The Heavy Lift Part 2C: Gimbals & Glass

We do not know what cameras fly on a Falcon or Starship booster; that information is not public, and this series does not pretend otherwise. This is the third of three articles. The first assessed two commercial cameras against the launch environment by the numbers; the second set out what NASA actually flew, from the documented record. This one covers the remaining engineering: how a camera is held still on a moving vehicle, what radiation does to an image sensor, and a case study in doing such work properly, the Space Shuttle windshield, from NASA's own 1972 design report.

Everything asserted here about flown hardware comes from published engineering reports and the cited literature; where I am reasoning rather than citing, I say so in the sentence. And as with the whole series, the subject is the mathematics. Where there is a formula, you will get the formula, set properly, with every symbol defined.

---

PART I. GIMBALS, WHICH ARE ENTIRELY MATHEMATICS

A gimbal looks like a mechanical device. It is not. It is a real-time solution to a problem in rotational kinematics, and the motors are merely how the answer is expressed.

1.1 The problem statement

Three frames of reference. The Earth frame is inertial. The base frame is whatever the gimbal is bolted to, and it does as it likes. The camera frame must be held still with respect to the Earth frame while the base frame misbehaves. A gimbal is a machine for holding one coordinate transformation constant.

1.2 Rotation, in matrices

Any orientation in three dimensions can be built from three elemental rotations.

Composed:

Note carefully what that second line says. Matrix multiplication does not commute, and neither do rotations. Yaw-then-pitch-then-roll is a different orientation from roll-then-pitch-then-yaw. The order is part of the specification, and two engineers using different conventions will disagree about a result while both are certain they are right.

1.3 Gimbal lock, which is a failure of the mathematics before it is a failure of the machine

Tilt to ninety degrees and two of the three rotation axes become parallel. The system has not lost a physical degree of freedom in the general case; it has lost the ability to describe one, because the parameterisation has become degenerate. In the rate equations a cosine goes to zero in a denominator, and the commanded rate goes to infinity.

The consequence in hardware is a motor that vibrates violently or freezes. The cause is a division by zero in a coordinate system chosen for human convenience.

This is not an obscure failure. Apollo 11's inertial platform had a mechanical version of exactly this problem, with a documented set of forbidden attitudes, and Michael Collins famously suggested over the loop that they be sent a fourth gimbal for Christmas.

1.4 Quaternions, which fix it

William Rowan Hamilton spent years trying to extend complex numbers to three dimensions and failing. On 16 October 1843, walking along the Royal Canal in Dublin, he understood that the answer required a fourth dimension, and he carved the multiplication rule into the stone of Broome Bridge with a penknife. He believed he had discovered the mathematics of physical space; it took over a century, and the arrival of computer graphics, robotics and spacecraft attitude control, for the world to agree.

Four numbers instead of nine. No singularities anywhere on the sphere. Cheaper to compose than a matrix, and trivially interpolable, which is why every serious attitude solution (spacecraft, aircraft, game engine, camera gimbal) runs quaternions internally and converts to Euler angles only to show a human a number.

1.5 Measuring the motion

You cannot correct what you cannot measure.

A MEMS gyroscope contains a silicon proof mass driven into resonant oscillation at tens of kilohertz. When the chip rotates, the Coriolis force deflects that oscillating mass perpendicular to its motion, and the deflection is read as a change in capacitance between interleaved comb fingers etched into the silicon. The measured capacitance change is proportional to angular rate. It is a tuning fork, machined at micron scale, that reports rotation as electricity.

The accelerometer works on a related principle: a proof mass on silicon springs, its displacement under acceleration read capacitively. At rest it measures the gravity vector, which gives an absolute reference for which way is down.

Each sensor has a characteristic failure:

The gyroscope is fast and precise in the short term but its bias integrates, so its estimate of angle walks away linearly with time and its random noise walks away as the square root of time. The accelerometer is absolute in the long term but useless in the short term, because it cannot distinguish gravity from any other acceleration; shake it and it reports that down has moved.

