7 ms·
> Ada code controls rockets like the Ariane 4 and 5, many satellites, and countless other systems where small glitches can have major consequences. A somewhat
by ch_123 7y ago
> Ada code controls rockets like the Ariane 4 and 5, many satellites, and countless other systems where small glitches can have major consequences.
A somewhat amusing endorsement given that the infamous failure of the maiden launch of the Ariane 5 due to series of interconnected software bugs - a reminder perhaps that the choice of implementation language does not automatically make for a reliable system.
- ahartmetz 7y agoAmusing but only superficially a counterexample because the bug was basically in a specification-implementation mismatch. Nothing in the language can catch that.
- deleted 7y ago[deleted]
- bigbaguette 7y ago105 launches, 2 failures, 3 partial failures. That's a 95,2% success rate.
- sixplusone 7y agoHow many dollars did the failures cost?
- pizzapill 7y agoCa. 370 Mio. USD
- Rexxar 7y agoI nitpick a little but failures were at launch 1 and 14. Partial Failures at launch 2, 10 and 97 so the current effective success rate is much higher than 95,2%. (4 failures in the 14 first launches, but only one partial failure in 91 launches since).
- kragen 7y agoThat's a normal failure rate for chemical rockets. The notable thing was that the first failure was due to software.
- aghillo 7y agoHere’s a report on the Ariane 5 incident https://zoo.cs.yale.edu/classes/cs422/2010/bib/lions96ariane5.pdf https://zoo.cs.yale.edu/classes/cs422/2010/bib/lions96ariane...
- markdoubleyou 7y agoA language doesn't make code automatically reliable, but it can certainly help. Ada can do overflow checking, so choice of language can have an impact on reliability, but the software engineers deliberately disabled some of those checks to save CPU cycles on a computer that was running at/near capacity. Their reasoning was that it was impossible for the variables in question to overflow given the known flight characteristics... of an Ariane 4.
- atoav 7y agoThis is why I always document considerations like these with stuff like: “This error case can’t happen because foo” or even better, enforce these things by type system and let the compiler decide if it really can’t happen once you changed something in the other part of the code.
- shakna 7y agoAda could have enforced those at the type system level, it has bounded types, but those checks were disabled.
- ajxs 7y agoThere's always someone who brings this up whenever Ada is mentioned, as if it serves as a damning refutation of Ada's reputation as a safe language. That bug was caused by a series of design failures if anything, rather than software bugs. From memory, they reused the inertial reference system from the Ariane 4 mission without testing its suitability for a different delivery vehicle. The actual 'bug' was caused by an integer overflow occurring due to the velocity variable not being wide enough to handle the higher horizontal velocities of the newer rocket. This caused the rocket to go off course and require termination. The backup computers had the exact same flaw due to having the same programming. I'm guessing they used Ada's modular integer types, which wrap around when they overflow. This is the same as C, and I'm guessing the same as Rust. Using either of those languages wouldn't have helped in the slightest here. It's not some software bug caused by Ada. It was a domain issue caused by a failure in management and testing.
- kragen 7y ago> It's not some software bug caused by Ada. This is not correct. It was, in fact, "some software bug caused by Ada", in the sense that in most other programming languages, the error that did in fact happen would have been harmless. For those who are interested, the full report is at http://www-users.math.umn.edu/~arnold//disasters/ariane5rep.html http://www-users.math.umn.edu/~arnold//disasters/ariane5rep..... There is no need to "guess" when a fairly detailed public analysis is available, particularly when the issue is one that comes up repeatedly. It is true that the problem was that a horizontal velocity variable ("horizontal bias", BH in the code) overflowed, although it was not the ordinary kind of integer overflow, but rather a floating-point-to-integer-conversion overflow, which does not produce an exception in any commonly-used programming language. The missing piece of the explanation is that the variable in question was no longer being used at that point in the flight, so if the failure had been allowed to pass silently rather than shutting down the SRI ("inertial reference system"), the rocket would not have been destroyed. Of course, under some circumstances, allowing variables to have grossly incorrect values in your inertial reference system could have been equally disastrous — that's what you assumed happened. The system was designed in the way it was because the assumption was that such errors would almost surely stem from hardware failures rather than software bugs; perhaps that is a "domain issue caused by a failure in management and testing". But in some sense, you can argue that any organizational failure is a "failure in management", since management's job is to look to windward and steer the organization clear of failures by any means necessary. But in fact the particular failure in management that happened was for the software to be inadequately thought out, such that one of Ada's hidden pitfalls caused Ariane 5's maiden flight to fail.
- stjohnswarts 7y agoI don't think that there is any language around that claims that just because it compiles/can be interpreted that is "reliable". Can you point out a single one that guarantees you won't have logic errors? Rust et. al. are good at eliminating very common issues like memory leaks and concurrency, I've never read in the documentation where it said you won't have issues.