5 ms·

The Integrated Navigation and Weapons System (INWS) developed by ATE Aerospace for the Hawk Mk.120 was written entirely in C, was DO-178B-certified, ran to a mi

by _djo_ 14y ago

The Integrated Navigation and Weapons System (INWS) developed by ATE Aerospace for the Hawk Mk.120 was written entirely in C, was DO-178B-certified, ran to a million lines of code and cost approximately $100 million for the development of the software and hardware combined. The software includes integration all the standard military navigation and weapons targeting and control functionality, along with a secure datalink using the Link-ZA protocol and a nifty radar simulation system (basically an airborne LAN for air-to-air training) that runs over it. They just delivered the latest iteration of the software which allows them to receive data-linked air picture information from other aircraft, such as an AWACS platform. Throughout all this the project has had no major snags, has missed no deadlines and has come in on budget. So my point being that it's possible to write complex safety-critical software in C if your processes and programmers are good enough and you're willing to pay about $100 million for it.

ajross 14y ago
You don't need to look that far afield. Literally everything runs over a kernel written in C. But that being said: this is just proof that it "can" be done, not that there aren't better choices. Specifically, could you do a missile management system in less than a million lines of code or for less than $100M with equivalent performance and quality on another platform? I think most of our intuitions would agree that you could.
- alexchamberlain 14y ago
  Literally?
  - ajross 14y ago
    Meaningless semantic quibble. Yes, "literally" everything. Or everything worth talking about anyway. Do you have a counter example of a complete system seeing active development in the modern world without any use of C at all? I certainly can't think of one.
    - alexchamberlain 14y ago
      Of course, many micros are still programmed in assembly. And assembly still plays a big part in many subsystems, though I would concede much would be written in C. Not literally everything.
      - ajross 14y ago
        I'm aware of no microcontroller work in the modern world that is done solely in machine code. Again, you have a counterexample?
        daeken 14y ago
        I write assembly for microcontrollers constantly. If you require reliable timing at the cycle level, you have absolutely no choice in the matter.
        ajross 14y ago
        Sure. But you don't write a system only in assembly. The point, now buried in this silly thread, was alexchamberlain's nit that it wasn't "literally" true that all systems are built on top of C kernels (whether it be an OS kernel, firmware, whatever).
        alexchamberlain 14y ago
        You can call me what you like and if you'd said "everything" instead of "literally everything", I would have let it slide. You were being quite misleading.
        ajross 14y ago
        Given that you haven't provided a single counterexample, I can't see how I'm being misleading. All modern systems are built on C. All of them. And for the record, I didn't call you anything. A "nit" is a pedantic correction, c.f "nitpicking". I could have said "quibble" too. It's a reference to your words, not you.
- dkersten 14y ago
  As far as I'm aware, a lot of the safety critical certification requires the entire stack to be certified, in which case the OS (which would probably be a hard-realtime OS) would be certified too. Probably part of the $100M price tag is a hefty license fee to use said OS.
  - _djo_ 14y ago
    Yep, unfortunately I don't know which OS they went for but it was one of the commercially-available RTOSes on the market. Those don't come cheap. Avionics software certification is phenomenally expensive. Both Airbus and Boeing have warned in recent years that it has become such a big part of their development costs that they're concerned about it becoming unsustainable.
derefr 14y ago
Emphasis especially here: > if your processes ... are good enough I would say that it's possible to write complex safety-critical software in any language, provided it's completely specified beforehand in, well, military detail. This program was likely done when that spec hit the programmers' desks--the project from that point on basically consisted of transforming pseudocode to language-of-choice-X without mucking anything up in the process.
- _djo_ 14y ago
  Not all languages lend themselves to formal certification, which is why such mission-critical software is typically written only in C, C++ or Ada. And while the specification process is obviously extremely extensive, it's only a part of the total process and not a guarantee of bug-free code. Many of these projects have gone pear-shaped during the implementation phase despite having good specifications. So that's why having good programmers, a good development process, solid libraries and great tooling is so important for the implementation phase. Especially because the requirements always change during development, even for mission-critical military avionics software. One of the main problems with the F-35 program is that the implementation phase for the development of the plane's software has gone badly wrong. It's already by far the most expensive avionics program ever. Finally the testing phase is super-critical. ATE designed their own extremely thorough testing setup, ranging from software verifiers to full-scale test-benches to simulate on the ground the full range of software functionality in flight. It's a difficult process that's very easy to get wrong as a result of the incredible complexity of modern avionics and weapons systems. I am in awe of those teams that get it right.
  - mietek 14y ago
    There is nothing about C or C++ which would make programs written in these languages especially suitable for formal verification. You could argue the one language which actually does lend itself to formal verification is the one which has been formally specified via operational semantics; namely, Standard ML.
    - a-priori 14y ago

