NASA's Shuttle language survives only as a 1980 scan. I had AI rebuild it.

A developer used AI to reconstruct HAL/S, the programming language NASA wrote for Space Shuttle flight software, from a degraded 1980 scan of its specification. The project involved OCR, hand-transcription of grammar rules, and automated checks to ensure accuracy, highlighting the limits of AI when source documents are damaged.

The complete specification of the language NASA wrote the Space Shuttle's flight software in is a 20-megabyte bag of page images. No text layer. Some pages sit at an angle. That document is IR-542, and nothing supersedes it. If you want to know whether a bit-string partition is legal on the left of an assignment, the answer is a photograph of a page printed in 1980. I wanted HAL/S to run again — lexer, parser, type checker, interpreter — and I wanted AI to write essentially all of it, because the interesting question isn't whether a dead language can be revived. It's what the current generation of models can do when the source of truth has been degraded, and what a human still has to hold. This is the first of four projects that vary exactly that. HAL/S is the easy end: a formal spec exists, real preserved code exists, and an independent implementation exists to check the answers against. Best-case conditions. Worth knowing what best case buys you. Run three OCR engines, take the majority vote, move on. This works for prose and fails for grammars, for a reason that took a diagnosis pass to make explicit rather than assume. OCR errors are correlated across engines . Tesseract, Textract and the PDF's embedded Envision layer are all reading the same glyphs at the same resolution with broadly similar priors, so they tend to misread ::= the same way and | the same way. A vote between them doesn't cancel error, it launders it — three engines agreeing confidently on ::: when the page says ::= . And the deeper problem: no aggregation method can recover a candidate that no engine produced. If all three miss a character, fusion has nothing to fuse. For prose that's survivable, because context repairs it. For BNF it's fatal — the metacharacters are the content, and there is no redundancy to recover them from. So the pipeline sorted pages into tiers by how much OCR could be trusted: | Tier | Content | Trust | Disposition | |---|---|---|---| | A | Prose | High | OCR, spot-check | | B | Tables | Medium | OCR + structural verify | | C | BNF productions | Low | Hand-transcribe, verify against the scan | | D | 2D source notation | Low | Vision model, then verify | Appendix G — the working grammar, 485 productions across physical pages 295–306 — is Tier C in its entirety. It got one strong engine as the authoritative draft Textract , with Tesseract and Envision used only to flag disagreement for re-inspection. Never as voters. Then every one of the 485 productions was read by eye against a zoomed crop of the page image. That by-eye pass is the human contribution to this project, and it is not incidental. The AI ran the renders, the despeckling, the extraction, the reconciliation and the assembly. It could not manufacture a character that the scan had eaten. What it could do is design checks that make the verification mechanical rather than faith-based. Two of them carried real weight: 1..485 , no gaps, no duplicates. The numbers are the spec's own and the last one is 485, so this proves nothing was dropped or double-counted across twelve pages. <nonterminal on a right-hand side either has a defining production or is one of 22 known lexical primitives. No dangling references, no misspellings. Neither check needs a human, and between them they catch the entire class of "a page got skipped" and "a name got mangled" errors. The eyeballs were then spent only on what the checks can't see. A small, characteristic detail: a human skim of the PDF reported that some pages "have an angle," which drove an early plan to deskew before OCR. Measuring it found skew under 0.3°, so the deskew step was dropped. The estimate was replaced by a number, and the number deleted a stage of the pipeline. Residual ambiguities went into DIVERGENCES.md https://github.com/singular-state/space-shuttle-sdk/blob/main/DIVERGENCES.md rather than getting guessed inline. One was a scaling glyph the scan left uncertain, later resolved to @ against the spec's own prose describing it. Another, production 348, is logged as an inference from physical scan damage and marked as such. Guessing silently would have been faster and would have made every downstream claim worthless. With a verified grammar, building the thing is ordinary compiler work, and the AI was very good at it. The result is in plain Rust with no cargo and no third-party crates — the crates link in dependency order through a two-stage rustc build in build.sh