6 ms·

Its not just pauses either. Non-deterministic memory usage is a big deal too.

GuB-42 7y ago
I have actually worked on a system where malloc() was forbidden. In fact it always returned null. Buffers were all statically allocated and stack usage was kept to a minimum (it was only a few kB anyways). The software was shipped with a memory map file so you know exactly what each memory address is used for. A lot of test procedures involved reading and writing at specific memory locations. It was for avionics BTW. As you may have guessed, it was certified code with hard real time constraints. Exceeding the cycle time is equivalent to a crash, causing the watchdog to trigger a reset.
- aetherspawn 7y ago
  I’d be interested in knowing more if you care to write more about this. I’m currently costing/scoping out what’s required in writing software at that level but don’t really have some real industry insight into what other people do Static memory is something we already do but we’re pretty interested whether industry actually adopts redundant code paths, monitors, to what extent watchdogs (how many cycles can be missed?), etc.
  - rramadass 7y ago
    I suggest you take a look at the books by Michael Pont and the offerings through his company "SafeTTy Systems". His/Company's work deals with hard real-time systems with all the associated standards.
- hackits 7y ago
  Sounds very similar to NASA C programming guidelines. Each module during the initialization period would allocate its static memory size. Every loop had a upper bound's max iteration to prevent infinite loops. I think they posted the guidelines and it was a wonderful read about how they developed real time systems.
  - mike00632 7y ago
    Do you happen to have a link to the guidelines?
    - hackits 7y ago
      http://spinroot.com/gerard/pdf/P10.pdf http://spinroot.com/gerard/pdf/P10.pdf
      - neop1x 7y ago
        I was wondering why I couldn't open this pdf on my android pdf viewer and this link gives me cloudflare's captcha. It uses google's ReCaptcha - storefronts, bicycles, semaphores. What a terrible practice. People stop overusing cloudflare!
    - kimown 7y ago
      https://ntrs.nasa.gov/search.jsp?R=19950022400 https://ntrs.nasa.gov/search.jsp?R=19950022400 http://mechatronics.me.wisc.edu/labresources/DataSheets/NASA-GSFC_C_Programming_Styles-94-003.pdf http://mechatronics.me.wisc.edu/labresources/DataSheets/NASA...
- loeg 7y ago
  Why even define a malloc() in this environment if it always returns NULL?
  - drblast 7y ago
    So you crash immediately if someone tries to use it or a library gets added that does? Never experienced the malloc() thing but do throw exceptions and fail fast under conditions like these so they're caught in testing.
    - a_t48 7y ago
      I think what he's asking to do is to make it a linker failure by not adding it to the standard lib at all. Compile fails are nicer than runtime fails.
    - loeg 7y ago
      Like sibling commenter says, a compile/link error is even better and faster than finding out at runtime with a crash.
  - seanmcdirmid 7y ago
    Because even if you don't use it directly, you might use some code that uses it. And even then, it might not ever be called given the way you are reusing the code, so...a dynamic check is the best way to ensure it never actually gets used.
    - loeg 7y ago
      > Because even if you don't use it directly, you might use some code that uses it. It seems extremely unlikely that any general purpose code you might adopt, which happens to invoke malloc() at all, would be fit for purpose in such a restricted environment without substantial modification; in which case you would just remove the malloc() calls as well. > And even then, it might not ever be called given the way you are reusing the code, so...a dynamic check is the best way to ensure it never actually gets used. In such a restricted environment, it is unlikely you just have unknown deadcode in your project. "Oh, those parts that call malloc()? They're probably not live code and we'll find out via a crash at runtime." That's like the opposite of what you want in a hard realtime system. So, no — a static, compile/link time check is a strictly superior way to ensure it never gets used.
- Impossible 7y ago
  Malloc was forbidden in a AAA title I worked on. Interestingly enough we also had two (!!!) embedded garbage collected scripting languages that could only allocate in small (32MB, 16 MB) arenas and would assert if they over allocated.
  - zippie 7y ago
    In modern C libraries malloc is mmap’ed anon pages underneath for an increasingly larger set of conditions these days.

