15 ms·

ZZ is a modern formally provable dialect of C

266 points by the_duke 7y ago

pjmlp 7y ago
I though this would be more like Frama-C, in this spirit it doesn't look like C to me. So not sure about possible adoption among C devs, even when the idea looks quite good.
- akavel 7y ago
  Right, I wonder why they didn't build it with a C-like syntax?
DmitryOlshansky 7y ago
It can’t be a dialect of a language if the compiler of said language doesn’t compile it.
- amitport 7y ago
  https://en.wikipedia.org/wiki/Programming_language#Dialects,_flavors_and_implementations https://en.wikipedia.org/wiki/Programming_language#Dialects,... Plenty of well-known dialects are not subsets of said language (/compiled by its compiler).
scoutt 7y ago
> where we still program C out of desperation I agree it's the standard and the only thing that actually works (author's words), but it's still a pleasure for me to write and have to deal with C (for embedded). I'd be desperate if I have to be forced to deal with huge different paradigms because pointer problems or insert-your-C-rant-here. C is not going to be replaced on embedded any moment soon.
- deleted 7y ago
  [deleted]
- lallysingh 7y ago
  Of course it isn't. It's portable (-ish) assembler. The only thing replacing C will be even more in the C spirit. Adding more checking in system-programming-friendly ways is the only way I can think of for improving the situation.
  - wheels 7y ago
    I know people often refer to C as portable assembly, but really it's not. That sounds like the sort of thing gets repeated by people who neither know C nor assembly. C is incomparably higher level than assembly and lacks the quirkiness modern instruction sets have which are focused on specific odd things modern processors do well.
    - Psyladine 7y ago
      Bit like chicken & egg though, with processors chasing better implementations of C rather than better implementations of assembly: https://queue.acm.org/detail.cfm?id=3212479 https://queue.acm.org/detail.cfm?id=3212479
    - lallysingh 7y ago
      I refer you to MASM macros in the late 1990s. If you want the same runtime environment of asm without the tediousness of asm development, and a reasonable optimizer to save you more tediousness, you end up at C. I count that as close enough.
- dmos62 7y ago
  > C is not going to be replaced on embedded any moment soon. Why? Doesn't for example Rust without stdlib already cover the use cases? Note I'm not experienced in embedded.
  - pjc50 7y ago
    I think most users are going to wait until CMSIS or their local equivalent is available: https://github.com/ARM-software/CMSIS_5 https://github.com/ARM-software/CMSIS_5 Besides, it's a big retraining effort.
  - MrBuddyCasino 7y ago
    Its slowly getting there, but no, right now there is a very limited number of target platforms that are supported, and the ecosystem is still very small and immature. You have to remember that there is a huge number of microcontrollers out there, with exotic architectures you have never heard of, and that LLVM definitely doesn't support. I'm not sure embedded Rust would even meaningfully exist without the work of Jorge Aparicio.
    - uxp100 7y ago
      Yeah. Even on the best supported platforms it is very immature. If you want to use embedded rust you kinda have to let language drive your choice of platform, which isn’t ideal. I wouldn’t use it at work yet, but it’s coming along.
  - scoutt 7y ago
    My personal opinion, is basically for 3 reasons: 1) There is no need to. C already has all we need to build our systems. The rest is seen as overhead/over-complication. Regarding Rust, I try to keep up to date about its progress. Unfortunately most of the diseases that Rust cures are not much of a trouble in embedded. My last UB, memory leak of loose pointer happened years ago. It will happen again and when it happens, I'll debug it. That's it. I'm not afraid of UB or dealing with pointers, even if there are 10K Rust users trying to FUD me. I know what I'm doing. Every embedded/kernel/driver developer know what they are doing. When shit happens, that's it, no big deal. You plug your debugger and solve the issue. It's not a nightmare that chases us in the middle of the day. FUD alone is not enough for switching. So, why should I start thinking that a variable cannot change, because it's a constant (wasn't it a variable?), unless it can mutate, so it's a constant variable that can change because now is mutable? Or constrain myself into borrow-checker torture for a thing I can do in a couple of instructions? WHY? 2) This is not about a language problem, is about solving a programmer problem with language. If C = math, then you cannot do math simpler/better because today's mathematicians are sloppier. Or because bosses pressures people to deliver crappy products. I'm not a genius. I'm far from it, and if any seasoned C programmer challenges me I'll probably run away. But embedded/kernel/driver development is harsh, so if a developer thinks that he/she cannot make it because language, then it's mostly about searching for an excuse. Time to change jobs. The key is to think that a lot of people did (and does) a lot with so much less, for 40 years now. It's not a language problem. People have to learn to deal with it. I was there too 20 years ago, when every C++ developer was afraid that they would lose their jobs because C#. It never happened. C++ is still one of the most used languages. 3) In my case, there are official libraries from manufacturers you have to use. Sometimes receiving customer support depends on if and how you use those libraries. All those libraries are in C. All the support is in C. All the examples are in C. Yes, I know there is that engineer that has a Github repo with a library that works fine with that STM32 for that specific language, that now is getting support for embedded so in 5 years we could maybe put something in production. But, not for now. Sorry for the length. Edited some typos.
- nicoburns 7y ago
  > but it's still a pleasure for me to write and have to deal with C But wouldn't you love a C with things like first class support for arrays and support for namespaces / modules, etc.
  - scoutt 7y ago
    With years you get to put together a swiss-army toolset of libraries to deal with all that (like arrays, strings, etc.). You know how they work, how far you can push them, the overhead, and all. Do I really know how much cycles/stack it takes to do std::sort(a.begin(), a.end()); in that specific platform? No, so I cannot trust it. I know it's reinventing the wheel, but I am sure that there are known simple libraries out there one can use. I use mine. What I would like is a better precompiler, like assigning dynamic values to constants. But I won't change the language for that.
    - hurrrrrrrr 7y ago
      >Do I really know how much cycles/stack it takes to do std::sort(a.begin(), a.end()); in that specific platform? No, so I cannot trust it. I also don't know how many cycles it takes for my implementation of quicksort apart from checking the output of a specific compiler and counting instructions. C is not, was not and will never be a portable assembler.
      - deleted 7y ago
        [deleted]
      - cwzwarich 7y ago
        > I also don't know how many cycles it takes for my implementation of quicksort apart from checking the output of a specific compiler and counting instructions. On any modern out-of-order CPU, that doesn't get you close to determining the dynamic performance. Even with full knowledge of private microarchitectural details, you'd still have a hard time due to branch prediction.
        7y ago
- oblio 7y ago
  I hope that with IoT we get some commoditization and standardization in this space. Though ARM doesn't give me much hope. I don't get why there couldn't be 1-2-3-5 standard architectures and 10-20-50-100 hardware configurations that cover the full spectrum of embedded configurations. We've had 32 bit x86 CPUs since 1985, surely we could produce a 100Mhz one for cheap enough that nobody would need to use 8 bit ones in 2020? I know that I'm just daydreaming and companies are stingy...
  - scoutt 7y ago
