10 ms·

Wow, my first “real world” programming language. Heavily used in critical systems software. Our company worked on aircraft controls and Ada was pretty much the

Wow, my first “real world” programming language. Heavily used in critical systems software. Our company worked on aircraft controls and Ada was pretty much the only one “approved” by the regulators as I understood it back then. Anyone working on it currently can speak to if it’s still widely used and what this change means for Ada?

ChuckNorris89 5y ago
Didn't the F-35 move to C++? I guess any future projects will follow suit.
- bottled_poe 5y ago
  I really hope that’s inaccurate. As much as I love programming in c++, I find it very hard to believe that the same number of nines can be achieved as Ada for similar budget.
  - caslon 5y ago
    Oh don't worry, the F-35 is already a twisted vanity project of the military industrial complex largely created to siphon off as many percentage points of the US budget as possible. The goal is not nines, it's getting more executives out on the field to play Nines*. * Niche golf game.
  - Nokinside 5y ago
    See my other comment. C/C++ is used over Ada just for familiar syntax. From a safety perspective, the choice of language is inconsequential. With C/C++ the code analyzers used must do more work than with Ada but not that much. All safety-critical code uses just a tiny subset of the language. It's like programming in a different language. Line-by-line coder reviews are a must.
    - pjmlp 5y ago
      I guess Toyota forgot to get those line-by-line coder reviews. https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_...
      - erikw 5y ago
        The linked PDF doesn't seem to mention anything related specifically to C++. It says that it is possible for bit flips to affect software. They then suggest that Toyota should have used the following practices: • “Near-perfect” software • Design out single points of failure • Justify real time scheduling with analysis • Watchdog timers that have real “bite” • Good software architecture • Good safety culture This seems like mostly good concrete advice, although I think we can all agree that simply creating "near-perfect software" is a goal, not a solution. If you read up on Toyota's unintended breaking legal issues, it appears that it was most likely driver error, as Toyota did not issue a firmware change to the affected vehicles, and no software problems were ever identified.
    - MaxBarraclough 5y ago
      > From a safety perspective, the choice of language is inconsequential. Citation very much needed. Some safety-critical projects choose to use Ada over C or C++, despite that there are far fewer Ada programmers out there, and that there are fewer development tools for Ada. The people running those projects presumably disagree with you. We know that the choice of language is very consequential regarding cybersecurity. The many foot-guns of C and C++ are the root of a significant fraction of security vulnerabilities. Saying that these same foot-guns are of no consequence in safety-critical software seems like a remarkable claim. This document [0] explicitly disagrees with your position that language is of little consequence. (Not to gloss over that it appears to have been funded by AdaCore, who are of course motivated to reach that conclusion.) [0] See especially page 12: (PDF) https://www.adacore.com/uploads/techPapers/Controlling-Costs-with-Software-Language-Choice-AdaCore-VDC-WP.PDF https://www.adacore.com/uploads/techPapers/Controlling-Costs...
