12 ms·

Ada and SPARK enter the automotive ISO-26262 market with Nvidia

116 points by gneuromante 1y ago

FirmwareBurner 1y ago
But why? The US military abandoned Ada for the F-35 and moved to C++ instead. Is it me or are they moving backwards?
- firesteelrain 1y ago
  Language selection is no panacea for bad systems engineering or poor project management
  - anthk 1y ago
    It helps on security and correctness. Either you are a Forth like guy/gal stating how a firmware will work at every level (low, med, high, every one), cutting down every flaw by getting it as small and predictable as possible (even by ditching floats for rationals and decimal scaling), or a high level Lisp/CL/Java/C# guy with a garbage collector and some memory safety. And Java/C# and some Lisps aren't nowhere as strict on that as ADA.
    - firesteelrain 1y ago
      I have worked on safety crucial systems and applications that interact with safety critical systems in a non safety critical language. Each time it never had anything to do with the language and everything to do with systems engineering and project management. The projects that were successful had excellent systems engineering and project management. Language choice was never a factor.
      - zppln 1y ago
        This is my experience as well. People need to ask themselves what benefits Rust would bring to an high assurance system (e.g. DO-178C Level A). You're not gonna want to malloc mid-flight even if you have a borrow checker. The entire point of e.g. DO-178C is to show that the software only does exactly what it is supposed to do under all assumptions and have any derived behavior fed back to the safety process for evaluation. Software can never in itself make a system safe. All that aside, modern tooling may be more ergonomic etc so I'm not saying languages like Rust shouldn't be considered, they just aren't as useful here as I think a lot of people assume.
        firesteelrain 1y ago
        I personally know of teams using modern tooling and expansive cloud based CI/CD with safety critical systems and we are talking hundreds of developers. This is in C++ with MISRA standards and DO-178 too.
        bb88 1y ago
        I don't think it's fair to say C++ is safe and reliable as is. The only way it could be made safe is with a restricted version of C++. I'm reminded by mozilla's sign "You must be this tall to write threaded code." [1] How much do you restrict your language and libraries to make it safe? Like custom templates? How do you define ownership of objects and lifetimes -- or just malloc everything all at once? [1] https://bholley.net/blog/2015/must-be-this-tall-to-write-multi-threaded-code.html https://bholley.net/blog/2015/must-be-this-tall-to-write-mul...
        zppln 1y ago
        We use C++ at my shop for Level A and of course we very much restrict it. But the restrictions are more due to reducing the scope of what you need to show for your compiler. > or just malloc everything all at once? Yes! But here's the thing: this isn't done due to the footguns associated with memory management, it is done because you want as little dynamic behavior as possible. For Level A software you need to show that your software has both bounded execution time and memory usage, and be robust against all inputs. Achieving that is so much easier without dynamic memory management. Also, another thing to keep in mind is that DO-178 has you show that your software requirements are traceable to system requirements, your software design to your software requirements, your source code to your software design and your object code to your source code. But testing should be requirements based. So if your compiler inserts a bounds check now you have object code not traceable to source code and for which you won't have coverage because your requirement mention it. But what if you mention it in your requirements? Well, then you'd have to implement it manually in source code to uphold traceability anyway... I will caveat the above by saying that other players may interpret things differently or have found ways to do things more cleverly.
        1y ago
- gneuromante 1y ago
  It was the US military who moved backwards.
- bb88 1y ago
  SPARK formal verification is a big win. Ada is also simpler than C++. However, the tooling for Ada was never as good as C++ tooling.
  - firesteelrain 1y ago
    GNAT, AUnit, VectorCAST are all good. AUnit isn’t compatible with Ada 95 though
- johnnyjeans 1y ago
