{ "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.", "soma_version": "3.2.4", "count": 15, "domains": { "aerospace": 15 }, "features": [ "agent", "cost", "fail", "guard", "http", "invariant", "lambda", "match", "multi_cell", "native", "pipeline", "service", "skeleton", "state_machine", "sum_type", "think", "tools", "try" ], "programs": [ { "id": "aerospace/autopilot_authority", "domain": "aerospace", "title": "AUTOPILOT AUTHORITY — Aeroflot 593: the half-disconnected autopilot", "summary": "AUTOPILOT AUTHORITY — Aeroflot 593: the half-disconnected autopilot On 23 March 1994, Aeroflot Flight 593 (an A310) crashed into a Siberian hillside, killing 75. The captain's children were at the controls; the boy's yoke force partially overrode the autopilot — it silently dropped the AILERON channel while the rest stayed engaged. No light, no horn. The crew flew for crucial seconds believing the autopilot had the aircraft. Nobody had authority, and nobody knew. The defect was authority as PER-AXIS FLAGS that could disagree. Here authority is ONE state. Yoke force past the breakout threshold drives the machine to override_latched — fully, loudly, all axes — and the only exit is an explicit crew acknowledgment. There is no edge from override_latched back to engaged: a fought autopilot can never silently take the aircraft back. A memory invariant caps servo torque so the actuator can never be commanded past its breakout rating.", "url": "https://soma-lang.dev/corpus/aerospace/autopilot_authority.cell", "repo_path": "examples/corpus/aerospace/autopilot_authority.cell", "lines": 108, "features": [ "state_machine", "invariant", "try" ], "cells": [ "AutopilotAuthority", "AuthorityTests" ] }, { "id": "aerospace/cabin_pressurization", "domain": "aerospace", "title": "CABIN PRESSURIZATION — Helios 522: the manual-mode takeoff, unrepresentable", "summary": "CABIN PRESSURIZATION — Helios 522: the manual-mode takeoff, unrepresentable On 14 August 2005, Helios Airways Flight 522 took off from Larnaca with the pressurization mode selector still in MANUAL — left there after an overnight maintenance leak check. The cabin never pressurized. As the 737 climbed, the cabin altitude climbed with it; the warning horn was mistaken for the takeoff-config horn; the crew lost consciousness from hypoxia, and 121 people died when the aircraft ran out of fuel. The failure was a MODE that survived a phase change: maintenance state leaked into flight state. Here those phases are one machine. The only path to airborne goes THROUGH auto_verified — the checklist step where the selector is confirmed in AUTO. From manual_maint there is no edge to airborne at all. And the cabin-altitude ledger refuses to record a hypoxic cabin: the controller's setpoint cannot leave the safe band.", "url": "https://soma-lang.dev/corpus/aerospace/cabin_pressurization.cell", "repo_path": "examples/corpus/aerospace/cabin_pressurization.cell", "lines": 106, "features": [ "state_machine", "invariant", "try" ], "cells": [ "CabinPressure", "PressurizationTests" ] }, { "id": "aerospace/cargo_door", "domain": "aerospace", "title": "CARGO DOOR — Turkish Airlines 981: \"indicated locked\" is not LOCKED", "summary": "CARGO DOOR — Turkish Airlines 981: \"indicated locked\" is not LOCKED On 3 March 1974, Turkish Airlines Flight 981 — a DC-10 climbing out of Paris — lost its aft cargo door at 11,500 feet. The latch cams had never gone over-center; a baggage handler had forced the handle and the indicator showed LOCKED anyway. The door blew, the cabin floor collapsed into the cargo hold, and the control cables running through it were severed. All 346 aboard died. Two years earlier the SAME failure over Windsor, Ontario had been survivable — and the fix was made optional. The defect: \"locked\" was an INDICATION derived from handle position, not a verified state. Here lock verification is a state you can only REACH by actually doing it — the vent-door visual check is the