    - Raphael_Amiard 5y ago
      > C/C++ is used over Ada just for familiar syntax. From a safety perspective, the choice of language is inconsequential. With C/C++ the code analyzers used must do more work than with Ada but not that much. That is completely and utterly false despite the millions (billions ?) invested in trying to make sound & safe static analysis tools for C/C++. I know you're trying to push that message but it couldn't be further from the truth. The nature of C & C++ is such that you cannot avoid unsafety, even with very restricted subsets. Disclaimer: I work on Ada tools, but have also worked on C/C++ tools. I have also studied MISRA C and worked on such static analyzers for C & C++.
      - Nokinside 5y ago
        Have you studied: https://www.absint.com/astree/index.htm https://www.absint.com/astree/index.htm
- pjmlp 5y ago
  You mean the highly successful and timely delivered F-35 project?
  - p_l 5y ago
    A non-trivial part of the problems is related to non-flying software, ALIS (now renamed ODIN, when the contract to redo it was awarded to the same people who fucked it up first). Knowing Lockheed-Martin, it's horrible mess of Java and JavaScript gathered from random geocities pages in 1990s.
    - trhway 5y ago
      >Knowing Lockheed-Martin, it's horrible mess of Java and JavaScript gathered from random geocities pages in 1990s well, it fits that the F-35 started as a horrible mess of JSF requirements bolted on top of Yak-141 from 1980s :)
- deleted 5y ago
  [deleted]
- Nokinside 5y ago
  Yes. C/C++ is used over Ada just for familiar syntax. The coding standards used for safety-critical projects limit the features into a tiny safe subset, Essentially DSL. Linters and code checkers and static analyzers check the code more thoroughly than the compiler does. For example, all memory is allocated during initialization. No allocation or reallocation from the heap afterward. That's why you see in the weapon specs familiar magic numbers like can track 256 targets simultaneously. Commerical code analyzers used in the military, aviation, etc. are good but expensive. I have used https://www.absint.com/astree/index.htm https://www.absint.com/astree/index.htm JOINT STRIKE FIGHTER AIR VEHICLE C++ CODING STANDARDS FOR THE SYSTEM DEVELOPMENT AND DEMONSTRATION PROGRAMDocument Number2RDU00001 Rev C December 2005 https://www.stroustrup.com/JSF-AV-rules.pdf https://www.stroustrup.com/JSF-AV-rules.pdf
  - zurn 5y ago
    Ada and C++ are worlds apart, how is it possible to come so close as to be "just syntax" with static analyzers and their known limitations? Unless we are talking about all programming languages being "just syntax" for a turing machine...
    - OnlyOneCannolo 5y ago
      I think they're saying that the switch was justified because the workforce is no longer familiar with Ada.
      - Jtsummers 5y ago
        More importantly the workforce is familiar with C/C++, how it’s listed on so many job listings. Which is kind of sad as a requirement. A programmer who can’t become productive with Ada after a few weeks (productive, not masterful) is not the kind of programmer anyone should be hiring for any job. The syntax is (almost) dead simple, for a reason.
        OnlyOneCannolo 5y ago
        Edit: Retracting my whole comment for being wrong.
- protomyth 5y ago
  If I remember correctly the F-22 is Ada and the F-35 is C++.
  - WoodenChair 5y ago
    Probably a good analogy for the languages too. One tries to do one thing well, the other tries be all things to all users and does them all mediocrely.

