JOURNAL OF GUIDANCE, CONTROL, AND DYNAMICS

Vol. 25, No. 1, January– February 2002

Some Funny Things Happened on the Way to the Moon

Richard H. Battin
Massachusetts Institute of Technology
Cambridge, Massachusetts 02139

In the Beginning In those days, the contract between MIT and the Ballistic Missile

W ITH THE TYPESETTING program TEX installed in my Division of the US Air Force contained a clause which allowed
MAC II, I begin the von Kármán Lecture for the AIAA. our laboratory, within certain limits of course, to work on whatever
The date is December 21, 1988, exactly 20 years to the day from struck its fancy—a sort of government IR&D program.
the launch of Apollo 8. Eleven years earlier, the world had been The few of us lucky enough to be involved were very excited
enthralled by the Russian Sputnik and the Space Age had begun. about the Mars probe. We studied the problem intensely for a year
I have at my Ž ngertips several orders of magnitude more comput- or so and produced a three volume report together with a full-scale
ing power than the Apollo Guidance Computer which was carried wooden model of the spacecraft.
Today, that model is displayed in the lobby of The Charles Stark
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

onboard the Apollo spacecraft. And this marvel of modern technol-

ogy sits on my desk at home! Draper Laboratory.¤
This is the year for celebrating Apollo 11—the 20th anniversary Navigation data for the Mars probe was to be gathered by an
of the Ž rst lunar landing. But the earlier  ight of Apollo 8 was also onboard sextant and processed by a spacecraft digital computer.
a dramatic milestone. It was the Ž rst manned space ight beyond Observation data would be used to determine vehicle position and
an earth orbit. The astronauts, Frank Borman, Jim Lovell, and Bill a correction to the onboard clock. Periodically, changes in velocity
Anders, were the Ž rst human beings ever to see the entire earth as a would be made by a small propulsion system as directed by the
ball. Said Norman Cousins computer. Spacecraft attitude was to be maintained by momentum
wheels also under computer control. Power would be obtained from
“On the Ž rst  ight to the moon we really discovered the the sun using solar panels which would unfold like venetian blinds
earth.” after launch.
Indeed, who can ever forget that picture of the earth rising above To ensure reasonable launch velocities, the round-trip  ight time
the lunar landscape? was to be three years. Computer activity would be minimal during
To many of us who were part of the Apollo program, it was the long coasting periods between velocity corrections. Most of the
the most thrilling  ight of all. We demonstrated the feasibility of time the computer would be “asleep” to conserve power. Indeed, the
onboard, self-contained space navigation for the very Ž rst time. principal requirement for the computer was that it have a long shelf
life.
It all began on October 4, 1957 when the RussianslaunchedthatŽ rst Only one picture of the Martian surface was to be taken to elim-
satellite. I had started life at MIT—Ž rst as a student, then working inate the mechanical pitfalls of a Ž lm transport system. The space-
with Hal Laning at the MIT InstrumentationLab. But on that fateful craft would make one pass by the planet a few thousand miles above
day I had been away from MIT for a year working in industry.When the surface, orient itself for the photograph, open the shutter to
I learned that Hal had a simulation of the solar system running on expose the Ž lm plate, and coast back to earth.
the IBM 650 and was “ ying” round trips to Mars, I could hardly The capsule housing the Ž lm had a shape similar to the Apollo
wait to rejoin him. Command Module and, in like manner, would dive through the at-
A report by Hal Laning, Elmer Frey, and Milt Trageser on the mosphere to splash down in the Gulf of Mexico. A radio transmitter,
feasibility of a photographic reconnaissance  ight to Mars had just a yellow dye, and a  ashing light would aid in its recovery. A repel-
been published at the laboratory. They were dead serious that such lent would hopefully discourage any shark who might think of it as
a  ight was possible within the next Ž ve to seven years. dinner.

Richard H. Battin received an S.B. degree in electrical engineering in 1945 and a Ph.D. in applied mathematics in
1951—both from the Massachusetts Institute of Technology. He received an Honorary Doctor of Science Degree in
1999 from Texas A& M University. Currently, he is a Senior Lecturer in the MIT Aeronautics and Astronautics De-
partment. He retired in 1987 from The Charles Stark Draper Laboratory, Inc. In 1972, he and David G. Hoag were
presented by the AIAA with the Louis W. Hill Space Transportation Award (now called the Goddard Astronautics
Award) “for leadership in the hardware and software design of the Apollo spacecraft primary control, guidance,
and navigation system which Ž rst demonstrated the feasibility of onboard space navigation during the historic
 ight of Apollo 8.” He received the AIAA Mechanics and Control of Flight Award for 1978, the Institute of Naviga-
tion Superior Achievement Award for 1980, the AIAA Pendray Aerospace Literature Award for 1987, and the von
Kármán Lectureship in Astronautics for 1989. He was presented by the American Astronautical Society with the
1996 Dirk Brouwer Award and the inaugural 2000 Tycho Brahe Award by the Institute of Navigation.For his latest
book An Introduction to the Mathematics and Methods of Astrodynamics, Revised Edition, published in 1999 by the
AIAA in their Education Series, he will receive the AIAA SummerŽ eld Book Award for 2002. He is an Honorary
Fellow of the AIAA and a Fellow of the American Astronautical Society. He is a member of the National Academy of
Engineering and the International Academy of Astronautics. “In recognition of outstanding teaching” the students
of the MIT Department of Aeronautics and Astronautics honored him in 1981 with their Ž rst Teaching Award.