only edge into locked_verified, and pressurization is only reachable FROM locked_verified. A latched-but-unverified door cannot be pressurized: the edge does not exist. Differential pressure is bounded in memory.", "url": "https://soma-lang.dev/corpus/aerospace/cargo_door.cell", "repo_path": "examples/corpus/aerospace/cargo_door.cell", "lines": 116, "features": [ "state_machine", "invariant", "try" ], "cells": [ "CargoDoor", "DoorTests" ] }, { "id": "aerospace/docking_approach", "domain": "aerospace", "title": "DOCKING APPROACH — Progress / Mir 1997: abort means ABORT", "summary": "DOCKING APPROACH — Progress / Mir 1997: abort means ABORT On 25 June 1997 the uncrewed Progress M-34 freighter, under manual TORU control, came in on Mir too fast and off-axis. The crew saw it late, the braking command came late, and Progress struck the Spektr module — puncturing the station and depressurizing a wing of it. The crew survived by sealing the hatch. The lesson every rendezvous system learned: a bad approach is not \"salvaged\", it is killed, and the vehicle retreats. You re-plan from scratch. Here the approach is a state machine where ABORTED IS TERMINAL: once an abort fires, there is no edge back to any approach state — a new rendezvous is a new machine instance, with new ground review. The final-approach gate is also a memory invariant: a closing rate above the structural capture limit cannot even be recorded as commanded.", "url": "https://soma-lang.dev/corpus/aerospace/docking_approach.cell", "repo_path": "examples/corpus/aerospace/docking_approach.cell", "lines": 116, "features": [ "state_machine", "invariant", "try" ], "cells": [ "DockingApproach", "DockingTests" ] }, { "id": "aerospace/fire_bottle", "domain": "aerospace", "title": "ENGINE FIRE BOTTLE — one-shot suppression, fuel off FIRST", "summary": "ENGINE FIRE BOTTLE — one-shot suppression, fuel off FIRST An engine fire bottle is halon under pressure, and it is ONE-SHOT. Twin-engine ETOPS aircraft carry exactly two per engine; when they are gone, the crew's remaining option is to land. Two procedural truths are written in blood across decades of engine-fire accidents: 1. Pull the fire handle (cut fuel and hydraulics) BEFORE firing the bottle. Halon discharged into a fuel-fed fire is wasted — the fire relights, and now you have one bottle and a burning wing. 2. Never let the controller believe a discharged bottle can fire again. A \"suppression available\" indication backed by an empty bottle is how crews delay the diversion that would have saved them. Here both rules are the machine's shape: the bottle states are reachable only THROUGH fuel_shutoff, and bottles_exhausted is TERMINAL — soma verify proves no path refills a fired bottle.", "url": "https://soma-lang.dev/corpus/aerospace/fire_bottle.cell", "repo_path": "examples/corpus/aerospace/fire_bottle.cell", "lines": 117, "features": [ "state_machine", "invariant", "try" ], "cells": [ "FireSuppression", "BottleTests" ] }, { "id": "aerospace/fuel_crossfeed", "domain": "aerospace", "title": "FUEL CROSSFEED — Air Transat 236: never feed a leak from the good tank", "summary": "FUEL CROSSFEED — Air Transat 236: never feed a leak from the good tank On 24 August 2001, Air Transat Flight 236 (an A330 over the Atlantic) developed a fuel leak in the right engine's feed line. Following the imbalance checklist, the crew opened the crossfeed valve — and pumped the LEFT tank's fuel into the leak too. Both engines flamed out; the aircraft glided 75 miles, dead-stick, to a runway in the Azores. 