    The answer is size, power consumption and most of all, price. I know I can do a wrist watch with a Raspberry Pi, but will it be profitable/convenient?
    - oblio 7y ago
      Well, let's say I take the Intel P54 (https://en.wikipedia.org/wiki/List_of_Intel_microprocessors#32-bit_processors:_the_non-x86_microprocessors https://en.wikipedia.org/wiki/List_of_Intel_microprocessors#...) as an example. So basically an Intel Pentium from 1994, so from 26 (!) years ago. Size: 90 mm2, maximum power consumption: 10W, price at launch: $699. Buuuut: production process 600nm. Today every Intel CPU uses a 14nm production process, but let's go for a cheaper option and "use" the 22nm. So the gate size is ~30x smaller today. And I know that the relation between the gate size and the die size is not linear (2x smaller gate size usually leads to a die size which is smaller by more than 2x), but let's go with the 30x, to keep things simple. For the power I have no idea, but I'd assume that the power consumption would go down at least 30x. Price: hard to say, but considering how hardware evolves, definitely more than 30x cheaper :-) So a Intel Pentium with modern technology could look something like this: Size: 3mm2 (probably less), maximum power consumption: 0.3W (probably way less), price at launch: $30 (I'd argue that it would be closer to 0.3$ :-) ). I could be way off in the weeds here... My guess is that it's just a matter of existing tooling, expertise, human resistance to change, companies wanting to a) not risk anything and b) to nickel and dime everything. I'm arguing for an x86 because that way you could throw any kind of modern tooling at it. ARM or MIPS would probably be better candidates.
- pjmlp 7y ago
  While C isn't going to replaced on embedded any moment soon, there are alternatives out there, when the team is open minded. C++, Pascal, Basic, Java, Ada, Oberon all have mature toolchains available from companies that have been in business for the last couple of decades. As per several C++ retrospective talks, the focus on C is more social issue than anything else.
  - non-entity 7y ago
    Does Oberon have any major commerical usage? I read up on it a while back and thought it was a neat experiment
    - nickpsecurity 7y ago
      It doesn't that I know of. Relevant to the C space, there is an embedded platform for it: https://astrobe.com/Oberon.htm https://astrobe.com/Oberon.htm
      - pjmlp 7y ago
        One should note that this company is in business for around 20 years now, so they get by, even if they aren't SV like rich.
  - colonwqbang 7y ago
    > As per several C++ retrospective talks, the focus on C is more social issue than anything else. The social issue may be that many embedded programmers prefer C to C++, for what they believe to be legitimate reasons.
    - pjmlp 7y ago
      Most of which seem more like cargo cult than anything else.
- Cyph0n 7y ago
  I’m a C developer working in the SP routing space. Personally, I do not enjoy debugging memory corruption issues. I especially would not enjoy doing this under customer pressure... Of course, in some spaces, C is basically the only option. But when you have options, and you’re working with a large enough codebase, C is a terrible choice.
- Accujack 7y ago
  Or anywhere else. Lots of people don't enjoy using C for various reasons, but generally programmers don't get to choose what language they work in, they get paid to work in whatever language is needed. Whether programmers like it or not for non personal projects doesn't actually matter too much. If you don't like using C, then don't take jobs programming in C. Just don't whine when that makes it more difficult to get a job.
  - AstralStorm 7y ago
    It does matter if the reasons why they do not like it are good. Decision makers should listen to such input instead of deciding on programming language by fiat or convention. Including hardware choices. Of course this should be weighted by market availability and cost of both hardware and programmers. Typically the reason C is used because there's no other toolchain available for said embedded device, except assembler, and they do not wish to invest in building or extending one. Those devices often do not have a kernel with POSIX-like syscalls to adapt an existing full blown libc, nor provide one. Some embedded chipset libraries are also written in C sprinkled with copious assembly, so the language that's used with these has to be very easily interoperable.
    - Accujack 7y ago
      >It does matter if the reasons why they do not like it are good. Decision makers should listen to such input instead of deciding on programming language by fiat or convention. This is rarely the case. Almost all programming tasks aren't free choices out of thin air except for start-ups or small software companies. Far more often than not you have to stick with the existing language for compatibility, or to minimize maintenance costs, or in short because someone else already decided on the language before you arrived. >Including hardware choices. Of course this should be weighted by market availability and cost of both hardware and programmers. In those rare cases when you get an opportunity to make such a choice, sure. However, those aren't the only criteria either.
- quotemstr 7y ago
  > I agree it's the standard and the only thing that actually works (author's words), C++ also "actually works" and, thanks to its much greater ability to support fluent abstractions, ends up being safer in practice than raw C code. You can use C++ for low-level system components. Did you know Android's libc is actually written in C++?
  - pjmlp 7y ago
    Windows new one as well.
- loeg 7y ago
  This is entirely orthogonal to the fine article and basically just a statement of personal preference. Having preferences is fine, and sure, if you like C you can take umbrage at some of the more flowery characterizations in the README, but it's not really the point of the language. There are lots of neat ideas in TFA that would be interesting to discuss; no one is interested in litigating the fate of C on embedded for the Nth time.
- 0xdead 7y ago
  I have an anecdote to share. I work in embedded space for a living. A web developer (which is quite funny) from another team somehow convinced our director to use Rust for a critical process that involved a lot of concurrent processing. Ok, I said, and began developing that process in Rust. I estimated that it took me about 10x the time to implement something than it would have taken if I did that in C. The reason for that could definitely be because I'm not a Rust expert at all. That's fine though because I will happily invest more time in programming if it saves me hours of debugging later. Plus, the claim that "if it compiles, it works" was enough for me to fight the compiler for hours if it gives me no trouble during runtime. Fast forward a week, we have that binary deployed to a non-critical set of our field devices. A few days later, we get reports of that particular binary crashing. I logged into one of those devices and fetched the logs. The binary was reporting a panic on an MPSC channel's tx send. There was nothing useful in that error message that would point me to the root cause. I had no tools to attach to a running process because I'm on a device with an ancient kernel. To fix the situtation "temporarily", because the customer is getting infuriated, we redeploy our old C binary. It has been there since. I basically now say "fuck off" to anyone who tells me to use Rust because it doesn't work if it compiles.
  - Blaisorblade0 7y ago
    "If it compiles it works" is just not true, just a very bad description for a true phenomenon. If there weren’t people repeating that seriously, you’d be attacking a strawman. People do say that, but that’s on those people, not Rust.
socialdemocrat 7y ago
Very cool idea! What I love about C is that all sorts of programming language can talk to its ABI and that it fits well with low level programming. However it is a cumbersome and unsafe language. This seems like a very nice solution. You can write in a much safer language while producing C code which does not look too alien relative to what you wrote I have been interested in Rust but thinking it looks a tad too complicated. This may be a happy inbetween.