Presented as the von Kármán Lecture at the AIAA 27th Aerospace Sciences Meeting, Reno, Nevada; Jan. 9 – 12, 1989, Paper 89-0861; received Jan. 9, 1989;
revision received March 8, 1989. Copyright ° c 2001 by Richard H. Battin. Published by the American Institute of Aeronautics and Astronautics, Inc., with
permission. Copies of this paper may be made for personal or internal use, on condition that the copier pay the $10.00 per-copy fee to the Copyright Clearance
Center, Inc., 222 Rosewood Drive, Danvers, MA 01923; include the code 0731-5090/02 $10.00 in correspondence with the CCC.
¤ The Draper Lab and the Instrumentation Lab are the same. Only the name was changed in 1970 as a Ž tting tribute to its founder.

1
 2 BATTIN

All in all, it was a rather sophisticated project considering the But it was used for the Ž rst time to navigate the Apollo 8 Com-
state-of-the-art. Milt Trageser was and is to be congratulated for mand Module in cis-lunar space on its way to the moon!
his engineering prowess and ingenuity. The program was well con-
ceived and carefully planned. But, as has happened to so many other With NASA funding, Hal Laning and Ramon Alonzo began, in
“best laid plans,” it too went astray. earnest, the design of the Mars probe computer with its unique
characteristics for space applications:
In the Doldrums ² variable speed to save power
The Mars probe preliminary design was complete in the summer ² relatively few transistors
of 1959. The Air Force had been its sponsor, but a new government ² parallel word transfer
agency—the “National Aeronautics and Space Administration” ² automatic counter incrementing
would control its destiny. ² automatic interrupt
With view graphs, reports, and the wooden spacecraft model, we The program and constants were wired in a so-called “core
arrived in Washington on the same day as Nikita Khrushchev. Our rope”—a memory with unusually high bit densities which could
presentation was well received. But the high-level NASA audience not be altered electronically.
we had anticipated, including Hugh Dryden, was busy entertaining This was the computer concept and architecture that would one
the Russians. day take man to the moon.
NASA did not immediately write us a blank check for the Mars
probe, but we were promised some future study money. Our small In the Race
team survived but much of the original enthusiasm did not. Now we Our NASA contract ended and there was a nine month hiatus
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

