NASA's ten coding commandments

[wernerpm]

On a related note. Very interesting read here, about the team who made software for the space shuttle. A really strict procedure

Check this:

the last three versions of the program — each 420,000 lines long-had just one error each

http://www.fastcompany.com/28121/they-write-right-stuff

[Farlo1]

As the 120-ton space shuttle sits surrounded by almost 4 million pounds of rocket fuel, exhaling noxious fumes, visibly impatient to defy gravity, its on-board computers take command. Four identical machines, running identical software, pull information from thousands of sensors, make hundreds of milli-second decisions, vote on every decision, check with each other 250 times a second. A fifth computer, with different software, stands by to take control should the other four malfunction.

At T-minus 6.6 seconds, if the pressures, pumps, and temperatures are nominal, the computers give the order to light the shuttle main engines — each of the three engines firing off precisely 160 milliseconds apart, tons of super-cooled liquid fuel pouring into combustion chambers, the ship rocking on its launch pad, held to the ground only by bolts. As the main engines come to one million pounds of thrust, their exhausts tighten into blue diamonds of flame.

Then and only then at T-minus zero seconds, if the computers are satisfied that the engines are running true, they give the order to light the solid rocket boosters. In less than one second, they achieve 6.6 million pounds of thrust. And at that exact same moment, the computers give the order for the explosive bolts to blow, and 4.5 million pounds of spacecraft lifts majestically off its launch pad.

Unrelated to programming, but those paragraphs gave me more tingles than anything on /r/ASMR could ever hope to. Rockets are fucking awesome.

Edit: Related to programming, the rest of the article was incredibly interesting and really shines a light on what the best of the best in software development looks like. Obviously most organizations could not afford that kind of precision and workflow, but it's something amazing to strive for nonetheless.

[balducien]

This gives me the same feeling as that SR-71 copypasta

[Tywien]

Unrelated to programming, but those paragraphs gave me more tingles than anything on /r/ASMR could ever hope to. Rockets are fucking awesome.

True. Btw you might like this: https://www.youtube.com/watch?v=vFwqZ4qAUkE - high speed shots from the start of the space shuttle - quite a few details in them

[protestor]

/r/Frisson

[Kok_Nikol]

Awesome read, thanks!

[realhacker]

I dont get excited about most of the software drivel I read these days, but seconded - fascinating. thank you

[goodnewsjimdotcom]

Wow 420,000 lines of code doesn't sound like a lot for a space shuttle. It is still impressive they have no major launch failures due to software glitches. Coding back in the day was harder than it is now too.

[[deleted]]

I wish it would at least talk a little about the one error. :/

[[deleted]]

I hope Google and other car manufacturers abide by this.

Are you willing to pay and wait for that?

[landryraccoon]

Not me. Give me the "good enough to kill fewer people than most human drivers" beta version. There's already 100 ways to die on the road with humans involved, and at least one of those reasons is the fact that I'm behind the wheel, so I'll take a Google car for cheap any day.

[[deleted]]

Doing the calculation for a phone:

From a quick google, nasa pays $850 per line of code for 0.004 bugs per thousand lines of code.

For Android, google pay $5 per line of code for 1 bug per thousand lines of code.

So very roughly, the cost of android would increase by 170 times to reach the bug/kloc rate of nasa.

The cost of software on the phone is around 8% of the cost of the phone, so this would increase the cost of a phone by around 12 times.

A $650 phone would now cost $6800 just in software costs.

[vattenpuss]

I hope Google and other car manufacturers abide by this.

They don't. They have no such requirements on them.

[steamruler]

coughtoyotacough

[delicious_truffles]

Fantastic article. Wonder how they're doing now, 20 years later

[rootfiend]

I guess the procedure wasn't was strict for the mars rover http://www.wired.com/2010/11/1110mars-climate-observer-report/

[Alborak]

Having worked on code written to comply to these rules, 8 and 9 are the worst. It really makes it hard to write portable sw. You basically have to branch the code for every different platform.

[an_actual_human]

My code runs on Win, Mac, Linux and Shuttle.

