• 0 Posts
  • 87 Comments
Joined 3 years ago
cake
Cake day: June 18th, 2023

help-circle
  • This doesn’t happen “on a distro” because all of the different software functions are at different safety criticalities. The autopilot is (usually) level B, the air data system that delivers altitude and airspeed is level A, the navigation computer is level C (because pilots can still navigate without the aid of the computer). And so on.

    At level C, the standard is statement coverage with unit tests. At level B, it’s decision coverage, covering every branch. And at level A, it’s modified condition / decision coverage, which is a lot more complex and expensive to write.

    If you mix code for stuff at different levels, you have to develop the whole package to the highest level. Unless you can prove that the lower level code can’t interfere with the higher level code.

    The easiest way to prove that is to put the different levels into different computers, so they’re only talking to each other on some digital bus interface. That’s called “hardware partitioning”. There’s also “software partitioning”, but it requires an operating system or supervisor layer to provide the guarantees, and that operating system has to be developed to the highest safety level that it handles.

    Final result: you still see a lot of discrete computer boxes on airplanes. Various vendors have developed safety-critical OSes for main avionics computers, but they’re closed-source, and usually not based on Linux at all.


  • It was a three-barreled gun that fired shotgun shells, rifle rounds, and rescue flares. 10 rounds of each type of ammunition were supplied. The stock could be detached and used as a machete.

    For a while, these guns were on every Soyuz capsule that docked with ISS, and they were under the operational control of the Soyuz commander. I’ve read that they may have been retired in 2007 because Russia finally ran out of the very unique ammo.


  • They later said it was less than 1 mile away from the target spot.

    A big benefit of the ocean is if the capsule loses all attitude control, it can still reenter and survive. But it will be a “ballistic reentry”, much more punishing with the g forces, and also about 1500 miles short of the target zone.

    The Pacific Ocean makes it easy to ensure that those backup contingency landing sites are also safe landing sites.


  • The Russian system has a braking rocket that fires at the very last second to soften up the landing. On one early Soyuz mission, this rocket didn’t fire, and the solo cosmonaut suffered substantial injuries from the landing.

    The Orion capsule hits the water at the final parachute speed of 20-30 mph without injuring the crew. But as you state, they also have to design the capsule for flotation and egress in potentially rough sea state.

    Boeing Starliner is designed for a land landing, but it uses deployable air bags instead of a braking rocket. It’s not clear that Starliner will ever fly again after the RCS thruster problems.