0:00:00.000,0:00:14.610
<i>34C3 preroll music</i>

0:00:14.610,0:00:21.220
Herald: The following talk is about a very[br]relevant piece of technological legacy of

0:00:21.220,0:00:27.990
our human race. The first piece of[br]computer that landed on our moon and

0:00:27.990,0:00:33.619
actually it became a metric. People[br]started to compare other architectures,

0:00:33.619,0:00:40.610
other computers in volumes of multiples of[br]processing speed of this computer. It's

0:00:40.610,0:00:46.100
rocket science, but it's even harder: it's[br]computer rocket science. So I'm very happy

0:00:46.100,0:00:50.920
to have Christian Hessmann, or Hessie, on[br]stage who is actually a rocket scientist.

0:00:50.920,0:00:52.799
And for the ...[br]<i>laughter</i>

0:00:52.799,0:00:58.249
... for the computer part we have Michael[br]Steil who is the founder of the Xbox Linux

0:00:58.249,0:01:02.670
project and has gathered with this project[br]and many others lots and lots of

0:01:02.670,0:01:06.520
experience around architectures of[br]computers. So please give a warm round of

0:01:06.520,0:01:09.550
applause for the Ultimate[br]Apollo Guidance talk!

0:01:09.550,0:01:18.060
<i>applause</i>

0:01:18.060,0:01:22.659
Michael Steil: Welcome! Is this on?[br]Can you all hear me? Yes.

0:01:22.659,0:01:27.140
Welcome to the Ultimate Apollo Guidance[br]Computer Talk, a.k.a. a comprehensive

0:01:27.140,0:01:32.359
introduction into computer architecture.[br]And operating systems. And spaceflight.

0:01:32.359,0:01:34.159
<i>laughter</i>

0:01:34.159,0:01:37.590
My name is Michael Steil ...[br]Christian: ... and I'm Christian Hessmann.

0:01:37.590,0:01:42.100
Michael: This talk is number six in a series[br]by various people. The idea is to explain as

0:01:42.100,0:01:46.490
much as possible about a classic computer[br]system in 60 minutes. The Apollo Guidance

0:01:46.490,0:01:50.860
Computer AGC is a digital computer that[br]was designed from scratch specifically for

0:01:50.860,0:01:54.580
use on board of the Apollo spacecraft to[br]support the Apollo moon landings between

0:01:54.580,0:02:01.919
1969 and 1972. Developed at MIT between[br]1961 and 1966 a total of 42 AGCs were

0:02:01.919,0:02:06.650
built at a cost of about $200,000 each.[br]The base clock is about one megahertz,

0:02:06.650,0:02:11.289
all data is 15 bits, and there are two[br]kilowords of RAM and 36 kiloword ROM,

0:02:11.289,0:02:16.480
words of ROM. It's about the size of[br]a large suitcase, weighs 32 kilograms and

0:02:16.480,0:02:22.130
consumes about 55 watts. Its user[br]interface is a numeric display and keyboard.

0:02:22.130,0:02:27.080
Some historical context: In the[br]mid 1960s you couldn't just take

0:02:27.080,0:02:29.580
an off-the-shelf computer and[br]put it into a spacecraft.

0:02:29.580,0:02:31.771
The first mini computers were[br]the size of a small fridge -

0:02:31.771,0:02:36.320
too heavy, to power-hungry and too slow[br]for real-time scientific calculations,

0:02:36.320,0:02:40.040
even though the industry had come a long[br]way since the previous decade.

0:02:40.040,0:02:43.110
Already 10 years later[br]though, microcomputers with highly

0:02:43.110,0:02:46.820
integrated circuits started outclassing[br]the AGC Hardware in many regards.

0:02:46.820,0:02:49.960
There are many reasons that make the AGC[br]especially interesting:

0:02:51.420,0:02:55.630
The architecture is very 60s and feels[br]very alien to us today,

0:02:55.630,0:02:58.060
the hardware is very innovative for its time.

0:02:58.060,0:03:01.560
It has some very interesting[br]and unusual peripherals.

0:03:01.560,0:03:04.770
Its operating system was revolutionary[br]for its time and

0:03:04.770,0:03:07.880
the mission software has all the bits to[br]- with the right hardware attached -

0:03:07.880,0:03:09.390
fly you to the moon.

0:03:10.710,0:03:13.360
C: In the Apollo program, the Apollo[br]guidance computer was used

0:03:13.360,0:03:16.700
in two unmanned test missions, where[br]it was remote control from the ground,

0:03:16.700,0:03:21.060
and three manned test missions, and in[br]the seven manned landing missions.

0:03:21.060,0:03:24.500
Astronauts hated the idea of giving up any[br]control to a computer,

0:03:24.500,0:03:27.120
they wanted to be in charge. [br]And while as a fallback,

0:03:27.120,0:03:29.170
most of the mission could also[br]be flown manually,

0:03:29.170,0:03:30.910
the mission planners got their way.

0:03:30.910,0:03:33.420
To understand the purpose[br]and the responsibilities of the

0:03:33.420,0:03:36.070
Apollo Guidance Computer, we need to[br]first look at the Apollo mission.

0:03:36.070,0:03:38.980
The core strategy of the Apollo program[br]was, instead of landing

0:03:38.980,0:03:42.390
the complete spacecraft on the moon,[br]for which an extremely large rocket

0:03:42.390,0:03:45.240
would have been required, to only[br]land a much smaller lander

0:03:45.240,0:03:48.750
while the larger part with the fuel[br]for the way back stays in orbit.

0:03:48.750,0:03:51.870
So the Apollo spacecraft can be[br]separated into the lunar module,

0:03:51.870,0:03:56.330
the command module and the service module.[br]The Saturn 5 rocket launches it and

0:03:56.330,0:03:59.140
three astronauts from Cape Kennedy[br]into Earth orbit.

0:03:59.140,0:04:02.970
By accelerating at the right time the[br]translunar injection moves the spacecraft

0:04:02.970,0:04:06.750
into a so-called free return orbit,[br]but just coasting it would travel

0:04:06.750,0:04:09.050
around the moon and back to earth.

0:04:09.050,0:04:11.950
Right at the beginning of this three-day journey[br]the command and service module

0:04:11.950,0:04:17.190
extracts the lunar module and docks with it.[br]By braking on the far side of the moon the

0:04:17.190,0:04:22.350
spacecraft enters a lunar orbit. After two[br]of the astronauts have climbed into the

0:04:22.350,0:04:26.590
lunar module, and after undocking, the[br]lunar module breaks - this is called

0:04:26.590,0:04:32.850
powered descent - and lands.

0:04:32.850,0:04:36.240
<i>Applause</i>

0:04:36.240,0:04:40.020
After taking off again, the lunar module[br]rendezvous with the command and service

0:04:40.020,0:04:43.220
module and the two astronauts from the[br]lunar module climb into the command module

0:04:43.220,0:04:47.240
and the lunar module is jettisoned. The[br]remaining command and service module

0:04:47.240,0:04:50.520
accelerates at the far side of the[br]Moon for trajectory towards Earth.

0:04:50.520,0:04:55.010
For entry, only the command module remains.[br]By the way, these excellent visualizations

0:04:55.010,0:04:58.140
are from Jared Owen's "How the Apollo[br]spacecraft works" videos,

0:04:58.140,0:05:00.971
which we can highly recommend.

0:05:00.971,0:05:03.530
The command and service[br]module and the lunar module each contained

0:05:03.530,0:05:07.190
one a AGC. It was the same hardware,[br]but attached to partially different

0:05:07.190,0:05:11.040
I/O devices, and with the software[br]adapted for the specific spacecraft.

0:05:11.040,0:05:15.250
The astronauts interact with them through[br]the display and keyboard units, which are

0:05:15.250,0:05:18.870
mounted alongside these[br]hundreds of switches.

0:05:18.870,0:05:22.590
The computer's responsibilities[br]during the mission are to track

0:05:22.590,0:05:26.200
the position and speed, the so called[br]state vector of both spacecraft,

0:05:26.200,0:05:30.450
stabilize the spacecraft's attitude,[br]calculate the control engine burns and

0:05:30.450,0:05:34.730
monitor or control the[br]Saturn V during launch.

0:05:36.810,0:05:40.280
M: In order to understand how the Apollo[br]guidance computer does all this,

0:05:40.280,0:05:43.900
we'll look at its architecture, the[br]hardware implementation, some of its

0:05:43.900,0:05:47.520
interesting peripherals, the system[br]software as well as ...

0:05:47.520,0:05:50.340
the system software as well as[br]the mission software.

0:05:50.340,0:05:55.290
The architecture of the[br]AGC can be described as a Von Neumann

0:05:55.290,0:05:59.370
accumulator machine with 15 bit one's[br]complement big-endian arithmetic.

0:05:59.370,0:06:03.200
So we'll talk about the instruction set, the[br]arithmetic model and instruction encoding

0:06:03.200,0:06:06.690
as well as the memory model, I/O[br]operations and counters, and finally the

0:06:06.690,0:06:11.741
interrupt model. Machine code instruction[br]sets vary widely. The instruction set of a

0:06:11.741,0:06:14.300
modern ARM processor, which is mainly[br]optimized for runtime performance

0:06:14.300,0:06:18.730
consists of about 400 instructions. Subleq[br]is a language mostly of academic interest,

0:06:18.730,0:06:22.010
that shows that a single instruction can[br]be enough to solve the same problems as

0:06:22.010,0:06:25.990
all other turing-complete languages. While[br]a more complex constructions, that can

0:06:25.990,0:06:30.740
achieve higher code density and contribute[br]to higher performance, it also generally

0:06:30.740,0:06:34.600
means that the CPU will be drastically[br]more complex. A computer from the early

0:06:34.600,0:06:38.250
1960s consisted of only a few thousand[br]transistors as opposed to today's

0:06:38.250,0:06:42.970
billions, which is why this is the sweet[br]spot for the AGC. 36 instructions provided

0:06:42.970,0:06:46.790
just about the performance that was[br]required for the mission. These are the 36

0:06:46.790,0:06:50.770
instructions: some load and store[br]instructions, arithmetic and logic,

0:06:50.770,0:06:56.120
control flow instructions, I/O instructions[br]and instructions for dealing with interrupts.

0:06:56.120,0:06:59.931
The memory model is the cornerstone[br]of the instruction set. Memory consists of

0:06:59.931,0:07:04.991
4096 cells, numbered in hexadecimal[br]000 through FFF. Each cell contains a

0:07:04.991,0:07:10.710
15 bit word, numbered between 0 and[br]7FFF. Almost all changes in data -

0:07:10.710,0:07:15.960
in memory go through a 15 bit accumulator,[br]also called the A register. A program can

0:07:15.960,0:07:19.080
copy words between the accumulator and a[br]memory cell, but also add, subtract,

0:07:19.080,0:07:23.340
multiply and divide values, as they are[br]moved around. The data in memory can have

0:07:23.340,0:07:26.690
many meanings, depending on how it is[br]interpreted. These values may represent

0:07:26.690,0:07:29.740
integers, while those three words are[br]meant to be decoded as machine code

0:07:29.740,0:07:33.090
instructions. Code and data in a single[br]address space make the AGC a so-called Von

0:07:33.090,0:07:38.140
Neumann machine. The CPU's program counter[br]PC always holds the address of the

0:07:38.140,0:07:42.310
instruction to be executed next. The[br]'load' instruction copies the contents of

0:07:42.310,0:07:46.200
a given memory cell into the accumulator.[br]The PC goes on to the next instruction.