ChuckNorris89 5y ago

Didn't the F-35 move to C++? I guess any future projects will follow suit.

bottled_poe 5y ago
I really hope that’s inaccurate. As much as I love programming in c++, I find it very hard to believe that the same number of nines can be achieved as Ada for similar budget.
- caslon 5y ago
  Oh don't worry, the F-35 is already a twisted vanity project of the military industrial complex largely created to siphon off as many percentage points of the US budget as possible. The goal is not nines, it's getting more executives out on the field to play Nines*. * Niche golf game.
- Nokinside 5y ago
  See my other comment. C/C++ is used over Ada just for familiar syntax. From a safety perspective, the choice of language is inconsequential. With C/C++ the code analyzers used must do more work than with Ada but not that much. All safety-critical code uses just a tiny subset of the language. It's like programming in a different language. Line-by-line coder reviews are a must.
  - pjmlp 5y ago
    I guess Toyota forgot to get those line-by-line coder reviews. https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_...
    - erikw 5y ago
      The linked PDF doesn't seem to mention anything related specifically to C++. It says that it is possible for bit flips to affect software. They then suggest that Toyota should have used the following practices: • “Near-perfect” software • Design out single points of failure • Justify real time scheduling with analysis • Watchdog timers that have real “bite” • Good software architecture • Good safety culture This seems like mostly good concrete advice, although I think we can all agree that simply creating "near-perfect software" is a goal, not a solution. If you read up on Toyota's unintended breaking legal issues, it appears that it was most likely driver error, as Toyota did not issue a firmware change to the affected vehicles, and no software problems were ever identified.
  - MaxBarraclough 5y ago
    > From a safety perspective, the choice of language is inconsequential. Citation very much needed. Some safety-critical projects choose to use Ada over C or C++, despite that there are far fewer Ada programmers out there, and that there are fewer development tools for Ada. The people running those projects presumably disagree with you. We know that the choice of language is very consequential regarding cybersecurity. The many foot-guns of C and C++ are the root of a significant fraction of security vulnerabilities. Saying that these same foot-guns are of no consequence in safety-critical software seems like a remarkable claim. This document [0] explicitly disagrees with your position that language is of little consequence. (Not to gloss over that it appears to have been funded by AdaCore, who are of course motivated to reach that conclusion.) [0] See especially page 12: (PDF) https://www.adacore.com/uploads/techPapers/Controlling-Costs-with-Software-Language-Choice-AdaCore-VDC-WP.PDF https://www.adacore.com/uploads/techPapers/Controlling-Costs...
  - Raphael_Amiard 5y ago
    > C/C++ is used over Ada just for familiar syntax. From a safety perspective, the choice of language is inconsequential. With C/C++ the code analyzers used must do more work than with Ada but not that much. That is completely and utterly false despite the millions (billions ?) invested in trying to make sound & safe static analysis tools for C/C++. I know you're trying to push that message but it couldn't be further from the truth. The nature of C & C++ is such that you cannot avoid unsafety, even with very restricted subsets. Disclaimer: I work on Ada tools, but have also worked on C/C++ tools. I have also studied MISRA C and worked on such static analyzers for C & C++.
    - Nokinside 5y ago
      Have you studied: https://www.absint.com/astree/index.htm https://www.absint.com/astree/index.htm
pjmlp 5y ago
You mean the highly successful and timely delivered F-35 project?
- p_l 5y ago
  A non-trivial part of the problems is related to non-flying software, ALIS (now renamed ODIN, when the contract to redo it was awarded to the same people who fucked it up first). Knowing Lockheed-Martin, it's horrible mess of Java and JavaScript gathered from random geocities pages in 1990s.
  - trhway 5y ago
    >Knowing Lockheed-Martin, it's horrible mess of Java and JavaScript gathered from random geocities pages in 1990s well, it fits that the F-35 started as a horrible mess of JSF requirements bolted on top of Yak-141 from 1980s :)
deleted 5y ago
[deleted]
Nokinside 5y ago
Yes. C/C++ is used over Ada just for familiar syntax. The coding standards used for safety-critical projects limit the features into a tiny safe subset, Essentially DSL. Linters and code checkers and static analyzers check the code more thoroughly than the compiler does. For example, all memory is allocated during initialization. No allocation or reallocation from the heap afterward. That's why you see in the weapon specs familiar magic numbers like can track 256 targets simultaneously. Commerical code analyzers used in the military, aviation, etc. are good but expensive. I have used https://www.absint.com/astree/index.htm https://www.absint.com/astree/index.htm JOINT STRIKE FIGHTER AIR VEHICLE C++ CODING STANDARDS FOR THE SYSTEM DEVELOPMENT AND DEMONSTRATION PROGRAMDocument Number2RDU00001 Rev C December 2005 https://www.stroustrup.com/JSF-AV-rules.pdf https://www.stroustrup.com/JSF-AV-rules.pdf
- zurn 5y ago
  Ada and C++ are worlds apart, how is it possible to come so close as to be "just syntax" with static analyzers and their known limitations? Unless we are talking about all programming languages being "just syntax" for a turing machine...
  - OnlyOneCannolo 5y ago
    I think they're saying that the switch was justified because the workforce is no longer familiar with Ada.
    - Jtsummers 5y ago
      More importantly the workforce is familiar with C/C++, how it’s listed on so many job listings. Which is kind of sad as a requirement. A programmer who can’t become productive with Ada after a few weeks (productive, not masterful) is not the kind of programmer anyone should be hiring for any job. The syntax is (almost) dead simple, for a reason.
      - OnlyOneCannolo 5y ago
        Edit: Retracting my whole comment for being wrong.
protomyth 5y ago
If I remember correctly the F-22 is Ada and the F-35 is C++.
- WoodenChair 5y ago
  Probably a good analogy for the languages too. One tries to do one thing well, the other tries be all things to all users and does them all mediocrely.