306 people survived on the captain's gliding skill, not on the system. The procedure trap: crossfeed is the correct response to an imbalance and the catastrophic response to a leak — and the two look identical on the gauges unless you check totals. Here that check is structural: opening crossfeed REQUIRES a fuel-total reconciliation, a detected leak drives the machine to leak_isolated — a TERMINAL state with no edge to crossfeed_open, ever — and the tank ledger refuses negative or overfull quantities outright.", "url": "https://soma-lang.dev/corpus/aerospace/fuel_crossfeed.cell", "repo_path": "examples/corpus/aerospace/fuel_crossfeed.cell", "lines": 118, "features": [ "state_machine", "invariant", "try" ], "cells": [ "FuelCrossfeed", "CrossfeedTests" ] }, { "id": "aerospace/gear_interlock", "domain": "aerospace", "title": "LANDING GEAR — weight-on-wheels interlock, made unrepresentable", "summary": "LANDING GEAR — weight-on-wheels interlock, made unrepresentable Gear-retraction-on-the-ground is an old, recurring accident: a crew or mechanic commands \"gear up\" while the aircraft is sitting on its wheels, the squat-switch wiring is faulted or bypassed, and the airframe drops onto its belly — people under the wings die. The classic fix is a weight-on-wheels (WoW) microswitch that an interlock relay reads. The classic failure is that the switch and the gear lever are TWO separate signals that can disagree. Here ground contact and gear position are ONE state. There is no edge from ground_down to airborne_up: retraction on the ground is not a guarded command, it is a transition that does not exist. The symmetric hazard — calling a gear-up arrival a normal touchdown — is equally absent. A memory invariant keeps the hydraulic system inside its burst rating no matter what the pump controller writes.", "url": "https://soma-lang.dev/corpus/aerospace/gear_interlock.cell", "repo_path": "examples/corpus/aerospace/gear_interlock.cell", "lines": 99, "features": [ "state_machine", "invariant", "try" ], "cells": [ "GearInterlock", "GearTests" ] }, { "id": "aerospace/launch_commit", "domain": "aerospace", "title": "LAUNCH COMMIT CRITERIA — Challenger: no waiver path to ignition", "summary": "LAUNCH COMMIT CRITERIA — Challenger: no waiver path to ignition On 28 January 1986, Challenger launched at 36°F — far below the SRB O-ring qualification temperature. Engineers argued against the launch the night before; the criterion was effectively waived under schedule pressure. 73 seconds later the right SRB field joint failed and seven astronauts died. The Rogers Commission's finding was procedural: the system ALLOWED a red criterion to be argued green. Here the launch commit criteria are a ledger, and ignition is a transition whose handler refuses unless EVERY criterion reads green. There is no waiver argument to have: a red board cannot ignite because the committed state is only entered through the all-green gate, and once SRBs light, liftoff is TERMINAL — solids cannot be shut down, and the machine says so: there is no edge out.", "url": "https://soma-lang.dev/corpus/aerospace/launch_commit.cell", "repo_path": "examples/corpus/aerospace/launch_commit.cell", "lines": 127, "features": [ "state_machine", "invariant", "try" ], "cells": [ "LaunchCommit", "CommitTests" ] }, { "id": "aerospace/oxygen_tank_heater", "domain": "aerospace", "title": "CRYO TANK HEATER — Apollo 13: the thermostat that welded shut", "summary": "CRYO TANK HEATER — Apollo 13: the thermostat that welded shut Apollo 13's oxygen tank 2 exploded 200,000 miles from Earth because of a heater interlock that failed YEARS earlier, on the ground. The tank heaters had thermostatic switches rated for 28 volts; a pre-flight detanking test ran them at 65 volts. The contacts welded closed. With the cutoff fused shut, a heater cycle that should have stopped at 80°F ran the tank interior to an estimated 1000°F, baking the Teflon off the fan wiring. In flight, a routine cryo stir sparked the bare wires and the tank blew — \"Houston, we've had a problem.