were simply doing “interplanetary navigation system studies.” We before another six-month contract began in early 1961—this time
had no reason to anticipate what lay ahead. for a preliminary design study of a guidance and navigation system
sponsored by the NASA Space Task Group.
Later that year on May 25, 1961, President John F. Kennedy in
To support the Mars project, we developedappropriatetrajectories
his Special Message to Congress on Urgent National Needs said:
with  ight times of roughly three years, and launch dates in 1962–
1963 time frame. In this case, the spacecraft makes two orbits of the “I believe that this nation should commit itself to achieve
sun while the earth does three. Later we found round-trip missions the goal, before this decade is out, of landing a man on
to Venus having  ight times of only a year and a quarter. the Moon and returning him safely to Earth.”
I also discovered on January 26, 1961 the Ž rst multiple  yby
orbit—earth to Venus to Mars to earth—which is traversed, at least Jim Webb, the NASA Administrator, knew Doc Draper and asked
theoretically, without additional propulsion. This game of celestial him to develop the Apollo guidance and navigation system. Of
billiards is played by proper control of the orientation of the orbital course Doc agreed.
plane and altitude during the swingby of each planet. “When will it be ready?” asked Webb.
Today, the Voyager spacecraft on its Grand Tour of the solar sys- “When you need it,” said Draper.
tem is a spectacular demonstration of such missions. Soon, hope- “How do I know it will work?” Webb persisted.
fully, the Galileo spacecraft will be making dozens of similar close “I’ll go along and operate it for you.”
encounter  ybys of the Jovian moons.
And he most certainly would have done so, had they only let him.
The tools we needed for this work were not easily achieved. One
It all became ofŽ cial on August 10, 1961—exactly eleven weeks
did not study Celestial Mechanics unless he planned to be an as-
after Kennedy’s speech.
tronomer and astronomers were not designing orbits for missions
to Mars. On the contrary, in 1956 the British Astronomer Royal The Ž rst major Apollo contract awarded by the space
declared “Space travel is utter bilge!” agency was to the MIT Instrumentation Laboratory!
Some astronomers, whom we did consult, had reservations about It sounds incredulous but that’s the way it really happened.
the success of the project. “How do you expect to send a spacecraft Everyone who knew Doc Draper believes it and it is the story just
to Mars when you don’t know exactly where it is?” (In those days the way Draper always told it. Doc is no longer with us but his spirit
the uncertainty was several thousand miles.) I suppose it was not and inspiration live on.†
easy to abandon their familiar earth-based reference coordinates.
Today, many people wonder “Was there ever really a Space Race?”
Navigating the Mars probe consistedof measuringangles between It was certainly real in the beginning. There was a strong concern
planets and stars. We linearized those measurements about a refer- that the Russians would interfere with an Apollo  ight by jamming
ence point and used Gaussian weighted least squares to obtain the the telemetry signals.
celestial Ž x. Our lab was noted for developingautonomous systems in missile
The terms “estimator” and “state vector” were not in vogue so guidance—the self-contained backup system for the Atlas inter-
we couldn’t yet say that we had designed an “estimator” for a continental ballistic missile, the Thor IRBM, and the Polaris  eet
four-dimensional “state vector”—three for position and one for the ballistic missile guidance system. Of course, needless to say, the
onboard clock correction. Mars probe would have been self contained.
Later, for the Apollo system, the state space had nine-dimensions. The challenge of providing an autonomous guidance and navi-
In addition to position and velocity, we would also be estimating gation system for Apollo was right up our alley. So when Charlie
the rendezvousradar antenna angle biases on the Lunar Module and Frick, our NASA boss from the Apollo Spacecraft Program OfŽ ce,
estimating lunar landmark locationsas observedfrom the Command announced:
Module. “There will be absolutelyno ground communicationswith
Gaussian least squares requires batch processing. All data is col- the Apollo spacecraft! Don’t even think about it!”
lectedbeforethe computationbegins. In a small  ight computerwith
data gathered over long periods of time, the method is cumbersome
and impractical. †On September 28, 1988 the Charles Stark Draper Prize was created by
The situation was remedied by a recursive form of the estimator the National Academy of Engineering and funded by the Draper Lab Board
of Directors. It is a major new international award to recognize achievement
which allowed measurements to be incorporated as they are made.
in engineering and technology.
It was not important for the Mars probe, but it was essential for The Prize is similar to the Nobel Prize. It will recognize extraordinary
Apollo navigation. engineering accomplishment in the service of human welfare and freedom,
This recursiveestimationprocessis now known as a Kalman Ž lter. and will emphasize those aspects of engineering that are essential to a better
Today, it is widely used for all sorts of purposes. Every student of future.
control systems studies the subject in school. Doc would certainly have been pleased.
 BATTIN 3

it was difŽ cult to suppress our smiles. We felt just like Br’er Rabbit: magnetic core. A stored bit is a “one” whenever a sense wire threads
a core and a “zero” when it fails to thread a core.
“Please don’t throw us in that briar patch, Br’er Frick!”
In the operation of the rope memory, a core is switched which in-
Security was also very real. Almost everything was classiŽ ed— duces a voltage drop in every sense line which threads that core. Six-
even schedules.Fortunately,that particularphobia soon petered out. teen sense wires were connected to sense ampliŽ ers to detect which
At the other extreme,there were many who advocatedcooperation had voltage drops. With the addition of an appropriate switching
with the Russians.During a paneldiscussionat an AIAA conference, network, each core could then hold several words.
Wernher von Braun addressed the question: “Why don’t we work All this information was permanently wired at Raytheon by
together on the Apollo program?” His response went right to the “LOL’s”—literally, “little old ladies” who slowly and painstakingly
heart of the matter: threaded the cores by hand. Later an ingenious adaptation of a tex-
“If there were cooperation with the Russians on space- tile loom was used for this purpose which was far faster and cer-
 ight, there wouldn’t be a program in either country.” tainly more reliable. The loom was driven by a punched paper tape
created by the same program that produced the mission software.
To start our part of the race we had Ž rst to assemble a team. But Once a memory module was manufactured, not a single bit could
Ž nding the right people was frustrating.We had the most challenging be changed, either intentionally or unintentionally.
guidance system imaginable to develop. Recruits should have been There was a dichotomy of opinion regarding the Ž xed memory
pounding at the door. But that didn’t happen. concept. Once the memory had been programmed, it took about six
In the long run, though, the best people were already at the Lab— weeks to manufacture. Add to that the time required for testing and
working in other divisions. Appropriate transfers were made. Nev- you discover the rule:
ertheless, for a very long time to come, the software task was not No  ight-computer memory changes
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

adequately staffed. within two months of a launch!!