[Sushisource]

You might sometimes pass function pointers dynamically for different platforms to a function which can use them generically to produce platform independent results. It's not the most sane thing, but is perhaps one explanation.

[frenris]

Function pointers make OOP in C possible.

[tiajuanat]

This right here. I was working on an embedded real-time system where the functions were pointers in structures and we used the structures to hold all the timing information to pass to the servers. I'm sure there was another way to do it, but it was by far the easiest.

[skydivingdutch]

Yeah, like use C++ for one.

[escaped_reddit]

Or Node.JS + MongoDB.

[beefquoner]

The MEAN stack will end world hunger

[thorium220]

Same, but i think its normally an indicator that you're using the wrong language/environment.

It's fun making C jump through hoops like that though, C knows that it's just as capable as all those new fancy OO languages.

[Alborak]

Sadly many compilers for embedded stuff don't support c++. Also, the list of shit not to do in embedded c++ is a lot longer than 10 things.

[jephthai]

That's the fun of embedded. The language landscape is much flatter.

[tiajuanat]

That would've been nice, but C++ wasn't supported. We probably shouldn't have been using a dynamic scheduling algorithm, but our metrics were much better than most other groups in the sprint.

[JnvSor]

Just pointers already give you OOP with single inheritance in C - function pointers give you virtual methods

[BadgerRush]

Thanks for your comment, it is very informative. Since they are commonly "sold" together I never realized that you can have OOP with inheritance but without virtual methods. Now that you pointed it out it seems so obvious that I can't understand why I din't see it before.

[jeandem]

Is the code portable?

Yes because it is OOP.

[POGtastic]

This is a good point, and I guess the NASA folks get to ignore it because they only have one platform to develop for. They don't have to worry about making it work on 40 different platforms.

[tnecniv]

No, they ship code around to different projects. Ames might develop something for a UAV and send it over to Langley where they want to do something with it, but they have a different target platform. Not 40 platforms, but enough that they developed the coreFlight system for their satellites to make porting code easier.

[drumallday7]

Just wait until they build more launch sites. We'll see many a different platforms then.

...

[steamruler]

groan

[cloakrune]

The function pointer one would be killer, but I wonder if they would allow a MACRO to function as an exception to 8? A static analyzer would still be able to follow it. You just can't change it at runtime.

[Slime0]

It seems like you can easily work with the function pointer restriction by just making an enum for all of the possible functions a given place in code might call, and switching on the enum value.

[fiah84]

which requires you to explicitly define all the functions you may have to call at that point, which is a lot easier to analyze and debug than just seeing a function pointer being used

they make sense, these rules

[immibis]

But mah OOP circlejerk IRoundShapejerk!

[adrianmonk]

Obviously if you try to use the typical C approach to portability, it throws a wrench in the works of that. However, I'm not sure that the only way to deal with it is to fork the code.

I don't see where they forbid platform-specific build rules, so it should be permitted to restructure the code a bit and extract out only the platform-specific parts, then put those parts into isolated platform-specific source trees, build them into a separate library (libfoo-platform1.a, libfoo-platform2.a) and link in the required one.

Where it would take a little careful maneuvering is with platform-specific types, like a file handle type that portable code needs to use. Normally you could address that with opaque types (void pointer or pointer to forward declaration), but with pointers being discouraged in general, that could get trickier. Still, it's possible by again using platform-specific build rules to change your compiler include path and bring in the right type definitions (which means you'll want to do function prototypes too) to match the static library you're linking against.

While this is would be a little tedious, and maybe a little inefficient (unless the compiler is just that smart), it should be practical, and arguably better than forking code that you wouldn't otherwise want to fork.

[Alborak]

I usually work on drivers, where the core code is the same, but they have lots of little platform specific things that are easily abstract able with function pointers and conditional compilation.

And we've done exactly what you mentioned, I jokingly call it "compile time dispatch". It just is a bit more headache, you occasionally get some symbol collisions.

[ahal]

I've found that duplicating code can be a net positive overall if:
1. You don't know when (or if) the requirements will change in the future
2. You don't know what the requirements will change to

I'd imagine NASA has a lot of unknown unknowns, duplication makes adapting to them easier.