0:07:46.200,0:07:50.220
The 'add' instruction adds contents of a[br]given memory cell to the accumulator, and

0:07:50.220,0:07:53.159
the 'store' instruction copies the value[br]in the accumulator into memory at a given

0:07:53.159,0:07:57.830
location. The generalized version of these[br]instructions we just saw, use K as a

0:07:57.830,0:08:02.729
placeholder for a memory address as an[br]argument. These are cards that are quick

0:08:02.729,0:08:08.120
reference of instructions. This is the[br]generic syntax of the instruction, a short

0:08:08.120,0:08:11.460
description, the exact operations in[br]pseudocode - this one takes a memory

0:08:11.460,0:08:15.190
address k and adds it to a, the[br]accumulator - the encoding of the

0:08:15.190,0:08:19.639
instruction in memory, and the number of[br]clock cycles. The original syntax is the

0:08:19.639,0:08:22.949
name the original designers gave to the[br]instruction. For this talk I have chosen a

0:08:22.949,0:08:27.400
more modern syntax, here on the right,[br]which makes it much more easier, much

0:08:27.400,0:08:30.990
easier to describe the CPU both to people[br]with and without a background in machine

0:08:30.990,0:08:34.719
programming. Let's have a look at the[br]instruction set in detail. Here's an

0:08:34.719,0:08:39.039
example of the load instruction. Load a[br]comma indirect two zero zero. On the left

0:08:39.039,0:08:42.818
you see the set of registers of the AGC.[br]Most operations work with the accumulator,

0:08:42.818,0:08:47.069
so we will be ignoring the other registers[br]for now. While executing this instruction,

0:08:47.069,0:08:50.779
the CPU looks at memory at location two[br]zero zero, reads its contents and copies

0:08:50.779,0:08:55.670
it into the accumulator. This is the store[br]instruction "store", a load indirect two

0:08:55.670,0:08:59.009
zero zero comma A. Like with all[br]instructions the first argument is the

0:08:59.009,0:09:03.041
destination - memory - the second one the[br]source - the accumulator. It looks up

0:09:03.041,0:09:06.490
address two zero zero in memory and copies[br]the contents of the accumulator to that

0:09:06.490,0:09:10.110
cell. There's also an exchange[br]instruction which can atomically swap the

0:09:10.110,0:09:14.870
contents of the accumulator and a memory[br]cell. The 'add' instruction will look up

0:09:14.870,0:09:18.329
the contents of a given memory address and[br]add it to the contents of the accumulator

0:09:18.329,0:09:23.049
and store the result back into the[br]accumulator. And there's a 'subtract'

0:09:23.049,0:09:26.589
instruction. It takes the contents of[br]memory dest and subtracts it from the

0:09:26.589,0:09:30.720
content of the accumulator and stores the[br]result back into the accumulator.

0:09:30.720,0:09:34.139
The result of every subtraction can be[br]negative, so we need to talk about how

0:09:34.139,0:09:39.290
negative numbers are expressed on the AGC.[br]Let's look at just 4 bit numbers.

0:09:39.290,0:09:44.860
4-bit unsigned integers can express values[br]from 0 to 15 with sign and value encoding

0:09:44.860,0:09:48.410
the uppermost bit corresponds to the sign,[br]and the remaining 3 bits represent the

0:09:48.410,0:09:52.869
absolute value. Consequently, there are[br]separate values for plus 0 and minus 0.

0:09:52.869,0:09:55.589
This encoding is hard to work with, since[br]the 0 transitions need to be special

0:09:55.589,0:09:59.430
cased. One's Complement encoding has the[br]order of the negative numbers reversed.

0:09:59.430,0:10:03.709
The 0 transitions are simpler now, but[br]there's still two representations of 0.

0:10:03.709,0:10:07.389
Modern Two's Complement encoding only has[br]a single encoding for 0, and it's fully

0:10:07.389,0:10:12.180
backwards compatible with unsigned[br]addition and subtraction. In the 1960s,

0:10:12.180,0:10:15.670
computers designed for scientific[br]calculations are usually One's Complement

0:10:15.670,0:10:21.039
and so is the AGC. Unsigned four bit[br]numbers can express values from 0 to 15.

0:10:21.039,0:10:25.779
In One's Complement the values 0 through 7[br]match the unsigned values 0 through 7, and

0:10:25.779,0:10:30.320
the negative size side is organized like[br]this: Unlike Two's Complement, the two

0:10:30.320,0:10:33.589
sides are perfectly symmetrical, so[br]negating a number is as easy as

0:10:33.589,0:10:40.200
complementing it, that is, flipping all[br]the bits. So the two representations of 0

0:10:40.200,0:10:45.830
are plus 0, with all 0 bits, and minus 0,[br]with all 1 bits. Addition in the positive

0:10:45.830,0:10:50.179
space is equivalent to the unsigned[br]version, same in the negative space when

0:10:50.179,0:10:54.449
mapping signed negative numbers to their[br]unsigned counterparts. It gets interesting

0:10:54.449,0:11:01.509
when we have a 0 transition. Signed 6 - 4[br]is 6 + (-4) which is unsigned 6 + 11,

0:11:01.509,0:11:07.970
which in modulus 16 is 1. We have a carry.[br]In One's Complement, a carry needs to be

0:11:07.970,0:11:11.319
added to the end result, so we get two,[br]which is correct. The trick to jump over

0:11:11.319,0:11:14.169
the duplicate 0 on a zero-transition[br]by adding the carries is called

0:11:14.169,0:11:16.329
the 'end-around-carry'.

0:11:16.329,0:11:20.050
An overflow means that the signed result[br]does not fit into the number space.

0:11:20.050,0:11:24.630
Signed 7 + 1 would result in signed -7,[br]which is incorrect. The same happens

0:11:24.630,0:11:28.421
when overshooting negative numbers. After[br]applying the end-around carry, the result

0:11:28.421,0:11:33.190
of signed 7 here is incorrect. The CPU[br]detects this and flags the result, the

0:11:33.190,0:11:37.429
accumulator has an extra bit to record the[br]information about an overflow, we call it V.

0:11:37.429,0:11:44.939
So if we have code that reads the value[br]of 7FFF from memory and adds 1, the result

0:11:44.939,0:11:49.139
is 0 and an overflow is detected, so the[br]accumulator is flagged. The store

0:11:49.139,0:11:52.580
instruction in addition to writing A to[br]memory, does extra work if there's an

0:11:52.580,0:11:57.880
overflow condition: it clears the overflow[br]condition, writes plus 1 or minus 1 into A,

0:11:57.880,0:12:01.970
depending on whether it's a positive or[br]a negative overflow, and skips the next

0:12:01.970,0:12:05.790
instruction. This way the program can[br]detect the overflow and use the plus 1 or

0:12:05.790,0:12:10.670
minus 1 to apply the signed carry to a[br]higher-order word. By storing A to memory,

0:12:10.670,0:12:15.459
we now have a double-word result. In one's[br]complement negating a number is as easy

0:12:15.459,0:12:19.069
as flipping every bit in a word so there's[br]a dedicatet instruction for loading and

0:12:19.069,0:12:22.160
negating a value. ldc, which stands for[br]'load complement', reads a word from

0:12:22.160,0:12:27.610
memory, negates it by inverting all the[br]bits and writes it into the accumulator.

0:12:27.610,0:12:31.730
Incrementing, that is adding 1 to a word,[br]is such a common operation that there's a

0:12:31.730,0:12:35.509
dedicated instruction that increments a[br]word in memory in place. There is no

0:12:35.509,0:12:38.879
corresponding decrement instruction.[br]Instead, there are two similar instructions:

0:12:38.879,0:12:43.140
augment and diminish. The increment[br]instruction adds one to the original value,

0:12:43.140,0:12:46.410
the augment instruction adds one[br]to all positive values and

0:12:46.410,0:12:51.019
subtracts 1 from all negative values.[br]Effectively increments the absolute value

0:12:51.019,0:12:54.819
retaining the sign. The diminish[br]instruction decrements positive values and

0:12:54.819,0:13:00.360
increments negative values. Optimized for[br]scientific calculations, the CPU has

0:13:00.360,0:13:04.420
dedicated multiplication circuitry. The[br]model instruction reads a word from memory

0:13:04.420,0:13:09.019
and multiplies it with the accumulator.[br]When you multiply two signed 15 bit words,

0:13:09.019,0:13:13.139
you need up to 29 bits, that is two words,[br]for the result. The complete result will

0:13:13.139,0:13:17.149
be written into two registers, the upper[br]half into A and the lower half into B.

0:13:17.149,0:13:21.420
B is a separate 15 bit register which is[br]mostly used together with the accumulator

0:13:21.420,0:13:26.540
with instructions that deal with 30 bit[br]data. Double word values are expressed

0:13:26.540,0:13:29.709
with the uppermost bits in A, or, if in[br]memory, at lower addresses, and the lower

0:13:29.709,0:13:34.299
bits in B, or at higher addresses, making[br]the AGC a big endian machine. Assuming the

0:13:34.299,0:13:38.290
normalized form, with matching signs, the[br]effective value is the concatenation of

0:13:38.290,0:13:42.290
the two times 14 bits of the values.

0:13:42.290,0:13:45.990
Division also works with double words.[br]It takes the combination of

0:13:45.990,0:13:49.540
the A and B registers as the dividend[br]and a word from memory as the divisor.

0:13:49.540,0:13:52.659
There are also two results:[br]the result and the remainder.

0:13:52.659,0:13:55.230
The result is written into A and[br]the remainder in to B.

0:13:55.230,0:13:59.590
Some other instructions also allow[br]using A and B as a double word register.

0:13:59.590,0:14:02.959
Load a b comma indirect two zero zero[br]looks up addresse two zero zero in

0:14:02.959,0:14:06.439
memory and reads the words at this[br]and the next cell into A and B.

0:14:06.439,0:14:09.899
The load complement variant does the same[br]but inverts all bits during the load.

0:14:09.899,0:14:12.749
There is no instruction to store A and B[br]in a single step,

0:14:12.749,0:14:16.149
but there is a double word[br]exchange instruction. And finally there's

0:14:16.149,0:14:21.079
an add instruction that works in double[br]words. And to load and store just the B

0:14:21.079,0:14:26.459
register there's an exchange instruction[br]for that. For working with tables there's

0:14:26.459,0:14:29.730
the indexed addressing mode. Any[br]instruction that takes an address as an

0:14:29.730,0:14:35.610
argument can use it. This example 'load A[br]comma indirect 7 0 0 plus indirect 8 0'

0:14:35.610,0:14:42.519
first looks up address 0 8 0, adds it to[br]the base of 7 0 0, which results in 7 0 2,

0:14:42.519,0:14:47.069
reads from that address and writes the[br]result into A. What does this mean?

0:14:47.069,0:14:51.399
There's a table in memory at 7 0 0. In the[br]example, it contains multiples of 3, and

0:14:51.399,0:14:56.309
an index to that table is stored in memory[br]at 0 8 0, which in the example is 2.

0:14:56.309,0:15:00.529
So we read the entry at index 2 of[br]the table, which is 6.

0:15:00.529,0:15:03.799
Without a base address, we get[br]the syntax in this example:

0:15:03.799,0:15:08.319
load A comma double indirect 8 0.[br]The base is effectively zero in this case.

0:15:08.319,0:15:13.490
The CPU will look up the value at 0 8 0[br]in memory, add it to the base of 0,

0:15:13.490,0:15:16.989
so the value is still the same.[br]And read from that address.

0:15:16.989,0:15:21.480
In this case, memory at 0 8 0 effectively[br]stores what C programmers know

0:15:21.480,0:15:25.200
as a pointer, and 3A0 is the pointer's[br]different destination.

0:15:25.200,0:15:28.780
The instruction performed it indirectly.

0:15:29.600,0:15:32.600
By default, instructions are[br]executed sequentially.

