fix was a sentence in a document, not a check in the code. The person typing was expected to remember it.
The short version, as a video:
How one keypress became "program 01"
You talked to the Apollo Guidance Computer through a keypad called the DSKY, with verbs (what to do) and nouns (what to do it to). Verb 37 means "change program to...", and the next number you type is the program.
On day 5 of Apollo 8, on the coast home from the Moon, Jim Lovell was about to measure the angle between star 01 (Alpheratz) and the lunar horizon. The Flight Journal lays out the correct sequence:
VERB 37 ENTER 23 ENTER -> start P23 (star sightings)
VERB 5 01 ENTER -> star code 01 (Alpheratz)
What he actually keyed, per the Journal, skipped the program number and the second verb:
VERB 37 ENTER 01 ENTER -> start P01
The computer did exactly what it was told. P01's stated job is "to initialise the platform for the prelaunch programs". The platform is the gyroscope-stabilised unit that holds a fixed direction in space, so the computer always knows which way the ship points. Starting P01 moved it away from its current alignment. A "No Attitude" light came on.
At 106:27:28 mission time Lovell reported: "For some reason, we suddenly got a Program 01 and a 'No Attitude' light on our computer." Three minutes later, at 106:30:21: "We have star 01 coming up, now that might have been the reason."
The Journal's own verdict on the machine: "astonishing" for its time, but its interface was "unsophisticated, even clunky, and very unforgiving of errors", and the crew were sleep-deprived. Both errors had the same root cause. One input was valid in two very different contexts, and nothing asked "are you sure?" before running the program meant for the launch pad.
Fixing it with two stars
The ship was not lost. Apollo 8 was on a long coast with no time-critical burns just ahead, and the Journal calls that fortunate. Houston's procedure: select P00, run P51 to align the platform again by sighting stars, then receive a new reference orientation (the REFSMMAT) from the ground and fine-tune with P52.
At 106:49:50 Frank Borman said: "Jim had to use Rigel and Sirius, and they're pretty close together." Two known stars give the computer enough to rebuild its sense of direction. That is the same job a navigator's sextant did at sea.
Houston later checked the memory. At 115:17:22 Ken Mattingly told the crew their P01 "didn't have any effect" on the erasable memory, apart from one display that might now be unreliable. The crew did not let it go: at 115:21:17 Borman called Lovell "the same guy that tried to launch us this afternoon" (Apollo Flight Journal, the next part of day 5).
What changed after
According to MIT News, Hamilton and her team were called in to solve the error, and after that her proposed changes went into the program. MIT News calls this an early example of "defensive" programming: software that expects mistakes and handles them instead of trusting the operator.
The pattern is still everywhere. A documented "never do X" is a bug report waiting for a date. If an input can destroy state in one mode, the code, not the manual, has to check the mode.
An open question I could not answer from these sources: what exactly did her final check look like in the flight software? If you have read the Apollo flight software listings, I would like to know how it decided P01 was not allowed.
Top comments (0)