4 ms·

> including garbage collection. Not only does flight control software typically never use garbage collection, it is also preferable to never allocate memory d

by jb1991 5y ago

> including garbage collection. Not only does flight control software typically never use garbage collection, it is also preferable to never allocate memory during the runtime -- all memory ever needed is allocated at program startup, and memory is not acquired or released until landing or some other major end event. Because memory issues are often the most significant causes of crashes, which you don't want to translate into, well.. a different kind of crash. The creator of C++, Bjarne, wrote a nice paper on flight control software if you are interested in more.

mrfusion 5y ago
Do you have a link to bjarnes writeup? My ask Jeeves skills are failing me.
- LeifCarrotson 5y ago
  I don't think it was actually written by Bjarne, I think it was K. Carroll and others from Lockheed Martin, but I expect the document is this one: https://www.stroustrup.com/JSF-AV-rules.pdf https://www.stroustrup.com/JSF-AV-rules.pdf which is linked from the Applications page of Bjarne's website.
  - jb1991 5y ago
    Ah, thanks for the link; yes this is the one I was referring to. I had thought it was by Bjarne since it was on his site, but either way, it's an interesting read.
  - maxlybbert 5y ago
    There are a couple others as well: https://stroustrup.com/autonomics09.pdf https://stroustrup.com/autonomics09.pdf https://stroustrup.com/sec09.pdf https://stroustrup.com/sec09.pdf https://stroustrup.com/mbd09.pdf https://stroustrup.com/mbd09.pdf
- funklute 5y ago
  This one might also be interesting https://web.cecs.pdx.edu/~kimchris/cs201/handouts/The%20Power%20of%2010%20-%20Rules%20for%20Developing%20Safety%20Critical%20Code.pdf https://web.cecs.pdx.edu/~kimchris/cs201/handouts/The%20Powe... It's basically just a quick list of 10 useful rules to follow for safety-critical code. (I've seen a different format in the past, that wasn't quite as fancy, but this is the only version I can find at the moment)
  - TchoBeer 5y ago
    Interesting. I wonder how compiler-dependent rule 10 is. Like, if I'm writing for a compiler that gives really bad and usually unhelpful warnings that make my code worse... but I suppose these are more very strict guidelines than rules.
    - pjc50 5y ago
      That section explicitly addresses that question and says you should rewrite it in a way that avoids the warning, since "usually unhelpful" means "sometimes critical". It's certainly an uncompromising view but that's what you get when failure is disastrous.
bombcar 5y ago
They've been known to leak memory ... https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98... >This sparked an interesting memory for me. I was once working with a customer who was producing on-board software for a missile. In my analysis of the code, I pointed out that they had a number of problems with storage leaks. Imagine my surprise when the customers chief software engineer said "Of course it leaks". He went on to point out that they had calculated the amount of memory the application would leak in the total possible flight time for the missile and then doubled that number. They added this much additional memory to the hardware to "support" the leaks. Since the missile will explode when it hits its target or at the end of its flight, the ultimate in garbage collection is performed without programmer intervention.
- TchoBeer 5y ago
  I think we've solved the GC vs Manual debate. Just add more RAM and explode your computer when it's done running
  - crazypython 5y ago
    Really, this is just region-based memory management or actor-based memory management.
    - mottosso 5y ago
      It's actually rocket-based memory management. Ba dum tss!
  - rm445 5y ago
    Very funny. But leak memory until you have to restart the process seems to be a very common strategy in practice. The programs explode even if the computer doesn't.
    - TchoBeer 5y ago
      Many moons ago I remember talking with someone who works in HFT software and they said they'd just load the system with tons of RAM because allocation/deallocation and even manual memory management was too slow.

by jb1991 5y ago

mrfusion 5y ago

Do you have a link to bjarnes writeup? My ask Jeeves skills are failing me.

LeifCarrotson 5y ago
I don't think it was actually written by Bjarne, I think it was K. Carroll and others from Lockheed Martin, but I expect the document is this one: https://www.stroustrup.com/JSF-AV-rules.pdf https://www.stroustrup.com/JSF-AV-rules.pdf which is linked from the Applications page of Bjarne's website.
- jb1991 5y ago
  Ah, thanks for the link; yes this is the one I was referring to. I had thought it was by Bjarne since it was on his site, but either way, it's an interesting read.
- maxlybbert 5y ago
  There are a couple others as well: https://stroustrup.com/autonomics09.pdf https://stroustrup.com/autonomics09.pdf https://stroustrup.com/sec09.pdf https://stroustrup.com/sec09.pdf https://stroustrup.com/mbd09.pdf https://stroustrup.com/mbd09.pdf
funklute 5y ago
This one might also be interesting https://web.cecs.pdx.edu/~kimchris/cs201/handouts/The%20Power%20of%2010%20-%20Rules%20for%20Developing%20Safety%20Critical%20Code.pdf https://web.cecs.pdx.edu/~kimchris/cs201/handouts/The%20Powe... It's basically just a quick list of 10 useful rules to follow for safety-critical code. (I've seen a different format in the past, that wasn't quite as fancy, but this is the only version I can find at the moment)
- TchoBeer 5y ago
  Interesting. I wonder how compiler-dependent rule 10 is. Like, if I'm writing for a compiler that gives really bad and usually unhelpful warnings that make my code worse... but I suppose these are more very strict guidelines than rules.
  - pjc50 5y ago
    That section explicitly addresses that question and says you should rewrite it in a way that avoids the warning, since "usually unhelpful" means "sometimes critical". It's certainly an uncompromising view but that's what you get when failure is disastrous.

bombcar 5y ago

They've been known to leak memory ... https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98... >This sparked an interesting memory for me. I was once working with a customer who was producing on-board software for a missile. In my analysis of the code, I pointed out that they had a number of problems with storage leaks. Imagine my surprise when the customers chief software engineer said "Of course it leaks". He went on to point out that they had calculated the amount of memory the application would leak in the total possible flight time for the missile and then doubled that number. They added this much additional memory to the hardware to "support" the leaks. Since the missile will explode when it hits its target or at the end of its flight, the ultimate in garbage collection is performed without programmer intervention.

TchoBeer 5y ago
I think we've solved the GC vs Manual debate. Just add more RAM and explode your computer when it's done running
- crazypython 5y ago
  Really, this is just region-based memory management or actor-based memory management.
  - mottosso 5y ago
    It's actually rocket-based memory management. Ba dum tss!
- rm445 5y ago
  Very funny. But leak memory until you have to restart the process seems to be a very common strategy in practice. The programs explode even if the computer doesn't.
  - TchoBeer 5y ago
    Many moons ago I remember talking with someone who works in HFT software and they said they'd just load the system with tons of RAM because allocation/deallocation and even manual memory management was too slow.