1.6 Fusing them

The classical cheap answer, and an honest one:

High-pass the gyroscope, low-pass the accelerometer, and cross them over at a time constant chosen so that each sensor is trusted only in the band where it is good. Two lines of code, and it works.

The rigorous answer is optimal in a defined sense:

Rudolf Kálmán published this in 1960. NASA Ames picked it up almost immediately, and by 1969 it was running inside the Apollo Guidance Computer, on a machine with roughly 2 kilowords of erasable memory, navigating to the Moon. The filter maintains not just an estimate but an estimate of its own uncertainty, and it weights each new measurement by how much that measurement deserves to be believed. That last clause is the entire idea.

1.7 Acting on it

Three terms: the present error, the accumulated past error, and the rate at which the error is changing, which is a prediction of the future. Proportional gain sets stiffness; too little and the mount feels loose and lags, too much and it oscillates audibly. Integral gain defeats a persistent force such as wind on a long lens; tuned wrong it produces a slow horizon drift. Derivative gain damps; unfiltered it amplifies sensor noise into a scream.

In practice the loop is discrete:

One to four kilohertz is typical, so the controller has a few hundred microseconds to sense, decide and act. Every practical difficulty in control engineering lives in the translation from the continuous equation to the sampled one: integral windup must be clamped, the derivative term must be filtered, and the loop rate must be far above the mechanical bandwidth or the loop is ineffective.

1.8 Driving the motors

Field-oriented control resolves the three stator currents of a brushless motor into two components in a frame that rotates with the rotor: one aligned with the magnetic flux, one perpendicular to it. Hold the flux-aligned component at zero and the perpendicular component becomes a direct, linear handle on torque:

Robert Park published the transform in 1929, for the analysis of synchronous machines in power systems. It now runs, silently, inside a camera mount a person can carry in one hand.

1.9 Why balance is not optional

Moment of inertia depends on mass times the square of its distance from the axis. A long lens and a short lens of identical mass present entirely different loads, and the long one is far harder to control. This is why gimbal payload specifications that quote only a mass figure are incomplete.

If the centre of mass sits even a millimetre off the pivot, gravity applies a restoring torque that varies with the sine of the tilt angle. You have built a pendulum, and the motors must now oppose it continuously, even standing perfectly still. The current does not go into motion; it goes into heat, in the stator, permanently. That is how motors are destroyed by poor balancing, and it is why the balance procedure is performed with the power off.

1.10 What a gimbal cannot do

Three axes of rotation are stabilised. Three axes of translation are not, and cannot be, because no amount of rotation corrects a displacement. The vertical bounce of a walking operator is not a gimbal failure; it lies entirely outside the gimbal's mathematics. The mechanical answer is a spring arm; the human answer is the bent-knee, heel-to-toe gait that camera operators have used since long before motors were involved.

---

PART II. THE OTHER WAYS TO HOLD A CAMERA STILL

Gimbals are one answer among several, and the others are worth setting out because they occupy different parts of the frequency spectrum.

2.1 Optical image stabilisation

A lens group is suspended on actuators and moved laterally, perpendicular to the optical axis, to steer the image back onto the sensor. The correction happens in the light path, before the sensor, so the recorded frame is genuinely stabilised rather than reconstructed. It corrects small angular disturbances only, and it corrects them within the lens that contains it.

2.2 In-body image stabilisation

The Nikon Z 9, one of the two candidates assessed in the first article of this series, uses five-axis sensor-shift stabilisation. The sensor assembly floats on actuators and is translated (and rotated, for roll) to follow the image.

The required sensor displacement is focal length times the angular disturbance. Note what that means: at long focal lengths the required travel grows linearly, and available travel is a few millimetres at best. Sensor-shift stabilisation therefore works superbly on a wide lens and runs out of physical room on a long one. It is trading a millimetre of travel against an arc-minute of shake.

For our application there is a sting in this. A stabilisation stage is, by construction, a heavy component mounted compliantly. Under launch vibration it is a resonant mass inside the instrument, and it would have to be locked out.