We were beginning to learn that “people problems” were often It was far too late to change the design so the argument was purely
much more difŽ cult to solve than the technical ones. philosophical:“Was it bad or was it good?”
Although we couldn’t seem to get engineers,we did get advice— Each side made its own case:
both technical and theological:
“Apollo should be launched on a clear night when the ² There must be a way to make last minute changes.
moon is full to provide the best possible target.” ± But, last minute changes may be ill-considered and/or hur-
riedly tested. They are dangerous.
and
“If the Lord had intended man to go to the moon, He In the long run, despite objections, it was good discipline and kept
everyone honest. If you know you can’t make last minute changes,
would never have created Senator Proxmire.”
then, by golly, you’ll be that much more careful in your design and
In the Software Jungle testing.
Inevitably,of course,someonewould discoverthat erasablemem-
The MIT Instrumentation Lab was designing software for the
ory could hold more than just data. You could actually write and
Apollo onboard guidance system even before the word “software”
execute programs from the erasable memory.
was invented.
By that time, though, strict NASA approval was required to
I still remember the Ž rst time I told my wife that I was in charge
do so.
of “Apollo Software.” She exhorted me: “Please don’t tell any of
our friends!”
The physical sizeof the computer was onecubic foot.That could be
I suppose real men do “Hardware” just as real men don’t eat
changed only at great cost since the spacecraft manufacturer,North
quiche.
American Aviation, had allowed that much room and no more in the
It was an attitude that prevailed a long time in many organiza-
Command Module. If we needed more capability, it would have to
tions. Salaries for computer programmers did not keep up with the
come from advances in computer technology.
salaries of engineers. Engineers did engineering.The programming
Eldon Hall, who had designed the Polaris missile computer, was
(or coding) was more menial work and should be left to others.
in charge of the Apollo Guidance Computer development.I can still
I wanted no such distinction. Our best engineers should design
remember the day he asked if I could use twice as much memory.
and program the software for the  ight computers. The reasoning (He had Ž gured out how to stuff twice as many sense wires through
was simple. A good engineer can learn to write programs. But a
a core.) I was ecstatic. Our prayers had been answered.
computer software specialist would Ž nd it far more difŽ cult to do
Charlie Frick, however, was not so pleased:
the engineering without considerably more training.
The basic architecture of the Apollo onboard computers was the “You told us that 4000 words was enough. And now you
design of Hal Laning—certainly one of our most creative engineers, want to double it!!”
and the early application programs were written by our best system
He was, obviously,a man of experiencein dealingwith unscrupulous
engineers. We tried hard to keep our standards high.
contractors.Doubling the size would surely mean doublingthe cost.
Even so, with the best talent, computer programs seldom perform
The memory size was, indeed, doubled. And it doubled twice
as intendedthe Ž rst time. If they work at all, they may do unexpected
again after that before it went to the moon. The Ž nal count was
or “funny” things. We called them “FLT’s”—short for Funny Little
36,864 sixteen-bit words for the Ž xed memory and 2048 for the
Things.
erasable. The cycle time had also been cut in half to 12¹sec. But
This was before “Murphy” discovered his famous law. He must
the physical size never did change.
have been secretly watching our software development efforts.
We were able to cope with limited memory, limited instruction
The Apollo Guidance Computer, or AGC as it was called, evolved repertoire, and short word length for mission programs by using a
from the design for the Mars probe. In 1961, when our Apollo powerful interpretive language.
contract was signed, it had 4096 words of Ž xed memory and 256 Charlie Muntz created the “Interpreter” to manipulate the 28 bit
words of erasable. data words. Memory was conserved (dramatically, to be sure) but
A word was 16 bits (that’s bits not bytes) with one bit for sign and now the time for numerical computationswas measured in millisec-
one for parity check. Hence, double precision was required for most onds:
calculations. The cycle time was modest, approximately 24¹sec,
which was more than sufŽ cient for the Mars application. ² Double-precision add—0.66 millisec
The Ž xed memory was called a “core rope memory” since the ² Double-precision multiply—1.1 millisec
early models clearly resembled lengths of rope. The high density ² Double-precision square root—1.9 millisec
of storage was achieved by “storing” a large number of bits in each ² Double-precision sine—5.6 millisec
 4 BATTIN

