Alarm and Abort
The ALARM_AND_ABORT.agc file is only five pages of the original printout (pages 1381-1385), but it contains some of the most-quoted label names in the history of software. The engineers who wrote these routines chose names that were vivid, sometimes funny, and occasionally ominous — each one calibrated to the severity of the failure it handled.
Page 1383 of the actual Luminary099 assembly listing, photographed at the MIT Museum by Paul Fjeld for the Virtual AGC project. WHIMPER, POODOO, MR.KLEAN, and CURTAINS — the entire abort severity ladder — all on one page.
The Alarm Hierarchy
Section titled “The Alarm Hierarchy”The AGC distinguishes between three categories of trouble:
- Alarms — non-fatal conditions that light the PROG alarm indicator but let the current program continue
- Bailouts — more serious failures that abort the current job but attempt orderly recovery
- Aborts (POODOO) — fatal conditions that terminate the current program entirely and return to P00
Each has its own entry point, and the naming convention tells the programmer which level of catastrophe they are invoking.
ALARM — The Warning
Section titled “ALARM — The Warning”The gentlest response. ALARM lights the program alarm indicator on the DSKY and records the alarm code in one of three FAILREG registers, but it returns control to the calling program:
# THE FOLLOWING SUBROUTINE MAY BE CALLED TO DISPLAY A NON-ABORTIVE# ALARM CONDITION. IT MAY BE CALLED EITHER IN INTERRUPT OR UNDER# EXECUTIVE CONTROL.## CALLING SEQUENCE IS AS FOLLOWS:# TC ALARM# OCT AAANN # ALARM NO. NN IN GENERAL AREA AAA.# # (RETURNS HERE)
ALARM INHINT
CA QALARM2 TS ALMCADR INDEX Q CA 0BORTENT TS LThe alarm code follows the TC ALARM instruction as a literal constant. The INDEX Q trick reads it directly from program memory — Q holds the return address, so INDEX Q; CA 0 fetches the word at that address.
Three FAILREG registers allow up to three simultaneous alarm codes to be stored. If all three are full, the newest alarm overwrites the third register with its high bit set as a flag:
MULTFAIL CA L AD BIT15 TS FAILREG +2The alarm light turns on via the DSKY relay word:
PROGLARM CS DSPTAB +11D MASK OCT40400 ADS DSPTAB +11DThis is what made the PROG light glow on the panel during the Apollo 11 descent. The 1202 and 1201 alarm codes were set here, triggering the yellow indicator that the crew and Mission Control saw.
BAILOUT — The Ejection
Section titled “BAILOUT — The Ejection”BAILOUT is for situations where the current job cannot continue but the system might recover. It is the entry point that triggers the 1201 and 1202 alarms from the Executive:
BAILOUT INHINT CA Q TS ALMCADR
INDEX Q CAF 0 TC BORTENTOCT40400 OCT 40400After storing the alarm code and recording the caller’s address, BAILOUT falls through to WHIMPER:
INHINT WHIMPER CA TWO AD Z TS BRUPT RESUME TC POSTJUMP # RESUME SENDS CONTROL HERE CADR ENEMA
ENEMA lives in FRESH_START_AND_RESTART.agc, and the source code includes a warning about it:
# DO NOT USE GOPROG2 OR ENEMA WITHOUT CONSULTING POOH PEOPLE.
“Pooh People” refers to the engineers responsible for P00 (pronounced “P-double-oh” or “pooh”) — the idle program. GOTOPOOH is the routine that returns the computer to P00, and its maintainers were apparently protective of the entry conditions.
The name ENEMA is precisely what it sounds like — a forceful cleanup. It flushes the task groups, resets flags, and restores the computer to a known state. The metaphor is medically accurate: it is not pleasant, but it clears the system of whatever was causing the problem.
