Skip to content

Margaret Hamilton and the Apollo Software

Abstract

Margaret Hamilton (17 August 1936 – 30 September 2026) led the team at the MIT Instrumentation Laboratory that wrote the onboard flight software for the Apollo Command Module and Lunar Module. She came to programming by accident, as a stopgap job to put her husband through law school, learned it on Edward Lorenz’s weather computer and on the SAGE air-defense system, and spent the rest of her life arguing that software deserved to be called engineering. This article follows her from Paoli, Indiana, to the 1202 alarms over the Sea of Tranquility and on to the two companies she founded to prevent software errors before they were written.

Margaret Hamilton
Margaret Hamilton with the Apollo guidance software listings, 1969. Image: Draper Laboratory, public domain, via Wikimedia Commons.

Indiana and Michigan

Margaret Heafield was born on 17 August 1936 in Paoli, Indiana. Her mother taught high school; her father, Kenneth Heafield, was a college professor of English, philosophy and poetry and for a time president of the Michigan Poetry Society. One grandfather was a Quaker minister. The family moved with the teaching jobs and settled in Michigan’s Upper Peninsula, where she finished high school in 1954.

From the age of sixteen she spent her summers as a tour guide in the Arcadian copper mine, a tourist attraction in a disused mine, and by her own account ended up hiring and running the other guides at the height of the season. Years later the men who interviewed her for Apollo asked more about the mine than about mathematics.

She began studying mathematics at the University of Michigan in 1955, then transferred to Earlham College in Richmond, Indiana, the Quaker-founded school her mother, aunts and grandparents had attended. There she found a mentor in Florence Long, head of the mathematics department, and graduated in 1958 with a BA in mathematics and a minor in philosophy, a combination she credited to her poet father and her grandfather. In 1958 she married James Hamilton, a fellow student. While he finished his degree she taught mathematics, and for one year French as well, at the high school in Boston, Indiana.

Lorenz’s Computer

The plan was for her to start graduate study in abstract mathematics, at Brandeis. Then her husband decided on Harvard Law School, their daughter Lauren was born at the end of 1959, and someone had to earn money. In the summer of 1959 she took a temporary job at MIT programming weather simulations for the meteorologist Edward Lorenz.

She had never been near a computer. Lorenz had a Royal McBee LGP-30 in his office, a desk-sized drum machine that weighed about 360 kilograms and sounded like a passing propeller plane, and he taught her how to place instructions on the drum so the program would run faster. She programmed it in hexadecimal and edited the binary paper tapes by hand, poking holes with a pencil for ones and covering others with Scotch tape, walking the tape the length of the meteorology department’s hallway. She scheduled the largest matrix multiplications before lunch. Lorenz thanked her in one of his papers, which she only found out decades later. In the summer of 1961 she trained her replacement, Ellen Fetter, and moved on, because a university research job did not pay enough to support a family and save for graduate school.

SAGE at Lincoln Laboratory

From 1961 to 1963 she worked at MIT Lincoln Laboratory on SAGE, the US air-defense network, writing software for the AN/FSQ-7 prototype XD-1. Her job interview took place in a hotel bar: the recruiter told her he normally interviewed candidates in his hotel room and could not do that with a woman. She could not travel to the weeks-long training course because of her daughter, so she stayed behind and, by her account, had done most of the assigned work by the time her colleagues returned.

New hires at Lincoln were handed a test: a program written by a programmer named Ernie who had since left, so tricky that nobody had managed to run it. Hamilton got it to run. When the printer finally started, everyone ran over to read the output, and found that all its comments were in Latin and Greek. She resolved then to comment her own code.

Her own program separated aircraft from radar noise. A crash on the XD-1 set off loud bells and flashing lights, and the operators would come running to ask the owner of the program what she had done. Her program happened to make a sound when it ran that everyone agreed resembled surf, and they called it the seashore program. One night at 4 a.m. an operator phoned her at home: “Margaret, something terrible has happened to your program. It doesn’t sound like a seashore anymore.” She drove in and fixed it. The experience of seeing a whole room hear a failure gave her an early interest in software reliability.

The Machine at the Heart of Apollo

The Apollo Guidance Computer (AGC) was designed beginning in 1961 at the MIT Instrumentation Laboratory, under the direction of Charles Stark Draper. It was built by Raytheon from about 2,800 integrated circuits, each holding two NOR gates. It was not the first digital computer in space: Minuteman missiles carried digital guidance in the early 1960s, and IBM’s Gemini computer, 4,096 words of 39-bit core on discrete components, flew on the uncrewed Gemini 2 test on 19 January 1965 and then guided the crewed Gemini rendezvous, such as Gemini 6A and 7 closing to about 30 centimetres in December 1965. Apollo’s lunar landings depended on that rendezvous experience.