Although the data words now had sufŽ cient length, they were During this period, NASA was totally focused on the success of
expressed with a Ž xed decimal point. We couldn’t afford the luxury those missions. The next  ight always has everyone’s undivided
of a  oating-point arithmetic. Fixed point is much faster and many attention.
of the mission programs had to function in real time. At one time during those Gemini  ights, a software change was
required in their reentry guidance program. IBM, the software con-
The Master Control of this software maze was the Executive and tractor, told NASA the cost of the change would be one million
Waitlist Program skillfully designed and written by Hal Laning. It dollars!
was a sophisticated piece of software that: George Mueller was appalled. As the new Associate Administra-
tor for Manned Space Flight he wondered “If it was that costly to
² permitted time-sharing of erasable memory change Gemini software, how about Apollo? Who was doing the
² allowed orderly interruption of programs by those of higher Apollo software anyhow?”
priority It was our Ž rst indication that top NASA management had ever
² accommodated as many as seven programs in suspended an- thought about the MIT software effort. Until then, we were virtually
imation with sufŽ cient information saved to enable each to unimpeded by outside in uences. It was pure heaven! So many
resume at a later time as though nothing had happened. things were decided by one or two engineers which, today, would
It was a supremetriumph of Hal Laning’s ingenuityand perspicacity. take many trade-off studies and large committees.
(Remember that this was 1961 and control computers were barely When the spotlightŽ nally fell on us, the conceptualpart of the job
in their infancy.) and many of the mission related programs were essentially Ž nished.
I can still remember when Hal Ž rst tried to explain to me just how Later, I reminded George Mueller of the incident and asked “How
all this was supposed to work. It was mind boggling. “Hal,” I said, much did it really cost to change the Gemini reentry program?” His
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

“This is much too complicated. There has to be a simpler way.” He answer: “One million dollars.”
responded with profound authority:
“There is no other way to do this job!” Soon we were made keenly aware of a basic fact of life: There is a
vast differencebetween getting the Apollo software job and keeping
And, of course, he was right. it.
But the same mind which could conceive this logical masterpiece We frequently heard the opinion that MIT should not do the
preferred not to cope with endless meetings, in large conference Apollo software. Production software is not the kind of job for a
rooms, with too many people, and too much contention. This was school. They don’t have the resources, the right people, or the moti-
to be our lot for years to come and Hal avoided it like the plague. vation. (I guess nonproŽ ts can’t be rewarded or punished—at least
Fortunately for us, he was always there for advice and counsel. not in the traditional ways.)
The NASA creed was evident everywhere—on desktops, on
Mission programming began in earnest as soon as the software posters, and bumper stickers:
tools were in place. We had no Ž rm requirements from NASA but
we knew, generally, some of the things that had to be done.
Better is the Enemy of Good
We would have to navigate with onboard sensors; to make course
changes outside the atmosphere; to reenter the atmosphere at the
proper angle; and we would have to guide the Command Module But, “MIT doesn’t know when to quit designing,” they said. “They
safely to its splash-down site in the ocean. have a bunch of prima donnas who want to make everything perfect
These activities started before the decision favoring Lunar Orbit regardless of how long it takes.”
Rendezvous and the invention of the Lunar Module. In fact, the We seemed to be in a kind of trench warfare—constantly defend-
Grumman Aircraft Engineering Corporation wasn’t even identiŽ ed ing our job against all assailants.
as the LM contractor until the end of 1962. An amusing incident took place at a meeting between our MIT
In June 1964, Robert C. (Cliff) Duncan, Chief of Guidance and software people and an industry group who was, obviously, probing
Control in Houston, directed that spacecraft autopilot functions be to Ž nd our weak spots. I presided at the conference table and was
performed digitally in our computer. It was rather late for such a big absentmindedlytoying with a pair of scissors when an annoying  y
change. By that time, we had been on the job for three years and a  ew past.
lot of code had been written. Suddenly, with one slash of the scissors, I cut that  y in half in
To accommodate these new and time-critical functions, he au- midair. The visitors swallowed hard and the tone of the meeting
thorized a design change in the computer—we could double the immediately changed. Once again, the day was saved.
speed and increase the repertoire of codes. (At that time the com-
puter had but eight basic instructions and “divide” was not one of
them.) But the software people were not to worry. Their carefully- George Mueller took a personal interest in the Apollo Guidance
crafted programs would still work on the new computer. “Upward Computer and it was no wonder that he did. He had recently expe-
Compatibility” was to be the name of the game. rienced the dire consequences of a programming error.
But the new computer could be programmed much more efŽ - A missing “hyphen” in a  ight computer program caused the loss
ciently with the new codes and our precious computer memory must of the Mariner I at the start of its mission to Venus on July 21, 1962.
never be squandered.Everythingwas redone for the Block II system. Although I never saw it, I understandthat he had the symbol framed
Unfortunately,the Block I system didn’t go away. It would still be
used for the Ž rst orbital  ights. Now we had two different software ¡
systems to maintain.
That wasn’t the worst either. Soon we would have both the LM
computer as well as the CM computerfor which to provide software. and prominently displayed on his ofŽ ce wall lest anyone forget the
The two were the same but they had radically different tasks to importance of  ight software.
perform. Early in his tenure at NASA, he formed the Apollo Software Task
The Apollo software job was escalating rapidly. The question Force with representatives from many of the Apollo contractors.
was: “Were we really up to it?” Fortunately, I was a member. When George saw computer memory
disappearing at a rapid clip, he solicited informal proposals from
In the Trenches Task Force members to program the Apollo computers using just
The Ž rst manned Mercury  ight was May 5, 1961 and the last half the memory.
on May 15, 1963. The Gemini program, which was to proof-test Inevitably, the “half-memory computer” would be privately la-
the concept of orbital rendezvous, had its Ž rst  ight on March 23, beled the “half-assed computer.” At least, we hadn’t lost our senses
1965—the last took place November 11, 1966. of humor.
 BATTIN 5