0:15:32.600,0:15:36.249
The program counter PC increments as[br]instructions are executed, always pointing

0:15:36.249,0:15:39.949
to the next instruction. Control flow[br]instructions like jump and conditional

0:15:39.949,0:15:44.609
jump change that. When the CPU hits a jump[br]instruction, it will load its argument

0:15:44.609,0:15:49.079
into the program counter, which means that[br]execution will continue at that address.

0:15:49.079,0:15:53.389
jz, jump if zero, only jumps if A is zero.[br]Otherwise it continues with the next

0:15:53.389,0:15:57.629
instruction. Similarly, jlez only jumps if[br]A is negative or zero.

0:15:57.629,0:16:03.449
CCS count compare and skip, is a fun one.[br]It's a four-way fork for execution.

0:16:03.449,0:16:06.820
Depending on whether the value in[br]memory is positive, negative,

0:16:06.820,0:16:11.050
plus minus - plus zero, minus zero, it will[br]jump to one of the next four instructions.

0:16:11.050,0:16:14.209
If you know the value is[br]positive or zero, you can ignore

0:16:14.209,0:16:16.480
the other two cases and just[br]fill the first two slots.

0:16:16.480,0:16:20.430
And if it's supposed to be only negative,[br]you have to skip the first two slots.

0:16:20.430,0:16:23.879
They should never be reached, but[br]it's good practice for them to fill them

0:16:23.879,0:16:29.029
with error handlers. Since CCS also puts[br]the absolute diminished value of the

0:16:29.029,0:16:34.489
memory location into A, so it decrements[br]A, a special case of CCS A can be used for

0:16:34.489,0:16:38.680
loops that count down A. The call[br]instruction. Isn't it for calling

0:16:38.680,0:16:42.609
subroutines aka functions. It's like a[br]jump instruction but it saves its origin,

0:16:42.609,0:16:45.809
so the callee can return to it later. For[br]the call instruction, the program counter

0:16:45.809,0:16:49.869
is incremented first, and then copied into[br]the link register LR. Finally, the

0:16:49.869,0:16:52.930
argument of the call instruction is copied[br]into the program counter, so that

0:16:52.930,0:16:57.440
execution continues there. The link[br]register now contains the return address.

0:16:57.440,0:17:00.939
At the end of the subroutine, the RET[br]instruction effectively copies the

0:17:00.939,0:17:05.010
contents of the linked register into the[br]program counter, so execution resumes just

0:17:05.010,0:17:08.690
after the call instruction.[br]If the subroutine wants to call

0:17:08.690,0:17:11.500
its own subroutine, the program has to[br]save the link register before,

0:17:11.500,0:17:15.071
and restore it afterwards. There's an[br]exchange instruction specifically for this.

0:17:15.071,0:17:18.580
For additional levels, a stack can be[br]constructed, manually,

0:17:18.580,0:17:20.400
using the indexing syntax.

0:17:20.400,0:17:24.010
So far we've seen the following[br]registers: the A register is used for

0:17:24.010,0:17:27.839
memory accesses and all arithmetic. It is[br]combined with the B register for double

0:17:27.839,0:17:31.731
width arithmetic, the program counter to[br]keep track of what to execute and the link

0:17:31.731,0:17:34.830
register remembers the return address when[br]calling a subroutine. We haven't seen the

0:17:34.830,0:17:38.519
zero register yet. It always contains[br]zero, so when we read from it, we get zero

0:17:38.519,0:17:42.280
and when we write to it the value gets[br]discarded. There are three more registers

0:17:42.280,0:17:46.330
that we will talk about later. The eight[br]registers are numbered, that is they are

0:17:46.330,0:17:50.610
assigned memory addresses. This means that[br]the first eight words in memory are

0:17:50.610,0:17:53.940
actually occupied by the registers. They[br]can be accessed using the addresses and

0:17:53.940,0:17:57.900
all instructions that take a memory[br]address. This allows for much greater

0:17:57.900,0:18:01.559
flexibility in the instruction set: we can[br]load A with the contents of the B register

0:18:01.559,0:18:05.440
by reading the contents of memory at[br]location 1 into A. The content of zero can

0:18:05.440,0:18:09.690
be loaded into A by just reading from[br]memory at 7, which is the zero register.

0:18:09.690,0:18:14.190
A can be incremented by incrementing[br]memory at zero and B can be used as

0:18:14.190,0:18:20.499
a pointer by reading from double indirect[br]one. Let's look at memory more closely.

0:18:20.499,0:18:26.719
Memory is 4096 words and goes from[br]000 to FFF. The registers are located at

0:18:26.719,0:18:31.140
the very bottom of memory. Including them,[br]there are 1024 words of RAM,

0:18:31.140,0:18:35.100
random access memory, and[br]three kilowords of ROM, read-only memory.

0:18:35.100,0:18:38.820
The AGC was originally architected to[br]only have this little RAM and ROM,

0:18:38.820,0:18:42.220
but there's actually more.[br]Let's look at the RAM area.

0:18:42.220,0:18:45.960
The uppermost quarter is banked. The area[br]is a window through which one of eight

0:18:45.960,0:18:50.540
different banks can be accessed, each 250[br]words in size. The erasable Bank register

0:18:50.540,0:18:56.040
EB points to one of these banks. If EB is[br]0, Bank 0 is visible in the banked area.

0:18:56.040,0:19:01.309
If EB is five, bank five is visible.[br]Addresses in the fixed area always

0:19:01.309,0:19:05.100
represent the same RAM cells, but these[br]are not additional cells, but the same as

0:19:05.100,0:19:09.030
banks zero, one and two. This means that[br]there's a total of 8 times 256 words of

0:19:09.030,0:19:15.690
RAM, two kilowords. ROM is organized[br]similarly. The lower kiloword is banked.

0:19:15.690,0:19:22.280
The fixed bank register FB selects one of[br]the 32 banks. Support for more than 32

0:19:22.280,0:19:26.090
kilowords of ROM was added at the last[br]minute. The 'superbank' bit can switch the

0:19:26.090,0:19:28.330
uppermost eight banks to the second set..[br]<i>laughter</i>

0:19:28.330,0:19:32.880
so that a total of 40 kilowords are[br]supported by the architecture.

0:19:32.880,0:19:36.799
The fixed ROM area will always show the[br]same contents as two of the ROM banks, the

0:19:36.799,0:19:42.169
designers chose banks two and three to[br]simplify address encoding. In practice,

0:19:42.169,0:19:46.850
fixed ROM contains core operating system[br]code, and fixed RAM core operating system

0:19:46.850,0:19:49.870
data, that have to be available at all[br]times. The remaining functionality is

0:19:49.870,0:19:55.059
distributed across the different ROM and[br]RAM banks. Switching the RAM Bank can be

0:19:55.059,0:19:58.960
done by writing through the EB register.[br]This is not a separate instruction but can

0:19:58.960,0:20:04.279
be expressed by writing A to memory[br]location three. If A is five, writing A

0:20:04.279,0:20:09.580
into EB will make RAM Bank five visible at[br]3 0 0. The same store instruction could be

0:20:09.580,0:20:13.659
used to write to the FB register at memory[br]location 4, to switch the ROM Bank. But

0:20:13.659,0:20:17.670
that wouldn't work for a common case.[br]If code in one bank wants to call code in

0:20:17.670,0:20:21.559
another Bank, by first switching the[br]ROM Bank, load FB, and then doing

0:20:21.559,0:20:26.059
the function call, writing the bank number[br]into FB will switch out the bank the code

0:20:26.059,0:20:29.230
is currently running on, so it won't[br]be able to execute the call instruction.

0:20:29.230,0:20:32.010
Instead it will continue running some[br]completely unrelated code that happens

0:20:32.010,0:20:34.110
to get the same address on[br]the other bank.

0:20:34.110,0:20:37.220
To call code on a different Bank,[br]FB and PC registers need

0:20:37.220,0:20:41.889
to be changed atomically. call f is only a[br]synonym for the existing double word

0:20:41.889,0:20:47.490
exchange instruction. Code first has to[br]load the bank and the program counter into

0:20:47.490,0:20:55.750
A and B. Which then call f can atomically[br]move into FB and PC. The same exchange

0:20:55.750,0:20:59.340
instruction can be used for a far return:[br]it moves the original values back into FB

0:20:59.340,0:21:06.360
and PC. The two Bank registers only hold[br]five and three bits respectively. The

0:21:06.360,0:21:10.659
other bits are zero and there's a third[br]bank register, BB, both banks, which

0:21:10.659,0:21:15.000
merges the information from both other[br]bank registers. The call far both banks

0:21:15.000,0:21:18.140
synonym is a double word exchange[br]instruction that updates the program

0:21:18.140,0:21:22.769
counter and both banks. Subroutines[br]usually have their private variables on

0:21:22.769,0:21:26.500
particular RAM banks. Call for both banks[br]passes control to a function on the

0:21:26.500,0:21:29.870
different ROM Bank and also directly[br]switches RAM banks, so that the callee can

0:21:29.870,0:21:33.890
immediately access its variables. Return[br]for both banks returns to the caller,

0:21:33.890,0:21:39.160
restoring its RAM Bank configuration. The[br]unusual ordering of the bank registers was

0:21:39.160,0:21:43.299
chosen to allow for a double word exchange[br]of FB and PC, as well as for a double word

0:21:43.299,0:21:49.149
exchange of PC and BB. Now we've seen all[br]eight registers. There's eight more

0:21:49.149,0:21:52.210
special locations in memory above the[br]registers, the shadow area, which we'll

0:21:52.210,0:21:56.179
talk about later. And above those, there[br]are four so-called editing registers,

0:21:56.179,0:22:00.029
which make up for the missing shift and[br]rotate instructions. When writing a 15 bit

0:22:00.029,0:22:05.660
value into the ROR editing register, it[br]will be moved to the right by one bit, and

0:22:05.660,0:22:09.670
the lowest bit will be cycled to the top.[br]The result can then be read back.

0:22:09.670,0:22:17.330
ROL rotates left, SHR shifts to the right[br]duplicating the top bit, and SHR7 shifts

0:22:17.330,0:22:20.890
to the right by 7 bits, filling the top[br]with zeros. This is needed for the

0:22:20.890,0:22:25.760
interpreter system software component that[br]we'll learn about later. We have seen that

0:22:25.760,0:22:29.669
the CPU is connected to RAM and ROM over[br]the memory bus, but computers also talk to

0:22:29.669,0:22:34.580
peripheral devices that is the I/O bus.[br]We've already seen the address space for

0:22:34.580,0:22:39.529
memory; there is a second address space[br]to talk to devices. There are 512 I/O

0:22:39.529,0:22:44.550
channels numbered 000 through FFF. Each[br]channel is 15 bits, and the in and out

0:22:44.550,0:22:48.980
instructions can read words from -, and[br]write words to I/O channels. For many

0:22:48.980,0:22:53.690
devices, a channel contains 15 individual[br]control bits. A control bit can for

0:22:53.690,0:22:58.639
example toggle a lamp on a display. The[br]'out OR' instruction sets individual bits,

0:22:58.639,0:23:03.580
and 'out AND' clears individual bits. So[br]I/O instructions can work on the whole

0:23:03.580,0:23:10.400
word or do boolean operations on them:[br]AND, OR and XOR. To make boolean

0:23:10.400,0:23:15.320
operations also usable between registers,[br]channels 1 and 2 are actually aliases of

0:23:15.320,0:23:21.860
the B and LR registers, which allows for[br]these instructions. For AND there's also a

0:23:21.860,0:23:27.299
dedicated instruction that works on A and[br]memory. After the registers, the shadow

0:23:27.299,0:23:31.909
area, and the editing registers, there's[br]another special area: the counters. Like

0:23:31.909,0:23:36.090
I/O channels, they connect to external[br]devices but they don't send bits or hold

0:23:36.090,0:23:39.961
words back and forth, instead they are[br]controlled by hardware pulses, or cause

0:23:39.961,0:23:44.630
hardware pulses. On every pulse, TIME1[br]gets incremented for example, while other

0:23:44.630,0:23:51.220
counters take the number stored into them[br]by code and count down, generating pulses.