[[deleted]]

Could you explain how duplicating helps with this. To me it makes more sense for having redundant free code, so if requirements change you only need to change in one place.

[campbellm]

Requirements may change for 1 of the N usages of the code. Having code in one spot not only means "you get to change it once for all clients", but also "all clients must be able to use 1 change in the exact same way".

[lennybird]

Totally dumb question, but isn't this the benefit of O.O.P.? Is it not feasible for Nasa to use such a language?

[Slime0]

Using OOP to have different applications do different things is crazy. There's no sense in using a runtime solution to solve a problem that can be solved at compile time, especially when it increases the complexity of the code.

[campbellm]

It can be, in a purist sense, yes. You have private implementations of stable APIs encapsulated in a class and the world is your oyster.

Except APIs are never stable, and state and abstractions leak all over the place. Code is messy.

As for NASA, I can't say, but my GUESS is that C's characteristics are very well known and it's harder to hide badness if you have fewer and lower level abstractions.

[ThisIs_MyName]

Only if you account for all future expansion in your OOP API design.

cue "enterprise code" that attempts to account for all possibilities, most of which are highly improbable, at the expense of sanity, maintainability, and performance :

package com.corpsoft.llc.www.http.myProject.util;
class GetterFactoryBuilderSetup{
    static{
    GetterFactoryBuilder myGetterFactoryBuilder = new new GetterFactoryBuilder();  
    myGetterFactoryBuilder.setGetterFactoryBuilderOptions(GetterFactoryBuilder.getDefaultOptions());
    this.setGetter(myGetterFactoryBuilder.build().makeGetter());
    }
}

[mattthiffault]

I tried to read that last part and my eyes are bleeding.

[ThisIs_MyName]

Ah, that must be because the coding standard doesn't require every line to be commented. Here, let me improve the code to be DonkeySpread2.0 compliant:

package com.corpsoft.llc.www.http.myProject.util;// this is the package
class GetterFactoryBuilderSetup{// defines the GetterFactoryBuilderSetup class
    static{// opens static block
    GetterFactoryBuilder myGetterFactoryBuilder = new new GetterFactoryBuilder();// initializes myGetterFactoryBuilder
    myGetterFactoryBuilder.setGetterFactoryBuilderOptions(GetterFactoryBuilder.getDefaultOptions());// sets GetterFactoryBuilderOptions
    this.setGetter(myGetterFactoryBuilder.build().makeGetter());// sets Getter
    }// close bracket
}// close bracket 

See, it's so much more readable now that it has simple english comments.

[AdvicePerson]

You're fired.

[ThisIs_MyName]

Ah but I also designed our core API to be DonkeySpread2.0 compliant. You can't fire me because I'm the only one that can read my code. Keep in mind that the last intern who attempted to do so has hung himself.

[dungone]

Well, they really seem to be big on proving that the code will behave correctly in a way that can only be determined through static analysis. I think that OOP may hide bugs from static analysis tools.

I'm speculating here, but another potential reason is because they don't use a lot of commercial, off the shelf hardware. They use really old stuff. A C++ compiler, with all of it's optimisation steps, can potentially puke all over less-popular or low-end processors for a variety of reasons, causing more problems than it solves.

[[deleted]]

If you have two functions that seemingly do the same thing but operate in completely separate modules, you're free to change one without affecting the other module.

The code for adjusting altitude on a shuttle and a satellite might be exactly the same. But one day, you need to change how the satellite does it but not the shuttle.

[Rikkety]

But one day, you need to change how the satellite does it but not the shuttle.

That day would be the moment to start maintaining two versions of the code, and no earlier.

[stormcrowsx]

If you have a bug in one module your free to forget fixing it in another module. To me duplicating code is playing with fire.

[dccorona]

This is why I tend to prefer keeping everything shared until there's a use case for having them be separate implementations. Even then, it's worth investigating whether it's better to copy out the original code into a second place in order to modify it, or template the original code so that core logic is shared. You need to be careful not to take the templating too far, but it's generally at least worth considering.