But now we were really nervous. The door was being opened After that, when new and absolutely essential requirements sur-
to compete the Apollo software job and Laboratory policy did not faced, they could only be added when something else of lesser
permit us to compete with industry. importance was removed.
We were conŽ dent that the Apollo software requirements could Things had gotten that serious.
not be met with only half the memory. But we were also certain that
there were those who would say that it could be done. Bellcom and Then came that terrible day of the Ž re and the loss of the crew:
IBM were among those interested in bidding. Gus Grissom, Ed White, and Roger Chaffee. It was January 27, 1967
The time soon came for proposal presentations from the various during ground testing of the Apollo spacecraft in Florida.
bidders. When it was Bellcom’s turn, Gordon Heffron, the Bellcom The launch schedule was now a shambles. The spacecraft was
representative,said that MIT was doing an outstandingjob and they completelyredesignedunder the superb leadership of Aaron Cohen.
would not submit a proposal. Three unmanned guided  ights, which had not been planned before
It all ended right there and then. Our job was secure—or so it the Ž re, were  own and supported by our software teams before the
seemed. Ž rst manned  ight, Apollo 7, on October 11, 1968. Then we really
went into high gear!
I still can’t believe how fast events happened after that 20 month
The biggest complaint NASA had about our software effort was hiatus:
quite straightforward:
² Apollo 8 on December 21, 1968—To the moon
“MIT doesn’t have enough people!” ² Apollo 9 on March 3, 1969—Flight-test the LM
² Apollo 10 on May 18, 1969—The dress rehearsal
Some tasks were obviouslyone man jobs. We used those examples
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

² Apollo 11 on July 16, 1969—The lunar landing

in feeble attempts to fend off the criticisms. We loved the analogy:
NASA was shooting them off like Roman candles!
“How many people do you have to squeeze into a booth
to make a phone call?” The rest is history. We never held up a  ight; we never had a system
failure; and I am proud to say:
The Michelangelo analogy was another favorite:
“The MIT Instrumentation Laboratory did all of the on-
“When he was painting the Sistine Chapel ceiling, would board software from the Ž rst Apollo guided  ight on
Michelangelo have accepted help from a gang of house August 25, 1966 through the three SkyLab missions in
painters just to Ž nish on schedule?” 1973 to the Apollo-Soyuz rendezvous mission with the
Russians on July 15, 1975.”
Our real problem was paradoxical:

