14 ms·
Boeing Flies on 99% Ada
- Artemis2 12y agoThat's not surprising, given that safety-critical software is very often programmed in Ada or SPARK.
- yoodenvranx 12y agoIf it is so safe and reliable, why isn't used more for normal projects?
- wwwwwwwwww 12y agobecause choosing a language for a commercial project is rarely about safety or effectiveness - it's about language popularity, availability of libraries, and replaceability of the programmers.
- pjmlp 12y agoBecause in IT no one gets sued when they go wrong.
- curtis 12y agoIt could be that the code is indeed more safe and reliable, but also quite a bit more expensive to write and maintain.
- TeMPOraL 12y agoBecause safety comes at a price. I did a little bit of Ada programming, and one of the distinct features it has is you can't do anything clever without being extremely explicit about it. This language has the most aggressive type-correctness checking I have ever seen. When you finally get your code to compile, it's likely that it will work reliably.
- coldtea 12y agoSounds like you're describing Haskell. I don't think Ada is that strict.
- joevandyk 12y agoAda has the advantage of not being weird though. :) Also, at least back then, Ada has no garbage collection, so you know what latencies are.
- eru 12y agomalloc / free style memory management has unbounded latency, too. Though Ada might do something even more conservative.
- SkyMarshal 12y agoAda uses its type system plus managed memory pools for manual memory management, it's very cool. Safe manual memory management with memory control of C/C++ but the safety of an ML. http://en.wikibooks.org/wiki/Ada_Programming/Types/access http://en.wikibooks.org/wiki/Ada_Programming/Types/access
- JasonFruit 12y agoAda is very strict; its type system might not be as well-planned as Haskell's, but it's both strict and effective.
- deleted 12y ago[deleted]
- wfunction 12y agoFor someone who's never seen Ada code, could you explain what kind of strictness it has that doesn't exist in other languages like (say) C++?
- Padding 12y ago
- awjr 12y agoI was involved in writing the short term collision alert system for the New En Route Centre down in Swanwick, UK. Basically proving something won't kill is extremely important in this environment. The language is almost irrelevant. Proving every single piece of logic has been exercised (an OR statement had to have true true, false true, true false and false false tests...now add multiple ORs to that). Mission critical software is another world. Probably rather alien to the HN crowd ;)
- malka 12y agoThe Paris subwway network is partially automated. The software is written in OCaml, and mathematically proven correct using Coq.
- sitkack 12y agoWhich parts aren't automated?
- donquichotte 12y agoInteresting. Do you have any additional information on this?
- monort 12y agoIt seems to be not OCaml: First real success was Meteor line 14 driverless metro in Paris: Over 110 000 lines of B models were written, generating 86 000 lines of Ada. No bugs were detected after the proofs, neither at the functional validation, at the integration validation, at on-site test, nor since the metro lines operate (October 1998). The safety-critical software is still in version 1.0 in year 2007, without any bug detected so far. From: http://rodin.cs.ncl.ac.uk/Publications/fm_sc_rs_v2.pdf http://rodin.cs.ncl.ac.uk/Publications/fm_sc_rs_v2.pdf
- ghshephard 12y agoSafety and Reliability are not as relevant for most projects as speed, flexibility, familiarity, availability of frameworks and developers, inexpensive compilers/debuggers,etc... All of these are area in which Ada is not as highly qualified as some of its competitors. But, for Avionics and Space System, Ada is a well known, and continues to be a well known implementation language.
- mwfunk 12y agoThe safety and reliability comes at the price of more verbosity and less dynamism. Most programmers don't need (or don't think they need) that level of reliability, and choose not to use languages like Ada (if they are even aware of its existence). On the other hand, failure is much less of an option when it comes to things like avionics, so much more focus is placed on reliability. In these cases that price starts looking like a bargain, if the use of Ada isn't already mandated (which it probably is).
- SkyMarshal 12y agoI was just asking that recently too [1]. I think it's because most "normal" projects, aka web/desktop/mobile apps aren't safety critical, a large cadre of developers prefers dynamic languages that let them program in a completely bottom-up exploratory manner without thinking about types and the like. [1]:https://news.ycombinator.com/item?id=8245442 https://news.ycombinator.com/item?id=8245442
- jbogp 12y agoA good thread about programming languages in avionics. https://www.linkedin.com/groups/Which-is-Major-Programming-language-141158.S.93712052 https://www.linkedin.com/groups/Which-is-Major-Programming-l... Having had a lot of my undergrad CS classes in Ada (in Toulouse France, the home of Airbus) I get nostalgic every time I see a post mentioning Ada on HN.