  you mean the plane plagued with software development issues[1][2]? even ignoring the obnoxious yellow journalism, i'm not sure it's a shining beacon of best practices. or that replacing one ancient language with an even more ancient language is "moving forwards." particularly when the language you're replacing was explicitly designed for your domain, and the language you're replacing it with is an entropic event horizon from which no coherent thoughtform can escape. [1] - https://www.dote.osd.mil/Portals/97/pub/reports/FY2024/other/2024Annual-Report.pdf?ver=WLJFmx7nkeDHIuvrtKyfGQ%3d%3d https://www.dote.osd.mil/Portals/97/pub/reports/FY2024/other... [2] - https://www.gao.gov/products/gao-24-107177 https://www.gao.gov/products/gao-24-107177
- nabla9 1y ago
  It was not for technical reasons. They needed more programmers and C++ had larger user base. Ada is technically better choice.
  - CivBase 1y ago
    It has more to do with tooling than programmers. C++ is used everywhere so there are many commercial tools to support it. Not so much for Ada. Ada's developmemt tools are fewer, less featued, and more costly due to low demand.
    - johnisgood 1y ago
      > Ada's developmemt tools are fewer, less featued Such as?
      - dardeaup 1y ago
        Regarding the number of options, C++ has quite a few IDEs: Visual Studio, Xcode, VSCode, CLion, and probably more (Oracle probably still sells the one they had for Solaris). For command-line compilers, C++ has: Visual Studio, Xcode, g++, clang++, IBM C++ compilers for their OSs, Oracle compilers for Solaris, etc. For Ada, is there anything other than AdaCore? Is that the same as GNATStudio? Edit* - fixed Ada capitalization
        cjbgkagh 1y ago
        I think IBM Rational Ada was a thing back then. Never used it but heard stories about it.
        cjbgkagh 1y ago
        I should add, what I was told is that they were amazing, especially the pre-IBM Rational stuff. Rational was acquired by IBM in 2003. I was working on tech adjacent to the JSF (F35). I was told by a guy working on the JSF that the extra bugs from C++ would mean better job security and he was 100% right. It’s pretty much that conversation that triggered my move into high tech and away from military. I think it’s a shame that IBM happened to Rational, a lot of nascent good ideas pretty much disappeared or were mangled beyond recognition.
- seabird 1y ago
  Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. I get that there's more tools for C++ but first class formal verification support and a language that's generally designed to save you from yourself seems like something you would stand your ground on. Ada is supremely good at killing people and/or keeping them un-killed, there's a reason you still see it kicking around in defense and aerospace despite the common perception that it's a bygone relic.
  - FirmwareBurner 1y ago
    >Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. Do you think the auto industry will have a easier time finding Ada talent at their pay rates? Or that talent will want to specialize into Ada just to pigeonhole themselves into the Automotive jobs market?
    - cmrdporcupine 1y ago
      As a Rust + C++ developer (in medical right now, and vehicle before that) I see no reason why I couldn't also pick up Ada as one of many skill sets. I have an Ada95 manual on my bookshelf from years ago that I bought out of curiosity -- frankly for senior level talent the language syntax is the easiest thing to pick up it's the intricacies of an existing code base and business domain that is the hard part of joining a new project and that is generally language independent. Arguably picking up Rust -- with its frankly exotic value passing and ownership semantics -- is much harder than learning Ada.
      - FirmwareBurner 1y ago
        > I see no reason why I couldn't also pick up Ada as one of many skill sets Low wages and the negative resume drive development might be reasons. Believe it or not, pigeon holing yourself in niche/uncool tech for years, can and will negatively impact your future hiring prospects at good jobs, since hiring in tech is broken and HR selects resumes on buzzwords and on your "last X years of experience in Y framework".
- pjmlp 1y ago
  Ever wondered why F-35 is so famous for software bugs, including in-flight reboot from avionics?
  - fransje26 1y ago
    Since Lockheed struck a deal with the government allowing them to no longer communicate the number of issues encountered on the F-35 program, news reports have only been writing about how it has been the best thing since sliced bread. (Save for the mishaps happening from time to time..) Which is entertaining, because until that point (2021, if memory serves?) it was encountering an ever increasing number of critical issues needing resolving, a double dozen of which would be lethal to the pilot flying. The backlog stood at 800+ issues at the time. Some of the software issues were so serious that they were considered beyond salvageable at the time, despite having already gone through a full re-write from scratch cycle..
