When NASA’s Artemis 2 crew splashed down in the Pacific Ocean after the first crewed lunar mission in more than 50 years, software that I built helped complete the voyage home.
This was a moment I had looked forward to for more than a decade.
I spent 13 years at NASA’s Johnson Space Center working on human spaceflight systems, starting on the Space Shuttle program and then moving to the Orion crew capsule that carried the four Artemis 2 astronauts back to Earth. What many people don’t realize is that Orion is an autonomous vehicle, capable of safely guiding its astronaut occupants home using its on-board sensors and computers.
I built and certified flight software for some of Orion’s most safety-critical guidance algorithms. This is the kind of software where getting it wrong doesn’t mean a bug report; it means losing a crew.
The same safety principles I used at NASA now guide my work in delivering safe autonomous driving technology at Kodiak.
The safety engineering challenge of deploying a self-driving truck is just as hard as the challenge of bringing astronauts back from space, and the engineering disciplines are far more alike than many people realize.
What NASA really instilled in me was a culture of vigilance, of healthy paranoia, of assuming that the next failure mode is the one you haven't thought of yet. At NASA, you learn to distrust your own confidence. You learn to operate with humility. You learn that the moment you stop looking for what can go wrong is the moment it will. I carry that mindset with me every day at Kodiak.
What I Built For Orion
Orion hit Earth's atmosphere at roughly 25,000 mph, or about Mach 32. The kinetic energy at that moment is approximately 650 gigajoules: enough to fully charge about 2,400 Teslas, or power the entire city of Mountain View for five hours. In just thirteen minutes, all of that energy needs to safely bleed off through heat generated by drag, while simultaneously steering to a landing zone the size of a small lake. To successfully return, the Orion spacecraft must re-enter the atmosphere with less than 0.1 degrees of error in the flight path angle. If Orion misses that window, the spacecraft could skip off the atmosphere or come in too steep and subject the capsule to unsurvivable heating and G-loads.
Over my eleven years on the Orion program, I was a member of the team that built and certified much of the onboard guidance software that manages this problem. I developed the Entry Monitor, the onboard system that computes the spacecraft's reachable landing area during re-entry, evaluates whether the primary target is still achievable, and recommends alternatives as needed.
The Entry Monitor is the crew's primary instrument for situational awareness during one of the most dangerous, dynamic phases of the mission: re-entry. I also helped refactor and verify Orion's primary entry guidance algorithm, its orbit powered flight guidance algorithm, onboard orbital trajectory prediction algorithms, and its onboard trajectory targeting system, transforming each from working prototypes into safety-rated software certified to NASA's stringent Class A flight software standards (roughly equivalent to ASIL-D in automotive terms). That certification process meant 100% MC/DC code coverage, full bidirectional requirements traceability, and closure of every static analysis finding.
I also developed Clutch, Orion's backup entry guidance algorithm, from concept through simulation to flight certification. Clutch is designed to provide continuous safe-abort coverage during a failure scenario where the standard emergency mode was unreliable.
To verify these systems, our NASA-led teams ran millions of Monte Carlo simulations with dispersions on atmosphere, aerodynamics, mass properties, navigation errors, sensor noise, winds, parachute performance, and many other factors to test rare events through those millions of combinations. That's how NASA builds confidence that onboard autonomy software will perform across the full range of conditions it might actually encounter, not just the nominal case.