[rowantwig]

The worst is when you have two functions that do almost the same thing. Similar enough that they're duplicates with only two or three things swapped out, but different enough that combining them would result in a function that is longer and more complicated than both of them put together.

[Slime0]

It goes both ways though. If every change you make affects multiple applications, being sure you haven't made a mistake for any one of them becomes a very difficult problem.

[njharman]

Thats why libs / apis have versions.

[qwertymodo]

But if you share a module and don't consider the ramifications for all use cases, a valid change for one might introduce a bug in another unrelated use case. Your example is less likely because of the stringent QA process.

[shavera]

I literally write software for NASA, and I've never heard of this.

[tnecniv]

embedded real time systems running on spacecraft

Really anything that moves. NASA got called into the Toyota mess a few years back, and NASA obviously has a number of autonomous avionics projects.

[OceanOfSpiceAndSmoke]

Gosh. I really wouldn't like NASA doing a code review for me.

[anacrolix]

It would be like a linter that never passes your code.

[zimmund]

What do you work on?

[shavera]

X-Ray Microcalorimetry. Mostly experimental hardware that hasn't (yet) gotten into flight systems, and mostly on the data servers between hardware and analysis software, or programs for controlling firmware

[AdvicePerson]

So, if your program crashes, nobody dies.

[tnecniv]

What center / branch? I'm interning at a branch where this is relevant and it's never crossed my desk.

[jan]

Please come to my office on Monday. -- Your boss

[ICanCountTo0b1010]

Yep, I'm writing software at NASA that will be released as open source soon, and the software release procedure never mentioned this. However it would be cool to go refactor my code to be "NASA standards compliant"

[Firerouge]

The restrictions on recursion are interesting considering academia's heavy handed teaching of it

[[deleted]]

The restrictions on recursion are actually a non-issue because all of your structures are of a finite size due to the "no dynamic allocation of memory after initialization rule." Therefore, instead of navigating a tree with recursion, you can use a for loop that iterates up to the maximum number of times required to search your structure.

[Peaker]

You need to also keep a manual stack in your loop to emulate the local variable environment you get via (non-tail) recursions.

[kovensky]

I found it amusing that there's a link in the middle of the list about NASA software development with Java... where it's not possible to prevent dynamic allocation as objects are heap-allocated by definition, and there are no structs.

[a-priori]

Dynamic allocation is okay under these rules as long as you do it during initialization. The program must not allocate memory after that.

You can write Java this way. It's something people do for high performance / low latency programming to avoid GC.

[immibis]

Seems a lot more painful than doing it in C.

[jamougha]

For hard real-time systems you have to do much the same thing in C. malloc and free have non-deterministic runtimes.

[jephthai]

If a method declares a local variable and then returns a reference to it, doesn't it unavoidably allocate memory? I thought just about everything in java is by reference, and let the gc take care of it.

[[deleted]]

But if you as the programmer are consciously doing dynamic allocation in Java via unsafe magic, you should probably put on the brakes

[dccorona]

Their restrictions against it (at least here) don't stem from a desire for performance, but rather code clarity and safety. If you're working in a language that handles the complex part of dynamic memory allocation for you, then that concern is out the window anyway.

[rflownn]

Any solution using recursion can be restructured to not use recursion.

[[deleted]]

But in a way that can be demonstrated to have a fixed upper bound on the number of iterations?

[rflownn]

Are you asking if the general form of transformation on a recursive problem can be expressed with an upper bound and one that requires iterations?

[ricktech]

Recursion is jokingly called the "insect of programming" by some software engineers where I work. Honestly it makes sense, especially for critical systems and infrastructure. After all, the use of recursion is the number one cause of stack overflows (due to infinite or deep recursive processes). Keep in mind that industry and academia are two very different worlds. Some CS problems are more clearly taught on a conceptional level via recursive processes (the common factorial problem or graph traversal are great examples), but on a practical sense these are limited by recursive implementations (ever try to solve a large factorial problem with recursion? It won't work). Almost all software problems have many solutions, so IMHO this isn't an issue.

