Margaret Hamilton (software engineer)

From 1961 to 1963, Hamilton worked on the Semi-Automatic Ground Environment (SAGE) Project at the MIT Lincoln Lab,[17] where she was one of the programmers who wrote software for the prototype AN/FSQ-7 computer (the XD-1), used by the U.S. Air Force to search for possibly unfriendly aircraft.[6] She also wrote software for a satellite tracking project at the Air Force Cambridge Research Laboratories.[17] The SAGE Project was an extension of Project Whirlwind, started by MIT to create a computer system that could predict weather systems and track their movements using simulators. SAGE was soon developed for military use in anti-aircraft air defense. Hamilton said:

What they used to do when you came into this organization as a beginner, was to assign you this program which nobody was able to ever figure out or get to run. When I was the beginner they gave it to me as well. And what had happened was it was tricky programming, and the person who wrote it took delight in the fact that all of his comments were in Greek and Latin. So I was assigned this program and I actually got it to work. It even printed out its answers in Latin and Greek. I was the first one to get it to work.[20]

It was her efforts on this project that made her a candidate for the position at NASA as the lead developer for Apollo flight software.[7]

Hamilton in 1969, standing next to listings of the software she and her MIT team produced for the Apollo project[21]

Hamilton during her time as lead Apollo flight software designer[22]

Hamilton then joined the MIT Instrumentation Laboratory, which developed the Apollo Guidance Computer for the Apollo lunar exploration program. Hamilton was the first programmer hired for the Apollo project and in 1965 became Director of the Software Engineering Division.[23][24] She was responsible for the team writing and testing all on board in flight software for the Apollo spacecraft's Command and Lunar Module and for the subsequent Skylab space station.[25][26][19] Another part of her team designed and developed the systems software.[27] This included error detection and recovery software such as restarts and the Display Interface Routines (also known as the Priority Displays), which Hamilton designed and developed.[28] She worked to gain hands-on experience during a time when computer science courses were uncommon and software engineering courses did not exist.[19]

Her areas of expertise include: systems design and software development, enterprise and process modeling, development paradigm, formal systems modeling languages, system-oriented objects for systems modeling and development, automated life-cycle environments, methods for maximizing software reliability and reuse, domain analysis, correctness by built-in language properties, open-architecture techniques for robust systems, full life-cycle automation, quality assurance, seamless integration, error detection and recovery techniques, human-machine interface systems, operating systems, end-to-end testing techniques, and life-cycle management techniques.[19][21] These techniques are intended to make code more reliable because they help programmers identify and fix errors sooner in the development process.

In one of the critical moments of the Apollo 11 mission, the Apollo Guidance Computer, together with the on-board flight software, averted an abort of the landing on the Moon. Three minutes before the lunar lander reached the Moon's surface, several computer alarms were triggered. According to software engineer Robert Wills, Buzz Aldrin entered the codes to request that the computer display altitude and other data on the computer’s screen. The system was designed to support seven simultaneous programs running, but Aldrin’s request was the eighth. This action was something he requested many times whilst working in the simulator. The result was a series of unexpected error codes during the live descent. The on-board flight software captured these alarms with the "never supposed to happen displays" interrupting the astronauts with priority alarm displays.[29] Hamilton had prepared for just this situation years before:

There was one other failsafe that Hamilton likes to remember. Her "priority display" innovation had created a knock-on risk that astronaut and computer would slip out of synch just when it mattered most. As the alarms went off and priority displays replaced normal ones, the actual switchover to new programmes behind the screens was happening "a step slower" than it would today.

Hamilton had thought long and hard about this. It meant that if Aldrin, say, hit a button on the priority display too quickly, he might still get a "normal" response. Her solution: when you see a priority display, first count to five.[30]

By some accounts, the astronauts had inadvertently left the rendezvous radar switch on, causing these alarms to be triggered (the claim that the radar was left on inadvertently by the astronauts is disputed by Robert Wills with the National Museum of Computing[31]). The computer was overloaded with interrupts caused by incorrectly phased power supplied to the lander's rendezvous radar.[32][33][34] The program alarms indicated "executive overflows", meaning the guidance computer could not complete all of its tasks in real time and had to postpone some of them.[35] The asynchronous executive designed by J. Halcombe Laning[36][32][37] was used by Hamilton's team to develop asynchronous flight software:

Because of the flight software's system-software's error detection and recovery techniques that included its system-wide "kill and recompute" from a "safe place" restart approach to its snapshot and rollback techniques, the Display Interface Routines (AKA the priority displays) together with its man-in-the-loop capabilities were able to be created in order to have the capability to interrupt the astronauts' normal mission displays with priority displays of critical alarms in case of an emergency. This depended on our assigning a unique priority to every process in the software in order to ensure that all of its events would take place in the correct order and at the right time relative to everything else that was going on.[38]

Hamilton's priority alarm displays interrupted the astronauts' normal displays to warn them that there was an emergency "giving the astronauts a go/no go decision (to land or not to land)".[39] Jack Garman, a NASA computer engineer in mission control, recognized the meaning of the errors that were presented to the astronauts by the priority displays and shouted, "Go, go!" and they continued.[40] Paul Curto, senior technologist who nominated Hamilton for a NASA Space Act Award, called Hamilton's work "the foundation for ultra-reliable software design".[27]

Hamilton later wrote of the incident:

The computer (or rather the software in it) was smart enough to recognize that it was being asked to perform more tasks than it should be performing. It then sent out an alarm, which meant to the astronaut, 'I'm overloaded with more tasks than I should be doing at this time and I'm going to keep only the more important tasks'; i.e., the ones needed for landing ... Actually, the computer was programmed to do more than recognize error conditions. A complete set of recovery programs was incorporated into the software. The software's action, in this case, was to eliminate lower priority tasks and re-establish the more important ones ... If the computer hadn't recognized this problem and taken recovery action, I doubt if Apollo 11 would have been the successful moon landing it was.

— Letter from Margaret H. Hamilton, Director of Apollo Flight Computer Programming MIT Draper Laboratory, Cambridge, Massachusetts, titled "Computer Got Loaded", published in Datamation, March 1, 1971[41]

In 1976, Hamilton co-founded with Saydean Zeldin a company called Higher Order Software (HOS)[42] to further develop ideas about error prevention and fault tolerance emerging from their experience at MIT working on the Apollo program.[43][44] They created a product called USE.IT, based on the HOS methodology they developed at MIT.[45][46][47] It was successfully used in numerous government programs[48][49] including a project to formalize and implement C-IDEF, an automated version of IDEF, a modeling language developed by the U.S. Air Force in the Integrated Computer-Aided Manufacturing (ICAM) project.[50] In 1980, British-Israeli computer scientist David Harel published a proposal for a structured programming language derived from HOS from the viewpoint of and/or subgoals.[51] Others have used HOS to formalize the semantics of linguistic quantifiers,[52] and to formalize the design of reliable real-time embedded systems.[53]

Hamilton was the CEO of HOS through 1984[43] and left the company in 1985. In March 1986, she founded Hamilton Technologies, Inc. in Cambridge, Massachusetts. The company was developed around the Universal Systems Language (USL) and its associated automated environment, the 001 Tool Suite, based on her paradigm of development before the fact for systems design and software development.[34][54][55]