1. Good people are hard to Ž nd. In Route

2. If you Ž nd them, they must be trained. Certainly the longest and most thrilling 5 minutes of my life
3. The people who must train them are too busy. was the 5 minute burn of the S– IVB engine to boost the speed of
the Apollo 8 spacecraft to the 24,200 mph necessary to escape the
4. Why are they so busy?
earth.
5. Because we don’t have enough people. “You are on your way,” said Chris Kraft, from the Mission Control
room, “you are really on your way.”
For the Ž rst Command Module  ight, Apollo 3, Alex Kosmala A few weeks before the launch, the Navigator Command Module
was the ofŽ cial “Rope Mother.” With a small dedicated group, he Pilot, Jim Lovell, spent a few hours practicing on the earth-horizon
spent 15 months preparing the  ight program, called CORONA. sextant simulator at MIT. He consistently identiŽ ed the “horizon”
The original estimate was 6 months. But until then, no one had about 20 miles above the real horizon.
any idea just how difŽ cult and time-consuming the job would be. Great! Jim Lovell could be calibrated and his bias number loaded
Although we were 9 months late, NASA was even later in imple- in the  ight computer.
menting the Real Time Control Center. CORONA was released in He was recalibrated in real time on the way to the moon. His Ž rst
January of 1966 but didn’t  y until August. eleven sextant angle measurements, made early in the  ight, were
We were saved this time, but the specter loomed that one day the compared with what they should have been according to the RTCC.
Saturn V would be perched on its launch pad carrying the Apollo After the horizon calibration,came the Ž rst midcourse correction
spacecraft and waiting for those MIT guys to deliver the  ight pro- of almost 25 ft/sec. It was a fairly large one due to earlier maneuvers
gram. to get the spacecraft safely away from the third stage of the launch
We could well become the “long pole in the tent”—a colorful vehicle.
label no one wanted pinned to his back. Following the course change, the onboard computer’s version of
the state vector was made to agree with the value obtained from
ground tracking.
The people problem was solved when the System Development From that time on, Jim Lovell made dozens of star-elevationmea-
Corporation became our subcontractor. They supplied organized surements using both the earth and lunar horizons. These were pro-
teams with competentleadership.We didn’t have to worry about how cessed by the Apollo Guidance Computer using the recursive es-
to employ 30 or 40 individuals, but could just deal with a few team timation algorithm. The Ž nal set of 15 sightings was made about
leaders. Other companies, Raytheon, AC Electronics, ARCON, and 35,000 miles from the moon.
CDC also supplied talent but not in such large numbers. The onboardand groundtracking estimateswere almost identical!
Flight Operationsin Houston under Bill Tindall took charge of the Chris Kraft even suggested that we use the onboard state vector for
MIT software contract. His Ž rst action was to deal with computer lunar orbit insertion. But the  ight plan dictated that a state vector
memory problems. It was Friday the 13th of May, 1966—“Black update from the ground was required before any maneuver. And
Friday” for many of our favorite programs. there was no overriding argument to deviate from the plan.
Since the Russians probably wouldn’t try to mess us up, the  ight Nevertheless, the evidence was conclusive.
would be controlled from the ground. We could just as well strip out The astronauts could have done it on their own without
all those lovely algorithmswhich made the spacecraftself-sufŽ cient. any ground assistance whatsoever!
But wait! Most of those programs were needed for another reason.
We could not, for instance, dispense with “Navigation” or “Return
to Earth” or “Powered Flight Guidance.” After all, we still could Early in the morning of December 24, Apollo 8 disappearedbehind
lose contact with the ground for non-sinister reasons. the Moon. For 34 minutes there was no way of knowing what had
 6 BATTIN

happened. During that time a 247-second burn took place under the Neil suggested the Apollo Guidance Computer:
control of the MIT guidancesystem and Apollo 8 was in lunar orbit.
The astronauts announced their orbital parameters provided by the “It’s the most reliable computer I know. It got me safely
AGC when voice contact was resumed. The Mission Control folks to the moon and back.”
were obviously disconcerted:
And that is exactly the computer that was used. Phil Felleman, an
“How do they know? We haven’t had time to track them outstanding leader and systems engineer at the Draper Lab, was
yet.” given the job to do. And he did it well.
The Apollo Guidance Computer never failed in any  ight. There
They were not yet experienced with self-containedinertial systems. was concern when lightning struck Apollo 12 during launch. It
At 8:40 pm Christmas Eve, 1968, the Apollo 8 astronauts were wiped out the erasable memory load and initiated a computer
on television broadcasting from lunar orbit. “For all the people restart. But the memory was reloaded in earth orbit and all went
on Earth,” said Bill Anders, “the crew of Apollo 8 has a message well.
we would like to send you.” He paused a moment and then began The quality-control people couldn’t calculate the “mean-time-
reading: between-failures” since it would have required dividing by zero.
“In the beginning God created the Heaven and the Earth Generally, engineers stare in disbelief when told that the Apollo
: : : and God saw that it was good.” computer had absolutely no built-in redundancy. There were many
possibilities of single-point failures which would have disabled the
The commander Frank Borman added: computer. But none of them happened.
Even the computer itself was not redundant. In the Space Shuttle
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