Its specifications:

  • Memory: 2,048 words (4 kilobytes) of erasable core memory and 36,864 words (72 kilobytes) of fixed core rope memory
  • Processor: 16-bit words, with a memory cycle of 11.7 microseconds (an addition took two)
  • Weight: 32 kilograms
  • Interface: a numeric display and keyboard called the DSKY (Display and Keyboard)

Every Apollo mission that flew a Lunar Module carried two AGCs, one in each spacecraft; Apollo 7 and Apollo 8, flown without one, had only the Command Module’s. They navigated, timed engine burns, and flew the spacecraft through a “fly-by-wire” autopilot, with the astronauts entering commands as numbered verbs and nouns on the DSKY.

Core Rope Memory

The AGC’s read-only program memory was woven. A wire threaded through a magnetic core stood for a 1; a wire routed around it stood for a 0. Women at a Raytheon plant in Massachusetts, known in the program as the “Little Old Ladies,” threaded the Apollo programs by hand. Weaving took months, so the code had to be frozen long before launch, and a wiring error meant redoing that section. In exchange, the rope could not be erased by a power failure or a stray bit of radiation. The engineers who signed off each mission’s rope were called “rope mothers.”

The Instrumentation Laboratory

In 1965 Hamilton was again preparing for graduate school when news reached her that the MIT Instrumentation Laboratory, which held NASA’s contract for the Apollo guidance system, was hiring people to write software to put men on the Moon. She went to two interviews with two different groups on the same day, and both offered her a job on the spot. Not wanting to disappoint either, she let them decide; they flipped a coin, and the winner was the group writing the onboard flight software. “I was the first programmer to join and the first woman they hired,” she told the Guardian in 2019. “Male engineers were already working on the project, but they were hardware engineers.”

The word itself was new. Hamilton recalled that when Richard Battin, who led the lab’s mission software effort, went home and told his wife he would be in charge of software, it sounded like a kind of soft clothing. NASA’s original requirements for the Apollo guidance system did not mention software at all; it was in neither the schedule nor the budget, as David Mindell documents in Digital Apollo.

As the junior hire, Hamilton was given the code for an abort that everyone agreed would never happen on an uncrewed test flight. She named it “ForgetIt.” The mission aborted, the program ran, and she became the lab’s instant expert on what had happened.

She moved from the uncrewed flights to the crewed ones, and up through the hierarchy. By 1968 she was assistant director in charge of the Command Module software team, and more than 400 people were working on Apollo software; about 100 of them reported to her. Programmers punched their code on cards, ran it overnight in simulation on a Honeywell mainframe, and checked it on hardware simulators before it went to Raytheon to be woven. She often brought Lauren to the lab in the evenings and on weekends. “People used to say to me, ‘How can you leave your daughter? How can you do this?’” she told Wired. Her first marriage ended in 1967. When she took over the team, one of the lab’s senior managers told her he had no doubt she could do the job but worried that the men might rebel. “They didn’t,” she said.

Defensive Code

Hamilton’s team was writing real-time software for a spacecraft that could not be patched after launch, on hardware with almost no spare capacity. The design they built around had three parts that mattered on the night of the landing:

  • Asynchronous, priority-driven scheduling. The AGC’s Executive, designed by Hal Laning, ran several jobs at once and always gave the processor to the highest-priority one.
  • Restart protection. Critical programs recorded checkpoints. After a restart the computer resumed from the last safe point and dropped work that could be dropped, instead of starting over.
  • Priority displays. Around 1966 Hamilton worried that an astronaut busy reading data off the DSKY would not notice an emergency inside the computer. She proposed that the software interrupt the crew’s normal display with a warning and a choice of options. The hardware engineers first said it could not be done, because the display hardware was not powered for the whole mission; after some days they agreed to leave it on. The systems engineers then objected that the astronaut and the computer would be acting in parallel and nobody would know which display a key press answered. Her fix was simple: the astronaut counts to five before responding. These Display Interface Routines were the part of the Apollo code she wrote herself, and they flew on every mission from the first landing onward.

Apollo DSKY CM Simulator
Apollo DSKY from a Command Module simulator. Image: Steve Jurvetson from Los Altos, USA, CC BY 2.0, via Wikimedia Commons.