2.3 Electronic image stabilisation

The frame is captured larger than it is delivered, and the delivered crop window is shifted frame by frame to counteract measured motion. It costs field of view and it costs resolution, and it cannot recover information the blur destroyed. What it can do, uniquely, is correct in software after the fact using recorded motion data, which makes it the only stabilisation method available to a camera that has already flown.

2.4 Mechanical supports

Tripods and monopods provide a fixed or single-point ground reference. Sliders and dollies constrain motion to a defined path, which is a different idea entirely: not the removal of motion but the specification of it. A fluid head damps the operator's input by viscous drag, which is a purely mechanical low-pass filter and needs no power at all.

2.5 Body mechanics

Three points of contact: both hands on the camera and the camera braced against the face, or a neck strap pulled taut so the camera is held in tension rather than balanced in space. Elbows locked to the ribs, so the arms become structure rather than linkage. Breathing paused at the moment of exposure, since respiration is a low-frequency oscillation of the entire torso. And the rolling heel-to-toe gait with bent knees, which turns the leg into a compliant suspension.

None of this is quaint. Every item on that list is an application of the same principle the isolation mount applies, using the only hardware the operator brought.

2.6 Vibration isolation, which is where this connects back to the rocket

This is the mathematics that governs mounting anything to anything.

Read that second plate carefully, because it contains the most counter-intuitive result in the whole field. Transmissibility is below one, meaning the mount actually attenuates, only when the forcing frequency exceeds the natural frequency by a factor of at least the square root of two. Below that, the mount transmits everything. At resonance, with light damping, it amplifies, sometimes enormously.

An isolator installed without knowing the excitation spectrum is not a safety measure. It is a gamble, and a badly chosen one turns a mount into an amplifier tuned to the exact frequency you were trying to escape. This is precisely why launch vehicle payloads are analysed against a specified random vibration spectrum before anyone selects a mount, and it is the single most common way that well-intentioned vibration fixes make things worse.

The Space Shuttle windshield used this principle in a form the report describes plainly: the panes were floated in their frames on compliant seals, with centering springs to maintain position and a cantilever leaf spring in series to maintain contact. The glass was never rigidly clamped, because a rigid clamp would have transmitted both vibration and thermal distortion straight into a brittle material.

---

PART III. RADIATION, AND WHAT IT DOES TO A SENSOR

3.1 The environment

In low Earth orbit a sensor is exposed to galactic cosmic rays, solar energetic particles, and protons and electrons trapped in the Van Allen belts. Exposure is not uniform around an orbit; it peaks sharply in the South Atlantic Anomaly, where the inner belt dips closest to the Earth's surface because the geomagnetic field is offset and tilted with respect to the planet's rotation axis.

3.2 Three distinct damage mechanisms

They are frequently conflated. They should not be.

Total ionising dose is cumulative. Ionising radiation liberates charge in the silicon dioxide insulating layers of the device, and some of that charge becomes trapped, shifting transistor threshold voltages and increasing leakage.

The visible symptom in an image sensor is a slowly rising dark current and a growing population of hot pixels. Radiation rarely kills a sensor outright; it ages it.

Displacement damage is structural. A sufficiently energetic particle knocks a silicon atom clean out of its lattice site, leaving a vacancy and an interstitial. These defects create energy states within the band gap that act as generation centres, producing dark current, and as trapping centres, degrading charge transfer efficiency. In a CCD this last effect is particularly damaging, because a CCD moves charge physically across the chip to read it out, and every trap it passes takes a small toll.

Single-event effects are instantaneous. One ion through one sensitive volume deposits enough charge to flip a bit or produce a bright transient in a single pixel.

On a long exposure, a cosmic ray hit is indistinguishable from a star, which is a recurring and entirely real problem in astronomical imaging.

3.3 Shielding, and why more metal is not the answer

Attenuation is exponential, which means there is no finite thickness that reaches zero. There are only thicknesses you can afford to lift.

