4 ms·

One of the reasons aircrafts like Boeing runs on safer languages like Ada. There's a pretty cool article about it: http://archive.adaic.com/projects/atwork/boe

by hu3 5y ago

One of the reasons aircrafts like Boeing runs on safer languages like Ada. There's a pretty cool article about it: http://archive.adaic.com/projects/atwork/boeing.html http://archive.adaic.com/projects/atwork/boeing.html edit: To those stating it was C++ portion of the compiler code at fault. That's not the point. Ada offers greater protection against segfaults than Rust. Not to mention that part of the compiler still being written in C++ and not Rust doesn't bode well.

johnisgood 5y ago
This is going to invite all the people who know nothing about the language and the circumstances with regarding to Ariane 5. :)
- hu3 5y ago
  Agreed. To those seeking more information about this, I always refer to this article because of the links it contains: http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/Research/Rvs/Misc/Additional/Reports/ariane.html http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/...
__jem 5y ago
I didn’t read that closely, but isn’t this is a segfault in the compiler, not a miscompilation?
- titzer 5y ago
  Nothing inspires confidence like the compiler crashing. Given C/C++'s attitude towards UB, a crash just means you got lucky and the program really f'd up before doing something seriously nefarious like silent memory corruption or carrying on with nonsensical results....
  - kelnos 5y ago
    As a practical matter, though, I'd much rather the compiler segfault, than miscompile my code so it does something incorrect at runtime. But agreed that seeing a compiler segfault doesn't inspire confidence!
    - titzer 5y ago
      Me too!
- gpm 5y ago
  Yes. A segfault in the portion of the compiler written in C++ no less, though triggered by invalid input from the portion of the compiler written in rust (due to a logic bug). Unless GPs point is that "rust code can still have bugs" (so can ADA) or "the rust compiler still has bugs" (I'm willing to bet so do all ADA compilers) I don't see how this supports his claim.
  - touisteur 5y ago
    I can confirm. I myself or our teams find compiler bugs every year or so, going from pure compiler crashes, to generate code that segfaults yay. Bugs are everywhere. Ada helps you with some categories of bugs and crashes but saying you can't segfault an Ada application is laughingly untrue. I manage that frequently on legacy codebases. And BTW, for the customer, a segfault or an uncaught top-level exception have the same effect. A crash.
theamk 5y ago
This article compares Ada with C and PL/1. This is pretty easy to win - its hard to imagine language less safe than C.
msla 5y ago
https://yarchive.net/comp/ada.html https://yarchive.net/comp/ada.html (Marc H. Donner and David H. Jameson, "Language and Operating System Features for Real-time Programming", Computing Systems vol 1 number 1, winter 1988, pp 33-62): > Ill-chosen abstraction is particularly evident in the design of the Ada runtime system. The interface to the Ada runtime system is so opaque that it is impossible to model or predict its performance, making it effectively useless for real-time systems. More: https://catless.ncl.ac.uk/Risks/6/36#subj12 https://catless.ncl.ac.uk/Risks/6/36#subj12 > Am I correct in thinking that several (two?) missiles were recently destroyed on launch each of which had their guidance systems coded in Ada? Were the problems which forced the destruction of the missiles the result of bad software design or some inherent ambiguity in Ada syntax? > I spotted but unfortunately left unlogged a report somewhere which gave an account of a talk by a leading scientist (name?) in the military technology area who expressed grave reservations about the design of Ada. I think the report mentioned that the person expressed little confidence in guidance systems coded in Ada.
- cpgxiii 5y ago
  In light of decades of demonstrated reliability of Ada use in aerospace applications, a bunch of comments about Ada from the late 1980s are meaningless.
  - zozbot234 5y ago
    The quoted comment is saying that the Ada support runtime is so high level that it sometimes ends up being unsuitable for real-time programming. This is exactly the kind of concern that would be hard to improve even in recent versions of Ada, whereas it is naturally addressed by Rust.
    - pjmlp 5y ago
      Except it ignores the little detail of stuff like Ravescar profile. https://en.wikipedia.org/wiki/Ravenscar_profile https://en.wikipedia.org/wiki/Ravenscar_profile
    - touisteur 5y ago
mbrubeck 5y ago
> Not to mention that part of the compiler still being written in C++ and not Rust doesn't bode well. The Ada compilers I'm familiar with are also written partly or entirely in C or C++.
touisteur 5y ago
GNAT is a frontend (written in Ada yes) to GCC which might be one of the strangest pieces of C++ code in this world. And don't go there with AdaCore's SPARK examiner/prover implementation either because it's mostly an Ada frontend to Why3 (I'm simplifying) and you don't want to know what's behind Z3, CVC4 and Altergo. I'm a huge fan of SMT tech but I'm glad I don't have to open the hood. These tools are enablers. Would it be nice to have an all-Ada compiler? Well, no! I want most of the gcc engineers to work for me! As long as the gcc backend improves, I get more perf! As long as SMT tools improve I get faster automated proof of contracts, or automated proof of far more complex contracts!

by hu3 5y ago

johnisgood 5y ago

This is going to invite all the people who know nothing about the language and the circumstances with regarding to Ariane 5. :)

hu3 5y ago
Agreed. To those seeking more information about this, I always refer to this article because of the links it contains: http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/Research/Rvs/Misc/Additional/Reports/ariane.html http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/...