0:23:51.220,0:23:55.190
When I/O devices need to signal the CPU,[br]thay can interrupt normal execution.

0:23:55.190,0:23:58.509
Next to the program counter, which points[br]to the next instruction, there's the

0:23:58.509,0:24:02.520
instruction register which holds the[br]current opcode. When an interrupt happens,

0:24:02.520,0:24:08.570
the CPU copies PC into a special memory[br]location PC' and IR into IR' and then

0:24:08.570,0:24:12.340
jumps to a magic location depending on the[br]type of interrupt, in this example 814.

0:24:12.340,0:24:16.059
When the interrupt handlers finished[br]servicing the device the iret instruction

0:24:16.059,0:24:20.530
will copy PC' and IR' back into PC and IR,[br]so execution will continue at the original

0:24:20.530,0:24:26.690
location. Memory locations eight through[br]hex F are shadows of the eight registers.

0:24:26.690,0:24:30.360
PC and IR are automatically saved by[br]interrupts and the remaining registers

0:24:30.360,0:24:35.330
need to be saved by software if necessary.[br]The overflow condition flag cannot be

0:24:35.330,0:24:40.120
saved or restored, so while there's an[br]overflow condition until the next store

0:24:40.120,0:24:44.019
instruction, which resolves the offload,[br]interrupts will be disabled.

0:24:44.019,0:24:49.960
The 11 interrupt handlers have to reside[br]in fixed ROM starting at 8 0 0.

0:24:49.960,0:24:54.609
There are 4 words for each entry.[br]Typical interrupt entry code saves A and B,

0:24:54.609,0:25:00.319
loads A and B with a bank and PC of the[br]actual handler and jumps there.

0:25:00.319,0:25:04.160
Interrupt 0 is special: it's the[br]entry point on reset.

0:25:04.160,0:25:07.799
Next we will enter the interrupt return[br]instruction, there's an instruction

0:25:07.799,0:25:11.019
to cause an interrupt in software,[br]and instructions to enable and

0:25:11.019,0:25:15.960
disable interrupts globally. There is one[br]more special memory location at hex 37,

0:25:15.960,0:25:20.830
the watchdog. This location needs to be[br]read from or - read from or written to -

0:25:20.830,0:25:23.940
at least every 0.64 seconds[br]otherwise the hardware will decide the

0:25:23.940,0:25:29.539
system software is unresponsive and cause[br]a reset. Now we've seen an instruction set

0:25:29.539,0:25:33.039
and in the examples we've seen the codes[br]that represent instructions in memory.

0:25:33.039,0:25:37.070
Let's look at how the encoding works. The[br]load instruction, the upper three bits are

0:25:37.070,0:25:41.790
the opcode representing the load a and the[br]remaining 12 bits encode the address.

0:25:41.790,0:25:44.610
This allows for a total of eight[br]instructions but there are more

0:25:44.610,0:25:48.570
than eight instructions. RAM addresses[br]always start with zero zero and

0:25:48.570,0:25:53.560
ROM adresses start with anything but[br]zero zero. So the store instruction,

0:25:53.560,0:25:57.100
which only makes sense on RAM, only[br]needs to encode 10 address bits instead

0:25:57.100,0:26:02.620
of 12, making room for another[br]three RAM-only instructions.

0:26:02.620,0:26:05.539
The same is true for the increment[br]instruction, which makes room for

0:26:05.539,0:26:10.310
three more, as well as CCS which shares[br]an opcode with jump, which only works

0:26:10.310,0:26:15.779
on ROM addresses. Since jumps to the[br]bank register don't make much sense

0:26:15.779,0:26:21.310
these codes are used to encode STI, CLI[br]and extend. Extend is a prefix.

0:26:21.310,0:26:23.570
It changes the meaning of the opcode[br]of the next instruction ...

0:26:23.570,0:26:28.389
<i>laughter</i> ... allowing for a[br]second set of two-word instructions.

0:26:28.389,0:26:33.990
There's one more special call instruction[br]'call 2' which is 'call LR',

0:26:33.990,0:26:37.510
which is the return instruction. But[br]the CPU doesn't special case this one.

0:26:37.510,0:26:42.009
Return is a side-effect of calling memory[br]at location 2. It executes the instruction

0:26:42.009,0:26:45.960
encoded in the LR register, the 12 bit[br]address with the leading zeros decodes

0:26:45.960,0:26:52.200
into another call instruction which[br]transfers control to the return address.

0:26:52.200,0:26:56.929
Indexed addressing is achieved by using[br]the index prefix. An indexed instruction

0:26:56.929,0:27:00.480
consists of two instruction words, index[br]and the base instruction. The addressing

0:27:00.480,0:27:03.690
code in the base instruction is the base[br]address and the index instruction encodes

0:27:03.690,0:27:08.809
the address of the index. Index is an[br]actual instruction. The CPU reads from the

0:27:08.809,0:27:14.549
given address, 0 8 0 in the example, then[br]adds its value, 3, to the instruction code

0:27:14.549,0:27:19.830
of the following instruction 3 7 0 0 which[br]is stored in the internal IR register.

0:27:19.830,0:27:23.980
Then it uses the resulting instruction[br]code 3 7 0 3 for the next instruction,

0:27:23.980,0:27:29.880
which is a load from 703, the effective[br]address. If an interrupt occurs after in

0:27:29.880,0:27:33.200
the index instruction, that is no problem[br]because IR contains the effective

0:27:33.200,0:27:36.339
instruction code which will be saved into[br]IR Prime and restored at the end of the

0:27:36.339,0:27:40.490
interrupt handler. Finally there's one[br]index encoding with a special meaning.

0:27:40.490,0:27:42.950
When the address looks like it's[br]referencing the shadow instruction

0:27:42.950,0:27:47.060
register it's an interrupt return[br]instruction. Looking at the instruction

0:27:47.060,0:27:50.230
set architecture as a whole, there are[br]many quirky and unusual features when

0:27:50.230,0:27:53.470
compared to modern architectures. It uses[br]One's Complement instead of Two's

0:27:53.470,0:27:57.809
Complement; it has no status register; the[br]overflow flag can't even be saved so

0:27:57.809,0:28:01.900
interrupts are disabled until the overflow[br]is resolved; the store instruction may

0:28:01.900,0:28:06.610
skip a word under certain circumstances;[br]the ccs destruction can skip several words

0:28:06.610,0:28:11.049
and can be outright dangerous if the[br]instructions following it use prefixes;

0:28:11.049,0:28:14.379
there are no shift or rotate instructions[br]but magic memory locations that shift and

0:28:14.379,0:28:18.889
rotate when writing into them; most[br]boolean instructions only work on I/O

0:28:18.889,0:28:23.039
channels; indexing is done by hacking the[br]following instruction code, and the

0:28:23.039,0:28:28.400
architecture has no concept of a stack,[br]indexing has to be used if one is needed.

0:28:28.400,0:28:32.929
This was the architecture of the Apollo[br]guidance computer, now let's look at how

0:28:32.929,0:28:36.460
this architecture is implemented in[br]hardware. The hardware implementation runs

0:28:36.460,0:28:40.320
at one megahertz, is micro coded and uses[br]integrated circuits, core memory, and core

0:28:40.320,0:28:43.310
rope memory. We'll look at the block[br]diagram and how instructions are

0:28:43.310,0:28:46.999
implemented in micro code, and then about[br]how the schematics map to integrated

0:28:46.999,0:28:52.890
circuits on modules on trays. This[br]simplified block diagram shows the AGC at

0:28:52.890,0:28:57.190
the hardware level. Each box contains on[br]the order of 500 logic gates. The dotted

0:28:57.190,0:29:01.340
lines are wires that to move a single bit[br]of information, the solid lines are 15

0:29:01.340,0:29:07.049
wires that move a data word. These units[br]deal with timing and control, and these

0:29:07.049,0:29:11.370
are the central units. The central[br]register unit stores A, B, link registers,

0:29:11.370,0:29:16.409
and program counter, and the arithmetic[br]unit can add and subtract numbers. The

0:29:16.409,0:29:22.090
memory components deal with RAM and ROM.[br]The main clock of about one megahertz

0:29:22.090,0:29:25.450
feeds into the sequence generator which[br]keeps cycling through twelve stages, which

0:29:25.450,0:29:31.340
is one memory cycle, MCT. Instructions[br]usually take as many memory cycles as they

0:29:31.340,0:29:35.899
need memory accesses, so load, add, and[br]store take two cycles, and jump takes one.

0:29:35.899,0:29:39.519
The sequence generator contains a[br]collection of 12 step micro programs for

0:29:39.519,0:29:44.690
each MCT, for each instruction, like this[br]one for the load instruction. In each

0:29:44.690,0:29:51.740
step, the entries send control pulses to[br]the other units, which are connected

0:29:51.740,0:29:57.059
through the write bus. The control signal[br]WA for example instructs the register unit

0:29:57.059,0:30:01.399
to put the contents of A onto the write[br]bus, and RA makes it read the value on the

0:30:01.399,0:30:06.630
bus into A. Memory is also connected to[br]the write bus. WS will copy the bus

0:30:06.630,0:30:10.349
contents into the memory address register,[br]and RG and WG will read and write the G

0:30:10.349,0:30:15.720
register, which buffers the cells value[br]after read and before a write. So in stage

0:30:15.720,0:30:24.629
7 for example RG puts the memory buffer[br]onto the bus, and WB writes the bus

0:30:24.629,0:30:30.000
contents into the temporary G register.[br]And in T10, B gets put on the bus and it

0:30:30.000,0:30:33.899
gets read into the A register. At the[br]beginning of every memory cycle the

0:30:33.899,0:30:37.860
hardware sends the memory address S,[br]usually what's encoded instruction, to

0:30:37.860,0:30:42.330
memory and copies the contents of that[br]address into G. in the second half of the

0:30:42.330,0:30:47.999
MCT it stores G back into the same cell.[br]So if we show memory timing next to the

0:30:47.999,0:30:50.440
microcode, as well as the pseudocode[br]version of the load instruction which is

0:30:50.440,0:30:55.470
easier to read, we can see it loads the[br]value from memory into G copies it into B

0:30:55.470,0:30:59.049
and then copies it into A. More[br]interesting is the exchange instruction.

0:30:59.049,0:31:05.519
It saves A to B, reads memory into G,[br]copies the result into A, copies the old

0:31:05.519,0:31:11.210
value into G, and stores that G into[br]memory. Division for example takes several

0:31:11.210,0:31:15.460
MCT and it's micro program is way more[br]complex. But there are more micro programs

0:31:15.460,0:31:18.799
than the ones for the machine[br]instructions. Since there is only a single

0:31:18.799,0:31:21.580
adding unit in the whole computer,[br]incrementing and decrementing the counters

0:31:21.580,0:31:26.070
is done by converting the pulses into[br]special instructions that get injected

0:31:26.070,0:31:30.539
into the instruction stream. There are 14[br]of these so-called unprogrammed sequences

0:31:30.539,0:31:34.749
with their own micro programs. Some counter[br]shift, some are for interacting with

0:31:34.749,0:31:40.869
debugging hardware, and these two control[br]the interrupt and reset sequences.

0:31:40.869,0:31:46.079
The complete schematics are publicly[br]available and fit on just 49 sheets.

0:31:46.079,0:31:51.119
The whole implementation only uses a single[br]type of gate, a three input NAND gate.

0:31:51.119,0:31:54.870
Two of these are contained in one[br]integrated circuit, and about a hundred of

0:31:54.870,0:31:57.700
these ICs form a logic module.