- simias 7y ago
  I'd expect that a formally provable language would be more complicated to write in practice than Rust. Take this example for instance: >you must tell the compiler that accessing the array at position 2 is defined. quick fix for this one: fn bla(int * a) where len(a) == 3 { a[2]; } In Rust you don't need the where clause, the `a[2]` operation will just panic at runtime if the array is too short. You don't have to prove to the language that the access is correct.
  - speps 7y ago
    Except the checks in ZZ are at compile time and have no runtime overhead.
    - Gene_Parmesan 7y ago
      Right, but the question was about which language was more complicated (with the implication being, complicated to write). In that sense I think my GP comment is probably correct.
  - dmos62 7y ago
    I've not looked at ZZ yet, but when we talk about formal proofs, we're usually proving much more interesting properties than what a type system typically proves.
  - firebacon 7y ago
    > operation will just panic at runtime if the array is too short Exactly, rust doesn't provide a good solution to this problem at all. Panics in rust are an escape hatch used to ensure the language stays "safe" in situations where the compiler can not prove a given behaviour at compile time, but where it would have made the language too ugly if you had to wire through Result types for all the trivial operations like adding two numbers. In my experience, panics in rust have been a major source of pain. In contrast to an exception, which you can catch, a panic behaves more like an abort. At least it has been that way in the past. Now, with a lot of libraries using panics to signalize runtime errors, coding in rust has at some times felt like I was using a bunch of badly written C libraries that internally call "abort()" and kill the process when something goes wrong that would have been totally handle-able without killing the whole process. That's the benefit of using a safe language, right? I think lately the rust "community" has become aware of this issue and IMO the way things are going is that that panics, as they are designed, should basically not be used. But, without proper exceptions, that brings you back to the situation where an operation as trivial as adding two numbers either produces a return code that must be explicitly checked or may silently fail and produce an "undefined" result in some cases.
Jaxan 7y ago
I like how they incorporate an SMT solver. They claim: “all code is proven”. What does that mean? What is proven about the code? Absence of memory bugs, or actual correctness of algorithms?
- mhd 7y ago
  "Beware of bugs in the above code; I have only proved it correct, not tried it."
- fuklief 7y ago
  +1 What does it even mean that the language is formally provable ?!
  - Jaxan 7y ago
    To me it means that there is a formal semantics (for example in Coq), and that we can formally prove properties of the code. There does not seem to be a semantics here.
- frabert 7y ago
  That the code is provably free of C undefined behavior
  - MaxBarraclough 7y ago
    Looking at the example code, [0] it's clear you're correct. As I just rambled about in another comment in this thread, their project summary isn't clear about this. Still a great idea for a language though. [0] https://github.com/aep/zz/tree/master/examples/hello/src https://github.com/aep/zz/tree/master/examples/hello/src
mr_vile 7y ago
Okay, it's provable... what value do really get out of it? isn't the whole reason why we still use C because it gets so close to resolving (or at least acknowledging) hardware or platform-level implementation problems? we can continue to re-invent the language in isolation but you can't replace a hardware-level programming language in this manner.
- iainmerrick 7y ago
  It is surprising that the syntax is so different for a “dialect” of C, but apart from that -- If the semantics are very close to C, so you can do basically all the same stuff, but you also get guarantees that your code will absolutely never hit any undefined behavior, that’s great and tremendously useful. It absolutely could replace C in applications where C is still the most useful and practical language. It would resolve a couple of major headaches in existing C code: security bugs caused by memory overflows (caused by using arrays or pointers in undefined ways); and highly optimizing compilers doing weird things to your code, by exploiting undefined edge cases. If I know my code will definitely not hit any undefined behavior, that gives me a ton more confidence that it won’t have stupid buffer overflow bugs and I won’t get mysterious errors on certain platforms.
simias 7y ago
So it's more like a C transpiler than a dialect of C IMO (it effectively looks more Rust-like than C-like). I'm not just saying that for nitpicking the obviously vague definition of "dialect" but rather because it's a very important feature IMO, and actually makes this project potentially more useful to me. I'd be very wary of switching my toolchain to an experimental one in production, especially if I'm targeting some niche DSP. On the other hand generating C and then compiling it as usual seems less of a hurdle to me. They actually point that out in the intro but I thought it might be worth mentioning it here. Now I just quickly skimmed the readme but do they explain how they deal with interfacing with standard, non-ZZ C code? I assume they need some sort of "FFI" bindings like Rust to make the code safe.
- speps 7y ago
  I think I found some FFI examples: - Using ZZ struct in C: https://github.com/aep/zz/tree/master/tests/mustpass/inlineincludedeps/src https://github.com/aep/zz/tree/master/tests/mustpass/inlinei... - Using C code in ZZ: https://github.com/aep/zz/tree/master/tests/mustpass/ctype_in_decl/src https://github.com/aep/zz/tree/master/tests/mustpass/ctype_i...
- rezeroed 7y ago
  It will always emit C into a C compiler which will then emit the binary. Presumably we can dump the C before compilation?
  - iainmerrick 7y ago
    Why? For this purpose, C is a very convenient and very portable assembly language. You could use a verified C compiler like CompCert to convert it to machine code. In an ideal world, there’d be no C compiler in the loop at all, sure. But in practice it’s not causing any trouble at all in a ZZ -> C -> machine code workflow. Quite the reverse, targeting C has some major benefits. (There are C compilers that are very fast, very highly optimizing, very portable, and/or verifiably correct.) Edit to add: just realised I might have totally misunderstood your comment, sorry! Apologies for jumping the gun if so. If you just mean can we save the generated C to disk instead of compiling it, yes, I would hope so too.
VladimirGolovin 7y ago
This is a very interesting idea. The world needs more languages that make formal provability practical. And I think I found a typo: thery is_open(int*) -> bool; -- should be "theory".
dooglius 7y ago
VCC [0] was a project by Microsoft Research that was used to successfully prove Hyper-V correct, but unfortunately it seems to have been abandoned. [0] https://github.com/microsoft/vcc https://github.com/microsoft/vcc
pjc50 7y ago
This is a great achievement in making formal methods accessible in pragmatic terms - something that actually works and can be used by normal humans. Would be nice to have an actual microcontroller example. > The standard library is fully stack based and heap allocation is strongly discouraged :/ - I can see why this is done, as it's hard, so banning it to make the problem tractable works. But it's also quite inconvenient. On the other hand, "MISRA C:2004, 20.4 - Dynamic heap memory allocation shall not be used."
- Nursie 7y ago
  There's the third sort of allocation that's often used in embedded systems - preallocated buffers, which are neither stack nor heap but set up by the .bss section of the executable. These allow you to have very predictable memory usage.
- pjmlp 7y ago