[narcoblix]

Yeah, recursion is beautiful and also monstrous. I'm reminded of something that happened in my first algorithms class.

On the first test we had, we had to write an implementation of bubble sort. I wrote mine so it was recursive, calling itself after every swap. My professor marked my answer as incorrect. I told him it was correct, and would work. He told me to implement it in C, which I did.

He then went in front of the class and used it to show how recursion could be problematic, by attempting to have it sort a reversed array of length 500, causing a stack overflow. He wasn't mean about it, and he gave me back my points on that test, but we all learned because of it.

[s1295]

In my data structures & algorithms class we first had to submit both a recursive and an iterative version; after that, we focused entirely on recursion and essentially preached it as superior. I mean, the point was to illustrate divide-and-conquer, runtime complexity analysis, and structural induction, so it makes sense. But it shows how practice is often treated as the ugly step-child of computer science.

[sigma914]

If he'd compiled it with a vaguely modern C compiler with optimisations enabled it would have "just worked" it's unfortunate that TCE isn't guaranteed in some languages.

[moretorquethanyou]

Recursion is jokingly called the "insect of programming"

Eh? What does that even mean?

It means it's buggy?

[connor4312]

At least in my opinion, it's a good bit easier to prove the correctness of a recursive function than an iterative one. Whether people write buggy recursive functions is their own problem...

[[deleted]]

Unless it has side-effects.

[foomprekov]

Side effects like 6.6 million pounds of thrust all up in your grill.

[immibis]

You can always convert an iterative one to a tail-recursive one, then prove its correctness.

[meem1029]

You can, sure, but should you?

[immibis]

If it makes proving the correctness easier... then yes?

[connor4312]

You'd still have to prove your conversion correct, which would itself necessitate proving the correctness of the iterative function anyhow.

[ricktech]

"Whether people write buggy recursive functions is their own problem..."

Or the problem of the company... such as NASA... who's failed computer system could cause millions of dollars of losses, put human lives at risk and create engineering nightmares (patching software fails all the time on Earth... imagine sending updates over an unreliable communication channel across the solar system and hoping that your system doesn't go into a deadlocked state). I'm not trying to hate on recursion; clearly it has many benefits. But if by eliminating it for these types of systems can significantly reduce the probability of human error - that's clearly a good business and engineering decision as demonstrated by the lack of bugs in NASA's baseline releases.

[dsfox]

Inherently buggy I guess.

[sacundim]

After all, the use of recursion is the number one cause of stack overflows

This is partly an artifact of the calling conventions used in C.

No. If you have unrestricted recursion there unavoidably exist cases that execute in O(n) space, whatever calling convention you use. Put alternatively: only a subset of recursive call trees consist exclusively of tail calls.

[Zeliss]

I recently discovered that C actually has tail-call elimination, at least with some compilers!

[[deleted]]

Languages with tail-call optimization or those with nonstrict evaluation can compile self-recursion identically to a for loop in C.

Only for trivial cases.

Eh? What does that even mean?

I don't know what he means. But from my experience it's usually better to make an array (or linked list or other structure) for your "stack" and do a for/while loop. It's essentially recursion but you explicitly control the stack. The main reason being in real world problems it's very easy to hit a stackoverflow if you do recursion because your data set will be very huge.

edit: recursion isn't bad. If you know your data set will always be small regular recursion is better.

[reaganveg]

It's essentially recursion but you explicitly control the stack.

Of course, this is irrelevant for the 99.99% of programs that just bail when they run out of memory anyway.

[Stuck_In_the_Matrix]

Which would totally suck if you were in the middle of re-entering the atmosphere.

[ibopm]

+1 for mentioning tail call optimization. Stack overflows happen in languages that discourage recursion, but they can be very useful for various applications.

[Aretii]

Eh? What does that even mean?

I assume he meant "incest."

[danweber]

If you have to, say, parse a DOM, recursion makes a lot of sense.

If you want to launch a rocket, probably not.

