Hacker News Reader

Comment by jamespetercook | Hacker News Reader

“They use Chromium and JavaScript for the Dragon 2 flight interface.“

This is the most interesting part for me being a web dev! How likely do you think this is?

Just because they do, doesn’t mean you should.

I’m running an automotive firmware project at the moment and there are such things as software integrity levels, and each time you add something to the stack you create quite a large amount of testing and validation and process that needs to be followed.

And it’s pretty much impossible to take something existing like Chromium and certify it to what you need. The architecture is wrong. The process is wrong. There is a lack of formal requirement traceability. Many other issues.

I believe the choice of Chromium and JS for the UI simply shows that the astronauts are merely inconvenient payloads. Gagarin's first flight was already fully automated 59 years ago.

Should've paired them with a dog. As the old joke goes, the astronauts are there to feed the dog; the dog is there to bite the astronauts if either of them tries to touch any of the controls.

As we saw in a recent Space Force episode on Netflix, the ape was much better than the dog. But you need pair them, as with Doug and Bob. Doug being the ape of course.

The UI design consisting exclusively of elegant but low contrast shades of blue certainly gives a similar vibe. But that might still be misleading, perhaps they deliberately keep the routine visualizations in a low key "style over substance" passenger entertainment mode so that they have plenty of visual headroom for when something actually important combs up?

This reminds me of the Airbus concept. They follow what's called a "lights out" design for all of those buttons on the overhead panel. When things are set and working the way they should be for normal flight, there is no indication. Only if something is non-normal does the indication or button light up.

For example, buttons that should be "on" for flight only light up when the system they control is "off", and things like emergency overrides or backup systems that should be "off" normally have buttons that light up when they're "on".

It's an interesting concept. Obvious benefit is you can glance at the overhead panel and instead of having to consider the state of, say, 50 or more buttons, you can instantly see if everything is "normal" for flight. But the downside is that it's not as intuitive to answer the question "is system X turned on (or off)"...you have to look at the button, then know what's considered "normal" for that system, on or off, and determine if the lack or presence of indicator light means on or off. That said...the pilots know the plane well enough where it's not a problem.

That's an interesting thought. If the UI is always blue-ish...and suddenly a bright red triangle appears with an Exclamation Point inside....you might be about to die and should act accordingly.

Right, I think the crew dragon is intended to fly fully automatic from launch to docking? But imagine if there is an emergency and the crew need to take over, but lo and behold, chromium crashed! Hopefully the spacecraft can still be operated without the display.

That's just the ship telemetry tab that's crashed. The tab with YouTube still works (undoubtedly playing "Space Oddity").

I think it is not helpful to call out that their architecture is "wrong" and their process is "wrong".

The attribute "wrong" is very opaque.

As somebody who doesn't have your background, i cannot follow you. I have no idea about automotive and space software requirements.

Since there are many aspects that lead to choices of a system architecture it requires more words to explain why a choice is not a good choice for the job.

I was referring to the architecture of Chromium being wrong to achieve certification for safety critical applications.

And look, I haven't said impossible, but rough estimate I'd say removing 75% of the features and 5+ years to rewrite it to be compliant. And the subset of javascript that it could run would be very limited - it might not even have loops or functions.

But mixed-criticality systems are quite normal in many deployments nowadays, especially with the advent of virtualization and hypervisors you should be able to run safety critical and non-safety critical functions at the same time on the same SoC.

Yes, but you have to prove that if one display considered to be "non critical" shows misleading data, it will not cause harm to the crew. For example, if the Chromium crashed and showed the heading or fuel level incorrectly, would they fly the rocket ship into the ocean or run out of fuel and drop out of the sky.

Yes, it's called software integrity decomposition, and it's complicated and requires much analysis.

Heresy.

That was the most surprising part to me too, but not that surprising. Lots of automotive and newer industrial UIs use Qt Quick with QML which is not all that different from HTML5 and JS with something like React.

It's used in the presentation layer, not the actually control systems.

It is very different from the audit/certification viewpoint, and Qt specifically caters to the automotive market

Reply on news.ycombinator.com