Worse, for charged particles there is an active penalty for using heavy shielding alone:

An energetic electron decelerating in matter radiates. The yield scales as the square of the atomic number of the absorber, so stopping electrons in a high-Z material such as tantalum generates roughly thirty times the secondary X-ray flux that aluminium would.

The answer is the graded-Z stack: a high-Z outer layer to stop and scatter the primary particles, backed by a low-Z inner layer to absorb the secondary bremsstrahlung the outer layer just created. Order matters as much as material, and getting it backwards makes the shield a source.

Hydrogen-rich polymers are unusually effective per unit mass against protons and neutrons, because energy transfer in an elastic collision is most efficient between particles of similar mass, and a hydrogen nucleus is a single proton. This is why polyethylene appears in shielding studies far more often than intuition would suggest.

3.4 A note on fabrication

There is a well-documented effect in which borophosphosilicate glass, historically used as an insulating layer in commercial integrated circuits, becomes a liability in a radiation environment. It contains boron, and the boron-10 isotope has a very large cross-section for thermal neutron capture, after which it fissions into an alpha particle and a lithium nucleus, both of which deposit charge locally. Radiation-tolerant fabrication processes eliminate it.

That effect is real and documented in the semiconductor literature. Whether any specific flown camera sensor was built to that rule is not something I can source, and I am not going to assert it. Treat it as an explanation of the general engineering problem, not as a claim about a particular part.

---

PART IV. THE WINDOW: A CASE STUDY IN GETTING IT RIGHT

Now we come to the best-documented part of this entire subject, and the reason it is best documented is that somebody wrote it down properly in 1972 and the US Government published it.

The source is NASA CR-112234, Space Shuttle Orbiter Windshield System Design and Test, by K. Hayashida and M. J. Suppanz of North American Rockwell's Space Division, dated November 1972, prepared for NASA Langley Research Center under contract NAS1-10957. It is a work of the US Government and public use is permitted.

Everything in this section comes from that document. Where a number appears here, it appears there, on a page I can point to.

4.1 The architecture

Three panes, and the middle one is the interesting decision.

• Outer pane: fused silica, Corning code 7940, nominal 1.0 inch thick, 32 by 25 inches. It is a heat shield, not a pressure pane.
• Middle pane: fused silica. Dual redundancy; it backs up both the outer pane and the inner pane.
• Inner pane: heat-tempered aluminosilicate, Corning code 1723, 0.90 by 16.5 by 23.0 inches. This is the pressure pane; it holds the cabin in.

The report considered a four-pane design (best reliability, worst mass) and a two-pane design, and rejected both. The two-pane argument is genuinely elegant and we will come back to it.

4.2 Temperatures, as designed

• Outer pane design temperature at entry: 1270 F at 1.0 inch nominal thickness; 1600 F at radiation equilibrium.
• Fused silica design allowable: 1800 F maximum.
• Middle pane, centre of pane: reaches 570 F.
• Inner surface of the inner pane: 240 F at overshoot touchdown with 0.90 inch panes.

That last figure is why the panes are 0.90 inch and not 0.50 inch. At half an inch the glass is structurally adequate; the report says so explicitly. But at half an inch the middle pane reaches 690 F, which exceeds what the elastomeric seals can survive, and the inner surface reaches 480 F against a limit of 300 F set by the proximity of the pilot's face.

So the glass was made thicker than strength required, and the extra mass was used deliberately as a heat sink. The cost was about 120 pounds. The report judged that not excessive in exchange for a fully passive window system with no active cooling to fail.

That reasoning deserves note: the optimal-mass solution was rejected because optimising the component would have de-optimised the system.

4.3 Why fused silica outside

Thermal stress scales with the coefficient of thermal expansion. Fused silica has an exceptionally low one, around 0.55 x 10^-6 per kelvin, which is why the outer surface can reach 1270 F while the inner surface stays comparatively cool and the pane does not tear itself apart.