- neurotech1 12y agoGoogle Cache Link: http://webcache.googleusercontent.com/search?q=cache%3Aarchive.adaic.com%2Fprojects%2Fatwork%2Fboeing.html&oq=cache%3Aarchive.adaic.com%2Fprojects%2Fatwork%2Fboeing.html http://webcache.googleusercontent.com/search?q=cache%3Aarchi...
- SEJeff 12y agoFYI I used to date a girl with a Masters in CS who got a job with Boeing. She worked on the OpenGL overlay for the B1 Lancer. She wrote about 3 pages of justification for every 5-6 lines of code she wrote. After 2 years she bounced as the job satisfaction in that type of environment, simply wasn't there. Also OpenGL from ADA is... interesting. She worked at the Boeing San Diego office, which is quite beautiful.
- foobarqux 12y agoWhere do you go after that type of ultra specialized experience?
- coldtea 12y agoWere ever you want? If you have the kind of skills to write Open GL in Ada for Boeing, then you're not the kind of person who's depending on having rote-learn some latest tech (J2EE, RoR, Node, Go, whatever) and only can get jobs looking for that.
- zeeshanm 12y agoOr you can start a startup.
- vonmoltke 12y agoI don't know. I frequently run into people who stereotype aerospace/defense software engineers as stodgy, inflexible dinosaurs.
- jacquesm 12y agoThat's most likely people who would not have the discipline or ability to write software at that level.
- pjmlp 12y agoSorry just downvoted you when I wanted to upvote. Pesky mobile browsers.
- eduardordm 12y agoThe actual language has little to do with the current widespread use of Ada in critical aviation software. The main reason lies in the certification process and reuse of certified tools. I wrote a little about it here: http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviation-sofware http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviat...
- foobarqux 12y agoC is usually supported as well as or better than Ada so it does have to do with the language.
- seanmcdirmid 12y agoWith certified tools?
- ahmett 12y agoFAA certifies software and databases (and the data in those databases) of companies like Boeing.
- seanmcdirmid 12y agoYes, was parent claiming that C has a lot of "certified" tools as much as Ada does? The phrasing was ambiguous.
- tjr 12y agoDynamic memory management is inadvisable in avionics code, making languages that rely on garbage collection (perhaps pointlessly) challenging to use. But in general, there are no restrictions on what language is used. The particular version of the compiler you are using has to be certified, but just long as you can use the language and the compiler to meet DO-178B/C standards, you can use whatever you want. You can use whatever tools you want, if they get certified. You can write your own tools and certify them. Anything goes, just so long as it meets standards. (Working on some flight management software, I found a bug in our version of GCC. It's free software, right? So I could just fix it? Or even upgrade to a newer version? That would have meant re-certifying the compiler, so it was easier to work around the bug.) In practice, I do see a lot avionics code written in Ada. I see a lot written in C. I see a lot written in C++. I haven't seen much else. I would guess a roughly even split between Ada and C or C++, with either C or C++ being increasingly favored for new clean sheet projects.
- ghshephard 12y agoThis is an awesome article - there are a ton of interesting excerpts all in one place, that I haven't seen before, such as this one: One compelling reason behind the extensive pre-testing was Boeing's desire to meet the Federal Aviation Agency's (FAA's) Extended Twin Operations (ETOPS) standards ahead of schedule. The original ETOPS rule was drafted in 1953 to protect against the chance of dual, unrelated engine failures. Unless a newly designed and produced aircraft has at least three engines, it usually had to wait, sometimes as long as four years, before the FAA and the Joint Airworthiness Authorities (JAA) will allow it to fly more than one hour from an airport; after a time, the new aircraft is deemed a "veteran" and is allowed to fly three hours away. A shortened trial period would drastically increase Boeing's sales." It hadn't occurred to me that a 777 is always three hours away from an Airport. I'll have to look more closely on the map.
- superuser2 12y agoSince it's mostly 747 and similarly large planes on intercontinental flights anyway, I doubt this is much of an issue. I wonder if there actually is anywhere in the CONUS that's more than 3 hours from at least a rural airstrip?