  - FirmwareBurner 1y ago
    Are those bugs because of C++, or because of bad programing skills and practices? No programming language can save you from bugs if you hire people who don't know what they're doing. I used to work in automotive when a lot of the critical safety SW was only assembly and the end product didn't have any critical bugs. Maybe Lockheed just has shitty programmers who don't know what they're doing because the US defense industry is incompetent and the US SW jobs market top heavy where talent who does know how to use C++ right goes to big-tech and not on-site at some defense contractor? To me that's not the fault of C++.
    - tialaramex 1y ago
      Not all programming languages are equal when it comes to the skill needed to deliver correct software. Since a large project necessarily can expect only to bring merely ordinary skill to the problem if that's not enough they're in trouble, even if superlative skill would have succeeded that's not what they have. C++ iterators are a big example of this problem. In the most skilled hands these are a very powerful technology, excellent performance yet tremendous flexibility - but they have a lot of footguns. So do you choose to accept the high defect rates when your ordinary programmers shoot themselves in the foot, or do you neuter this powerful technique to reduce those defects but suffer significant performance problems ?
transpute 1y ago
Ada/SPARK root of trust anchors Nvidia GPU market segmentation licensing, 50% profit margin and $3T market cap. "Nvidia Security Team: “What if we just stopped using C?”, 170 comments (2022), https://news.ycombinator.com/item?id=42998383 https://news.ycombinator.com/item?id=42998383
atlgator 1y ago
Wow. I developed in Ada in aerospace 17 years ago. I thought the industry would move toward Rust.
- steveklabnik 1y ago
  Rust is also making inroads, probably the most famous example is there’s two models of Volvo shipping today that rely on it.
- cashsterling 1y ago
  Yeah... my intro CS class was in C and Ada95 (I'm not a CS guy btw, just took the class). I actually preferred Ada over C... but continued to program in C for other classes because of compiler availability; I had to do all my Ada programming on Sparc workstations at school. I personally think that AdaCore, and friends, missed an opportunity in the early 2000's to fully embrace open source... they left a big gap which Rust has filled nicely. I still think Ada is a great programming language. When a question comes up along the lines of: "what's the best programming language nobody's heard of?", or "what's the best programming language that is under used?" Ada is usually my first answer. I think other good answers include F#, <insert LISP flavor>, Odin, Prolog, Haxe, and Futhark (if you're into that sort of thing).
  - pjmlp 1y ago
    We are on Ada 202x nowadays being discussed, and in a world where FOSS tool makers have problems making a sustainable business, always changing licenses, there are still 7 Ada vendors selling compilers.
    - anthk 1y ago
      Libre compilers do not impose restrictions on output.
      - pjmlp 1y ago
        As long as there are enough people around to actually work on them.
pfdietz 1y ago
Are auto companies going with error correction in memory? I'm thinking of the Toyota unintended acceleration problem. https://www.slideshare.net/slideshow/toyota-unintended-acceleration/39277734 https://www.slideshare.net/slideshow/toyota-unintended-accel...
- marze 1y ago
  Wasn't a correlation with elderly drivers and the unintended accretion found in the Toyota cases?
  - f1shy 1y ago
    Just because they could not handle it. It happened to many people, young people hndled that better.
  - pfdietz 1y ago
    How about a difference between Toyotas and non-Toyotas? It's not like elderly drivers are unique to Toyotas. Also, unintended acceleration seems to have gone away. The control hardware has been changed; driver age, not so much.
    - marze 1y ago
      References?
      - pfdietz 1y ago
        https://capitolweekly.net/toyota-has-settled-hundreds-of-sudden-acceleration-cases/ https://capitolweekly.net/toyota-has-settled-hundreds-of-sud...
  - nickpsecurity 1y ago
    It happened to me. I sure wasn't elderly. The only thing that stopped a crash was shifting into neutral and hitting the brakes. Then, I was sitting there with the engine revving loudly for no reason. Car behind me started backing up. I decided to just shut it off and turn it back on. It went away. Scary stuff. Especially since I had no idea why it happened.
deleted 1y ago
[deleted]