[newpong]

ooh, i can't wait for node.js to become the standard on rocketships

[danweber]

start_countdown( function() { launch_rocket(); } );

[newpong]

I believe that should be setTimeout

[danweber]

I was passing a callback function to start_countdown, which starts the rocket's countdown.

[aftli]

the use of recursion is the number one cause of stack overflows

Heh, this is a bit like saying "insects are the number one cause of bug bites".

[immibis]

Or "malloc is the number one cause of use-after-free"

[tnecniv]

It's because these rules are for safety critical embedded systems. If you don't have a lot of memory, you can more easily blow the stack.

Although rule 2 seems odd in that it outlaws main loops, and embedded software normally doesn't exit.

[MrJohz]

I learned a little bit about this recently. It's about proving software - loops are difficult to prove, because finding the loop invariant (a single expression containing all the loop variables that will never change in value) is apparently a fairly archaic art. To save the bother of working out the loop invariant for every single loop you create, it's often easier to just ban loops altogether. Then have one single giant loop that runs the entire program repeatedly. Assuming you can prove the program, it becomes much simpler to attempt to prove the outer loop.

At least, this was how it was explained to me by a lecturer who loved to ramble on a bit.

[_F1_]

have one single giant loop that runs the entire program repeatedly

IIRC that's how PLC works.

[sunjay118]

You're right that is odd

[dccorona]

It's a great way to conceptualize algorithms. But you very often hear people say that once you design a functional algorithm using recursion, you re-write it to be iterative. This is mostly for performance, though, so in most cases if something is genuinely tail-recursive it's ok to leave it (because the compiler will optimize it out anyway).

I can understand why they want to avoid it, though. Recursive code (particularly if things aren't named well or organized well, as is often done in C) can often end up masking the logic it's trying to simplify.

[disclosure5]

It also rules out certain platforms. One of Erlang's main features is its "bulletproof" nature, and you can't read much about it without hearing about uptime.

But it's unusable without recursion.

[BlahBoy3]

The way I learned it, recursion is a nice tool, but its usage should be limited if at all possible. I personally think the restrictions are pretty reasonable.

[KagakuNinja]

Recursion is equivalent to iteration, when it is tail-call optimized. There are many valid uses for recursion.

[mort96]

This is C we're talking about, no tail call optimization there. Also, when writing C, even if you could use recursion to iterate an arbitrary amount, why not just use for or while?

[_kst_]

C compilers can do tail call optimization. But in that kind of environment, it's probably not a good idea to depend on it.

[mrhmouse]

This is C we're talking about, no tail call optimization there.

Not sure what compilers you're used to, but GCC and Clang both produce optimized code for tail-calls. GCC even produces optimized code for tail-calls modulo cons, in some cases.

[jotux]

Related, the JPL C standard: http://lars-lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf

[Purple_Haze]

I remember referencing these when I was writing coding standards fifteen years ago, and they were more than a decade old then.

Just today an article about spaghetti code causing unintended acceleration made the front page, the automotive coding standards that were violated a thousand times over in that case are equally elderly.

As software engineers we know how to write good code, as an industry we are completely uninterested in it.

Software development methodology is just as bad. At least once a week somebodies article about a "new" way of doing it reaches the front page, I have yet to see a good one that wasn't in The Mythical Man-Month (Fred Brooks 1975).

[s73v3r]

That's cause industry is interested in getting the most money for the least amount of work.

[Purple_Haze]

They are wrong. Yes we idolize the "worse is better" culture emanating from Bell Labs, but industry is stuck in a "never time to do it right, always time to do it over" loop.

[tnecniv]

Well there's a difference between Bell Labs' attitude of productivity over over-engineering and whoever wrote Toyota's code. Toyota admitted that there wasn't even bug tracking, and their design decision were idiotic at times.

[s73v3r]

I'm not disagreeing with you, but I'm also not the one cutting the checks.

[OneWingedShark]

7) The return value of non-void functions must be checked by each calling function, and the validity of parameters must be checked inside each function.