__jem 5y ago

I didn’t read that closely, but isn’t this is a segfault in the compiler, not a miscompilation?

titzer 5y ago
Nothing inspires confidence like the compiler crashing. Given C/C++'s attitude towards UB, a crash just means you got lucky and the program really f'd up before doing something seriously nefarious like silent memory corruption or carrying on with nonsensical results....
- kelnos 5y ago
  As a practical matter, though, I'd much rather the compiler segfault, than miscompile my code so it does something incorrect at runtime. But agreed that seeing a compiler segfault doesn't inspire confidence!
  - titzer 5y ago
    Me too!
gpm 5y ago
Yes. A segfault in the portion of the compiler written in C++ no less, though triggered by invalid input from the portion of the compiler written in rust (due to a logic bug). Unless GPs point is that "rust code can still have bugs" (so can ADA) or "the rust compiler still has bugs" (I'm willing to bet so do all ADA compilers) I don't see how this supports his claim.
- touisteur 5y ago
  I can confirm. I myself or our teams find compiler bugs every year or so, going from pure compiler crashes, to generate code that segfaults yay. Bugs are everywhere. Ada helps you with some categories of bugs and crashes but saying you can't segfault an Ada application is laughingly untrue. I manage that frequently on legacy codebases. And BTW, for the customer, a segfault or an uncaught top-level exception have the same effect. A crash.

theamk 5y ago

This article compares Ada with C and PL/1. This is pretty easy to win - its hard to imagine language less safe than C.

msla 5y ago

https://yarchive.net/comp/ada.html https://yarchive.net/comp/ada.html (Marc H. Donner and David H. Jameson, "Language and Operating System Features for Real-time Programming", Computing Systems vol 1 number 1, winter 1988, pp 33-62): > Ill-chosen abstraction is particularly evident in the design of the Ada runtime system. The interface to the Ada runtime system is so opaque that it is impossible to model or predict its performance, making it effectively useless for real-time systems. More: https://catless.ncl.ac.uk/Risks/6/36#subj12 https://catless.ncl.ac.uk/Risks/6/36#subj12 > Am I correct in thinking that several (two?) missiles were recently destroyed on launch each of which had their guidance systems coded in Ada? Were the problems which forced the destruction of the missiles the result of bad software design or some inherent ambiguity in Ada syntax? > I spotted but unfortunately left unlogged a report somewhere which gave an account of a talk by a leading scientist (name?) in the military technology area who expressed grave reservations about the design of Ada. I think the report mentioned that the person expressed little confidence in guidance systems coded in Ada.

cpgxiii 5y ago
In light of decades of demonstrated reliability of Ada use in aerospace applications, a bunch of comments about Ada from the late 1980s are meaningless.
- zozbot234 5y ago
  The quoted comment is saying that the Ada support runtime is so high level that it sometimes ends up being unsuitable for real-time programming. This is exactly the kind of concern that would be hard to improve even in recent versions of Ada, whereas it is naturally addressed by Rust.
  - pjmlp 5y ago
    Except it ignores the little detail of stuff like Ravescar profile. https://en.wikipedia.org/wiki/Ravenscar_profile https://en.wikipedia.org/wiki/Ravenscar_profile
  - touisteur 5y ago

mbrubeck 5y ago

> Not to mention that part of the compiler still being written in C++ and not Rust doesn't bode well. The Ada compilers I'm familiar with are also written partly or entirely in C or C++.

touisteur 5y ago

GNAT is a frontend (written in Ada yes) to GCC which might be one of the strangest pieces of C++ code in this world. And don't go there with AdaCore's SPARK examiner/prover implementation either because it's mostly an Ada frontend to Why3 (I'm simplifying) and you don't want to know what's behind Z3, CVC4 and Altergo. I'm a huge fan of SMT tech but I'm glad I don't have to open the hood. These tools are enablers. Would it be nice to have an all-Ada compiler? Well, no! I want most of the gcc engineers to work for me! As long as the gcc backend improves, I get more perf! As long as SMT tools improve I get faster automated proof of contracts, or automated proof of far more complex contracts!