Building Functional Systems from Cloud to Orbit.
OCaml is a pragmatic functional language. You can do very advanced things with its type system (like an entire roguelike ), and you can also hide the traditional buffer management techniques of C behind a nice abstract interface. One of those techniques stopped being safe when OCaml became multicore; I've hit it in ocaml-wire last week. ocaml-wire is the codec layer of Parsimoni 's space protocol…
As discussed in a previous post , I have been working for a while on running Tailwind CSS without a Node.js dependency. That meant porting its CSS generation to OCaml and checking the output against the JavaScript original, byte for byte. Comparing bytes is trivial; explaining a mismatch needed a parser. The parser needed a typed representation of CSS rather than a bag of strings. Once CSS is…
On 23 April, our pure-OCaml CCSDS protocol stack booted up in low Earth orbit! The project, codename Borealis , is running inside DPhi Space 's ClusterGate-2 payload module on the host satellite, with end-to-end-encrypted command and control and post-quantum key rotation, all implemented in safe OCaml. Why does OCaml matter here? Untrusted code running on a satellite is a huge security risk , and…
On 15 April, the Cambridge Ring , the alumni society of the University of Cambridge Computer Laboratory, named our paper "Functional Networking for Millions of Docker Desktops" its Publication of the Year . I wrote the paper with my Cambridge colleagues Anil Madhavapeddy , Dave Scott , Patrick Ferris , and Ryan Gibb . It describes how we rebuilt Docker Desktop's networking and storage stack: a…
Tailwind CSS introduced a clever way to manage the HTML/CSS split: encode CSS properties as class names. This solves a recurrent friction in large codebases: keeping HTML and CSS in sync. Tailwind's build scans the source and generates exactly the classes needed to style it. You can (mostly) copy-paste an HTML snippet anywhere and its stylesheet follows. As in other domains, referential…
A satellite link is a radio signal between a ground station and a spacecraft moving at 7.5 km/s, visible for 10 minutes at a time, over a channel measured in kilobits per second. If you have used TCP/IP, the protocol structure will look familiar: there is a transport layer that handles reliability, a network layer that handles addressing, and an application layer where the actual data lives. The…
In January 2026, two things happened that changed how satellite operators think about collision risk. The Office of Space Commerce published the TraCSS verification dataset : open test data, with an answer key, for anyone who wants to build software that predicts whether two satellites will collide. A few days later, SpaceX unveiled Stargaze , a free collision-screening service powered by 30,000…
I have rewritten my website in OCaml more times than I can count (from ocaml-cow to Canopy to custom MirageOS unikernels ). This time, the styling was the problem: I use Tailwind CSS , and I wanted the entire pipeline (Markdown to styled HTML to CSS) to be a single dune build with no Node.js dependency. That meant porting Tailwind's CSS generation to OCaml. To make sure the port was correct, I…
Satellites are becoming software platforms . More software means more bugs, and bugs 400 km overhead are not easy to fix. Binary parsers written in C are a recurring weak spot: the KA-SAT attack bricked thousands of satellite modems by exploiting the management interface, and researchers have since demonstrated RF signal injection against VSAT terminal firmware by crafting inputs that exploit…
Four years ago, Thales Alenia Space invited me into their integration hall in Cannes. I was there to sketch ideas about running the unikernel software we had been building at Cambridge on satellites. Euclid was in the corner of the room, being prepared for its vacuum chamber test. That kind of early trust meant a lot -- a small team with a whiteboard, in the same building as a spacecraft about to…
Back in 2012, Anil Madhavapeddy and I were building MirageOS as a library OS, and we started to accumulate a lot of libraries to manage manually. So I wrote opam to handle the dependencies and the mirage tool, an embedded DSL to describe device trees and auto-generate the build and wiring code. Gabriel Radanne later refined and formalised it as Functoria, which made the correspondence between…
The same conversation keeps happening. I explain what Parsimoni does (run third-party software on someone else's satellite) and the response is always some variant of: "I would never trust code I have not reviewed to run on my satellite." They are right to worry -- I would say the same thing in their position. And the security research community has been saying it loudly for several years now. To…
Our 2013 ASPLOS paper, " Unikernels: Library Operating Systems for the Cloud ", received a test-of-time award in March 2025. The title says "for the Cloud." We wrote it while I was in Jon Crowcroft 's group at the University of Cambridge. The core idea: instead of running an application on a general-purpose OS, compile the application and only the OS libraries it needs into a single sealed image…
Last week I attended the F Prime workshop at JPL , over 100 people, from CubeSat student teams to flagship mission engineers. I learned a lot about F Prime, and I kept noticing how familiar the concepts felt. This post is some of my thoughts on why. F Prime ( GitHub ) is NASA's open-source framework for building reusable flight software. Before it, most missions started from scratch or copy-pasted…
Hello world, finally this is live :-) The last couple of weeks have been pretty intense as I've been moving to LA with my family. I am spending six months here, working on Parsimoni and getting closer to the US space industry. Last week I visited NASA's Jet Propulsion Laboratory (JPL) and saw Voyager 2's control room -- still running after 48 years. Optimism , Perseverance's ground twin, was…