The Lauren Bug

One evening Lauren, still a small child, watched her mother “fly” a mission on the lab’s Command Module simulator and wanted to try it herself. She pressed keys, started program P01, the prelaunch routine, while the simulated spacecraft was in mid-flight, and the simulation crashed: P01 shared erasable memory with the navigation programs and overwrote their data.

Hamilton wanted to add code that would reject P01 during flight. She was overruled, because of the extra code and because, as she recalled the argument, astronauts were trained not to make mistakes. “We had been told many times that astronauts would not make any mistakes,” she told Wired. “They were trained to be perfect.” The compromise was a program note in the documentation: “Do not select P01 during flight.”

Around Christmas 1968, on the way back from the first crewed flight to orbit the Moon, Apollo 8’s Jim Lovell selected P01 by accident while entering star data, and the navigation data vanished. Hamilton was in the lab’s SCAMA room, the line to Mission Control in Houston, and recognised it at once: “It’s the Lauren bug.” The team spent hours going through the printed listings and worked out a procedure; Houston uplinked fresh navigation data and the crew came home. After the flight she was allowed to put in her fix.

July 20, 1969: The 1202 Alarm

During the powered descent of Apollo 11 on 20 July 1969, about seven minutes before touchdown, the Lunar Module’s DSKY showed program alarm 1202. Further 1202s and a 1201 followed over the next minutes, the last at about 770 feet above the surface.

The cause was in the hardware interface, not in the code. The rendezvous radar switch was in a position that fed its angle counters to the computer, and because of an undocumented mismatch in the phase of two 800 Hz power supplies, those counters were incremented almost continuously. The spurious counting took about 13 percent of the computer’s time. The main guidance job could no longer finish within its two-second cycle, unfinished copies piled up, and the Executive ran out of storage areas: 1202 meant no free core sets, 1201 no free vector-accumulator areas. Each alarm triggered a restart. Restart protection then did what it had been built for: the computer resumed guidance from its checkpoints and shed the lower-priority work, so the landing programs kept running.

By Hamilton’s account, the alarms reached the crew through her priority displays. In Houston the 26-year-old guidance officer Steve Bales, backed by Jack Garman, who had written out a list of every possible alarm after a 1201 in a training simulation on 5 July had led Bales to call a needless abort, judged that 1202 was safe as long as it did not recur continuously and navigation stayed sound. About half a minute after the first alarm Houston called “go.” Armstrong took manual control in the final phase and landed Eagle at 4:17 p.m. EDT.

Hamilton heard the alarms from the SCAMA room in Cambridge. “Going through my mind had nothing to do with the mission,” she told the Computer History Museum. “My software, the priority displays, that was the part I had personally written.” In a 1971 letter to Datamation titled “Computer got loaded” she set out the sequence for a professional audience. The Guardian later summarised her team’s record as no known software bug in any crewed Apollo mission.

The famous photograph of Hamilton beside a stack of listings as tall as she was dates from this time. An MIT photographer took it for the newspapers during the Apollo 11 mission. “We got carried away and grabbed all the Apollo listings in my office and created the tower,” she said in 2019. “I was trying to find a way of keeping the stack up.”

Naming Software Engineering

At the Instrumentation Laboratory the programmers were, in her words, “kind of like second-class citizens”: engineers threw requirements “over the wall” and expected the code to work. While simulating the integrated system she noticed that the hardware and software modules behaved alike and raised the same design questions, and she started calling her side of the system “software engineering,” to tell it apart from hardware engineering while treating both as parts of systems engineering. The engineers found it funny. “There’s Margaret again with her software engineering.” The joke ended, as she remembered it, when one of the most respected hardware engineers stood up in a large meeting and said she was right: what the programmers did was engineering too.

She used the term early in the project by her own account. The wider field adopted it after the NATO conference on Software Engineering at Garmisch in October 1968.

Misconception: Margaret Hamilton coined the term “software engineering”

Obituaries in 2026 repeated that Hamilton or her team coined the phrase. It was already in print by June 1965, in an advertisement in Computers and Automation, and appeared in ACM publications in 1966, while she was just starting on Apollo. Hamilton claimed to have introduced it at the Instrumentation Laboratory and fought for its meaning there, not to have invented it first; asked whether it had been used elsewhere, she said, “Who knows?” Her contribution was to apply the name and its standards to flight software that had to work. See Friedrich L. Bauer for the Garmisch side and Myths and Misconceptions.