Note the final line of that plate, because it is counter-intuitive and the report states it directly: thermal stress is to a degree independent of thickness. Making the pane thicker to satisfy a pressure requirement increases the temperature differential through it, and can therefore increase the thermal stress. Adding glass does not always help. Sometimes it hurts.

4.4 Why heat-tempered aluminosilicate inside, and a correction

The report evaluated four candidates for the pressure pane: heat-tempered aluminosilicate, heat-tempered borosilicate, heat-tempered soda-lime, and chemically tempered glass.

• Borosilicate: eliminated for poor optical quality.
• Soda-lime: aluminosilicate has roughly half the coefficient of thermal expansion, and therefore develops about half the thermal stress for the same gradient. Worth the added cost outright when the consequence of failure is what it is here.
• Chemically tempered glass: rejected. Two reasons, both cited. Kerper and Scuderi report maximum long-term usage without loss of strength at about 300 F, which is far too low. And the compression layer produced by chemical tempering is only 0.015 to 0.030 inch deep, against approximately one sixth of the glass thickness for heat tempering. The deeper layer makes heat-tempered glass markedly less sensitive to handling scratches, which over a 100-mission design life is decisive.

This overturns a claim that circulates widely. Secondary accounts frequently describe the Shuttle's inner pane as chemically strengthened by ion exchange in a molten potassium salt bath. The primary document says the opposite: chemical tempering was evaluated and specifically rejected, and the pane that flew was heat-tempered. The ion-exchange story is a real process; it is simply not what happened here.

4.5 The structural mathematics

Stress falls as the square of thickness. That is the governing relation for the pressure pane.

Allowable stresses from the report:

• Tempered aluminosilicate: 16,900 psi
• Annealed fused silica: 4,000 psi

Design pressures: 12 psi for the outer window; 25.8 psi for the inner and middle. Maximum limit differential on the inner pane: 17.2 psi, which arises from an assumed regulator malfunction leaving the cabin at relief-valve pressure while the inter-pane cavity has slowly vented to space.

And now the number that matters most, because it is the one most often reported wrongly:

The factor of safety was 1.5. Not 4. The report states it plainly and then, more impressively, explains why a larger factor was rejected: it would have added little except weight, and on the outer pane the added thickness would have increased the temperature differential and therefore increased the thermal stress. A bigger safety factor would have made that pane less safe.

The ultimate pressure test bears the number out directly: the assembled window was taken to 26.0 psig at 570 F, which is one and a half times the assumed relief-valve setting of 17.2 psig.

4.6 Fracture mechanics, and the fourth-power argument

Glass does not yield. It fractures, from a flaw, in tension. The report works the problem explicitly:

Substituting the section modulus of a rectangular plate into the stress intensity expression produces a striking result: allowable flaw depth varies as the fourth power of thickness. Double the thickness and the pane tolerates a flaw sixteen times deeper before it fails.

Which raises the two-pane question the report actually asked. If you take the mass of two redundant panes and put it into one pane of double thickness, that single pane tolerates a sixteen-times-deeper flaw. So: is a flaw of depth h more likely to occur simultaneously in two panes, than a flaw of depth 16h is to occur in one?

To answer it they surveyed the Apollo programme's material review dispositions for scratched windows: 473 scratches recorded, of which only 2 were significant at a threshold of 0.001 inch total flaw depth. The sample was too sparse to settle the question. Lacking firm logic to depart from customary practice, the two-pane concept was abandoned and three panes stayed.

That passage is instructive: a sharp question asked, data gathered, the data judged insufficient, the insufficiency stated, and the conservative choice made on the record.

4.7 Static fatigue: why glass fails on a schedule

Glass under sustained tension in the presence of water undergoes subcritical crack growth. Water molecules reach the crack tip and hydrolyse the silicon-oxygen bonds there, so the crack advances slowly at stress intensities well below the critical value. The glass is failing on a clock, and the clock is chemical.

This explains a detail in the acceptance testing that would otherwise look arbitrary. Modulus-of-rupture specimens were cut from the same boule, in the same process, as each outer pane. They were then broken in liquid nitrogen, and acceptance required each specimen to exceed 7,020 psi.

