5 ms·

Do avionics in general subscribe to MISRA C/C++ or do they go even further with an additional (or different) approach?

by barfoure 10mo ago

fallingmeat 10mo ago
coding standard is a part of the story. mainly it comes down to level of rigor and documenting process and outcomes for audit ability. DO-178c
4gotunameagain 10mo ago
Depends on the region. MISRA is widely adopted, and then there are the US MIL standards, ECSS for european aerospace stuff, do-178C for aviation..
- westurner 10mo ago
  /?hnlog awesome-safety-critical From https://news.ycombinator.com/item?id=45562815 https://news.ycombinator.com/item?id=45562815 : > awesome-safety-critical: https://awesome-safety-critical.readthedocs.io/en/latest/ https://awesome-safety-critical.readthedocs.io/en/latest/ From "Safe C++ proposal is not being continued" (2025) https://news.ycombinator.com/item?id=45237019 https://news.ycombinator.com/item?id=45237019 : > Safe C++ draft: https://safecpp.org/draft.html https://safecpp.org/draft.html Also there are efforts to standardize safe Rust; rust-lang/fls, rustfoundation/safety-critical-rust-consortium > How does what FLS enables compare to these [unfortunately discontinued] Safe C++ proposals?
- pacoWebConsult 10mo ago
  DO-178c is not a coding standard, it's a process standard. Projects following DO-178c processes would adopt a coding standard as a part of the process, reviewing software deliverables adhere to those standards.
stackghost 10mo ago
Depends on the company in my experience. I've seen some suppliers that basically just wire up the diagram in Matlab/simulink and hit Autocode. No humans actually touch the C that comes out. Honestly I think that's probably the correct way to write high reliability code.
- garyfirestorm 10mo ago
  You’re joking right? That autogenerated code is generally garbage and spaghetti code. It was probably the reason for Toyotas unintended acceleration glitch.
  - AnimalMuppet 10mo ago
    > It was probably the reason for Toyotas unintended acceleration glitch. Do you have any evidence for "probably"?
    - garyfirestorm 10mo ago
      I know for the fact simulink generates spaghetti and spaghetti code was partially blamed for Toyotas problems. Hence the inference See https://www.safetyresearch.net/toyota-unintended-acceleration-and-the-big-bowl-of-spaghetti-code/ https://www.safetyresearch.net/toyota-unintended-acceleratio...
      - CamouflagedKiwi 10mo ago
        That's a nonsensical connection. "Spaghetti code" is a very general term, that's nowhere near specific enough for the two to be related. "I know for a fact that Italian cooks generate spaghetti, and the deceased's last meal contained spaghetti, therefore an Italian chef must have poisoned him"
      - stackghost 10mo ago
        SRS is a for-profit corporation whose income comes from lawsuits, so their reports/investigations are tainted by their financial incentive to overstate the significance of their findings.
  - vodou 10mo ago
    Modern autogenerated C code from Simulink is rather effective. It is neither garbage nor spaghetti, it is just... peculiar.

Do avionics in general subscribe to MISRA C/C++ or do they go even further with an additional (or different) approach?

coding standard is a part of the story. mainly it comes down to level of rigor and documenting process and outcomes for audit ability. DO-178c

4gotunameagain 10mo ago

Depends on the region. MISRA is widely adopted, and then there are the US MIL standards, ECSS for european aerospace stuff, do-178C for aviation..

westurner 10mo ago
/?hnlog awesome-safety-critical From https://news.ycombinator.com/item?id=45562815 https://news.ycombinator.com/item?id=45562815 : > awesome-safety-critical: https://awesome-safety-critical.readthedocs.io/en/latest/ https://awesome-safety-critical.readthedocs.io/en/latest/ From "Safe C++ proposal is not being continued" (2025) https://news.ycombinator.com/item?id=45237019 https://news.ycombinator.com/item?id=45237019 : > Safe C++ draft: https://safecpp.org/draft.html https://safecpp.org/draft.html Also there are efforts to standardize safe Rust; rust-lang/fls, rustfoundation/safety-critical-rust-consortium > How does what FLS enables compare to these [unfortunately discontinued] Safe C++ proposals?
pacoWebConsult 10mo ago
DO-178c is not a coding standard, it's a process standard. Projects following DO-178c processes would adopt a coding standard as a part of the process, reviewing software deliverables adhere to those standards.

stackghost 10mo ago

Depends on the company in my experience. I've seen some suppliers that basically just wire up the diagram in Matlab/simulink and hit Autocode. No humans actually touch the C that comes out. Honestly I think that's probably the correct way to write high reliability code.

garyfirestorm 10mo ago
You’re joking right? That autogenerated code is generally garbage and spaghetti code. It was probably the reason for Toyotas unintended acceleration glitch.
- AnimalMuppet 10mo ago
  > It was probably the reason for Toyotas unintended acceleration glitch. Do you have any evidence for "probably"?
  - garyfirestorm 10mo ago
    I know for the fact simulink generates spaghetti and spaghetti code was partially blamed for Toyotas problems. Hence the inference See https://www.safetyresearch.net/toyota-unintended-acceleration-and-the-big-bowl-of-spaghetti-code/ https://www.safetyresearch.net/toyota-unintended-acceleratio...
    - CamouflagedKiwi 10mo ago
      That's a nonsensical connection. "Spaghetti code" is a very general term, that's nowhere near specific enough for the two to be related. "I know for a fact that Italian cooks generate spaghetti, and the deceased's last meal contained spaghetti, therefore an Italian chef must have poisoned him"
    - stackghost 10mo ago
      SRS is a for-profit corporation whose income comes from lawsuits, so their reports/investigations are tainted by their financial incentive to overstate the significance of their findings.
- vodou 10mo ago
  Modern autogenerated C code from Simulink is rather effective. It is neither garbage nor spaghetti, it is just... peculiar.