5 ms·

Just because they do, doesn’t mean you should. I’m running an automotive firmware project at the moment and there are such things as software integrity levels,

Just because they do, doesn’t mean you should. I’m running an automotive firmware project at the moment and there are such things as software integrity levels, and each time you add something to the stack you create quite a large amount of testing and validation and process that needs to be followed. And it’s pretty much impossible to take something existing like Chromium and certify it to what you need. The architecture is wrong. The process is wrong. There is a lack of formal requirement traceability. Many other issues.

wadim 6y ago
But mixed-criticality systems are quite normal in many deployments nowadays, especially with the advent of virtualization and hypervisors you should be able to run safety critical and non-safety critical functions at the same time on the same SoC.
- jki275 6y ago
  Heresy.
- aetherspawn 6y ago
  Yes, but you have to prove that if one display considered to be "non critical" shows misleading data, it will not cause harm to the crew. For example, if the Chromium crashed and showed the heading or fuel level incorrectly, would they fly the rocket ship into the ocean or run out of fuel and drop out of the sky. Yes, it's called software integrity decomposition, and it's complicated and requires much analysis.
fsh 6y ago
I believe the choice of Chromium and JS for the UI simply shows that the astronauts are merely inconvenient payloads. Gagarin's first flight was already fully automated 59 years ago.
- TeMPOraL 6y ago
  Should've paired them with a dog. As the old joke goes, the astronauts are there to feed the dog; the dog is there to bite the astronauts if either of them tries to touch any of the controls.
  - rurban 6y ago
    As we saw in a recent Space Force episode on Netflix, the ape was much better than the dog. But you need pair them, as with Doug and Bob. Doug being the ape of course.
- usrusr 6y ago
  The UI design consisting exclusively of elegant but low contrast shades of blue certainly gives a similar vibe. But that might still be misleading, perhaps they deliberately keep the routine visualizations in a low key "style over substance" passenger entertainment mode so that they have plenty of visual headroom for when something actually important combs up?
  - CapricornNoble 6y ago
    That's an interesting thought. If the UI is always blue-ish...and suddenly a bright red triangle appears with an Exclamation Point inside....you might be about to die and should act accordingly.
  - racingmars 6y ago
    This reminds me of the Airbus concept. They follow what's called a "lights out" design for all of those buttons on the overhead panel. When things are set and working the way they should be for normal flight, there is no indication. Only if something is non-normal does the indication or button light up. For example, buttons that should be "on" for flight only light up when the system they control is "off", and things like emergency overrides or backup systems that should be "off" normally have buttons that light up when they're "on". It's an interesting concept. Obvious benefit is you can glance at the overhead panel and instead of having to consider the state of, say, 50 or more buttons, you can instantly see if everything is "normal" for flight. But the downside is that it's not as intuitive to answer the question "is system X turned on (or off)"...you have to look at the button, then know what's considered "normal" for that system, on or off, and determine if the lack or presence of indicator light means on or off. That said...the pilots know the plane well enough where it's not a problem.
- neurostimulant 6y ago
  Right, I think the crew dragon is intended to fly fully automatic from launch to docking? But imagine if there is an emergency and the crew need to take over, but lo and behold, chromium crashed! Hopefully the spacecraft can still be operated without the display.
  - TeMPOraL 6y ago
    That's just the ship telemetry tab that's crashed. The tab with YouTube still works (undoubtedly playing "Space Oddity").
je42 6y ago
I think it is not helpful to call out that their architecture is "wrong" and their process is "wrong". The attribute "wrong" is very opaque. As somebody who doesn't have your background, i cannot follow you. I have no idea about automotive and space software requirements. Since there are many aspects that lead to choices of a system architecture it requires more words to explain why a choice is not a good choice for the job.
- mrmonkeyman 6y ago
  "Wrong" for certification. Something like Chromium is so enormously humongously complex and integrated it will never pass any formal test.
- aetherspawn 6y ago
  I was referring to the architecture of Chromium being wrong to achieve certification for safety critical applications. And look, I haven't said impossible, but rough estimate I'd say removing 75% of the features and 5+ years to rewrite it to be compliant. And the subset of javascript that it could run would be very limited - it might not even have loops or functions.