Why liquid nitrogen? Because it removes the water and suppresses the stress-corrosion mechanism entirely, so you measure the intrinsic strength rather than a strength contaminated by the test environment. And 7,020 psi was the current estimate of the liquid-nitrogen strength required to guarantee a working strength of 3,300 psi in water for 100 hours, 3,300 psi being the highest stress in the outer pane during entry.

The three specimens returned 13,750, 9,650 and 10,650 psi. All passed comfortably.

The edges were then etched with hydrofluoric acid, which dissolves the surface layer and with it the invisible micro-flaws left by grinding, because on a plate in bending the edges are where the tension is highest and the flaws are worst.

4.8 The seals, sized by four lines of arithmetic

The inner and middle panes are sealed by fluorocarbon (Viton) O-rings, 0.275 inch diameter, with a second 0.139 inch ring providing redundancy along any potential leak path.

• Allowable compression: 30 percent of undeflected diameter, so 0.0825 inch.
• Elastic recovery at 400 F: about 80 percent of that, so 0.066 inch.
• Required return: 0.052 inch of tolerance return plus 0.005 inch of minimum squeeze, so 0.057 inch.
• Margin: 0.009 inch.

Nine thousandths of an inch. That is the margin between the seal following the glass as it moves and the seal losing contact with it. Viton was chosen over silicone after comparative testing, with an elastic recovery range from about -10 F to +400 F against a predicted Shuttle low temperature of +30 F.

The outer seal is an entirely different animal, because at 1270 F no elastomer exists. It is a tadpole seal: a woven ceramic cloth jacket over an Inconel wire mesh core, rated for use at 2000 F, and it is deliberately not hermetic. Its job is to impede the inflow of hot plasma, not to hold pressure.

The reason for the woven jacket is a genuinely fine piece of failure analysis. Earlier candidate seals bonded to the glass, deposited metal on it, and spalled it. The hypothesis was that although average contact pressure was low, irregularities between two unyielding surfaces produced local pressures in the thousands of psi. A woven jacket is made of threads, and each thread of hundreds of fine drawn fibres, so it conforms and distributes the load. Testing confirmed it, and both woven-metal and woven-ceramic jackets solved the problem.

Because that seal barely springs back at temperature, a René 41 cantilever leaf spring was placed in series with it to restore 0.050 inch of travel. The report's own survey of spring materials found that about 1400 F is the upper limit at which useful elastic springback can be achieved with production materials at all, which is the real temperature ceiling on the whole exposed-window concept.

4.9 The optics of looking through it

A ray entering a plane parallel plate at an angle emerges parallel to its original direction but laterally displaced. Three panes means three displacements in series, and since the displacement depends on the angle of incidence, it varies across the field. A camera shooting through the windshield therefore records a known, systematic, and above all correctable geometric error.

Reflection is the larger practical problem. Each air-to-glass boundary reflects about 3.5 percent at normal incidence, and a three-pane window has six such boundaries. Compounded, roughly nineteen percent of the light never gets through, and every percent of it is bouncing around inside the assembly as a ghost or a veiling flare.

The report set a floor of 70 percent minimum light transmittance per window to assure adequate crew vision. That requirement was set against exactly these losses.

The classical fix is a quarter-wave antireflection coating whose index is the geometric mean of the two media it separates. For an air-to-fused-silica boundary that ideal index is about 1.21, and no durable solid material has an index that low; magnesium fluoride at 1.38 is the usual compromise, which is why single-layer coatings never quite reach zero and why multilayer stacks exist.

On coatings, the report's conclusion runs contrary to the popular account. Hayashida and Suppanz concluded that no firm requirement for glass coatings had been identified, that reflectivity problems can be seriously increased by coatings in multi-pane windows, and, most pointedly, that infrared and ultraviolet coatings would seriously degrade the capacity of fused silica to withstand high temperatures. Their recommendation was that maximum effort be spent meeting the optical transmission requirements without coatings at all.

