Safety critical software has longer lead times than other software. There are often code coverage requirements, code review requirements, and extensive automated and human testing cycles.

Edit: I gave you an upvote since this is an area that people should try to learn more about.

While working at NASA on code related to the Space Shuttle I once found a piece of Fortran that jumped into assembler. The assembler bit used a parameter to decide where to re-enter the Fortran code. Over time every exit but one was commented out. I asked "Can we just patch the software to jump from here to there instead?" and the answer was "Your six month project is to replace Fortran with 'C' and that's about how long it'll take to get a code change through the committee." People take flight safety very seriously.

This isn't a matter of just tweaking some code, running your test suite and having someone buddy your check-in. Once they've identified the bug and come up with a solution they probably have to fly an airliner around for a while, deliberately trying to break it, to confirm that it worked.

> 6 months to a year and a half before Boeing thinks they'll have a software patch... That seems silly long

IIRC, SQLite is flight certified...which means that they have to show that every machine code branch is tested by their test suite [1]. This stuff is not developed with the same lax processes as "move fast and break things" web apps.

[1] From some Youtube talk by one of the lead SQLite developers.

I would _love_ to see that talk if you can dig it up - SQLite's stability story is fascinating.

He mentions it here: SQLite: The Database at the Edge of the Network with Dr. Richard Hipp - https://www.youtube.com/watch?v=Jib2AmRb_rk

Safety critical software is a different ballgame.

That seems extremely quick in this sort of space. This isn’t fixing a bug in a shopping cart or some “silly” web app. This is code upon which millions of lives will ultimately depend.

Agreed. I would have expected 3m. I have a feeling they are also busy with a ton of other issues. The Q is whether this is top priority or not in light of all those other issues and it's chance of occurring.

Three months is very little in software. If formal verification is required (as I hope), it is very difficult to do that under time pressure.