https://github.com/singular-state/space-shuttle-sdk/blob/main/build.sh . There is nothing to install. $ ./build.sh cli $ ./build/hals crates/hals-syntax/tests/corpus/realworld/HELLO.hal THE BEGINNING 1 HELLO, WORLD 2 RON BURKEY SAYS ISN'T THIS FUN? The north star was real preserved source, not samples anyone wrote for the occasion: twelve byte-for-byte Shuttle-era programs from the Virtual AGC https://www.ibiblio.org/apollo/ project. All twelve now run. MATVECS3 puts 22 vector and matrix operations through 400 iterations and prints TEST SUCCESSFUL . DATATYPES reproduces every value its own comments say it should. TEST7 links against a separately compiled COMPOOL and exercises true NAME pointers. Arithmetic is where fidelity stops being a slogan. SINGLE precision on the Shuttle's general-purpose computer is IBM System/360 short hexadecimal floating point: it truncates toward zero rather than rounding to nearest, and its precision wobbles between 21 and 24 bits depending on the value. IEEE f32 would have been easier and would have produced different numbers. Authentic is the default; --modern gives you f64 when you want to use HAL/S as a live language rather than as a museum exhibit. You can flip between them in the browser playground and watch the digits move. Passing your own tests means your implementation agrees with your understanding, which is the thing under suspicion. So every program is also run through Ron Burkey's yaHAL-S , an independent HAL/S interpreter, and compared value-for-value by tools/oracle diff.py https://github.com/singular-state/space-shuttle-sdk/blob/main/tools/oracle diff.py . Every program the oracle can run, we match exactly — including all 339 numbers DATATYPES emits. The four it can't run, ours handles. This is the Backup Flight System principle applied to a reconstruction: a bug in one implementation shouldn't be shared by the other. It is also the reason this project is the easy arm of the series. An independent oracle is a luxury. Two of the other three don't have one, and the fourth has one deliberately sealed in an envelope. The corpus is closed, and so is the scope. FIXED-point scaling, true mid-statement preemption in the real-time executive, the latched/unlatched event distinction, and full 56-bit hex DOUBLE are all unimplemented, each logged with its reasoning. Not because they're hard — because no preserved program exercises them, so there would be nothing to check the implementation against. Building unverifiable behaviour is the specific failure this project was structured to avoid. It is also the thing an eager model will happily do for you at any hour, which is why the constraint has to live in the repo rather than in your intentions. The payoff for all that discipline is Fly the Shuttle https://github.com/singular-state/space-shuttle-sdk/tree/main/crates/hals-wasm/web : the same interpreter compiled to WebAssembly, driving a landing simulator whose flight law is editable HAL/S. The hardcore vehicle writes the approach as actual flight software — a guidance TASK that the real-time executive runs each cycle over VECTOR state, terminated by a TOUCHDOWN event. You can crash it by editing the autopilot, which is the correct relationship to have with a language like this. Give a current model a formal spec, real code to test against, and an independent implementation to check answers with, and it will produce a faithful reconstruction of a dead language. That's the result, and it's a genuinely strong one. The load-bearing human contributions were smaller than expected and not where I expected. Not architecture, not algorithms, not debugging the type checker. They were: deciding not to vote between correlated OCR engines , and reading 485 grammar productions against page images by eye . One judgement call and one irreducible act of looking. The first is the kind of mistake that produces a clean-looking artifact with silent errors baked in, which is the worst failure shape available. The second is bounded by information theory rather than by model capability — no future model recovers a character the scan destroyed. Better OCR narrows that gap. It never closes it. Next in the series: the same question with the spec removed entirely. The source of truth is a novel, there is no oracle, so the project had to build one — and then discovered that Verne's submarine implodes at roughly 340 metres. Code: https://github.com/singular-state/space-shuttle-sdk https://github.com/singular-state/space-shuttle-sdk . The HAL/S corpus and IR-542 are NASA-derived public domain, preserved by the Virtual AGC project, which also supplies the yaHAL-S oracle. Transcription working artifacts — page renders, crops, per-engine output, per-page verified fragments — are committed under transcription/ so the grammar can be audited against the scan rather than taken on trust.