That is the opposite of the story usually told about spacecraft windows, and it comes from the people who designed them.

The transmission limits they did specify, based on Apollo and Skylab practice: ultraviolet transmittance below 0.1 percent in the 180 to 290 nanometre band, with a design goal of 0.01 percent; infrared transmittance below 10 percent beyond 800 nanometres, with a goal of 1 percent. Both to be achieved without reducing the pilot's visibility.

4.10 Correcting the residual

Whatever geometric error the optical path leaves behind, whether from the lens or from the window, is characterised by photographing a target of precisely known geometry and solving for the coefficients. Radial terms capture barrel and pincushion; tangential terms capture the decentering that arises when elements are not perfectly coaxial.

Measure the lie once, then subtract it from every frame forever. That is photogrammetry's entire bargain, and it is why a photograph taken through a thick, imperfect, triple-glazed window can still be a metric instrument.

4.11 What the tests actually showed

The inner window article was tested in three parts:

1. 100 thermal entry cycles at 270 F and 14.7 psig, simulating the inner pane.
2. 100 thermal entry cycles at 570 F and 14.7 psig, simulating the middle pane.
3. One ultimate pressure cycle at 26.0 psig at 570 F.

Seal leakage, against an allowable of 0.1 standard cubic inch per minute per linear foot of seal:

Every reading comfortably inside the allowable, and no contamination of the glass by the seal. The outer window article completed 120 entry cycles, equivalent to 100 entry cycles plus enough fatigue to account for 100 boost cycles.

One thing failed. A small bumper strip, mounted on the heat shield window frame to prevent glass abrasion in the event of contact under thermal distortion, debonded. That was the entire defect list for the programme.

The stated conclusions: exposed outer windows without shades are feasible; available materials and methods suffice; the temperature limits are about 1400 F for the outer seal, 1300 F for the outer pane, and 400 F for the elastomeric hermetic seal; each pane requires inspection for meteoroid damage between missions; and no special provision is needed against bird strike, rain erosion or hail.

Those two probabilities, for the record: bird impact 0.00058, and probability of no windshield failure from meteoroid damage 0.9991, the latter conditional on a post-mission inspection and replacement procedure.

---

PART V. WHAT IT ALL COMES TO

Set the pieces of this series side by side and a single argument runs through them.

The first article's guess was a Nikon and a Panasonic. The second article's record shows a Nikon, and the reason the guess landed is not luck; it is that the constraint driving the decision is mass, and mass is visible from the outside.

The deeper lesson is the IMAX camera in the payload bay, from the second article. NASA did not qualify a cinema camera for space. It built an enclosure with heaters, insulation and a controlled internal environment, qualified that, and put an ordinary camera inside it. Everything required to fly a cinema camera on a booster was already done, in the 1980s, by people who reached the same conclusion from the same equations.

The window report makes the same point from the other end. That team chose glass 80 percent thicker than strength required, in order to use it as a heat sink. They chose a safety factor of 1.5 and could explain why a bigger one would be worse. They asked whether one thick pane beat two thin ones, went and counted 473 Apollo scratches to find out, and when the data would not answer, said so and stayed conservative. Then they held a cabin's atmosphere on nine thousandths of an inch of seal recovery margin, and tested it a hundred times to prove it.

None of that is about cameras. It is about the discipline of putting a number on the thing, and signing your name under it.

We still do not know what is bolted to those boosters. But we know exactly what questions the people who bolted it there had to answer, because the questions have not changed since 1972, and neither has the mathematics.

---

DISCLAIMERS

1. Nothing here describes any current launch vehicle's camera systems. No claim is made, implied or intended about the cameras aboard any SpaceX vehicle. That information is not public. This article is history and physics.
2. Where a source could not be verified, I have said so in the text rather than repeating it. One claim is flagged as unverified in this article: fabrication-process choices for flown image sensors.
3. Two widely repeated claims are corrected here against the primary source, namely the Shuttle windshield's factor of safety (1.5, not 4.0) and the tempering method of the inner pane (heat-tempered, not chemically tempered). Both corrections are supported by NASA CR-112234 at the pages cited.
4. This article is not engineering advice and must not be used as a basis for design.

