5 ms·
Has this library been stress tested? I am interested in using this library for a spaceflight application, but reliability is paramount in our situation.
by gibsjose 11y ago
Has this library been stress tested? I am interested in using this library for a spaceflight application, but reliability is paramount in our situation.
- asveikau 11y agoI stopped looking when I saw it doesn't check for malloc failure. I am going to say space flight is a no-go.
- ryandrake 11y agoSome of the functions do check for malloc failure and others don't. It's on github--Have you submitted a pull request? Wow--guess the idea of sending a patch to an open source project is now controversial.
- david-given 11y agoBut for this kind of application, wouldn't you just panic and do a soft restart on malloc failure anyway? Actually recovering from an out-of-memory situation is incredibly fraught and unreliable; most of the realtime operating systems I've used don't even bother to try.
- duaneb 11y agoEven then you'd want proper logging and panicking over a segfault (the likely result).
- david-given 11y agoIn such an environment, malloc() will do that.
- gibsjose 11y agoThat depends on when a failure were to occur. If we have a failure while the spacecraft is en route to its destination, perhaps we can recover because we may have enough time. If we have a failure during rendezvous with our target, it could be a very bad day.
- TickleSteve 11y agoDynamic memory allocation is extremely frowned-upon in embedded/real-time systems such as flight systems for exactly that reason. You simply cannot handle out-of-memory and fragmentation issues in a safe manner.
- david-given 11y ago...necropost, but: You always need to be able to recover from a soft reboot, even during maneuvers; you're in a high radiation environment and any passing high energy particle or cosmic ray can trigger this.
- gibsjose 11y agoOuch. I'll keep looking then. Any recommendations for reliable C data structures?
- raarts 11y agoDon 't take this personally, but it worries me that someone who is not well versed with things like safe memory structures is tasked with writing software like this.
- gibsjose 11y agoI'm not sure what aspect of asking about the level of testing performed on an open source library gives you that idea, but sure: no offense taken.
- TickleSteve 11y agoDon't dismiss it because of that, handling OOM errors is best handled by the alloc call by panicing. If that situation is not allowed, I would suggest you shouldn't be performing memory allocation (or any other resource allocation) dynamically.
- rewqfdsa 11y agoThank you. There is somebody else on this fucking planet who understands that memory is not limitless manna from heaven.
- TickleSteve 11y agoThis is quite common because the alloc() call itself would panic if out-of-memory. Remember, a large proportion of C code is for embedded/real-time systems where the only sensible recovery option is to reset. Attempting to 'handle' an error manually in every case is simply not possible. Better to reset and come up in a clean state than propagate errors. Having said that, dynamic memory allocation is itself frowned upon in embedded systems.
- junke 11y agoGive Ada a try
- gibsjose 11y ago[Un]fortunately, we are tied to C/C++ due to mission requirements and our hardware platform.
- deleted 11y ago[deleted]