  Unless it has changed, SPARK also forbids dynamic allocation.
  - yannickmoy 7y ago
    It has changed: https://blog.adacore.com/pointer-based-data-structures-in-spark https://blog.adacore.com/pointer-based-data-structures-in-sp...
- a3p 7y ago
  the standard library does not allocate any heap memory, but heap modelling will be added to the prover eventually. note that there are convenience tools to deal with heap-free targets (microcontrollers) such as tail variants (statically enforced flexible arrays): https://github.com/aep/zz#metaprogramming-or-templates-tail-variants https://github.com/aep/zz#metaprogramming-or-templates-tail-...
je42 7y ago
> Checking is done by executing your code in SSA form at compile time within a virtual machine in an SMT prover. None of the checks are emitted into runtime code. Cool !
rurban 7y ago
Way cool. But in my testing yices blows away z3 by ~ factor 10. (see solvecomp.sh in one of the example ssa dirs)
waffle_ss 7y ago
Is the name supposed to be a French dick reference like Coq? https://en.wiktionary.org/wiki/zizi#Noun https://en.wiktionary.org/wiki/zizi#Noun
baybal2 7y ago
This is gold, if it will actually work. I will cross my fingers, and try it.
asimpletune 7y ago
I love this idea. Does anyone know what the compile-time performance is like?
MaxBarraclough 7y ago
I find the basic idea of this project to be very compelling - I was thinking aloud on HN recently and arrived at roughly the idea this project is implementing. [0] With that said, I really dislike the way they're describing their project. When I read safe dialect of C, I first assumed they meant they had developed a safe subset of C, or perhaps a very similar language, like OpenCL C [1]. Instead, they developed a new language which isn't C at all. Nothing wrong with that, but if I don't instantly recognise the syntax as C, I wouldn't call it a C dialect. They also put formally provable dialect of C. Their language compiles to C code which is guaranteed to be free from undefined behaviour. This is not the same thing as a language where hard guarantees can be made about program behaviour, such as SPARK [2] or Dafny [3]. If the authors are reading this, I urge you to improve your project summary. Your language does not allow me to prove program correctness, instead it protects me from C's undefined behaviour. That's still a great idea! Please make this clear! [0] https://news.ycombinator.com/item?id=22102658 https://news.ycombinator.com/item?id=22102658 [1] https://en.wikipedia.org/wiki/OpenCL#OpenCL_C_language https://en.wikipedia.org/wiki/OpenCL#OpenCL_C_language [2] https://en.wikipedia.org/wiki/SPARK_(programming_language) https://en.wikipedia.org/wiki/SPARK_(programming_language) [3] https://en.wikipedia.org/wiki/Dafny https://en.wikipedia.org/wiki/Dafny
- lwb 7y ago
  Seems like they are using a narrow definition of "mathematically provable" -- they only thing that appears to be proven is that "all memory access is mathematically proven to be defined". Which just seems like a fancy way of achieving the same thing as a type checker? Either way, cool project, but is there anything else that ZZ can prove?
  - augusto-moura 7y ago
    In the README there's a example of proving a simple state machine open > read > close [1] Just read the docs™ [1] https://github.com/aep/zz#theory https://github.com/aep/zz#theory
    - lwb 7y ago
marta_morena 7y ago
This is just another symptom of why OpenSource often sucks. Instead of somehow coordinating and focusing their efforts, everyone seems to need to start their own spin off "inspired" by other projects. When do people realize that building a new language is almost always going to fail and only very very few languages ever reach anything close to adoption. Instead of spending all this time writing your own doomed language, why not try to contribute to a project like LLVM or Rust and add your provable subset there? The same goes for Linux, which is the paradigm of wasted efforts.
- throwaway17_17 7y ago
  Just an example of why things don't go the way seem to feel they must: I do things that are not for work, because I want to do them. I enjoy designing and implementing languages, I love writing compilers and interpreters. So, I don't care one bit if anyone ever sees them or uses them. Of those languages I've designed, the only language I consider minimally complete is one I designed for personal use on personal projects. I have been arguing with friends recently who want me to at least release it to the public, if only to post about it and its quirks on blogs. I would be utterly shocked if anyone ever wanted to use anything I've built for fun/research, that's why I've never released any of it. Also because of the assumption you make being quite popular, that I somehow owe Open Source or something to help them do things that are interesting to them. Additionally, telling a developer who is developing what they want for their own reasons to contribute to a project like LLVM or Rust is ridiculous. If these projects aren't what drew my interest why would I want to bend over backwards to change what I'm doing to try and fit it into some existing model. TL;DR --> I don't program outside of my job for anyone but myself, and that's all that matters. If the ZZ devs want to make a provable dialect of C, that's what they should do.
- AnimalMuppet 7y ago
  Bjarne Stroustrup never expected C++ to be very widely used. He made it anyway. Alex Stepanov never thought that anyone would care about his ideas on generic programming. He pursued them anyway. They became the STL. True, building a new language is almost always going to fail. The problem is, when someone starts working on a new language, they don't know if it's doomed or not. It is good that 1000 people try, because from that we get one language that many people use, and 10 specialized languages that a few people use, and 10 languages that nobody uses but future people steal some of the ideas. > The same goes for Linux, which is the paradigm of wasted efforts. Um... what? Wasted because nobody uses it? Very much no. Wasted because it's a duplication of what was there before? To some degree, yes. But not everything in Linux was in Unix before it. And Unix couldn't run all the places that Linux does (smartphones to mainframes). So, no, Linux is not wasted effort.
camgunz 7y ago
Love this project. Super pragmatic (use an existing solver) and small scope (no template functions).
iainmerrick 7y ago
One question that isn’t obvious from the overview: This language compiles to C and asserts that your program will never exhibit undefined behavior; have they proved that ZZ is correct, ie that it will definitely never output C code that exhibits undefined behavior? If you really care about correctness, that seems important. I absolutely love the idea in general though.
- pickdenis 7y ago
  This seems similar to bootstrapping theorem provers. Here is a HN discussion on one: https://news.ycombinator.com/item?id=21358674 https://news.ycombinator.com/item?id=21358674
- colonwqbang 7y ago
  It's always concerning to see a compiler not being written in the compiled language.
loeg 7y ago
Pre- and post-condition annotations (`where` and `model`, respectively) are great. It's nice to see those in a new language. Syntactically, this seems more like a Rust dialect than a C dialect. The primary relation to C seems to be portability (transpiler) and integration (ABI). This is true of most C-transpiled languages, though. It's certainly cute, and potentially useful if your program is small enough to be solved by a SAT solver. Ideally relatively quickly, or those compile times will be poor. I wonder how it deals with machine registers, which are often something you would be using in embedded C.
naasking 7y ago
No mention of unions, discriminated or otherwise. Sums/unions are a pretty important abstraction, and a lot of C's unsafety can sneak in if you don't enforce discriminated unions.
_sbrk 7y ago
> Its main use case is code close to hardware, where we still program C out of desperation, because nothing else actually works. I think I'll stick with Ritchie's language over this fly-by-night invention.

