BobHoward posted:

As I understand it, the "documentation" wasn't ordinary either -- it was detailed to the level of nearly being pseudocode.

Another interesting detail: The Shuttle flight software was naturally a safety critical system, and everything safety-critical on the Shuttle was engineered using highly detailed fault trees to estimate the probability of loss of mission, loss of vehicle, loss of vehicle and crew, etc. Relying on just one implementation of the software spec was considered too risky -- they had some target defect rate per line of code, and even though it was really low, fault tree analysis suggested the risk of loss of life was too high. So they implemented all the software twice, with independent and semi-firewalled teams, in hopes that if one version had a potentially devastating implementation bug, the other version might not share it.

In flight, both versions were always running simultaneously. The primary version ran on a cluster of three redundant computers, using majority vote to decide on the correct control outputs. The secondary backup software ran on a 2-way redundant set (so, 5 computers in total). Handoff from the 3-way to the 2-way was automatic if the 3-way self-detected severe problems with itself, and could also be forced manually.