- ghshephard 12y agoThe reason why I thought it might be an issue, is that according to Wikipedia, The 777-200LR is the world's longest-range airliner and can fly more than halfway around the globe; it holds the record for the longest distance flown non-stop by a commercial aircraft. . It hadn't occurred to me that because the 777 is a twin engine, it can't really use all that range. It needs to stay near airports.
- cfallin 12y agoTwin engine planes absolutely can cross oceans -- if you need three hours' flying distance in the worst case (ETOPS-180), then you can cross up to six hours of water between any two backup airports. North Atlantic routes have only a few hours of contiguous water between, say, Greenland and Iceland. Even the Pacific has enough small islands (e.g. Hawaii) to make something like this possible (shaded areas are outside 3-hour range): http://www.gcmap.com/mapui?P=EWR+-+SYD&MS=wls&DU=mi&E=180 http://www.gcmap.com/mapui?P=EWR+-+SYD&MS=wls&DU=mi&E=180
- theoutlander 12y agoWhat is the other 1%? (I was only able to glance through pieces of the article for now)
- ajb 12y agoProbably the coffee machine. Although given the effort required to write safety critical code, I wouldn't be surprised if the coffee machine had more lines of code than the rest of the airplane.
- twistedpair 12y agoThe galley is a main source of in flight fires. I'd expect such systems to be classified as critical to flight safety. Obviously not as much as the auto pilot, but it is still a system that could bring the plane down if an oven or cofee pot shorts. IFE, on the other hand, is not.
- userbinator 12y agoI wouldn't be surprised if the coffee machine didn't have a single microcontroller in it, but a simple old-fashioned analogue controller. The prevailing attitude in safety-critical systems is "if it works (and has been certified with much $$$), leave it alone".
- Narkov 12y agoPresumably PHP.
- raverbashing 12y agoIf I had to bet it would be the non-safety systems, like lighting Or just their website and intranet maybe?
- ghshephard 12y agoGiven how reliably the video system fails on the 777, I'm going with the In Flight entertainment system.
- 12y ago
- cpeterso 12y agoWhat new languages are being developed that could be even safer than Ada for safety critical systems? Are Agda, Haskell, or Rust as safe or strongly typed as Ada?
- tjr 12y agoWeirdly, avionics development seems to be moving away from Ada toward C! I personally think something like OCaml would be a better choice... I think the problem is, there is so much momentum built up around Ada and C usage in the avionics world that there just isn't the infrastructure and culture built up around better languages, so it's hard to make the switch. Even if you have to write a brand new codebase for some small avionics project, how do you justify the expense of doing it all in OCaml when there is already certified compilers and support for Ada? It ought to happen, though.
- en4bz 12y agoYes, cause one definitely wants "Stop the World" GC in a real-time system.
- tjr 12y agoRight, that was unclear. Languages that rely on garbage collection can't realistically be used in flight. "Something like OCaml" but with manual memory management might be better than Ada. But with recursive functions also frowned upon in avionics, a lot of the fun of OCaml might be drained...
- damian2000 12y agoThere's a relevant Programmers.SE post on this ... http://programmers.stackexchange.com/questions/153266/what-operating-systems-are-used-in-airplanes-and-what-programming-languages-are http://programmers.stackexchange.com/questions/153266/what-o... According to comments there, some modern aircraft run an RTOS (real time operating system) on top of the bare hardware, which then lets you run Ada or C code. Those mentioned include VxWorks[1] for the Boeing 787 and Integrity[2] used by the Airbus A380. [1] http://en.wikipedia.org/wiki/VxWorks http://en.wikipedia.org/wiki/VxWorks [2] http://en.wikipedia.org/wiki/Integrity_(operating_system) http://en.wikipedia.org/wiki/Integrity_(operating_system)
- xarien 12y agoMost bootloaders (of components) if nothing else will be wrapped in vxworks.
- xarien 12y agoAda is by far the strongest typed language I've used in my 2 decades of programming. In the defense / aviation industry, it's very common to have multiple sub-contractors working on different pieces of the platform. Due to this trait, interfaces between these sub-systems / components are heavily scrutinized. Using a language such as Ada to ensure that large amounts of bitwise data structures are clearly defined and match eases the burden (at least a little).
- warriar 12y agoAnyone else thinking that Public Write and Execute would be bad for an Airplane?!
- SkyMarshal 12y ago>According to Brian Pflug, engineering avionics software manager at Boeing's Commercial Airplane Group, most companies disliked the idea of a standard language at all, and then seriously objected to Ada as too immature. By what measure did they consider Ada "too immature" I wonder? It's one of the oldest languages, an open international standard, and has been through several major updates over three decades. On the surface there are few if any languages that claim more maturity than that.