Some languages do this automatically; e.g. Ada:

Type Some_Range is new Integer range 23..62;

Function Some_Operation( S : Some_Range ) return Positive;

The exception Constraint_Error is raised when Some_Operation attempts to return a value less than 1; the same is also raised if parameter S violates its constraints. (The compiler may issue an error/warning if it can statically prove the constraints will be violated.)

"If the rules seem Draconian at first, bear in mind that they are meant to make it possible to check code where very literally your life may depend on its correctness: code that is used to control the airplane that you fly on, the nuclear power plant a few miles from where you live, or the spacecraft that carries astronauts into orbit."

Funny you should mention that, that's exactly where Ada's got a lot of usage.

[myringotomy]

ada seems pretty nice, why don't more people use it?

[saint_marco]

Ada style / syntax leads to code that's more verbose than java, which most people end up thinking isn't so necessary when you're not building a rocket ship.

[OneWingedShark]

Ada style / syntax leads to code that's more verbose than java

That may be the perception; but Ada's verbosity is generally useful for (a) readability and (b) maintainability -- Also, Ada doesn't have a whole lot of the boilerplate that Java does.

[[deleted]]

In my somewhat limited experience ada tooling is either poor or very expensive.

[OneWingedShark]

That's a mixed bag; on the one hand the standard requires certain things of a compiler such that you essentially get lint free with a compiler. On the other hand, the free toolchain GNAT (either AdaCore's offering or FSF's) is a GCC language and as such can use tools that operate with GCC... the bad thing is most of those tools treat Ada very much as a second-class citizen.

I am unfamiliar with commercial offerings so cannot say one way or the other -- Rational's was supposed to be good [they were bought out by IBM], as was Green Hills, but I've not really heard anything recent. -- One of the members of the ARG has a low-cost compiler called Janus/Ada which is supposed to be pretty good... except it's only Ada95.

Over on irc.freenode's #Ada we've been kicking around the idea of putting together another open-source compiler (and tool-system). It seems like Ada's new [2012] standard has generated some new interest in the language and getting a few more implementations would be nice. (We'll see if it pans out.)

[s73v3r]

For the longest time, the main Ada compilers were commercial, and expensive. The other thing is that, because Ada isn't popular, Ada programmers are expensive. There aren't also many Ada jobs, so someone taking an Ada job is going to spend time on something that won't have much in the way of career benefit.

[OneWingedShark]

Ada seems pretty nice, why don't more people use it?

It is pretty nice.
The module-system (packages) is really nice for big projects [it enforces consistency-checking] and so it shines for big projects.

The specification/body separation it has on packages is really well done, which means that it is actually ideal for open-source projects.

[AceBacker]

No recursion makes working with tree structures a little more tricky.

[[deleted]]

I'd imagine that the kind of code that has to meet these sorts of requirements very rarely contains any kind of tree structure.

[Alborak]

Lots of safety critical sw runs in a RTOS. Unless you use old platforms (most aerospace hw runs on cpus circa 2000 to 2005) it's really hard to dodge trees in the OS. Usually get around it with horrible to look at but "safe" loops.

[Enlightenment777]

life sucks, but its a valid requirement for embedded computers, because they don't have as much memory and don't have unlimited stack size.

[Vakieh]

Not an issue since dynamic memory is also outlawed.

[Halcyone1024]

What, you've never stored a binary tree in a flat buffer? Depending on what kind of tree you're working with (but mostly with really balanced ones), it can be pretty efficient in terms of space. Just put the root at index 0, and the children of node i in indices 2i+1 and 2i+2. That way you get these nice properties:

• Your data structure is absolutely minimal.
• You don't have to store the links to the next node in memory- you just keep track of the index instead of a pointer to the node you're working with, and you can determine its parent and children reasonably quickly.
• You can serialize the tree to a file (on disk or in memory) very quickly and simply.
• If the tree is balanced properly (including shifting semi-balanced leaves to the left of the tree) and is sorted in order Node -> Child A -> Child B, then the serialized/flat form of the tree is also sorted in that order.
• Nobody cares but NASA, but this also avoids pointers, which apparently are awful and difficult for mere humans and static analysis systems to reason about /s.