“And from the crew of Apollo 8, we close with good night, today there are Ž ve guidance computers but there was only one
good luck, a Merry Christmas, and God bless all of you— each in the Command Module and the Lunar Module. (There was
all of you on the good Earth.” a back-up computer of limited capability in the LM for emergency
use, designed and built by TRW, but it was never needed.)
Days later, in the Washington Post, there appeared an editorial: It wasn’t a matter of luck either. Reliability considerations were
uppermost in the design right from the start.
“At some point in the history of the world someone may For example, only one type of integrated logic circuit, a three-
have read the Ž rst ten verses of the Book of Genesis inputNOR gate, was used. This meant that Eldon Hall and Raytheon,
under conditions that gave them greater meaning than the computer manufacturer, could concentrate on quality control of
they had on Christmas Eve. But it seems unlikely : : : This a single circuit rather than several. A wider variety of circuits would
Christmas will always be remembered as the lunar one.” have reduced the number of componentsper computer but reliability
would have been adversely affected.
In Retrospect
In the wake of the Apollo 11  ight, Dave Hoag, the MIT Program
The euphoriafollowing the success of Apollo 8 was quickly over- Manager for Apollo, and I were invited to Russia as guests of the
shadowed by the departure of most of our top software talent. One USSR Academy of Sciences. We took with us the NASA Ž lm of the
of the many “spinoffs” of the Instrumentation Lab was happening lunar landing.
again. Like so many others before them, they were starting their It was an immediate success. No matter where we went, everyone
own company. It was a hard blow indeed. wanted to see the Ž lm. If there was no screen, they would hang up
But we did survive.By that time we had very strongteam members a bed sheet. When the lights went out, cleaning ladies, janitors, and
and they were ready for the promotions to follow. other extraneous folk would squeeze into the room. It was shown so
many times on so many strange projectors that the sprocket holes
were damaged beyond repair.
Apollo 11 was a magniŽ cent triumph! But the actual landing was
During the question and answer period following the show, there
more exciting than we had counted on. Just before touch down the
was always the question:
Apollo Guidance Computer almost caused a near panic by display-
ing alarms. The NASA  ight controllers remained cool and did not
order an abort. “When will the Americans go to the moon again?”
During the short stay of Neil Armstrong and Buzz Aldrin on
the lunar surface, everyone who could possibly contribute to an Fortunately, we knew the planned date of Apollo 12 and told them.
understandingof the problem was hard at work. There was concern They were incredulous. No one ever announced launches ahead of
about the upcoming liftoff and rendezvous in just a few hours. time.
The culprit was an erroneousmode setting—the rendezvousradar As it happened, we were dead right. Apollo 12 did  y on schedule
was transmitting pulses to the computer at maximum rate. During November 14, 1969. That must have done a lot for our credibility
landing, the computer has plenty of work to do. The additional task back in the USSR.
of counting all those extraneous pulses was just too much.
There are still a lot of people, who should know better, who
describe that event as a computer malfunction. Nothing could be The Soviet penchant for secrecy has always baf ed me. Just before
farther from the truth. It was, in fact, a triumph of software design. we  ew to Russia, the Soyuz 6 with two cosmonauts aboard was
When the computer was operating near capacity and sensed an launched on October 11, 1969. When we changed planes in London,
overload condition, it was programmed to stop everything, clear we learned of the launch of Soyuz 7 on October 12. “Wonderful,”
the table, and restart only the top priority jobs. The display of the we thought. “We will be there in person and learn all about this Ž rst
alarm was to tell the astronautsand ground controllersjust what was hand.”
happening. As we drove toward Moscow from the airport with our host,
The software designers had the foresight to anticipate such a I asked about the purpose of the double launch. The reply was
possibility and the skill to cope with it should it ever happen. No an irrelevant comment about some housing project we had just
one ever thought it would happen—except Murphy, of course. passed.
Neil Armstrong remembered the Apollo computer when he was The next day, October 13, Soyuz 8 lifted off to join the other two.
later assigned to NASA headquarters to head the research and Now there were three spacecraftand six cosmonautsin orbit—a real
development programs. One such program involved an F8 airplane spectacular! We knew of this only from pictures in Pravda. None
to be used for a  y-by-wire experiment. NASA needed a reliable of us read Russian so we were at the mercy of our Russian host for
computer to  y that airplane. A computer failure would mean the details. But, to our dismay, we again learned nothing. Any question
loss of the plane. was countered by a quick change of the subject.
 BATTIN 7

Each of the three missions lasted about Ž ve days. When all of the When we returned from the Soviet Union, Howard Johnson, then
cosmonauts had safely returned, we speculated that there would be president of MIT, told us a marvelous story which always brings
a big celebration and parade in Moscow. “Oh no,” was the reply. tears to my eyes.
“Space ight is now so routine.” It seems that a friend of Howard’s was between  ights in London
At the time, we were in Tbilisi, Georgia where we stayed an extra after the lunar landing. To pass the time, he visited Westminster
day because of, alleged, bad weather—no planes to Moscow. Abbey and came upon the tomb of Sir Isaac Newton. (If you haven’t
When we Ž nally did arrive in Moscow, we were met by a new seen it, you should. It is an impressive memorial.) Someone had left
host. “You should have been here yesterday,” he said. “There was a a note on the tomb. It read:
big parade in Red Square and we had seats for you with Brezhnev
Sir Isaac—the Eagle has landed!
in the reviewing stand.”
Downloaded by 2405:8100:8000:5ca1::242:77b7 on December 13, 2019 | http://arc.aiaa.org | DOI: 10.2514/2.4850

A MERICA’S P ROGRAM FOR O RBITAL AND L UNAR L ANDING O PERATIONS

Apollo 11 Splashdown Party

MIT Faculty Club
July 24, 1969

STANDING FROM RIGHT TO LEFT: Fred Martin, Eldon Hall, Gerry Levine, Dick Battin, Tom Fitzgibbon, and George Schmidt.