Your ICD Names the Value. It Can't Watch You Read It.
On December 20, 2019, Boeing's Starliner reached into the Atlas V beneath it, read the mission clock, and came back with a number that was a valid time and about eleven hours wrong. Nothing in the interface was undefined. The capsule knew exactly which value to read. It read it at the wrong instant, decided it was already past orbital insertion, and started spending the propellant it needed to reach the station.
That is the part worth sitting with. The interface between the launch vehicle and the spacecraft was specified. Starliner draws its Mission Elapsed Time from the Atlas V, and it is supposed to sample that time during the terminal count before liftoff. Instead it pulled the value early, during a window when the number it grabbed did not mean what the flight software assumed it meant. The clock came up eleven hours off. The software, trusting its own clock, believed it was in a later phase of flight and fired thrusters to hold an attitude that flight was nowhere near. By the time the ground corrected the timer, too much propellant was gone, and the rendezvous with the ISS was scrubbed. Every number in that exchange was, on its own, a well-formed number.
Some interface values are read at an instant, not written in a table
An ICD is good at static shapes. This field is a float. That one is a uint32. This quantity is in newton-seconds. A spreadsheet holds those facts and a reviewer can check them by reading.
It is bad at the thing that lost Starliner: when, and from what state, a value gets sampled. Mission Elapsed Time is not a number you store and hand over. It is a number one system reaches into another to grab, live, at a defined moment, and its meaning depends entirely on the moment you grab it. The document can specify that moment down to the second and still not be standing on the wire when the second arrives. It names the value. It cannot watch you read it.
A valid value is not a correct value
Every number in the Starliner exchange would pass a type check. The clock read was a proper time. The error lived in the relationship between that value and the state of the mission when the software read it. Nothing about the bits was wrong. What was wrong was the assumption wrapped around them.
A document can say which value to read. It cannot stand on the wire and check you read it at the moment it meant.
This is why "we specified the interface" is a weaker claim than it sounds. Correctness of an interface is not a property you can inspect one field at a time. It is a property of an exchange: the value, plus the instant it crosses, plus the state each side is in when it does. A PDF holds the first of those three and is silent on the other two.
This is the class of bug a document is structurally blind to
The valid-number-wrong-meaning failure hides everywhere two systems agree on a shape and disagree on a reference. A position vector in ECI read as though it were ECEF is off by the Earth's rotation, and both are three honest floats. A timestamp in GPS time read as UTC is off by whole leap seconds, and both are honest timestamps. Starliner grabbed an honest time from the wrong point in the count. In each case the receiver got a value that would survive any check that asks "is this a number of the right type," because the type was never the problem.
A spreadsheet ICD names each of these and watches none of them. Whatever checking exists was written once, in code, by a person reading the document, and from then on the code and the document agree only as long as nobody touches either. During Starliner's flight a second software error, in how the service module's thrusters were mapped for disposal, was caught and patched while the vehicle was already in orbit. It had passed every review that read the interface. It had not passed the one test that ran it.
If the interface is executable, the exchange gets checked, not just the field
There is a version of this where the launch-vehicle-to-spacecraft interface is not a document describing when to sample the clock. It is a contract you can run. The precondition on the read, that Mission Elapsed Time is only valid after a given point in the count and only in a given vehicle state, is part of the interface definition, enforced at the boundary and exercised in an end-to-end run with a model of the launch vehicle in the loop, on the ground, before anyone lights the engine.
Boeing's own review of the failure concluded that an integrated, end-to-end test would have caught the timer error before flight. That is the whole argument in one sentence from the people who paid for the lesson. A field-by-field reading of the interface passed. The exchange, run once against a live counterpart, would have failed loudly in a test bay in Florida instead of quietly over the Atlantic. Software-in-the-loop is what turns a specified interface into a checked one.
What changes
Accept this and the ICD is no longer the place where an interface is agreed and then trusted. It becomes a projection of a contract that runs. Review is no longer a reading of fields. It becomes a question about the exchange: at what instant, in what state, is this value meant, and does anything enforce that when the real systems meet. A compiler and a simulator can help answer that. A PDF cannot, because a document was never able to be present at the moment the value crossed.
Starliner did not fail because two teams disagreed about the clock. They agreed on which clock, which value, which field. It failed because agreement on the field is not agreement on the exchange, and only the exchange flies. Make the interface something you can run, and the wrong instant fails on the ground, where a wrong instant is cheap.