Dead End: Software as an Afterthought

Apollo was planned on the assumption that software was a minor detail of the guidance system. It appeared in no schedule and no budget. When the lab’s software fell behind, NASA sent the engineer Bill Tindall to Cambridge as a troubleshooter. Hardware engineering had tolerances, safety factors and test standards. Software had a few talented people and the “augekugel method,” lab slang for eyeballing the listing until the bug showed itself; when Hamilton finally asked what it meant, she was told it was German for eyeballing.

The Cost of the Assumption

The Apollo 1 fire on 27 January 1967 killed three astronauts and led to a sweeping redesign of the Command Module and of NASA’s hardware processes. On the software side the safeguards were built inside the lab: listings reviewed by the rope mothers, every program run through simulation before it flew, and code that assumed the crew and the hardware would sometimes be wrong. The P01 note and the 1202 restarts are the two places where that assumption was tested in flight. Avionics, medical-device and nuclear-control software still work under the same premise, now written into standards.

Higher Order Software and Hamilton Technologies

She stayed at the laboratory, renamed the Charles Stark Draper Laboratory in 1970 and independent of MIT from 1973, and led software work for Skylab and requirements recommendations for the Space Shuttle, among them that its flight software be asynchronous. She also began studying the Apollo error reports systematically: which errors had occurred, where, and how they could have been prevented rather than found. From that study came a set of six axioms for defining software formally, which drew interest from the US Navy.

In 1976 she left Draper and co-founded Higher Order Software (HOS) with Saydean Zeldin to apply the axioms, mostly for Department of Defense customers. The company grew past 100 employees and took venture money. By her account Electronic Data Systems (EDS) negotiated for over a year to buy it for about $38 million, and the deal was agreed with a handshake at a board meeting when General Motors’ purchase of EDS in 1984 froze all its acquisitions. The investors brought in a new chief executive and moved the product toward IBM mainframes. Hamilton, moved up to chairman, left; she said she briefly considered moving to Italy to be a waitress. Defense contacts offered her funding to continue, and the company she had left folded a few years later.

In March 1986 she founded Hamilton Technologies in Cambridge, Massachusetts, a few blocks from MIT. Its Universal Systems Language (USL) and the 001 Tool Suite implement what she called “Development Before the Fact”: define the system so that whole classes of interface errors cannot arise, instead of writing code and patching it. “It is better to define your system up front to minimise errors,” she said in 2019, “rather than producing a bunch of code that then has to be corrected with patches on patches.” She wrote more than 130 papers over her career.

Recognition

Margaret Hamilton Medal of Freedom 2016
President Barack Obama awards Margaret Hamilton the Presidential Medal of Freedom, 22 November 2016. Image: White House, public domain, via Wikimedia Commons.

Recognition came late and then all at once. The Association for Women in Computing gave her its Augusta Ada Lovelace Award in 1986. In 2003 NASA gave her its Exceptional Space Act Award for scientific and technical contributions, with $37,200. On 22 November 2016 President Barack Obama awarded her the Presidential Medal of Freedom, saying she “symbolizes that generation of unsung women who helped send humankind into space.” The Computer History Museum named her a Fellow in 2017, “for her leadership and work on software for DOD and NASA’s Apollo space missions and for fundamental contributions to software engineering.” The same year she became a Lego minifigure in the “Women of NASA” set designed by MIT’s Maia Weinstock. The Intrepid Museum’s Lifetime Achievement Award followed in 2019 and induction into the National Aviation Hall of Fame in 2022.

Asked in 2019 for advice to young women in programming, she said: “Don’t be afraid to say ‘I don’t know’ or ‘I don’t understand’. No question is a dumb question. And don’t always listen to the so-called experts!”

Death

Margaret Hamilton died on 30 September 2026 in a hospital in Cambridge, Massachusetts, aged 90. MIT announced her death on 7 October 2026. She was survived by her daughter Lauren, two grandsons, four great-grandchildren and her siblings John, David and Kathryn. Looking back on Apollo for MIT News in 2009, she had written: “There was no second chance. We knew that.”

For the hardware that ran Hamilton’s software, see The Von Neumann Architecture and The Microprocessor Revolution. For SAGE, see Whirlwind, SAGE, and Core Memory; for the Shuttle’s flight software, The Space Shuttle’s Two Software Teams That Were Forbidden to Communicate. For the broader history of women in computing, see Women in Computing.

📚 Sources