0:31:59.580,0:32:03.730
24 logic modules and some interface and[br]power supply modules are connected

0:32:03.730,0:32:06.999
together in tray A, which also contains[br]the I/O and debug connectors.

0:32:06.999,0:32:11.370
Tray B contains various driver and amplifier[br]modules, as well as RAM and ROM.

0:32:11.370,0:32:16.061
RAM is implemented as magnetic core memory,[br]which stores bits in magnetized toroids.

0:32:16.061,0:32:19.800
Reading a bit clears it, so the memory[br]sequencer makes sure to always write the

0:32:19.800,0:32:24.080
value again after reading it.[br]Without mass storage, like tape, the AGC

0:32:24.080,0:32:29.960
has an unusually high amount of ROM.[br]Core Rope Memory encodes bits by wires that

0:32:29.960,0:32:35.190
either go through- or past a ferrite core.[br]The 500,000 bits per computer were woven

0:32:35.190,0:32:40.429
completely by hand. Trays A and B are put[br]together like this and hermetically

0:32:40.429,0:32:45.019
sealed, making for a rather compact[br]computer. This is its orientation when

0:32:45.019,0:32:50.440
installed on the spacecraft, with the six[br]ROM modules accessible so they could in

0:32:50.440,0:32:54.529
theory be replaced during the mission. And[br]that was the hardware part.

0:32:54.529,0:33:00.699
<i>applause</i>[br]C: Next let's look at the devices.

0:33:00.699,0:33:04.610
<i>applause</i>[br]

0:33:04.610,0:33:08.090
Let's look at the devices connected[br]to the computer.

0:33:08.090,0:33:10.921
We will look at the core devices[br]that allow the Apollo guidance computer to

0:33:10.921,0:33:14.260
maintain the state vector, some quite[br]special devices you don't see on many

0:33:14.260,0:33:17.759
other computers, and the peripherals used[br]for communication with astronauts and

0:33:17.759,0:33:21.799
Mission Control. The gyroscope is the core[br]peripheral that the Apollo guidance

0:33:21.799,0:33:24.800
computer was originally built around. The[br]Apollo Guidance Computer rotates it into a

0:33:24.800,0:33:28.600
certain base position with the CDU command[br]counters, and then the gyro detects

0:33:28.600,0:33:31.930
rotation around the three axes of the[br]spacecraft that can be read from the CDU

0:33:31.930,0:33:35.470
counters. Using the gyroscope, the[br]spacecraft always knows it's attitude,

0:33:35.470,0:33:39.799
that is its orientation in space. The[br]accelerometer adjust acceleration forces

0:33:39.799,0:33:45.509
on the three axis. The three values can be[br]read from the PIPA counters. The optics on

0:33:45.509,0:33:49.419
the command module are used to measure the[br]relative position to the celestial bodies.

0:33:49.419,0:33:53.220
The computer uses the OPT command counters[br]to move the optics to point towards the

0:33:53.220,0:33:56.669
general direction of a star, and will read[br]in the astronauts fine-tuning through the

0:33:56.669,0:34:00.640
OPT counters. The landing radar sits at[br]the bottom of the lunar module and

0:34:00.640,0:34:03.649
measures the distance to the ground. The[br]RADARUPT interrupt will be triggered

0:34:03.649,0:34:07.009
whenever a new measurement is available,[br]and the RNRAD counter contains the new

0:34:07.009,0:34:11.562
value. Lunar module's rendezvous radar[br]measures the distance of the command and

0:34:11.562,0:34:15.550
service module during rendezvous. After[br]setting the two angles and the CDUT and

0:34:15.550,0:34:18.980
CDUS counters to point it towards the two[br]other spacecraft, it will automatically

0:34:18.980,0:34:22.250
track it and cause RADARUPT interrupts[br]when new data is available, which can be

0:34:22.250,0:34:26.780
read from the RNRAD counters. The command[br]module, the service module, and the lunar

0:34:26.780,0:34:30.960
module all contain reaction control[br]system, RCS, jets that emit small bursts

0:34:30.960,0:34:34.870
for holding or charging the attitude. On[br]lunar module, there's one bit for each of

0:34:34.870,0:34:38.469
the sixteen jets. Setting a bit to one[br]will make the jet fire.The system software

0:34:38.469,0:34:44.189
uses a dedicated timer, TIME6, and it's[br]interrupt T6RUPT for timing the pulses.

0:34:44.189,0:34:47.560
The user interface is provided by the so[br]called DSKY which stands for display and

0:34:47.560,0:34:51.861
keyboard. It has 19 keys, 15 lamps, and[br]several numeric output lines.

0:34:51.861,0:34:55.050
Keys generate the KEYRUPT interrupts and[br]the key number can be read

0:34:55.050,0:34:59.630
from the KEYIN I/O channel. The numeric[br]display is driven by the OUT O channel.

0:34:59.630,0:35:02.500
There is bidirectional digital radio[br]communication and S-band between

0:35:02.500,0:35:06.970
Mission Control and each spacecraft at a[br]selectable speed of 1.9 or 51 kbit/s

0:35:06.970,0:35:10.210
Data words from Mission Control show up[br]in the INLINK counter and

0:35:10.210,0:35:15.071
trigger interrupt UPRUPT. Data words to be[br]sent are stored in the I/O channel DNTM1

0:35:15.071,0:35:17.690
and the DOWNRUPT interrupt will signal[br]the program when it can load

0:35:17.690,0:35:23.550
the register with the next word. These[br]were some of the interesting peripherals.

0:35:25.070,0:35:29.520
M: The AGC system, the AGC system software

0:35:29.520,0:35:32.490
makes it a priority based cooperative -[br]but also pre-emptive - real-time

0:35:32.490,0:35:37.410
interactive fault tolerant computer with[br]virtual machine support. The topics we'll

0:35:37.410,0:35:40.740
talk about are multitasking, the[br]interpreter, device drivers, and the

0:35:40.740,0:35:45.540
waitlist, as well as the user interface,[br]and mechanisms for fault recovery. The AGC

0:35:45.540,0:35:49.020
has many things to do. It does[br]mathematical calculations that can take

0:35:49.020,0:35:52.900
several seconds, and it does I/O with its[br]devices; it services interrupts when a

0:35:52.900,0:35:56.890
device wants the computers attention, for[br]example a key press. It does regular

0:35:56.890,0:36:01.110
servicing of devices, like updating the[br]display, and it supports real-time

0:36:01.110,0:36:05.820
control, like flashing a lamp or firing[br]boosters at exactly the right time.

0:36:05.820,0:36:09.520
There's only a single CPU, so it must[br]switch between the different tasks.

0:36:09.520,0:36:13.680
Batch processing multitasking computers[br]work on long-running jobs one after the

0:36:13.680,0:36:17.720
other, but if some jobs have higher[br]priorities it makes more sense to run a job

0:36:17.720,0:36:21.140
for only - say 20 milliseconds - then[br]check the job queues and keep running

0:36:21.140,0:36:24.830
the highest priority job in the queue[br]until it terminates and is removed

0:36:24.830,0:36:29.300
from the queue, then keep picking the[br]highest priority job.

0:36:29.300,0:36:32.560
Jobs have to manually check at least[br]every 20 milliseconds whether

0:36:32.560,0:36:36.110
there's a higher priority job in the queue[br]by doing doing a so-called 'yield',

0:36:36.110,0:36:41.370
which makes the AGC a priority scheduled[br]cooperative multitasking computer.

0:36:41.370,0:36:44.790
A job is described by 12 word data[br]structure in memory, that contains

0:36:44.790,0:36:48.690
the PC and both bank's register that point[br]to where the job will start or continue

0:36:48.690,0:36:55.170
running, as well as a word with a disabled[br]flag in the sign bit and a 5 bit priority.

0:36:55.170,0:36:59.120
The core set consists of seven[br]job entries. Minus zero in the priority

0:36:59.120,0:37:03.100
word means that the entry is empty. Job[br]zero is always the currently running one.

0:37:03.100,0:37:07.040
When a new job gets created with a higher[br]priority, the yield operation will

0:37:07.040,0:37:12.070
exchange the 12 words so that new job is[br]job zero. Negating the priority will put a

0:37:12.070,0:37:16.510
job to sleep, so yield won't switch to it[br]again. Negating it again will wake it up.

0:37:16.510,0:37:20.530
The first eight words in the job entry can[br]be used for local storage for the job.

0:37:20.530,0:37:23.250
Since it's always job zero that is[br]running, these words are always

0:37:23.250,0:37:27.840
conveniently located at the same addresses[br]in memory. The executive has a set of

0:37:27.840,0:37:32.790
subroutines that control the job data[br]structures. You can create a new job

0:37:32.790,0:37:37.190
pointed to by a pair of PC and BB[br]registers of a given priority, change the

0:37:37.190,0:37:41.430
priority of the current job, put the[br]current job to sleep, wake up a given job,

0:37:41.430,0:37:45.931
and terminate the current job.[br]Yield is not an executive function, but a

0:37:45.931,0:37:50.190
two instruction sequence that checks the[br]new job variable in which the executive

0:37:50.190,0:37:54.070
always holds the idea of the highest[br]priority job. If job zero is the highest

0:37:54.070,0:37:57.450
priority job there's nothing to do. If[br]there is a higher priority job, it calls

0:37:57.450,0:38:02.120
the change job subroutine which switches[br]to that job. NEWJOB isn't just a variable

0:38:02.120,0:38:05.990
in memory, but also the watchdog word. If[br]it isn't accessed regularly, that is

0:38:05.990,0:38:10.280
cooperative multitasking is stuck, the[br]hardware will automatically reset itself.

0:38:10.280,0:38:14.500
A lot of the code in the AGC does[br]scientific calculations, calculating for

0:38:14.500,0:38:18.610
example just the sum of two products of a[br]scalar and a vector would require hundreds

0:38:18.610,0:38:22.971
of instructions in AGC machine code. There[br]is library code that provides all kinds of

0:38:22.971,0:38:27.370
operations on single, double, or triple[br]precision fixed point values, vectors, and

0:38:27.370,0:38:32.570
matrices. It also provides a softer multi-[br]purpose accumulator, MPAC, which can hold

0:38:32.570,0:38:36.240
a double, triple, or a vector, depending[br]on the mode flag. In C-like pseudo code we

0:38:36.240,0:38:40.610
would load the vector into the MPAC,[br]multiply it with a scalar, save it, do the

0:38:40.610,0:38:45.650
other multiplication, and add the result[br]to the saved value. Formulas like this one

0:38:45.650,0:38:50.930
need to store intermediate results, so a[br]thirty-eight word stack is provided. If a

0:38:50.930,0:38:54.160
job uses math code, the MPAC, the MODE[br]field, and the stack pointer will be

0:38:54.160,0:38:58.040
stored in the remaining fields of the Core[br]Set Entry. The stack will be part of a

0:38:58.040,0:39:02.700
data tructure called VAC, which will be[br]pointed to by the Core Set Entry. A job

0:39:02.700,0:39:06.450
can be created with, or without a VAC,[br]depending on which subroutine it is

0:39:06.450,0:39:11.530
created with. The machine code version of[br]the example code would still be very

0:39:11.530,0:39:15.100
verbose, with many function calls passing[br]pointers. The designers of the AGC

0:39:15.100,0:39:18.080
software decided to create a new and[br]compact language that will be interpreted

0:39:18.080,0:39:22.450
at runtime, a virtual machine. The[br]interpretive language is turing-complete

0:39:22.450,0:39:26.710
and in addition to the MPAC it has two[br]index registers, two step registers, and

0:39:26.710,0:39:31.030
its own link register. The encoding[br]manages to fit two seven bit op codes in

0:39:31.030,0:39:35.290
one word, which allows for 128 op codes[br]and explains why there is a 'shift right

0:39:35.290,0:39:39.720
by seven' function in the CPU. The two[br]operands are stored in the following two

0:39:39.720,0:39:44.540
words, allowing 14 bit addresses. 14 bit[br]addresses means interpretive code doesn't

0:39:44.540,0:39:48.970
have to work this complicated memory layer[br]anymore. It allows addressing about half

0:39:48.970,0:39:53.080
of the ROM at the same time. At the lowest[br]kiloword of each half, RAM is visible, so

0:39:53.080,0:39:57.900
interpretive code can pick between one of[br]these two memory layouts. This is the

0:39:57.900,0:40:01.580
complete instruction set, regular machine[br]code, interpretive code can be mixed and

0:40:01.580,0:40:04.570
matched inside the job. The exit[br]instruction will continue executing

0:40:04.570,0:40:08.870
regular machine code at the next address,[br]and CALL INTPRET will similarly switch to

0:40:08.870,0:40:13.190
interpreter mode. In addition to long-[br]running math tasks, the system software

0:40:13.190,0:40:17.001
also supports device drivers. When a[br]device needs the computers attention, for

0:40:17.001,0:40:21.160
example in case of a DSKY key press, it[br]causes an interrupt. The current job will

0:40:21.160,0:40:24.290
be interrupted, and the interrupt handler[br]will read the device data and return as

0:40:24.290,0:40:29.401
quickly as possible. If there's more to[br]do, it can schedule a job for later. Some

0:40:29.401,0:40:34.390
devices need to be serviced regularly. A[br]120 microsecond timer causes interrupts

0:40:34.390,0:40:38.450
that read data and write data... that read[br]data from and write data to certain

0:40:38.450,0:40:42.520
devices. The numeric display of the DSKY[br]for example only allows updating a few

0:40:42.520,0:40:48.350
digits at a time, so its driver is[br]triggered by the 120 microsecond timer.