116 points by gneuromante 1y ago

FirmwareBurner 1y ago

But why? The US military abandoned Ada for the F-35 and moved to C++ instead. Is it me or are they moving backwards?

firesteelrain 1y ago
Language selection is no panacea for bad systems engineering or poor project management
- anthk 1y ago
  It helps on security and correctness. Either you are a Forth like guy/gal stating how a firmware will work at every level (low, med, high, every one), cutting down every flaw by getting it as small and predictable as possible (even by ditching floats for rationals and decimal scaling), or a high level Lisp/CL/Java/C# guy with a garbage collector and some memory safety. And Java/C# and some Lisps aren't nowhere as strict on that as ADA.
  - firesteelrain 1y ago
    I have worked on safety crucial systems and applications that interact with safety critical systems in a non safety critical language. Each time it never had anything to do with the language and everything to do with systems engineering and project management. The projects that were successful had excellent systems engineering and project management. Language choice was never a factor.
    - zppln 1y ago
      This is my experience as well. People need to ask themselves what benefits Rust would bring to an high assurance system (e.g. DO-178C Level A). You're not gonna want to malloc mid-flight even if you have a borrow checker. The entire point of e.g. DO-178C is to show that the software only does exactly what it is supposed to do under all assumptions and have any derived behavior fed back to the safety process for evaluation. Software can never in itself make a system safe. All that aside, modern tooling may be more ergonomic etc so I'm not saying languages like Rust shouldn't be considered, they just aren't as useful here as I think a lot of people assume.
      - firesteelrain 1y ago
        I personally know of teams using modern tooling and expansive cloud based CI/CD with safety critical systems and we are talking hundreds of developers. This is in C++ with MISRA standards and DO-178 too.
        bb88 1y ago
        I don't think it's fair to say C++ is safe and reliable as is. The only way it could be made safe is with a restricted version of C++. I'm reminded by mozilla's sign "You must be this tall to write threaded code." [1] How much do you restrict your language and libraries to make it safe? Like custom templates? How do you define ownership of objects and lifetimes -- or just malloc everything all at once? [1] https://bholley.net/blog/2015/must-be-this-tall-to-write-multi-threaded-code.html https://bholley.net/blog/2015/must-be-this-tall-to-write-mul...
        zppln 1y ago
        We use C++ at my shop for Level A and of course we very much restrict it. But the restrictions are more due to reducing the scope of what you need to show for your compiler. > or just malloc everything all at once? Yes! But here's the thing: this isn't done due to the footguns associated with memory management, it is done because you want as little dynamic behavior as possible. For Level A software you need to show that your software has both bounded execution time and memory usage, and be robust against all inputs. Achieving that is so much easier without dynamic memory management. Also, another thing to keep in mind is that DO-178 has you show that your software requirements are traceable to system requirements, your software design to your software requirements, your source code to your software design and your object code to your source code. But testing should be requirements based. So if your compiler inserts a bounds check now you have object code not traceable to source code and for which you won't have coverage because your requirement mention it. But what if you mention it in your requirements? Well, then you'd have to implement it manually in source code to uphold traceability anyway... I will caveat the above by saying that other players may interpret things differently or have found ways to do things more cleverly.
      - 1y ago
gneuromante 1y ago
It was the US military who moved backwards.
bb88 1y ago
SPARK formal verification is a big win. Ada is also simpler than C++. However, the tooling for Ada was never as good as C++ tooling.
- firesteelrain 1y ago
  GNAT, AUnit, VectorCAST are all good. AUnit isn’t compatible with Ada 95 though
johnnyjeans 1y ago
you mean the plane plagued with software development issues[1][2]? even ignoring the obnoxious yellow journalism, i'm not sure it's a shining beacon of best practices. or that replacing one ancient language with an even more ancient language is "moving forwards." particularly when the language you're replacing was explicitly designed for your domain, and the language you're replacing it with is an entropic event horizon from which no coherent thoughtform can escape. [1] - https://www.dote.osd.mil/Portals/97/pub/reports/FY2024/other/2024Annual-Report.pdf?ver=WLJFmx7nkeDHIuvrtKyfGQ%3d%3d https://www.dote.osd.mil/Portals/97/pub/reports/FY2024/other... [2] - https://www.gao.gov/products/gao-24-107177 https://www.gao.gov/products/gao-24-107177
nabla9 1y ago
It was not for technical reasons. They needed more programmers and C++ had larger user base. Ada is technically better choice.
- CivBase 1y ago
  It has more to do with tooling than programmers. C++ is used everywhere so there are many commercial tools to support it. Not so much for Ada. Ada's developmemt tools are fewer, less featued, and more costly due to low demand.