by _djo_ 14y ago

ajross 14y ago

You don't need to look that far afield. Literally everything runs over a kernel written in C. But that being said: this is just proof that it "can" be done, not that there aren't better choices. Specifically, could you do a missile management system in less than a million lines of code or for less than $100M with equivalent performance and quality on another platform? I think most of our intuitions would agree that you could.

alexchamberlain 14y ago
Literally?
- ajross 14y ago
  Meaningless semantic quibble. Yes, "literally" everything. Or everything worth talking about anyway. Do you have a counter example of a complete system seeing active development in the modern world without any use of C at all? I certainly can't think of one.
  - alexchamberlain 14y ago
    Of course, many micros are still programmed in assembly. And assembly still plays a big part in many subsystems, though I would concede much would be written in C. Not literally everything.
    - ajross 14y ago
      I'm aware of no microcontroller work in the modern world that is done solely in machine code. Again, you have a counterexample?
      - daeken 14y ago
        I write assembly for microcontrollers constantly. If you require reliable timing at the cycle level, you have absolutely no choice in the matter.
        ajross 14y ago
        Sure. But you don't write a system only in assembly. The point, now buried in this silly thread, was alexchamberlain's nit that it wasn't "literally" true that all systems are built on top of C kernels (whether it be an OS kernel, firmware, whatever).
        alexchamberlain 14y ago
        You can call me what you like and if you'd said "everything" instead of "literally everything", I would have let it slide. You were being quite misleading.
        ajross 14y ago
        Given that you haven't provided a single counterexample, I can't see how I'm being misleading. All modern systems are built on C. All of them. And for the record, I didn't call you anything. A "nit" is a pedantic correction, c.f "nitpicking". I could have said "quibble" too. It's a reference to your words, not you.
dkersten 14y ago
As far as I'm aware, a lot of the safety critical certification requires the entire stack to be certified, in which case the OS (which would probably be a hard-realtime OS) would be certified too. Probably part of the $100M price tag is a hefty license fee to use said OS.
- _djo_ 14y ago
  Yep, unfortunately I don't know which OS they went for but it was one of the commercially-available RTOSes on the market. Those don't come cheap. Avionics software certification is phenomenally expensive. Both Airbus and Boeing have warned in recent years that it has become such a big part of their development costs that they're concerned about it becoming unsustainable.

derefr 14y ago

Emphasis especially here: > if your processes ... are good enough I would say that it's possible to write complex safety-critical software in any language, provided it's completely specified beforehand in, well, military detail. This program was likely done when that spec hit the programmers' desks--the project from that point on basically consisted of transforming pseudocode to language-of-choice-X without mucking anything up in the process.

_djo_ 14y ago
Not all languages lend themselves to formal certification, which is why such mission-critical software is typically written only in C, C++ or Ada. And while the specification process is obviously extremely extensive, it's only a part of the total process and not a guarantee of bug-free code. Many of these projects have gone pear-shaped during the implementation phase despite having good specifications. So that's why having good programmers, a good development process, solid libraries and great tooling is so important for the implementation phase. Especially because the requirements always change during development, even for mission-critical military avionics software. One of the main problems with the F-35 program is that the implementation phase for the development of the plane's software has gone badly wrong. It's already by far the most expensive avionics program ever. Finally the testing phase is super-critical. ATE designed their own extremely thorough testing setup, ranging from software verifiers to full-scale test-benches to simulate on the ground the full range of software functionality in flight. It's a difficult process that's very easy to get wrong as a result of the incredible complexity of modern avionics and weapons systems. I am in awe of those teams that get it right.
- mietek 14y ago
  There is nothing about C or C++ which would make programs written in these languages especially suitable for formal verification. You could argue the one language which actually does lend itself to formal verification is the one which has been formally specified via operational semantics; namely, Standard ML.
  - a-priori 14y ago