266 points by the_duke 7y ago

I though this would be more like Frama-C, in this spirit it doesn't look like C to me. So not sure about possible adoption among C devs, even when the idea looks quite good.

akavel 7y ago
Right, I wonder why they didn't build it with a C-like syntax?

DmitryOlshansky 7y ago

It can’t be a dialect of a language if the compiler of said language doesn’t compile it.

amitport 7y ago
https://en.wikipedia.org/wiki/Programming_language#Dialects,_flavors_and_implementations https://en.wikipedia.org/wiki/Programming_language#Dialects,... Plenty of well-known dialects are not subsets of said language (/compiled by its compiler).

scoutt 7y ago

> where we still program C out of desperation I agree it's the standard and the only thing that actually works (author's words), but it's still a pleasure for me to write and have to deal with C (for embedded). I'd be desperate if I have to be forced to deal with huge different paradigms because pointer problems or insert-your-C-rant-here. C is not going to be replaced on embedded any moment soon.

deleted 7y ago
[deleted]
lallysingh 7y ago
Of course it isn't. It's portable (-ish) assembler. The only thing replacing C will be even more in the C spirit. Adding more checking in system-programming-friendly ways is the only way I can think of for improving the situation.
- wheels 7y ago
  I know people often refer to C as portable assembly, but really it's not. That sounds like the sort of thing gets repeated by people who neither know C nor assembly. C is incomparably higher level than assembly and lacks the quirkiness modern instruction sets have which are focused on specific odd things modern processors do well.
  - Psyladine 7y ago
    Bit like chicken & egg though, with processors chasing better implementations of C rather than better implementations of assembly: https://queue.acm.org/detail.cfm?id=3212479 https://queue.acm.org/detail.cfm?id=3212479
  - lallysingh 7y ago
    I refer you to MASM macros in the late 1990s. If you want the same runtime environment of asm without the tediousness of asm development, and a reasonable optimizer to save you more tediousness, you end up at C. I count that as close enough.
dmos62 7y ago
> C is not going to be replaced on embedded any moment soon. Why? Doesn't for example Rust without stdlib already cover the use cases? Note I'm not experienced in embedded.
- pjc50 7y ago
  I think most users are going to wait until CMSIS or their local equivalent is available: https://github.com/ARM-software/CMSIS_5 https://github.com/ARM-software/CMSIS_5 Besides, it's a big retraining effort.
- MrBuddyCasino 7y ago
  Its slowly getting there, but no, right now there is a very limited number of target platforms that are supported, and the ecosystem is still very small and immature. You have to remember that there is a huge number of microcontrollers out there, with exotic architectures you have never heard of, and that LLVM definitely doesn't support. I'm not sure embedded Rust would even meaningfully exist without the work of Jorge Aparicio.
  - uxp100 7y ago
    Yeah. Even on the best supported platforms it is very immature. If you want to use embedded rust you kinda have to let language drive your choice of platform, which isn’t ideal. I wouldn’t use it at work yet, but it’s coming along.
- scoutt 7y ago
  My personal opinion, is basically for 3 reasons: 1) There is no need to. C already has all we need to build our systems. The rest is seen as overhead/over-complication. Regarding Rust, I try to keep up to date about its progress. Unfortunately most of the diseases that Rust cures are not much of a trouble in embedded. My last UB, memory leak of loose pointer happened years ago. It will happen again and when it happens, I'll debug it. That's it. I'm not afraid of UB or dealing with pointers, even if there are 10K Rust users trying to FUD me. I know what I'm doing. Every embedded/kernel/driver developer know what they are doing. When shit happens, that's it, no big deal. You plug your debugger and solve the issue. It's not a nightmare that chases us in the middle of the day. FUD alone is not enough for switching. So, why should I start thinking that a variable cannot change, because it's a constant (wasn't it a variable?), unless it can mutate, so it's a constant variable that can change because now is mutable? Or constrain myself into borrow-checker torture for a thing I can do in a couple of instructions? WHY? 2) This is not about a language problem, is about solving a programmer problem with language. If C = math, then you cannot do math simpler/better because today's mathematicians are sloppier. Or because bosses pressures people to deliver crappy products. I'm not a genius. I'm far from it, and if any seasoned C programmer challenges me I'll probably run away. But embedded/kernel/driver development is harsh, so if a developer thinks that he/she cannot make it because language, then it's mostly about searching for an excuse. Time to change jobs. The key is to think that a lot of people did (and does) a lot with so much less, for 40 years now. It's not a language problem. People have to learn to deal with it. I was there too 20 years ago, when every C++ developer was afraid that they would lose their jobs because C#. It never happened. C++ is still one of the most used languages. 3) In my case, there are official libraries from manufacturers you have to use. Sometimes receiving customer support depends on if and how you use those libraries. All those libraries are in C. All the support is in C. All the examples are in C. Yes, I know there is that engineer that has a Github repo with a library that works fine with that STM32 for that specific language, that now is getting support for embedded so in 5 years we could maybe put something in production. But, not for now. Sorry for the length. Edited some typos.
nicoburns 7y ago
> but it's still a pleasure for me to write and have to deal with C But wouldn't you love a C with things like first class support for arrays and support for namespaces / modules, etc.
- scoutt 7y ago
  With years you get to put together a swiss-army toolset of libraries to deal with all that (like arrays, strings, etc.). You know how they work, how far you can push them, the overhead, and all. Do I really know how much cycles/stack it takes to do std::sort(a.begin(), a.end()); in that specific platform? No, so I cannot trust it. I know it's reinventing the wheel, but I am sure that there are known simple libraries out there one can use. I use mine. What I would like is a better precompiler, like assigning dynamic values to constants. But I won't change the language for that.
  - hurrrrrrrr 7y ago
    >Do I really know how much cycles/stack it takes to do std::sort(a.begin(), a.end()); in that specific platform? No, so I cannot trust it. I also don't know how many cycles it takes for my implementation of quicksort apart from checking the output of a specific compiler and counting instructions. C is not, was not and will never be a portable assembler.
    - deleted 7y ago
      [deleted]
    - cwzwarich 7y ago
      > I also don't know how many cycles it takes for my implementation of quicksort apart from checking the output of a specific compiler and counting instructions. On any modern out-of-order CPU, that doesn't get you close to determining the dynamic performance. Even with full knowledge of private microarchitectural details, you'd still have a hard time due to branch prediction.
      - 7y ago
oblio 7y ago
I hope that with IoT we get some commoditization and standardization in this space. Though ARM doesn't give me much hope. I don't get why there couldn't be 1-2-3-5 standard architectures and 10-20-50-100 hardware configurations that cover the full spectrum of embedded configurations. We've had 32 bit x86 CPUs since 1985, surely we could produce a 100Mhz one for cheap enough that nobody would need to use 8 bit ones in 2020? I know that I'm just daydreaming and companies are stingy...
- scoutt 7y ago
  The answer is size, power consumption and most of all, price. I know I can do a wrist watch with a Raspberry Pi, but will it be profitable/convenient?