\" The defect was a LIMIT that lived in a relay that could fail welded. Here the limit lives in memory itself: the tank-temperature ledger refuses any write above the thermostat ceiling, so the 1000°F state is unrepresentable no matter what the heater controller commands. An overtemp ATTEMPT trips the heater machine to thermal_lockout — a terminal state that only maintenance (a new instance) escapes.", "url": "https://soma-lang.dev/corpus/aerospace/oxygen_tank_heater.cell", "repo_path": "examples/corpus/aerospace/oxygen_tank_heater.cell", "lines": 110, "features": [ "state_machine", "invariant", "try" ], "cells": [ "CryoHeater", "HeaterTests" ] }, { "id": "aerospace/parachute_sequence", "domain": "aerospace", "title": "PARACHUTE SEQUENCE — Genesis: the drogue that never fired", "summary": "PARACHUTE SEQUENCE — Genesis: the drogue that never fired On 8 September 2004 the Genesis sample-return capsule hit the Utah desert at 311 km/h. The G-switch that should have sensed deceleration and started the parachute sequence had been installed BACKWARDS — a drawing error that sailed through review. No drogue, no main, just a crater and three years of solar-wind samples shattered. (Its sister design on Stardust, wired correctly, landed perfectly.) The deeper defect: the deploy sequence lived in event timers keyed off one sensor, with nothing structural forcing the order. Here descent is a LINEAR machine — drogue, then main, then touchdown, terminal. Main deployment from entry (a chute shredded at Mach 1.4) does not exist as a transition, touchdown without chutes does not exist as a transition, and the deploy-altitude ledger refuses values outside the corridor.", "url": "https://soma-lang.dev/corpus/aerospace/parachute_sequence.cell", "repo_path": "examples/corpus/aerospace/parachute_sequence.cell", "lines": 105, "features": [ "state_machine", "invariant", "try" ], "cells": [ "ParachuteSequence", "SequenceTests" ] }, { "id": "aerospace/range_safety", "domain": "aerospace", "title": "RANGE SAFETY — the flight termination system's three one-way doors", "summary": "RANGE SAFETY — the flight termination system's three one-way doors A flight termination system (FTS) is the explosive last resort that destroys a rocket veering toward people. Its safety logic cuts both ways. In 1996 a Long March 3B went off course two seconds after liftoff and flew into a village near Xichang; an off-course vehicle that is NOT terminated kills on the ground. But the inverse hazard is just as real: a destruct system that can fire while technicians are torquing bolts on a \"safed\" pad vehicle, or that can be re-armed after a nominal flight ends, is itself the accident. Here the FTS has exactly three one-way doors. SAFED cannot terminate — the edge is absent, so no stray command, test signal, or RF hit can blow a pad vehicle. ARMED can either fire (terminated, terminal) or stand down after orbit (safed_orbital, terminal). Nothing exits the terminal states: a fired FTS is gone, a flown-out FTS can never be re-armed. The deviation ledger that justifies a destruct is bounded.", "url": "https://soma-lang.dev/corpus/aerospace/range_safety.cell", "repo_path": "examples/corpus/aerospace/range_safety.cell", "lines": 114, "features": [ "state_machine", "invariant", "try" ], "cells": [ "RangeSafety", "FtsTests" ] }, { "id": "aerospace/stage_separation", "domain": "aerospace", "title": "STAGE SEPARATION — the ascent sequence as a proven order", "summary": "STAGE SEPARATION — the ascent sequence as a proven order Launch vehicle staging has exactly one correct order: first-stage cutoff, THEN separation, THEN second-stage ignition. Every permutation is a lost vehicle. Igniting stage 2 while still bolted to stage 1 fires an engine into a full propellant tank. Separating under thrust drives the stages into each other (recontact has ended real flights). Lighting stage 2 before separation completes burns the interstage. In flight software these are timer-sequenced events that a dropped packet or a stuck sensor can reorder. Here the sequence is a LINEAR state machine: each event is reachable only from its predecessor, and orbit_insertion is terminal — soma verify proves there is no path that skips, repeats, or reverses a staging