POODOO — The Full Abort
Section titled “POODOO — The Full Abort”POODOO is the most severe abort. The name is P00-DOO — “DO Program 00.” This is confirmed by the AGC source itself: the routine is defined under the $$/P00 section in FRESH_START_AND_RESTART.agc, and the transcription correction notes in EXTENDED_VERBS.agc explicitly correct the spelling to P00DOO. When things go badly wrong, the computer returns to P00 (the idle program, pronounced “pooh”), and the engineers who maintained P00 were called the “POOH People.”
POODOO INHINT CA Q ABORT2 TS ALMCADR INDEX Q CAF 0 TC BORTENT OCT77770 OCT 77770 # DON'T MOVE
The OCT 77770 with the comment “DON’T MOVE” is not an instruction — it is a constant that must remain at a specific memory address because other routines reference it by location. Moving it would cause the abort system itself to fail. The comment is addressed directly to anyone editing the code.
POODOO leads to GOPOODOO, which performs a thorough teardown:
GOPOODOO INHINT TC BANKCALL # RESET STATEFLG, REINTFLG, AND NODOFLAG. CADR FLAGS CA FLAGWRD7 # IS SERVICER CURRENTLY IN OPERATION? MASK V37FLBIT CCS A TCF STRTIDLE TC BANKCALL # TERMINATE GRPS 1, 3, 5, AND 6 CADR V37KLEAN TC BANKCALL # TERMINATE GRPS 2, 4, 1, 3, 5, AND 6 CADR MR.KLEAN # (I.E., GRP 4 LAST) TCF WHIMPER
The cleanup calls two routines with telling names:
- V37KLEAN — kills task groups 1, 3, 5, and 6
- MR.KLEAN — kills everything, including groups 2 and 4, with group 4 going last (because group 4 contains the abort restart protection)
After the cleanup, control flows to WHIMPER, which resumes into ENEMA, which ultimately returns the computer to P00.
CURTAINS
Section titled “CURTAINS”The last abort routine, and perhaps the most dramatic name in the entire codebase:
CURTAINS INHINT CA Q TC ALARM2 OCT217 OCT 00217 TC ALMCADR # RETURN TO USER
CURTAINS is not a full abort — it calls ALARM2 (the alarm path, not the bailout path) and then returns to the caller. The alarm code 00217 is recorded, and the alarm light comes on. The name suggests finality, but the code is more restrained than the label implies. It is used for situations where something has gone badly wrong but the calling routine wants to handle the aftermath itself.
CCSHOLE
Section titled “CCSHOLE”An oddity worth noting:
CCSHOLE INHINT CA Q TC ABORT2 OCT1103 OCT 1103
CCSHOLE is called when program execution reaches a location that should be unreachable — specifically, the unused branches of a CCS instruction. The CCS (Count, Compare, and Skip) instruction has four possible outcomes, and sometimes the programmer knows that only one or two should ever occur. The unused slots are filled with TC CCSHOLE.
Alarm code 1103 means “fell into a CCS hole” — the program somehow took a path that the programmer believed was impossible. The Executive itself uses this pattern extensively in its priority scanner.
The Full Stack
Section titled “The Full Stack”Putting it together, the hierarchy from mild to severe:
| Routine | Severity | What it does |
|---|---|---|
ALARM | Warning | Lights PROG alarm, records code, returns to caller |
CURTAINS | Serious warning | Lights PROG alarm with code 217, returns to caller |
BAILOUT | Job abort | Kills current job, cleans up via WHIMPER/ENEMA |
POODOO | Full abort | Kills current program, all task groups, returns to P00 |
CCSHOLE | Impossible state | Fires alarm 1103, aborts (should never be reached) |
What ties them all together is a shared set of registers (ALMCADR, FAILREG) and a common entry path through BORTENT that records the alarm code and the caller’s address for post-mortem analysis via telemetry. Even in failure, the software was designed to leave a trail.
Try It
Section titled “Try It”Experience the 1202 alarm firsthand. The simulator below runs Hamilton’s actual BAILOUT code — the same instructions that fired on July 20, 1969.