0:40:48.350,0:40:51.930
The timer interrupt cycles through eight[br]phases, which distributes the device

0:40:51.930,0:40:56.941
drivers across time to minimize the[br]duration of one interrupt handler. Some

0:40:56.941,0:41:00.810
devices need to be driven at exact times.[br]If for example a job decides that it needs

0:41:00.810,0:41:05.330
to flash a lamp twice, it would turn it on[br]immediately and schedule three weightless

0:41:05.330,0:41:10.630
tasks in the future at specific times. The[br]first one will turn the lamp off, the

0:41:10.630,0:41:15.940
second one will turn it on again and the[br]third one will turn it off again. The

0:41:15.940,0:41:21.010
sorted time deltas of the weightless tasks[br]are stored in the data structure LST1,

0:41:21.010,0:41:24.590
with the first entry always currently[br]counting down in a timer register, and

0:41:24.590,0:41:29.630
LST2 contains a pair of PC and BB for each[br]task. There are subroutines to create a

0:41:29.630,0:41:34.690
new task and end the current task. The[br]timer that controls the wait list has a

0:41:34.690,0:41:39.251
granularity of 10 milliseconds. Other[br]timers can fire at the same rate, but are

0:41:39.251,0:41:42.950
offset, and the work triggered by them is[br]designed to be short enough to never

0:41:42.950,0:41:47.000
overlap with the next potential timer[br]triggered work. This is complicated by

0:41:47.000,0:41:50.820
device interrupts, which can come in at[br]any time. The duration of an interrupt

0:41:50.820,0:41:55.560
handler causes latency and the maximum[br]duration will reduce the allowed time for

0:41:55.560,0:41:59.090
the timer handlers. The core system[br]software makes no guarantees about the

0:41:59.090,0:42:04.120
timing, it's all up to components to...[br]it's up to all the components to cooperate

0:42:04.120,0:42:10.270
so the real time goal can be met. The[br]PINBALL program is the shell of the AGC.

0:42:10.270,0:42:14.160
Key press interrupts schedule a job, that[br]collects the digits for the command and

0:42:14.160,0:42:18.380
updates an in-memory representation of[br]what should be on the display. The 120

0:42:18.380,0:42:23.150
millisecond timer triggers the display[br]update code. When the command is complete

0:42:23.150,0:42:27.940
PINBALL schedules a new job. Mission[br]Control has a remote shell in form of a

0:42:27.940,0:42:34.070
DSKY connected through the s-band radio.[br]System software that supports human life

0:42:34.070,0:42:37.830
has to be able to communicate malfunctions[br]and be able to recover from them.

0:42:37.830,0:42:40.940
The alarm subroutine takes the following[br]word from the instruction stream,

0:42:40.940,0:42:44.530
displays it, and illuminates the prog[br]light. This should be interpreted as

0:42:44.530,0:42:48.590
a warning or an error message.[br]The AGC software is full of validity and

0:42:48.590,0:42:51.550
plausibility checks that help to find[br]bugs during development and help

0:42:51.550,0:42:54.250
better understanding potential issues[br]during the mission.

0:42:54.250,0:42:58.080
Some kinds of failures triggered by[br]various hardware watchdogs or by code

0:42:58.080,0:43:01.830
make it impossible for normal operations[br]to continue. In addition to showing

0:43:01.830,0:43:05.950
the error code, they also cause a hardware[br]reset but the system software also offers

0:43:05.950,0:43:10.500
recovery services. A job can have recovery[br]code for its different phases.

0:43:10.500,0:43:15.080
During execution it sets the respective[br]phase and if an abort happens in any

0:43:15.080,0:43:20.540
job or task, the currently set up recovery[br]routine gets executed which could

0:43:20.540,0:43:25.070
for example clean up and try the work[br]again, or skip to a different phase, or

0:43:25.070,0:43:30.070
cancel the job altogether. The phase[br]change call sets the current phase for a

0:43:30.070,0:43:34.310
job in the recovery table, for example[br]phase 5 for job 4. Each phase is

0:43:34.310,0:43:39.900
associated with a descriptor of a task or[br]a job with or without a VAC. So during

0:43:39.900,0:43:44.150
normal execution with several jobs and[br]tasks scheduled, if an abort happens, the

0:43:44.150,0:43:47.900
core set and wait list are cleared, the[br]contents of the recovery table are

0:43:47.900,0:43:52.210
activated, scheduling tasks and jobs for[br]all jobs that set up recovery code.

0:43:52.210,0:43:56.670
Sometimes a failure though, like corrupted[br]memory, are not recoverable. They cause a

0:43:56.670,0:44:00.330
fresh start, meaning a full initialization[br]of the system without running any recovery

0:44:00.330,0:44:05.030
code.[br]And that was the AGC system software.

0:44:07.630,0:44:11.350
C: As we now have a good overview on[br]architecture, hardware, peripherals, and

0:44:11.350,0:44:14.550
system software of the Apollo Guidance[br]Computer, it's time briefly view on it's

0:44:14.550,0:44:18.930
practical use on a mission to the moon. We[br]will look at the user interface, the

0:44:18.930,0:44:22.580
launch sequence, and, once in orbit, the[br]attitude in orbit determination. Further

0:44:22.580,0:44:26.130
we will understand how the digital[br]autopilot works, and how powered flight is

0:44:26.130,0:44:30.280
being performed. As soon as we've reached[br]the moon, we look at the lunar landing and

0:44:30.280,0:44:34.380
the lunar rendezvous after liftoff and[br]finally re-entry into Earth's atmosphere.

0:44:34.380,0:44:38.000
Last but not least contingencies, or as we[br]like to call them, "fun issues".

0:44:38.000,0:44:41.761
Let's start with the user interface.[br]It is like any command-line interface but

0:44:41.761,0:44:44.921
since there are only numbers and no letters,[br]key words have to be encoded.

0:44:44.921,0:44:48.540
On a normal system you might say[br]'display memory', 'enter'.

0:44:48.540,0:44:52.190
Display is the verb, memory is the noun.[br]On the Apollo guidance computer you say

0:44:52.190,0:44:57.150
verb '0 1', which means 'display', noun[br]'0 2' - 'memory' - 'enter'.

0:44:57.150,0:45:01.320
Subroutine asks for an argument. On a[br]normal system it might display a prompt,

0:45:01.320,0:45:03.830
you enter the number, press 'enter'.[br]On the Apollo Guidance Computer, flashing[br]

0:45:03.830,0:45:09.350
'verb' and 'noun' indicate that is waiting[br]for input. So you type '2 5', 'enter';

0:45:09.350,0:45:12.602
an octal address, and the Apollo Guidance[br]Computer displays the result.

0:45:12.602,0:45:16.690
The memory contents at the address octal[br]'2 5'. The Apollo Guidance Computer uses

0:45:16.690,0:45:19.840
the same concept of verb and noun when[br]it proactively asks for input.

0:45:19.840,0:45:24.100
Verb '6', noun '11' asks for the CSI[br]ignition time. CSI meaning

0:45:24.100,0:45:27.980
Coelliptic Sequence Initiation, we will[br]come to that later. Special case is when

0:45:27.980,0:45:31.230
the Apollo Guidance Computer asks a[br]yes-or-no question. Verb 99 has the

0:45:31.230,0:45:35.010
astronaut confirm engine ignition[br]with a proceed key.

0:45:35.010,0:45:37.950
The astronauts have a complete reference of[br]all verbs and nouns on paper,

0:45:37.950,0:45:41.160
as well as cue cards were the most[br]important information.

0:45:41.160,0:45:45.510
Let's now go through each of the phases[br]of the mission, starting with a liftoff.

0:45:45.510,0:45:49.530
So, we are on our way.[br]The Apollo Guidance Computer is

0:45:49.530,0:45:53.500
in passive monitoring mode. With the[br]cutting of the umbilical cables, which you

0:45:53.500,0:45:58.150
see right about ... now, it has started[br]the mission clock. In case this trigger

0:45:58.150,0:46:01.690
fails, one DSKY is always prepared with[br]verb 75 and just waiting for 'enter' to

0:46:01.690,0:46:04.940
manually start the mission timer. We can[br]display the mission elapsed time at any

0:46:04.940,0:46:10.570
time with verb 16, noun 65. During the[br]flight with the SaturnV, the Apollo

0:46:10.570,0:46:13.521
Guidance Computer is only performing[br]passive monitoring of the flight. Control

0:46:13.521,0:46:16.660
of the SaturnV is with its own launch[br]vehicle digital computer, and the

0:46:16.660,0:46:20.520
instrument unit ring. The DSKY[br]automatically shows verb 16, noun 62,

0:46:20.520,0:46:24.110
which is velocity in feet per second.[br]Altitude change rate in feet per second,

0:46:24.110,0:46:27.960
and altitude above pad and nautical miles.[br]Note that the units and the position of

0:46:27.960,0:46:31.590
the decimal point are implicit, and yes[br]the whole system was working in metric

0:46:31.590,0:46:35.300
internally but for the benefit of the[br]American astronauts the display procedures

0:46:35.300,0:46:41.740
converted everything to imperial units.[br]<i>laughter and applause</i>

0:46:41.740,0:46:45.731
In case of problems with the Saturn[br]computer, the Apollo Guidance Computer can

0:46:45.731,0:46:49.050
take over full control of the launch[br]vehicle, in extreme cases astronauts could

0:46:49.050,0:46:52.601
even steer the whole stack into orbit[br]themselves with the hand controller. In

0:46:52.601,0:46:56.300
case you ever wanted to fly... to manualyl[br]control a 110 meter tall rocket with more

0:46:56.300,0:46:59.020
than 30 million Newton of thrust, this is[br]your chance.

0:46:59.020,0:47:01.540
<i>laughter</i>[br]In less than 12 minutes we've gone through

0:47:01.540,0:47:04.820
the first and second stage and are using a[br]small burn from the third stage to get us

0:47:04.820,0:47:09.190
into a 185 kilometer orbit which circles[br]the earth every 88 minutes.

0:47:11.050,0:47:13.800
But how do we know where ...[br]we are in the right orbit?