  - johnisgood 1y ago
    > Ada's developmemt tools are fewer, less featued Such as?
    - dardeaup 1y ago
      Regarding the number of options, C++ has quite a few IDEs: Visual Studio, Xcode, VSCode, CLion, and probably more (Oracle probably still sells the one they had for Solaris). For command-line compilers, C++ has: Visual Studio, Xcode, g++, clang++, IBM C++ compilers for their OSs, Oracle compilers for Solaris, etc. For Ada, is there anything other than AdaCore? Is that the same as GNATStudio? Edit* - fixed Ada capitalization
      - cjbgkagh 1y ago
        I think IBM Rational Ada was a thing back then. Never used it but heard stories about it.
        cjbgkagh 1y ago
        I should add, what I was told is that they were amazing, especially the pre-IBM Rational stuff. Rational was acquired by IBM in 2003. I was working on tech adjacent to the JSF (F35). I was told by a guy working on the JSF that the extra bugs from C++ would mean better job security and he was 100% right. It’s pretty much that conversation that triggered my move into high tech and away from military. I think it’s a shame that IBM happened to Rational, a lot of nascent good ideas pretty much disappeared or were mangled beyond recognition.
seabird 1y ago
Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. I get that there's more tools for C++ but first class formal verification support and a language that's generally designed to save you from yourself seems like something you would stand your ground on. Ada is supremely good at killing people and/or keeping them un-killed, there's a reason you still see it kicking around in defense and aerospace despite the common perception that it's a bygone relic.
- FirmwareBurner 1y ago
  >Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. Do you think the auto industry will have a easier time finding Ada talent at their pay rates? Or that talent will want to specialize into Ada just to pigeonhole themselves into the Automotive jobs market?
  - cmrdporcupine 1y ago
    As a Rust + C++ developer (in medical right now, and vehicle before that) I see no reason why I couldn't also pick up Ada as one of many skill sets. I have an Ada95 manual on my bookshelf from years ago that I bought out of curiosity -- frankly for senior level talent the language syntax is the easiest thing to pick up it's the intricacies of an existing code base and business domain that is the hard part of joining a new project and that is generally language independent. Arguably picking up Rust -- with its frankly exotic value passing and ownership semantics -- is much harder than learning Ada.
    - FirmwareBurner 1y ago
      > I see no reason why I couldn't also pick up Ada as one of many skill sets Low wages and the negative resume drive development might be reasons. Believe it or not, pigeon holing yourself in niche/uncool tech for years, can and will negatively impact your future hiring prospects at good jobs, since hiring in tech is broken and HR selects resumes on buzzwords and on your "last X years of experience in Y framework".
pjmlp 1y ago
Ever wondered why F-35 is so famous for software bugs, including in-flight reboot from avionics?
- fransje26 1y ago
  Since Lockheed struck a deal with the government allowing them to no longer communicate the number of issues encountered on the F-35 program, news reports have only been writing about how it has been the best thing since sliced bread. (Save for the mishaps happening from time to time..) Which is entertaining, because until that point (2021, if memory serves?) it was encountering an ever increasing number of critical issues needing resolving, a double dozen of which would be lethal to the pilot flying. The backlog stood at 800+ issues at the time. Some of the software issues were so serious that they were considered beyond salvageable at the time, despite having already gone through a full re-write from scratch cycle..
- FirmwareBurner 1y ago
  Are those bugs because of C++, or because of bad programing skills and practices? No programming language can save you from bugs if you hire people who don't know what they're doing. I used to work in automotive when a lot of the critical safety SW was only assembly and the end product didn't have any critical bugs. Maybe Lockheed just has shitty programmers who don't know what they're doing because the US defense industry is incompetent and the US SW jobs market top heavy where talent who does know how to use C++ right goes to big-tech and not on-site at some defense contractor? To me that's not the fault of C++.
  - tialaramex 1y ago
    Not all programming languages are equal when it comes to the skill needed to deliver correct software. Since a large project necessarily can expect only to bring merely ordinary skill to the problem if that's not enough they're in trouble, even if superlative skill would have succeeded that's not what they have. C++ iterators are a big example of this problem. In the most skilled hands these are a very powerful technology, excellent performance yet tremendous flexibility - but they have a lot of footguns. So do you choose to accept the high defect rates when your ordinary programmers shoot themselves in the foot, or do you neuter this powerful technique to reduce those defects but suffer significant performance problems ?