  - oblio 7y ago
    Well, let's say I take the Intel P54 (https://en.wikipedia.org/wiki/List_of_Intel_microprocessors#32-bit_processors:_the_non-x86_microprocessors https://en.wikipedia.org/wiki/List_of_Intel_microprocessors#...) as an example. So basically an Intel Pentium from 1994, so from 26 (!) years ago. Size: 90 mm2, maximum power consumption: 10W, price at launch: $699. Buuuut: production process 600nm. Today every Intel CPU uses a 14nm production process, but let's go for a cheaper option and "use" the 22nm. So the gate size is ~30x smaller today. And I know that the relation between the gate size and the die size is not linear (2x smaller gate size usually leads to a die size which is smaller by more than 2x), but let's go with the 30x, to keep things simple. For the power I have no idea, but I'd assume that the power consumption would go down at least 30x. Price: hard to say, but considering how hardware evolves, definitely more than 30x cheaper :-) So a Intel Pentium with modern technology could look something like this: Size: 3mm2 (probably less), maximum power consumption: 0.3W (probably way less), price at launch: $30 (I'd argue that it would be closer to 0.3$ :-) ). I could be way off in the weeds here... My guess is that it's just a matter of existing tooling, expertise, human resistance to change, companies wanting to a) not risk anything and b) to nickel and dime everything. I'm arguing for an x86 because that way you could throw any kind of modern tooling at it. ARM or MIPS would probably be better candidates.
pjmlp 7y ago
While C isn't going to replaced on embedded any moment soon, there are alternatives out there, when the team is open minded. C++, Pascal, Basic, Java, Ada, Oberon all have mature toolchains available from companies that have been in business for the last couple of decades. As per several C++ retrospective talks, the focus on C is more social issue than anything else.
- non-entity 7y ago
  Does Oberon have any major commerical usage? I read up on it a while back and thought it was a neat experiment
  - nickpsecurity 7y ago
    It doesn't that I know of. Relevant to the C space, there is an embedded platform for it: https://astrobe.com/Oberon.htm https://astrobe.com/Oberon.htm
    - pjmlp 7y ago
      One should note that this company is in business for around 20 years now, so they get by, even if they aren't SV like rich.
- colonwqbang 7y ago
  > As per several C++ retrospective talks, the focus on C is more social issue than anything else. The social issue may be that many embedded programmers prefer C to C++, for what they believe to be legitimate reasons.
  - pjmlp 7y ago
    Most of which seem more like cargo cult than anything else.
Cyph0n 7y ago
I’m a C developer working in the SP routing space. Personally, I do not enjoy debugging memory corruption issues. I especially would not enjoy doing this under customer pressure... Of course, in some spaces, C is basically the only option. But when you have options, and you’re working with a large enough codebase, C is a terrible choice.
Accujack 7y ago
Or anywhere else. Lots of people don't enjoy using C for various reasons, but generally programmers don't get to choose what language they work in, they get paid to work in whatever language is needed. Whether programmers like it or not for non personal projects doesn't actually matter too much. If you don't like using C, then don't take jobs programming in C. Just don't whine when that makes it more difficult to get a job.
- AstralStorm 7y ago
  It does matter if the reasons why they do not like it are good. Decision makers should listen to such input instead of deciding on programming language by fiat or convention. Including hardware choices. Of course this should be weighted by market availability and cost of both hardware and programmers. Typically the reason C is used because there's no other toolchain available for said embedded device, except assembler, and they do not wish to invest in building or extending one. Those devices often do not have a kernel with POSIX-like syscalls to adapt an existing full blown libc, nor provide one. Some embedded chipset libraries are also written in C sprinkled with copious assembly, so the language that's used with these has to be very easily interoperable.
  - Accujack 7y ago
    >It does matter if the reasons why they do not like it are good. Decision makers should listen to such input instead of deciding on programming language by fiat or convention. This is rarely the case. Almost all programming tasks aren't free choices out of thin air except for start-ups or small software companies. Far more often than not you have to stick with the existing language for compatibility, or to minimize maintenance costs, or in short because someone else already decided on the language before you arrived. >Including hardware choices. Of course this should be weighted by market availability and cost of both hardware and programmers. In those rare cases when you get an opportunity to make such a choice, sure. However, those aren't the only criteria either.
quotemstr 7y ago
> I agree it's the standard and the only thing that actually works (author's words), C++ also "actually works" and, thanks to its much greater ability to support fluent abstractions, ends up being safer in practice than raw C code. You can use C++ for low-level system components. Did you know Android's libc is actually written in C++?
- pjmlp 7y ago
  Windows new one as well.
loeg 7y ago
This is entirely orthogonal to the fine article and basically just a statement of personal preference. Having preferences is fine, and sure, if you like C you can take umbrage at some of the more flowery characterizations in the README, but it's not really the point of the language. There are lots of neat ideas in TFA that would be interesting to discuss; no one is interested in litigating the fate of C on embedded for the Nth time.
0xdead 7y ago
I have an anecdote to share. I work in embedded space for a living. A web developer (which is quite funny) from another team somehow convinced our director to use Rust for a critical process that involved a lot of concurrent processing. Ok, I said, and began developing that process in Rust. I estimated that it took me about 10x the time to implement something than it would have taken if I did that in C. The reason for that could definitely be because I'm not a Rust expert at all. That's fine though because I will happily invest more time in programming if it saves me hours of debugging later. Plus, the claim that "if it compiles, it works" was enough for me to fight the compiler for hours if it gives me no trouble during runtime. Fast forward a week, we have that binary deployed to a non-critical set of our field devices. A few days later, we get reports of that particular binary crashing. I logged into one of those devices and fetched the logs. The binary was reporting a panic on an MPSC channel's tx send. There was nothing useful in that error message that would point me to the root cause. I had no tools to attach to a running process because I'm on a device with an ancient kernel. To fix the situtation "temporarily", because the customer is getting infuriated, we redeploy our old C binary. It has been there since. I basically now say "fuck off" to anyone who tells me to use Rust because it doesn't work if it compiles.
- Blaisorblade0 7y ago
  "If it compiles it works" is just not true, just a very bad description for a true phenomenon. If there weren’t people repeating that seriously, you’d be attacking a strawman. People do say that, but that’s on those people, not Rust.

socialdemocrat 7y ago

Very cool idea! What I love about C is that all sorts of programming language can talk to its ABI and that it fits well with low level programming. However it is a cumbersome and unsafe language. This seems like a very nice solution. You can write in a much safer language while producing C code which does not look too alien relative to what you wrote I have been interested in Rust but thinking it looks a tad too complicated. This may be a happy inbetween.