wadim 6y ago

But mixed-criticality systems are quite normal in many deployments nowadays, especially with the advent of virtualization and hypervisors you should be able to run safety critical and non-safety critical functions at the same time on the same SoC.

jki275 6y ago
Heresy.
aetherspawn 6y ago
Yes, but you have to prove that if one display considered to be "non critical" shows misleading data, it will not cause harm to the crew. For example, if the Chromium crashed and showed the heading or fuel level incorrectly, would they fly the rocket ship into the ocean or run out of fuel and drop out of the sky. Yes, it's called software integrity decomposition, and it's complicated and requires much analysis.

fsh 6y ago

I believe the choice of Chromium and JS for the UI simply shows that the astronauts are merely inconvenient payloads. Gagarin's first flight was already fully automated 59 years ago.

TeMPOraL 6y ago
Should've paired them with a dog. As the old joke goes, the astronauts are there to feed the dog; the dog is there to bite the astronauts if either of them tries to touch any of the controls.
- rurban 6y ago
  As we saw in a recent Space Force episode on Netflix, the ape was much better than the dog. But you need pair them, as with Doug and Bob. Doug being the ape of course.
usrusr 6y ago
The UI design consisting exclusively of elegant but low contrast shades of blue certainly gives a similar vibe. But that might still be misleading, perhaps they deliberately keep the routine visualizations in a low key "style over substance" passenger entertainment mode so that they have plenty of visual headroom for when something actually important combs up?
- CapricornNoble 6y ago
  That's an interesting thought. If the UI is always blue-ish...and suddenly a bright red triangle appears with an Exclamation Point inside....you might be about to die and should act accordingly.
- racingmars 6y ago
  This reminds me of the Airbus concept. They follow what's called a "lights out" design for all of those buttons on the overhead panel. When things are set and working the way they should be for normal flight, there is no indication. Only if something is non-normal does the indication or button light up. For example, buttons that should be "on" for flight only light up when the system they control is "off", and things like emergency overrides or backup systems that should be "off" normally have buttons that light up when they're "on". It's an interesting concept. Obvious benefit is you can glance at the overhead panel and instead of having to consider the state of, say, 50 or more buttons, you can instantly see if everything is "normal" for flight. But the downside is that it's not as intuitive to answer the question "is system X turned on (or off)"...you have to look at the button, then know what's considered "normal" for that system, on or off, and determine if the lack or presence of indicator light means on or off. That said...the pilots know the plane well enough where it's not a problem.
neurostimulant 6y ago
Right, I think the crew dragon is intended to fly fully automatic from launch to docking? But imagine if there is an emergency and the crew need to take over, but lo and behold, chromium crashed! Hopefully the spacecraft can still be operated without the display.
- TeMPOraL 6y ago
  That's just the ship telemetry tab that's crashed. The tab with YouTube still works (undoubtedly playing "Space Oddity").

je42 6y ago

I think it is not helpful to call out that their architecture is "wrong" and their process is "wrong". The attribute "wrong" is very opaque. As somebody who doesn't have your background, i cannot follow you. I have no idea about automotive and space software requirements. Since there are many aspects that lead to choices of a system architecture it requires more words to explain why a choice is not a good choice for the job.

mrmonkeyman 6y ago
"Wrong" for certification. Something like Chromium is so enormously humongously complex and integrated it will never pass any formal test.
aetherspawn 6y ago
I was referring to the architecture of Chromium being wrong to achieve certification for safety critical applications. And look, I haven't said impossible, but rough estimate I'd say removing 75% of the features and 5+ years to rewrite it to be compliant. And the subset of javascript that it could run would be very limited - it might not even have loops or functions.