- Padding 12y agoThere's no compiler (and standard library implementation) that has faced public scrutiny like other popular languages have. Aditionally, there are no IDEs for Ada comparable to the IDEs of other comercial languages (e.g. C++, C# or Java). Which is understandable given how little interest there is in Ada, amongst the "general public" of developers, which is understandable given how there's no proper free implementation of for Ada. There's essentially just the AdaCore implementation that costs $$$, the GPL'd AdaCore implementation that requires you to publish your source code (because of the libraries) and then there's some unsupported GCC implementation. I like Ada, and I would like to see it gain more market share. If it had, things like Rust and Go may have been superfluous. But the way things are, I just don't see it happening. Unless you're some big enterprise Ada is essentially a non-option, due to licensing, and if you're a big enterprise it's essentially a non-option since there's very few devs around for it. And so it remains an obscure language used in very niche applications (albeit with great success there?).
- sgt101 12y agoReally strange about the tooling, if I were BAE or Boeing I'd be standing up a project to create an IDE on top of Eclipse - ~2 man year effort for vast productivity gains! dons asbestos pants in expectation of anti eclipse comments!
- johansch 12y agohttp://www.atego.com/products/atego-objectada/ http://www.atego.com/products/atego-objectada/
- reacweb 12y agoI have developed many years in Ada. It is a marvelous language. Many mistakes are found during compilation. Very often, when it compiles, it works. Since Ada95, the multitasking features are really awesome. The overhead of the verbosity is real for short programs, but becomes less relevant for big projects. Ada is not in the hype anymore. It is getting more and more difficult (and expensive) to have developers with a good knowledge in Ada. In my current society, some projects are still in Ada, but the quality of the code is becoming lower and lower, with a lot of type cast. It seems people are thinking in C (C++) and are painfully writing their ideas in Ada.
- ArkyBeagle 12y agoIt is an absolute shame that Ada did not take its place as a dominant player early on. But people have difficulties reasoning about cost in computing. The verification cost for the toolchains pretty much kept places I worked at out of it. It is too bad that those costs were not treated as public goods and paid for out of tax money. I expect it would have been a good investment.
- donquichotte 12y agoI recently applied for a job at a company that makes civilian drones (rescue, police). They required knowledge of the Oberon language, I'm pretty sure they use HelyOS [1] for real-time control of their coaxial helicopters. It's quite interesting how these Pascal derivatives seem to find their niche in high-reliability or real-time applications, although I don't quite understand why. That may have been part of the reason why I didn't get the job. [1] http://en.wikipedia.org/wiki/XOberon http://en.wikipedia.org/wiki/XOberon
- nimrody 12y agoNo pointers. Range limited types, e.g. Type Day = (0..7); Days = (monday,tuesday,wednesday,thursday,friday, saturday,sunday);
- blueskin_ 12y ago...and now I will always want to fly on an Airbus instead. Reminds me of the joke: > At a recent real-time Java conference, the participants were given an awkward question to answer: > "If you had just boarded an airliner and discovered that your team of programmers had been responsible for the flight control software, how many of you would disembark immediately?" > Among the forest of raised hands only one man sat motionless. When asked what he would do, he replied that he would be quite content to stay aboard. With his team's software, he said, the plane was unlikely to even taxi as far as the runway, let alone take off.
- enjoy-your-stay 12y ago>...and now I will always want to fly on an Airbus instead. Reminds me of a joke I was once told by a QA consultant: His colleague was on his way to deliver a revision of software which had been extensively tested and many serious bugs discovered and fixed. The software was so important that it was to be delivered in person by the consultant on a laptop to the customer. On the walkway to the plane, he happened to glance up and see the aeroplane he was about to board was an Airbus. In fact the very revision that had the same software he'd just been testing and had found to be full of bugs. Oh no. Suddenly getting very cold feet and desperately thinking of a way not to get on the plane he takes a drastic step and deliberately drops and destroys the laptop with the software he was going to deliver. Happy now he returns to the office and declares 'well, that's a shame - but I think I'll take the train next time' - was told to me as a true story, and you never know...
- Artemis2 12y agoI've heard from an airline pilot that Airbuses are a lot more driven by the central computer, while in Boeing planes, the pilot has more freedom.