simias 7y ago
I'd expect that a formally provable language would be more complicated to write in practice than Rust. Take this example for instance: >you must tell the compiler that accessing the array at position 2 is defined. quick fix for this one: fn bla(int * a) where len(a) == 3 { a[2]; } In Rust you don't need the where clause, the `a[2]` operation will just panic at runtime if the array is too short. You don't have to prove to the language that the access is correct.
- speps 7y ago
  Except the checks in ZZ are at compile time and have no runtime overhead.
  - Gene_Parmesan 7y ago
    Right, but the question was about which language was more complicated (with the implication being, complicated to write). In that sense I think my GP comment is probably correct.
- dmos62 7y ago
  I've not looked at ZZ yet, but when we talk about formal proofs, we're usually proving much more interesting properties than what a type system typically proves.
- firebacon 7y ago
  > operation will just panic at runtime if the array is too short Exactly, rust doesn't provide a good solution to this problem at all. Panics in rust are an escape hatch used to ensure the language stays "safe" in situations where the compiler can not prove a given behaviour at compile time, but where it would have made the language too ugly if you had to wire through Result types for all the trivial operations like adding two numbers. In my experience, panics in rust have been a major source of pain. In contrast to an exception, which you can catch, a panic behaves more like an abort. At least it has been that way in the past. Now, with a lot of libraries using panics to signalize runtime errors, coding in rust has at some times felt like I was using a bunch of badly written C libraries that internally call "abort()" and kill the process when something goes wrong that would have been totally handle-able without killing the whole process. That's the benefit of using a safe language, right? I think lately the rust "community" has become aware of this issue and IMO the way things are going is that that panics, as they are designed, should basically not be used. But, without proper exceptions, that brings you back to the situation where an operation as trivial as adding two numbers either produces a return code that must be explicitly checked or may silently fail and produce an "undefined" result in some cases.

Jaxan 7y ago

I like how they incorporate an SMT solver. They claim: “all code is proven”. What does that mean? What is proven about the code? Absence of memory bugs, or actual correctness of algorithms?

mhd 7y ago
"Beware of bugs in the above code; I have only proved it correct, not tried it."
fuklief 7y ago
+1 What does it even mean that the language is formally provable ?!
- Jaxan 7y ago
  To me it means that there is a formal semantics (for example in Coq), and that we can formally prove properties of the code. There does not seem to be a semantics here.
frabert 7y ago
That the code is provably free of C undefined behavior
- MaxBarraclough 7y ago
  Looking at the example code, [0] it's clear you're correct. As I just rambled about in another comment in this thread, their project summary isn't clear about this. Still a great idea for a language though. [0] https://github.com/aep/zz/tree/master/examples/hello/src https://github.com/aep/zz/tree/master/examples/hello/src

mr_vile 7y ago

Okay, it's provable... what value do really get out of it? isn't the whole reason why we still use C because it gets so close to resolving (or at least acknowledging) hardware or platform-level implementation problems? we can continue to re-invent the language in isolation but you can't replace a hardware-level programming language in this manner.

iainmerrick 7y ago
It is surprising that the syntax is so different for a “dialect” of C, but apart from that -- If the semantics are very close to C, so you can do basically all the same stuff, but you also get guarantees that your code will absolutely never hit any undefined behavior, that’s great and tremendously useful. It absolutely could replace C in applications where C is still the most useful and practical language. It would resolve a couple of major headaches in existing C code: security bugs caused by memory overflows (caused by using arrays or pointers in undefined ways); and highly optimizing compilers doing weird things to your code, by exploiting undefined edge cases. If I know my code will definitely not hit any undefined behavior, that gives me a ton more confidence that it won’t have stupid buffer overflow bugs and I won’t get mysterious errors on certain platforms.

simias 7y ago

So it's more like a C transpiler than a dialect of C IMO (it effectively looks more Rust-like than C-like). I'm not just saying that for nitpicking the obviously vague definition of "dialect" but rather because it's a very important feature IMO, and actually makes this project potentially more useful to me. I'd be very wary of switching my toolchain to an experimental one in production, especially if I'm targeting some niche DSP. On the other hand generating C and then compiling it as usual seems less of a hurdle to me. They actually point that out in the intro but I thought it might be worth mentioning it here. Now I just quickly skimmed the readme but do they explain how they deal with interfacing with standard, non-ZZ C code? I assume they need some sort of "FFI" bindings like Rust to make the code safe.

speps 7y ago
I think I found some FFI examples: - Using ZZ struct in C: https://github.com/aep/zz/tree/master/tests/mustpass/inlineincludedeps/src https://github.com/aep/zz/tree/master/tests/mustpass/inlinei... - Using C code in ZZ: https://github.com/aep/zz/tree/master/tests/mustpass/ctype_in_decl/src https://github.com/aep/zz/tree/master/tests/mustpass/ctype_i...
rezeroed 7y ago
It will always emit C into a C compiler which will then emit the binary. Presumably we can dump the C before compilation?
- iainmerrick 7y ago
  Why? For this purpose, C is a very convenient and very portable assembly language. You could use a verified C compiler like CompCert to convert it to machine code. In an ideal world, there’d be no C compiler in the loop at all, sure. But in practice it’s not causing any trouble at all in a ZZ -> C -> machine code workflow. Quite the reverse, targeting C has some major benefits. (There are C compilers that are very fast, very highly optimizing, very portable, and/or verifiably correct.) Edit to add: just realised I might have totally misunderstood your comment, sorry! Apologies for jumping the gun if so. If you just mean can we save the generated C to disk instead of compiling it, yes, I would hope so too.

VladimirGolovin 7y ago

This is a very interesting idea. The world needs more languages that make formal provability practical. And I think I found a typo: thery is_open(int*) -> bool; -- should be "theory".

dooglius 7y ago

VCC [0] was a project by Microsoft Research that was used to successfully prove Hyper-V correct, but unfortunately it seems to have been abandoned. [0] https://github.com/microsoft/vcc https://github.com/microsoft/vcc

pjc50 7y ago

This is a great achievement in making formal methods accessible in pragmatic terms - something that actually works and can be used by normal humans. Would be nice to have an actual microcontroller example. > The standard library is fully stack based and heap allocation is strongly discouraged :/ - I can see why this is done, as it's hard, so banning it to make the problem tractable works. But it's also quite inconvenient. On the other hand, "MISRA C:2004, 20.4 - Dynamic heap memory allocation shall not be used."