event.", "url": "https://soma-lang.dev/corpus/aerospace/stage_separation.cell", "repo_path": "examples/corpus/aerospace/stage_separation.cell", "lines": 90, "features": [ "state_machine", "invariant", "try" ], "cells": [ "StageSequencer", "SequenceTests" ] }, { "id": "aerospace/tcas_ra", "domain": "aerospace", "title": "TCAS RESOLUTION ADVISORY — Überlingen: the opposite maneuver is no state", "summary": "TCAS RESOLUTION ADVISORY — Überlingen: the opposite maneuver is no state On 1 July 2002, over Überlingen, a Tu-154 and a DHL 757 were converging at the same level. TCAS told the Tupolev crew CLIMB and the 757 crew DESCEND — a coordinated, deconflicted pair. Then the ground controller, working two stations alone, told the Tupolev to descend. The crew followed the human voice instead of the RA. Both aircraft descended into each other. 71 people died, most of them children. The rule written after that night: once a resolution advisory is active, the RA has authority — an ATC instruction in the opposite sense must not be flown. Here that rule is the machine's shape: from ra_climb the ONLY pilot response state is complying_climb. Flying a descend against a climb RA is not a violation to detect — it is a transition that does not exist. Altitude commands are bounded by the envelope ledger.", "url": "https://soma-lang.dev/corpus/aerospace/tcas_ra.cell", "repo_path": "examples/corpus/aerospace/tcas_ra.cell", "lines": 121, "features": [ "state_machine", "invariant", "try" ], "cells": [ "TcasAdvisory", "RaTests" ] }, { "id": "aerospace/thrust_reverser", "domain": "aerospace", "title": "THRUST REVERSER — Lauda Air 004: in-flight deployment, made structural", "summary": "THRUST REVERSER — Lauda Air 004: in-flight deployment, made structural On 26 May 1991, Lauda Air Flight 004 — a Boeing 767 climbing out of Bangkok — lost 223 people when the left engine's thrust reverser deployed IN FLIGHT. Reverse thrust at climb power tore the airflow off the wing; the aircraft broke up in seconds. The reverser system had interlocks, but they were plumbing and relays guarding a hydraulic valve — and a fault sequence got past them. Here flight phase and reverser position are ONE state machine. The state {in flight, reverser deployed} is not guarded against — it is not a state. Deployment is reachable only from on_ground (weight on wheels), and the only exit from reverse thrust is stowing: you cannot rotate back into the air with the buckets out either.", "url": "https://soma-lang.dev/corpus/aerospace/thrust_reverser.cell", "repo_path": "examples/corpus/aerospace/thrust_reverser.cell", "lines": 100, "features": [ "state_machine", "invariant", "try" ], "cells": [ "ThrustReverser", "ReverserTests" ] }, { "id": "aerospace/unreliable_airspeed", "domain": "aerospace", "title": "UNRELIABLE AIRSPEED — AF447: the autopilot never flies on bad data", "summary": "UNRELIABLE AIRSPEED — AF447: the autopilot never flies on bad data On 1 June 2009, Air France 447's pitot tubes iced over in a storm over the Atlantic. The three airspeed channels disagreed; the autopilot dropped out and the flight control law degraded to alternate — with stall protection gone. In the confusion of the handover the crew held the A330 in a stall from 38,000 feet to the ocean. 228 people died. Two structural properties matter, and this controller makes both machine-shaped rather than flag-shaped: 1. There is NO state with the autopilot engaged and degraded data. The instant the channels split, AP-off and alternate law arrive as ONE transition — never a half-handover. 2. Alternate law is LATCHED for the remainder of the flight (as on the real A330): when the pitots thaw and the speeds agree again, the law does NOT spring back. soma verify proves the latch — the state is terminal.", "url": "https://soma-lang.dev/corpus/aerospace/unreliable_airspeed.cell", "repo_path": "examples/corpus/aerospace/unreliable_airspeed.cell", "lines": 105, "features": [ "state_machine", "invariant", "try" ], "cells": [ "AirDataLaw", "LawTests" ] } ] }