DSKY Simulation

In Their Own Words: James Kernan on the Genesis of Restart Protection in the AGC

James Kernan
Engineer Alex Kosmala
Albert Hopkins
J. Halcombe Laning For Brochure

Genesis of Restart Protection in Apollo Flight Software by James Kernan

"Early in the program, late 1962 to early 1963, Al Hopkins returned from an Interface Control meeting with the spacecraft contractor with the news that the Apollo Guidance Computer (AGC) might experience a brief power transient whenever a Reaction Control System (RCS) jet fired. This got the software folks very concerned so under the direction of Alex Kosmala, restart protection was incorporated into the mission program. The implementation relied on Hal Laning’s design of the Executive program which allowed for the scheduling and dispatching of relative priority programs. So if a power interruption occurred, the software cleared the Executive queues and restarted programs flagged as restartable for the current phase.

Each restartable program saved critical data and restart points as it progressed in its execution. For cyclic programs, the re-start point was usually at its beginning. The software was extensively tested, especially the restart protection aspects. This design made the flight software very robust and forgiving of hardware and environment “funnies”, so we were quite confident in the software, as well as the hardware. This feature was subsequently incorporated into all critical phase mission programs (Ascent, On-orbit powered flight, and Entry for the CM, and Ascent, On-orbit powered flight, and Descent for the LM). The restart feature was also utilized in the design of the program-to-program mission phase transition as a so-called software restart.

In fact, the RCS system and the power system of both the CM and LM never caused a restart in any mission. However the restart protection design was responsible for the success of the Apollo 11 landing. As has been well described, the AGC suffered queue overflows due to higher than expected CPU usage resulting from a procedural switch position error. The software execution proceeded almost normally and the crew landed successfully at Tranquility Base.

So, hats off to Albert Hopkins and Alex Kosmala for the successful landing. Of course, a few other folks also contributed."

James Kernan worked on computer engineering and software during the Apollo Program at MIT/Draper.