---

---

FAIR USE NOTICE: Under Section 107 of the Copyright Act of 1976, allowance is made for fair use for purposes such as criticism, comment, news reporting, teaching, scholarship and research.

Source Citations

Ordered by authority: government agencies first, then manufacturers, then standards and academic literature. This series cites per article; a source used in more than one article appears in each.

I. Government agencies and public research

• Hayashida, K., and M. J. Suppanz. Space Shuttle Orbiter Windshield System Design and Test: Final Report. NASA CR-112234; SD 72-SH-0123. Downey, CA: North American Rockwell Space Division, for NASA Langley Research Center under Contract NAS1-10957, November 1972. Document ID 19730007152. Work of the US Government; public use permitted. ntrs.nasa.gov/citations/19730007152
• National Aeronautics and Space Administration. Meteoroid Environment Model. NASA SP-8013. (Reference 9 of CR-112234; the basis of the 0.9991 no-failure probability.)
• United States Department of Defense. Aircrew Station Vision Requirements for Military Aircraft. MIL-STD-850A, 8 June 1967. (The standard that set the Shuttle windshield pane sizes; Reference 3 of CR-112234.)
• National Air and Space Museum, Smithsonian Institution. Collection records for the IMAX Cargo Bay Camera and related NASA flight camera hardware. airandspace.si.edu

II. Manufacturers

• Corning Incorporated. Technical data for Corning code 7940 fused silica and code 1723 aluminosilicate glass. www.corning.com

III. Standards, academic and reference literature

• Kerper, M. J., and T. G. Scuderi. "Mechanical Properties of Chemically Strengthened Glasses at High Temperatures." Journal of the American Ceramic Society (November 1966): 613-617. (Reference 4 of CR-112234; the 300 F limit that eliminated chemical tempering.)
• Wilhem, D. P. Fracture Mechanics Guidelines for Aircraft Structural Applications. AFFDL-TR-69-111, February 1970. (Reference 10 of CR-112234.)
• Zwaal, A., and J. Dauphin. Screening of Space Materials with the Micro-VCM Weight-Loss Test. Noordwijk: European Space Research and Technology Centre, February 1971. (Reference 6 of CR-112234.)
• Timoshenko, S. P., and S. Woinowsky-Krieger. Theory of Plates and Shells. 2nd ed. New York: McGraw-Hill, 1959. (Source of the plate bending coefficients in Fig. 28.)
• Macleod, H. A. Thin-Film Optical Filters. 5th ed. Boca Raton, FL: CRC Press, 2018. (Thin-film interference and the quarter-wave condition, Fig. 37.)
• Wiederhorn, S. M. "Subcritical Crack Growth in Ceramics." In Fracture Mechanics of Ceramics, vol. 2. New York: Plenum Press, 1974. (Static fatigue, Fig. 32.)
• Kálmán, R. E. "A New Approach to Linear Filtering and Prediction Problems." Transactions of the ASME, Journal of Basic Engineering 82, series D (1960): 35-45. (Fig. 12.)
• Park, R. H. "Two-Reaction Theory of Synchronous Machines." Transactions of the AIEE 48, no. 3 (1929): 716-727. (Fig. 15.)
• Hamilton, W. R. "On Quaternions; or on a New System of Imaginaries in Algebra." Philosophical Magazine (1844 onward). (Figs. 07 and 08.)

Note on sources not cited

A number of citations circulating in secondary compilations of this material could not be verified against any primary record and have been deliberately excluded, including several journal articles on gimbal stabilisation, a NASA technical memorandum on radiation shielding numbered TM-1999-40361, and a JSC report numbered 28430 on camera calibration. I could not confirm that these exist as described. They may well; I simply will not put my name under a citation I have not seen. Everything above, I have.

Figures set by the author. Formula plates are original work.