0:47:13.800,0:47:16.810
Well the Apollo guidance computer, as well[br]as Mission Control, are monitoring

0:47:16.810,0:47:20.200
position and velocity, because to get[br]where we want to be, we first need to know

0:47:20.200,0:47:24.210
where we are. To be able to navigate in[br]space, we need to maintain our

0:47:24.210,0:47:26.990
three-dimensional position, and our[br]three-dimensional velocity,

0:47:26.990,0:47:30.360
the so-called state vector. Let's start[br]with the determination of the position.

0:47:30.360,0:47:34.670
For this we need a telescope and a space[br]sextant. The space sextant is very similar

0:47:34.670,0:47:37.430
to an 18th century nautical sextant.[br]Position is determined by measuring

0:47:37.430,0:47:41.320
the angle between the horizon and a[br]celestial body. As an horizon we can

0:47:41.320,0:47:45.310
either take that of Earth or Moon and[br]celestial bodies - well we are in orbit,

0:47:45.310,0:47:48.720
we are surrounded by them. So let's just[br]pick one. Luckily the Apollo guidance

0:47:48.720,0:47:52.720
computer already knows the position of 45[br]of them. The whole optics hardware and the

0:47:52.720,0:47:55.830
command and service module can be moved to[br]point in the general direction of Earth

0:47:55.830,0:47:59.260
and moon. With the launch of program 52,[br]we command the Apollo guidance computer to

0:47:59.260,0:48:02.840
rotate the spacecraft to point one axis of[br]the sextant, the so-called landmark line-

0:48:02.840,0:48:07.310
of-sight, LLOS, to the nearest body, which[br]is earth or moon. The astronaut then used

0:48:07.310,0:48:11.590
the optics systems to exactly align the[br]horizon to the LLOS. With the telescope

0:48:11.590,0:48:14.490
the astronaut looks for one of the known[br]stars, points the star line to it and lets

0:48:14.490,0:48:17.800
the Apollo guidance computer read the[br]tuning and shaft angle. Repeating this one

0:48:17.800,0:48:20.960
or more times in a different plane gives a[br]three-dimensional position of the vehicle

0:48:20.960,0:48:25.130
in space. In the lunar module on the other[br]hand, the optics hardware was trimmed down

0:48:25.130,0:48:28.380
for weight reduction. Any alignment[br]requires rotation of the lunar module.

0:48:28.380,0:48:31.610
This is mostly used to determine the[br]landing site and support the rendezvous

0:48:31.610,0:48:36.130
maneuvre. It even lacks the software to[br]perform positioning in translunar space.

0:48:36.130,0:48:40.100
As we are moving, our position changes all[br]the time. But after 2 location fixes, as

0:48:40.100,0:48:43.170
long as we're coasting, we are able to[br]establish our speed and can determine

0:48:43.170,0:48:47.010
future positions by dead reckoning. As[br]position and velocity are known, future

0:48:47.010,0:48:50.720
positions can be extrapolated.[br]Unfortunately the near extrapolation

0:48:50.720,0:48:54.450
doesn't work in space as we have[br]gravitational forces which bend our path.

0:48:54.450,0:48:57.090
Thankfully there are two mathematical[br]models implemented in the Apollo Guidance

0:48:57.090,0:49:00.400
Computer: Conic integration based on the[br]Keplerian orbit model on the left, which

0:49:00.400,0:49:04.640
assumes one perfectly round gravitational[br]body influencing our flight path, and

0:49:04.640,0:49:08.060
Encke's integrating method for[br]perturbation considering multiple bodies

0:49:08.060,0:49:12.080
with gravitational imbalances. I think[br]this helps to understand why we need a

0:49:12.080,0:49:15.610
computer on board and can't just fly to[br]the moon with a hand controller. As we

0:49:15.610,0:49:19.020
see, the Apollo spacecraft was perfectly[br]capable to fly on its own, but in the end

0:49:19.020,0:49:22.150
NASA decided that the primary source for[br]state vector updates shall be Mission

0:49:22.150,0:49:25.580
Control in Houston, measured with three[br]ground stations. Remote programming is

0:49:25.580,0:49:28.621
done with the Apollo guidance Computer in[br]idle, and running program 27. Mission

0:49:28.621,0:49:32.590
Control can use its link via s-band to[br]update the state vector. But there's one

0:49:32.590,0:49:36.450
thing Mission Control doesn't know better[br]than us, and that's attitude. Attitude is

0:49:36.450,0:49:39.880
the orientation of the spacecraft in its[br]three axis. Starting from a known

0:49:39.880,0:49:44.041
attitude, we have to ensure that we can[br]measure any rotation on any axis.

0:49:44.041,0:49:48.020
That's what gyros are for. They are one of[br]the major component of the IMU,

0:49:48.020,0:49:51.740
the inertial measurement unit. Three[br]gyroscopes, one per axis measure any

0:49:51.740,0:49:54.810
rotation and provide their data to the[br]Apollo Guidance Computer to keep track of

0:49:54.810,0:49:59.350
the attitude of the spacecraft. Before we[br]leave Earth orbit, let's quickly discuss

0:49:59.350,0:50:02.490
the digital autopilot. It is the single[br]biggest program in the Apollo Guidance

0:50:02.490,0:50:05.690
Computer, with about 10% of all the source[br]code both in the command and service

0:50:05.690,0:50:09.080
module as well as the lunar module. The[br]implementations for each vehicle are

0:50:09.080,0:50:12.140
significantly different though, due to[br]different flight modes, thruster sets,

0:50:12.140,0:50:16.950
and symmetry of vehicle. As there's no[br]friction in space, the tiniest event would

0:50:16.950,0:50:20.580
constantly make the spacecraft rotate. The[br]digital autopilot of the Apollo Guidance

0:50:20.580,0:50:24.150
Computer uses the jets to maintain the[br]attitude within certain thresholds,

0:50:24.150,0:50:28.420
so-called dead bands. The autopilot is[br]also used in case the astronauts ever need

0:50:28.420,0:50:31.970
to use the hand controllers for thrusters.[br]Basically both the command service module

0:50:31.970,0:50:35.400
and the lunar module have fly-by-wire[br]control. As any thruster could break at

0:50:35.400,0:50:39.250
any time, the autopilot is capable of[br]calculating the ideal burn mode even with

0:50:39.250,0:50:42.750
a reduced number of thrusters. It has some[br]simple algorithms for center of gravity and

0:50:42.750,0:50:45.920
weight distribution as well, which are[br]taken into account when calculating

0:50:45.920,0:50:50.360
thruster maneuvers. It can do more than[br]that, though. Give it a new attitude and

0:50:50.360,0:50:54.320
it will calculate the most efficient[br]transfer vector to reach the new attitude.

0:50:54.320,0:50:58.120
In certain flight modes it might be[br]required to have a stable rotation, be it

0:50:58.120,0:51:01.240
for temperature control, monitoring of the[br]landing site, or other reasons. The

0:51:01.240,0:51:05.510
autopilot supports stable constant[br]rolling, which can be directly activated.

0:51:05.510,0:51:08.380
The autopilot does not only control[br]attitude, it also supports the crew in

0:51:08.380,0:51:12.030
performing powered flight maneuvers. It[br]calculates a potential solution, which

0:51:12.030,0:51:15.600
obviously can be overwritten by ground as[br]usual, but still, after confirmation the

0:51:15.600,0:51:18.880
autopilot automatically fires the engines[br]and keeps a timer for the correct length

0:51:18.880,0:51:23.590
of time. It does not measure the results[br]of the burn though. For powered flight

0:51:23.590,0:51:27.220
obviously dead reckoning isn't correct[br]anymore, so the Apollo Guidance Computer

0:51:27.220,0:51:30.960
contains a subroutine called average G,[br]which takes the input from the IMU,

0:51:30.960,0:51:35.500
meaning gyro and accelerometer, to compute[br]the change to the state vector. Now that

0:51:35.500,0:51:38.770
we know how to orient ourselves, and how[br]to control the spaceship, it's time we fly

0:51:38.770,0:51:42.300
to the moon. Usually the translunar[br]injection happens in the middle of the

0:51:42.300,0:51:46.120
second orbit around the earth, so around 2[br]hours 45 minutes into the flight. This is

0:51:46.120,0:51:49.680
still performed by the third stage of the[br]SaturnV so the Apollo Guidance Computer

0:51:49.680,0:51:52.280
once again should only have a passive role[br]here by monitoring the translunar

0:51:52.280,0:51:56.220
injection with the dedicated program P 15.[br]After separation from the S-IV-B

0:51:56.220,0:51:59.350
we are on our way. Since the next[br]interesting phase is the lunar

0:51:59.350,0:52:04.210
landing, let's skip to that one. Once in[br]lunar orbit, separation between the

0:52:04.210,0:52:07.380
command and service module and lunar[br]module happens four hours and 45 minutes

0:52:07.380,0:52:11.450
before landing. On the lunar module,[br]directly afterwards, rendezvous equipment

0:52:11.450,0:52:15.150
like radar, strobe and VHF are tested, as[br]well as the IMU, which is realigned.

0:52:15.150,0:52:18.560
Additionally there's lots of preparation[br]work on the lunar module. One of the main

0:52:18.560,0:52:22.580
tasks is to prepare the abort guidance[br]system, AGS, which is another, more

0:52:22.580,0:52:25.450
simpler computer, that is able to get the[br]lunar module with the astronauts back into

0:52:25.450,0:52:29.600
orbit and safely docked with the CSM in[br]case of an emergency. Let's get back to

0:52:29.600,0:52:33.220
powered descent. The lunar module AGC has[br]a special program for that one, P 63,

0:52:33.220,0:52:37.600
braking phase. The landing radar has[br]switched on and updates the state vector.

0:52:37.600,0:52:40.460
The Apollo Guidance Computer controls the[br]burn to reach the correct corridor towards

0:52:40.460,0:52:44.510
the surface with a minimal amount of fuel.[br]This is fully automatic, the astronauts

0:52:44.510,0:52:47.910
just sit along for the ride. The lunar[br]module is oriented with its descent engine

0:52:47.910,0:52:52.040
towards the moon, visibility for the[br]astronauts is close to zero. The second

0:52:52.040,0:52:55.920
program, P 64, starts automatically at[br]around 8,000 feet. Lunar module is pitched

0:52:55.920,0:52:58.900
so that the astronauts can actually see[br]the ground and the lunar module commander

0:52:58.900,0:53:01.650
is getting a better understanding of the[br]landing site and can search for a suitable

0:53:01.650,0:53:06.570
spot. The third program, P 68, keeps the[br]lunar module in a stable attitude above

0:53:06.570,0:53:10.740
the surface and the commander manually[br]adjusts the height in one feet per second

0:53:10.740,0:53:13.870
increments, to slowly descend to the[br]surface. Ideally at that point, the

0:53:13.870,0:53:17.310
horizontal movement of the lunar module[br]should be zero. After touchdown the crew

0:53:17.310,0:53:21.480
manually activates program 68, which[br]confirms to the Apollo guidance computer

0:53:21.480,0:53:24.790
that yes, we have indeed landed, and[br]ensures that the engine is switched off,

0:53:24.790,0:53:28.350
terminates the average G routine, and sets[br]the autopilot in a very forgiving setting,

0:53:28.350,0:53:32.460
to avoid any corrections when it measures[br]the rotation of the moon. The autopilot is

0:53:32.460,0:53:35.700
not completely switched off though, as the[br]astronaut might need it in case of an

0:53:35.700,0:53:39.340
emergency ascent. Well we are on the moon,[br]we do the usual stuff, small step for man,

0:53:39.340,0:53:42.940
jump around plant the flag, and we then[br]skip directly to the interesting bits

0:53:42.940,0:53:46.950
which is liftoff and rendezvous. The[br]rendezvous technique was developed in the

0:53:46.950,0:53:50.950
Gemini project. Here you can see the Agena[br]rendezvous target in Earth orbit. It

0:53:50.950,0:53:54.030
follows the principle of an active[br]vehicle, in this case the lunar module,

0:53:54.030,0:53:56.870
which follows the command and service[br]module and approaches it from below at

0:53:56.870,0:54:00.980
slightly faster orbit. There were actually[br]two different ways for rendezvous. A more

0:54:00.980,0:54:04.320
conservative method called Coelliptic[br]rendezvous which required one and a half

0:54:04.320,0:54:07.470
orbits for the lunar module to reach the[br]command and service module, but gave ample

0:54:07.470,0:54:11.610
opportunity for monitoring progress, mid-[br]course corrections, and orbit scenarios.