transpute 1y ago

Ada/SPARK root of trust anchors Nvidia GPU market segmentation licensing, 50% profit margin and $3T market cap. "Nvidia Security Team: “What if we just stopped using C?”, 170 comments (2022), https://news.ycombinator.com/item?id=42998383 https://news.ycombinator.com/item?id=42998383

atlgator 1y ago

Wow. I developed in Ada in aerospace 17 years ago. I thought the industry would move toward Rust.

steveklabnik 1y ago
Rust is also making inroads, probably the most famous example is there’s two models of Volvo shipping today that rely on it.
cashsterling 1y ago
Yeah... my intro CS class was in C and Ada95 (I'm not a CS guy btw, just took the class). I actually preferred Ada over C... but continued to program in C for other classes because of compiler availability; I had to do all my Ada programming on Sparc workstations at school. I personally think that AdaCore, and friends, missed an opportunity in the early 2000's to fully embrace open source... they left a big gap which Rust has filled nicely. I still think Ada is a great programming language. When a question comes up along the lines of: "what's the best programming language nobody's heard of?", or "what's the best programming language that is under used?" Ada is usually my first answer. I think other good answers include F#, <insert LISP flavor>, Odin, Prolog, Haxe, and Futhark (if you're into that sort of thing).
- pjmlp 1y ago
  We are on Ada 202x nowadays being discussed, and in a world where FOSS tool makers have problems making a sustainable business, always changing licenses, there are still 7 Ada vendors selling compilers.
  - anthk 1y ago
    Libre compilers do not impose restrictions on output.
    - pjmlp 1y ago
      As long as there are enough people around to actually work on them.

pfdietz 1y ago

Are auto companies going with error correction in memory? I'm thinking of the Toyota unintended acceleration problem. https://www.slideshare.net/slideshow/toyota-unintended-acceleration/39277734 https://www.slideshare.net/slideshow/toyota-unintended-accel...

marze 1y ago
Wasn't a correlation with elderly drivers and the unintended accretion found in the Toyota cases?
- f1shy 1y ago
  Just because they could not handle it. It happened to many people, young people hndled that better.
- pfdietz 1y ago
  How about a difference between Toyotas and non-Toyotas? It's not like elderly drivers are unique to Toyotas. Also, unintended acceleration seems to have gone away. The control hardware has been changed; driver age, not so much.
  - marze 1y ago
    References?
    - pfdietz 1y ago
      https://capitolweekly.net/toyota-has-settled-hundreds-of-sudden-acceleration-cases/ https://capitolweekly.net/toyota-has-settled-hundreds-of-sud...
- nickpsecurity 1y ago
  It happened to me. I sure wasn't elderly. The only thing that stopped a crash was shifting into neutral and hitting the brakes. Then, I was sitting there with the engine revving loudly for no reason. Car behind me started backing up. I decided to just shut it off and turn it back on. It went away. Scary stuff. Especially since I had no idea why it happened.

deleted 1y ago

[deleted]