Nursie 7y ago
There's the third sort of allocation that's often used in embedded systems - preallocated buffers, which are neither stack nor heap but set up by the .bss section of the executable. These allow you to have very predictable memory usage.
pjmlp 7y ago
Unless it has changed, SPARK also forbids dynamic allocation.
- yannickmoy 7y ago
  It has changed: https://blog.adacore.com/pointer-based-data-structures-in-spark https://blog.adacore.com/pointer-based-data-structures-in-sp...
a3p 7y ago
the standard library does not allocate any heap memory, but heap modelling will be added to the prover eventually. note that there are convenience tools to deal with heap-free targets (microcontrollers) such as tail variants (statically enforced flexible arrays): https://github.com/aep/zz#metaprogramming-or-templates-tail-variants https://github.com/aep/zz#metaprogramming-or-templates-tail-...

je42 7y ago

> Checking is done by executing your code in SSA form at compile time within a virtual machine in an SMT prover. None of the checks are emitted into runtime code. Cool !

rurban 7y ago

Way cool. But in my testing yices blows away z3 by ~ factor 10. (see solvecomp.sh in one of the example ssa dirs)

waffle_ss 7y ago

Is the name supposed to be a French dick reference like Coq? https://en.wiktionary.org/wiki/zizi#Noun https://en.wiktionary.org/wiki/zizi#Noun

baybal2 7y ago

This is gold, if it will actually work. I will cross my fingers, and try it.

asimpletune 7y ago

I love this idea. Does anyone know what the compile-time performance is like?

MaxBarraclough 7y ago

I find the basic idea of this project to be very compelling - I was thinking aloud on HN recently and arrived at roughly the idea this project is implementing. [0] With that said, I really dislike the way they're describing their project. When I read safe dialect of C, I first assumed they meant they had developed a safe subset of C, or perhaps a very similar language, like OpenCL C [1]. Instead, they developed a new language which isn't C at all. Nothing wrong with that, but if I don't instantly recognise the syntax as C, I wouldn't call it a C dialect. They also put formally provable dialect of C. Their language compiles to C code which is guaranteed to be free from undefined behaviour. This is not the same thing as a language where hard guarantees can be made about program behaviour, such as SPARK [2] or Dafny [3]. If the authors are reading this, I urge you to improve your project summary. Your language does not allow me to prove program correctness, instead it protects me from C's undefined behaviour. That's still a great idea! Please make this clear! [0] https://news.ycombinator.com/item?id=22102658 https://news.ycombinator.com/item?id=22102658 [1] https://en.wikipedia.org/wiki/OpenCL#OpenCL_C_language https://en.wikipedia.org/wiki/OpenCL#OpenCL_C_language [2] https://en.wikipedia.org/wiki/SPARK_(programming_language) https://en.wikipedia.org/wiki/SPARK_(programming_language) [3] https://en.wikipedia.org/wiki/Dafny https://en.wikipedia.org/wiki/Dafny

lwb 7y ago
Seems like they are using a narrow definition of "mathematically provable" -- they only thing that appears to be proven is that "all memory access is mathematically proven to be defined". Which just seems like a fancy way of achieving the same thing as a type checker? Either way, cool project, but is there anything else that ZZ can prove?
- augusto-moura 7y ago
  In the README there's a example of proving a simple state machine open > read > close [1] Just read the docs™ [1] https://github.com/aep/zz#theory https://github.com/aep/zz#theory
  - lwb 7y ago

marta_morena 7y ago

This is just another symptom of why OpenSource often sucks. Instead of somehow coordinating and focusing their efforts, everyone seems to need to start their own spin off "inspired" by other projects. When do people realize that building a new language is almost always going to fail and only very very few languages ever reach anything close to adoption. Instead of spending all this time writing your own doomed language, why not try to contribute to a project like LLVM or Rust and add your provable subset there? The same goes for Linux, which is the paradigm of wasted efforts.

throwaway17_17 7y ago
Just an example of why things don't go the way seem to feel they must: I do things that are not for work, because I want to do them. I enjoy designing and implementing languages, I love writing compilers and interpreters. So, I don't care one bit if anyone ever sees them or uses them. Of those languages I've designed, the only language I consider minimally complete is one I designed for personal use on personal projects. I have been arguing with friends recently who want me to at least release it to the public, if only to post about it and its quirks on blogs. I would be utterly shocked if anyone ever wanted to use anything I've built for fun/research, that's why I've never released any of it. Also because of the assumption you make being quite popular, that I somehow owe Open Source or something to help them do things that are interesting to them. Additionally, telling a developer who is developing what they want for their own reasons to contribute to a project like LLVM or Rust is ridiculous. If these projects aren't what drew my interest why would I want to bend over backwards to change what I'm doing to try and fit it into some existing model. TL;DR --> I don't program outside of my job for anyone but myself, and that's all that matters. If the ZZ devs want to make a provable dialect of C, that's what they should do.
AnimalMuppet 7y ago
Bjarne Stroustrup never expected C++ to be very widely used. He made it anyway. Alex Stepanov never thought that anyone would care about his ideas on generic programming. He pursued them anyway. They became the STL. True, building a new language is almost always going to fail. The problem is, when someone starts working on a new language, they don't know if it's doomed or not. It is good that 1000 people try, because from that we get one language that many people use, and 10 specialized languages that a few people use, and 10 languages that nobody uses but future people steal some of the ideas. > The same goes for Linux, which is the paradigm of wasted efforts. Um... what? Wasted because nobody uses it? Very much no. Wasted because it's a duplication of what was there before? To some degree, yes. But not everything in Linux was in Unix before it. And Unix couldn't run all the places that Linux does (smartphones to mainframes). So, no, Linux is not wasted effort.

camgunz 7y ago

Love this project. Super pragmatic (use an existing solver) and small scope (no template functions).

iainmerrick 7y ago

One question that isn’t obvious from the overview: This language compiles to C and asserts that your program will never exhibit undefined behavior; have they proved that ZZ is correct, ie that it will definitely never output C code that exhibits undefined behavior? If you really care about correctness, that seems important. I absolutely love the idea in general though.

pickdenis 7y ago
This seems similar to bootstrapping theorem provers. Here is a HN discussion on one: https://news.ycombinator.com/item?id=21358674 https://news.ycombinator.com/item?id=21358674
colonwqbang 7y ago
It's always concerning to see a compiler not being written in the compiled language.

loeg 7y ago

Pre- and post-condition annotations (`where` and `model`, respectively) are great. It's nice to see those in a new language. Syntactically, this seems more like a Rust dialect than a C dialect. The primary relation to C seems to be portability (transpiler) and integration (ABI). This is true of most C-transpiled languages, though. It's certainly cute, and potentially useful if your program is small enough to be solved by a SAT solver. Ideally relatively quickly, or those compile times will be poor. I wonder how it deals with machine registers, which are often something you would be using in embedded C.

naasking 7y ago

No mention of unions, discriminated or otherwise. Sums/unions are a pretty important abstraction, and a lot of C's unsafety can sneak in if you don't enforce discriminated unions.

_sbrk 7y ago

> Its main use case is code close to hardware, where we still program C out of desperation, because nothing else actually works. I think I'll stick with Ritchie's language over this fly-by-night invention.