I have actually worked on a system where malloc() was forbidden. In fact it always returned null. Buffers were all statically allocated and stack usage was kept to a minimum (it was only a few kB anyways). The software was shipped with a memory map file so you know exactly what each memory address is used for. A lot of test procedures involved reading and writing at specific memory locations. It was for avionics BTW. As you may have guessed, it was certified code with hard real time constraints. Exceeding the cycle time is equivalent to a crash, causing the watchdog to trigger a reset.

aetherspawn 7y ago
I’d be interested in knowing more if you care to write more about this. I’m currently costing/scoping out what’s required in writing software at that level but don’t really have some real industry insight into what other people do Static memory is something we already do but we’re pretty interested whether industry actually adopts redundant code paths, monitors, to what extent watchdogs (how many cycles can be missed?), etc.
- rramadass 7y ago
  I suggest you take a look at the books by Michael Pont and the offerings through his company "SafeTTy Systems". His/Company's work deals with hard real-time systems with all the associated standards.
hackits 7y ago
Sounds very similar to NASA C programming guidelines. Each module during the initialization period would allocate its static memory size. Every loop had a upper bound's max iteration to prevent infinite loops. I think they posted the guidelines and it was a wonderful read about how they developed real time systems.
- mike00632 7y ago
  Do you happen to have a link to the guidelines?
  - hackits 7y ago
    http://spinroot.com/gerard/pdf/P10.pdf http://spinroot.com/gerard/pdf/P10.pdf
    - neop1x 7y ago
      I was wondering why I couldn't open this pdf on my android pdf viewer and this link gives me cloudflare's captcha. It uses google's ReCaptcha - storefronts, bicycles, semaphores. What a terrible practice. People stop overusing cloudflare!
  - kimown 7y ago
    https://ntrs.nasa.gov/search.jsp?R=19950022400 https://ntrs.nasa.gov/search.jsp?R=19950022400 http://mechatronics.me.wisc.edu/labresources/DataSheets/NASA-GSFC_C_Programming_Styles-94-003.pdf http://mechatronics.me.wisc.edu/labresources/DataSheets/NASA...
loeg 7y ago
Why even define a malloc() in this environment if it always returns NULL?
- drblast 7y ago
  So you crash immediately if someone tries to use it or a library gets added that does? Never experienced the malloc() thing but do throw exceptions and fail fast under conditions like these so they're caught in testing.
  - a_t48 7y ago
    I think what he's asking to do is to make it a linker failure by not adding it to the standard lib at all. Compile fails are nicer than runtime fails.
  - loeg 7y ago
    Like sibling commenter says, a compile/link error is even better and faster than finding out at runtime with a crash.
- seanmcdirmid 7y ago
  Because even if you don't use it directly, you might use some code that uses it. And even then, it might not ever be called given the way you are reusing the code, so...a dynamic check is the best way to ensure it never actually gets used.
  - loeg 7y ago
    > Because even if you don't use it directly, you might use some code that uses it. It seems extremely unlikely that any general purpose code you might adopt, which happens to invoke malloc() at all, would be fit for purpose in such a restricted environment without substantial modification; in which case you would just remove the malloc() calls as well. > And even then, it might not ever be called given the way you are reusing the code, so...a dynamic check is the best way to ensure it never actually gets used. In such a restricted environment, it is unlikely you just have unknown deadcode in your project. "Oh, those parts that call malloc()? They're probably not live code and we'll find out via a crash at runtime." That's like the opposite of what you want in a hard realtime system. So, no — a static, compile/link time check is a strictly superior way to ensure it never gets used.
Impossible 7y ago
Malloc was forbidden in a AAA title I worked on. Interestingly enough we also had two (!!!) embedded garbage collected scripting languages that could only allocate in small (32MB, 16 MB) arenas and would assert if they over allocated.
- zippie 7y ago
  In modern C libraries malloc is mmap’ed anon pages underneath for an increasingly larger set of conditions these days.