0:54:11.610,0:54:14.660
And a more risky direct rendezvous method[br]which directly aimed the lunar module

0:54:14.660,0:54:18.780
towards the command and service module,[br]taking less than one orbit until docking.

0:54:18.780,0:54:22.430
This one was used starting from the Apollo[br]14 mission, as Mission Control had more

0:54:22.430,0:54:28.140
experience and aimed for the shorter, less[br]fuel intensive method. Preparation had to

0:54:28.140,0:54:32.290
start two hours before liftoff. We have to[br]align the IMU and we visually monitor the

0:54:32.290,0:54:35.720
orbit of the CSM and calculate the[br]rendezvous data. The Apollo Guidance

0:54:35.720,0:54:40.350
Computer has program 22, CSM tracking, for[br]this purpose. At liftoff minus one hour,

0:54:40.350,0:54:44.130
we start program 12, powered ascent, and[br]feed it with the necessary data, liftoff

0:54:44.130,0:54:48.640
time and velocity target. The Apollo[br]Guidance Computer performs the countdown,

0:54:48.640,0:54:52.140
and ask for confirmation, we proceed and[br]we have liftoff.

0:54:52.140,0:54:55.200
The trip into orbit takes only seven and a[br]half minutes but depending on which method

0:54:55.200,0:54:58.300
for reaching the target orbit was used, it[br]takes us either one and a half, or three

0:54:58.300,0:55:01.710
and a half hours to come up behind the[br]command and service module. During that

0:55:01.710,0:55:04.810
time, program 20 is running all the time,[br]measuring the state vector of the other

0:55:04.810,0:55:08.270
vehicle, the command and service module,[br]via various peripherals like rendezvous

0:55:08.270,0:55:12.370
radar, VHF antenna, and the optic system[br]for visual alignment. It calculates the

0:55:12.370,0:55:15.530
necessary corridor and respective[br]maneuvers required to get the lunar module

0:55:15.530,0:55:18.800
into an interception course. Multiple[br]other programs run in parallel to perform

0:55:18.800,0:55:22.920
the necessary mid-course burn maneuvers.[br]On the commander of service module, the

0:55:22.920,0:55:25.730
pilot is actively tracking the lunar[br]module the whole way up to orbit. The

0:55:25.730,0:55:28.580
command and service module's computer is[br]calculating the state vector of the lunar

0:55:28.580,0:55:31.850
module, to take over the role of the[br]active vehicle, in case anything goes

0:55:31.850,0:55:35.290
wrong. The approach of the lunar module[br]stops at 50 meter distance, at which point

0:55:35.290,0:55:39.050
it rotates to point its docking target on[br]top towards the command and service

0:55:39.050,0:55:42.700
module. At that point in time the command[br]service module takes over the active role

0:55:42.700,0:55:46.590
and activates program 79, final[br]rendezvous, which slows down the command

0:55:46.590,0:55:50.240
and service module to close the distance[br]until docking. Seconds before contact, the

0:55:50.240,0:55:54.620
autopilot on both spacecraft is switched[br]off to avoid both trying to correct the

0:55:54.620,0:55:58.740
attitude of the combined spacecraft. So[br]far so good, time to go home with the

0:55:58.740,0:56:02.310
trans-earth injection. We feed the Apollo[br]guidance computer with Earth orbit

0:56:02.310,0:56:05.910
parameters and let it calculate the burn[br]which is then activated and controlled.

0:56:05.910,0:56:09.080
Any kind of potential mid-course[br]corrections are performed the exact same

0:56:09.080,0:56:14.210
way. Once in orbit around Earth, re-entry[br]parameters are calculated on ground and

0:56:14.210,0:56:17.260
transferred to the Apollo guidance[br]computer via a S-band uplink. The first

0:56:17.260,0:56:21.720
entry program, P 61, entry preparation,[br]starts at entry minus 25 minutes. Various

0:56:21.720,0:56:25.280
landing parameters are requested, like[br]latitude and longitude of the splash zone,

0:56:25.280,0:56:28.631
as well as the velocity and angles to[br]enter the atmosphere. Entering and

0:56:28.631,0:56:31.940
confirming these values completes program[br]61, and starts program 62, which basically

0:56:31.940,0:56:35.850
asks the astronaut to perform a checklist[br]for manual command module - service module

0:56:35.850,0:56:39.420
- separation, which is not controlled by[br]the Apollo guidance computer. After that

0:56:39.420,0:56:42.750
has been performed it switches[br]automatically to program 63, entry

0:56:42.750,0:56:47.630
initialization. At that point, the[br]autopilot is taking care of thruster

0:56:47.630,0:56:51.250
control to break the command module out of[br]its orbit into Earth's atmosphere. The

0:56:51.250,0:56:57.030
main program for re-entry is program 64,[br]entry, which starts automatically. Program

0:56:57.030,0:57:00.490
64 monitors the trajectory, and splashdown[br]location, and determines the best entry

0:57:00.490,0:57:04.570
solution and potential velocity reduction[br]by invoking two specific programs, either

0:57:04.570,0:57:08.630
P 65, entry up control, which basically[br]makes the current module surf on the

0:57:08.630,0:57:13.250
atmosphere to reduce speed and extend the[br]range, or program 66, entry ballistic,

0:57:13.250,0:57:16.411
throwing us through the atmosphere like a[br]cannonball. The right mixture of the two

0:57:16.411,0:57:22.020
is decided by program 64. The last[br]program, program 67, final phase, performs

0:57:22.020,0:57:25.190
the final maneuvers to the splash down.[br]The following steps, like parachute

0:57:25.190,0:57:28.790
deployment and so on, are not done by the[br]Apollo guidance computer but by the ELSC,

0:57:28.790,0:57:32.200
the Earth Landing Sequence Controller. The[br]drop of the Apollo guidance computer is

0:57:32.200,0:57:36.721
done before deploying the parachutes. So[br]this was a beautiful nominal mission, what

0:57:36.721,0:57:42.320
can go wrong? Well let's start with Apollo[br]11, which had a 12 02 program alarm during

0:57:42.320,0:57:46.380
powered descent. Normally programs during[br]powered descent use about 85% of the

0:57:46.380,0:57:49.950
processing power of the computer, but due[br]to an incorrect power supply design, the

0:57:49.950,0:57:53.100
rendezvous... of the rendezvous radar[br]generated an additional twelve thousand

0:57:53.100,0:57:57.080
eight hundred involuntary instructions per[br]seconds, ironically amounting to the exact

0:57:57.080,0:58:01.210
additional 15 percent load.[br]Due to the co-operative multitasking, a

0:58:01.210,0:58:07.700
queue of jobs build up, which resulted in[br]executive overflow and the 12 02 alarm.

0:58:07.700,0:58:11.180
The operating system automatically[br]performed a program abort, all jobs were

0:58:11.180,0:58:14.860
cancelled and restarted. All of this took[br]just a few seconds, and landing could

0:58:14.860,0:58:20.090
commence. Next, Apollo 13. They had an[br]explosion of the oxygen tank in the

0:58:20.090,0:58:25.120
service module at 55 hours 54 minutes 53[br]seconds and it will ... yep, correct,

0:58:25.120,0:58:29.230
320,000 kilometers from Earth. Fortunately[br]they could make use of the free return

0:58:29.230,0:58:32.402
trajectory to get the astronauts back to[br]earth but they had to move to the lunar

0:58:32.402,0:58:35.750
module to survive, as the command and[br]service module was completely shut down,

0:58:35.750,0:58:39.030
including its Apollo Guidance Computer.[br]The IMU settings needed to be transferred

0:58:39.030,0:58:42.200
to the lunar module system first, adapted[br]to the different orientations of the

0:58:42.200,0:58:45.790
spacecraft. The manual burns and the mid-[br]course corrections were actually done with

0:58:45.790,0:58:48.630
the abort guidance system on the lunar[br]module, due to power constraints with the

0:58:48.630,0:58:52.170
Apollo Guidance Computer. Successful[br]reboot of the command and service module

0:58:52.170,0:58:57.650
computer was luckily done hours before re-[br]entry. And last but not least, Apollo 14,

0:58:57.650,0:59:00.630
which had a floating solder ball in the[br]abort button, which might lead to an

0:59:00.630,0:59:03.450
unwanted activation of abort, therefore[br]putting the lunar module back into orbit.

0:59:03.450,0:59:06.810
This was solved within hours, by[br]reprogramming the Apollo Guidance

0:59:06.810,0:59:10.010
Computer, to spoof the execution of a[br]different program, which was not listening

0:59:10.010,0:59:13.290
to the abort button during the powered[br]descend. Real abort activation though

0:59:13.290,0:59:18.830
would have to be manually activated via[br]the DSKY. So this was an overview and how

0:59:18.830,0:59:23.270
the mission software was used on a flight[br]to the moon and back.

0:59:23.270,0:59:32.350
<i>applause</i>

0:59:32.350,0:59:36.440
M: Now you probably want to run your own[br]code on a real Apollo Guidance Computer,

0:59:36.440,0:59:41.100
so you need to know where to find one.[br]42 computers were built total.

0:59:41.100,0:59:46.410
Seven lunar module computers crashed onto[br]the moon. Three lunar module AGC's burned

0:59:46.410,0:59:50.470
up in the Earth's atmosphere, 11 command[br]module computers returned.

0:59:50.470,0:59:55.520
They're all presumably parts of museum[br]exhibits. And 21 machines were not flown.

0:59:55.520,0:59:59.180
Little is known about those. One is on[br]display at the Computer History Museum

0:59:59.180,1:00:02.240
in Mountain View, California, but it is[br]missing some components.

1:00:02.240,1:00:07.290
Luckily several emulation solutions are[br]publicly available, as well as a tool chain.

1:00:07.290,1:00:11.740
And the complete mission source, originally[br]the size of a medium-sized suitcase,[br]

1:00:11.740,1:00:17.080
is available on github.[br]<i>laughter</i>

1:00:17.080,1:00:25.700
<i>applause</i>

1:00:25.700,1:00:29.430
It takes a village to create a presentation.[br]We would like to thank everyone who

1:00:29.430,1:00:32.990
helped and supported us. This includes[br]the indirect contributors, who wrote

1:00:32.990,1:00:35.940
the books, the original documentation,[br]the websites, and the software.

1:00:35.940,1:00:39.560
Thank you very much for your attention.[br]C: Thank you.

1:00:39.580,1:00:53.020
<i>applause and cheering</i>

1:00:53.020,1:00:58.080
Herald: Wow that was a densely packed talk.[br]<i>laughter</i>

1:00:58.080,1:01:06.260
Thanks Michael, and thanks Christian, for[br]this amazing information overload.

1:01:06.260,1:01:11.410
Please give a warm hand of applause,[br]because we can't have a Q&A, unfortunately.

1:01:11.410,1:01:20.108
<i>applause</i>

1:01:20.108,1:01:35.448
<i>postroll music</i>

1:01:35.448,1:01:41.301
<i>subtitles created by c3subtitles.de[br]in the year 2018</i>