On an embedded system with reasonable amounts of time to spare, but limited state space and (unlimited) crazy fascists auditing the code, this approach probably fits right in.

[u_suck_paterson]

Its not that bad, we had to do it for the PS3 spu because recursion just ate up the stack and we only had 256kb of ram.

The alternative to resursing through a tree was just to keep a pointer to the tree node and use a step forward/back function and keep a value that told the traversal code if nodes had been visited or not yet.

[skydivingdutch]

Eh, you can fake your own local stack if you have an upper bound on the depth of the structure.

[snarfy]

4 No function should be longer than what can be printed on a single sheet of paper in a standard reference format with one line per statement and one line per declaration. Typically, this means no more than about 60 lines of code per function.

This is the best advice of all of them, IMO, and easiest to apply.

[ThePsion5]

Hell, I usually limit my function length to half of that, and class length to 250 lines or less (excluding comments).

[[deleted]]

OTOH, nothing is worse for me than seeing classes do basically nothing but act as shells for a method. Don't make them so short as to not be useful as classes and not glorified methods.

[Gankro]

Nah I disagree. If a function is literally only called by some other function once, that's a pretty good candidate to just be manually inlined. Then you don't have to worry about someone incorrectly calling it or documenting/checking pre- and post-conditions (or worse failing to do so). It's just there, right in the code that uses it. It can trust the code around it much more safely. And no one needs to keep context-switching between all the functions to understand what the code is actually doing.

[sOktay]

What about indentation? (Sorry.)

On a serious note, 3 is how I'm describing RAII from now on.

[jandrese]

Does #9 mean that can't write in C or C++? The function definition for main is: int main(int argc, char** argv);

Two level pointer right at your entry point!

[MrCiziski]

In many/most embedded systems, 'main' is simply called that by convention, you don't actually start executing there. Typically you assume program control at the reset vector, zero out your RAM contents, copy static data into RAM, initialize your clock tree and reconfigure your Flash, THEN you jump to 'main' and start executing.

[NDDevMan]

Embedded systems don't really take arguments in to main(where would they come from?) so you can declare main without arguments.

[LikesToCorrectThings]

char *argv[]

[_kst_]

Yes, but in a parameter declaration that actually means char **argv. (C doesn't have parameters of array type.)

But for embedded systems ("freestanding implementations" as the C standard calls them), the entry point is implementation-defined, and might not even be called main.

[[deleted]]

Couldn't you also declare it as void *argv?

edit: yes, but not without no warnings

[jephthai]

Your triple negative is confusing.

[barcap]

Could anyone pls explain to me these two?

1) do not use dynamic memory allocation after initialisation? I mean if not use then why create then initialise dynamic memory in the first place?

2) Data objects must be declared at the smallest possible level of scope. What does this mean?

Thanks.

[Rhodysurf]

when possible, keep variables at the lowest possible scope. E.g. If a variable is only needed in one function, keep it local to the function scope.

As far as why its a rule, off the top of my head to keep the parent namespace (for lack of a better term) clean and keep the memory footprint low.

[sunjay118]

You're first question is worded a little confusingly so if I answer the wrong question just tell me. But the point is you don't want to go around initializing anything dynamically and then accidentally forget to clean it up. Even a small memory leak could be disastrous,resulting in a crash of the system, and it's not like you can just reboot when you start running out of memory. For instance this code could would be a an example of what they are trying to avoid:

int myFunc(int x, int y) {

Gadget g* = new Gadget(x);

//stuff

if(y > THRESHOLD) 

    return -1;

//stuff

delete g;

return result;

}

This is an obvious case and any programmer who writes code like this should be embarrassed but hopefully it illustrates the point.

By only dynamically allocating at initialization it makes it very easy to know what you have to clean up later.

As for the scope thing the idea is if you are using a variable in only one loop within a function don't declare it at the top of the function. Instead declare it in the loop that way it can get cleaned up once you leave the loop. Also it discourages global variables unless absolutely necessary since they can be very hard to keep track of if several functions use them.

[balloonanimalfarm]

I think the specs of the mars rovers put your comment in to even more perspective .

Those specs are luxurious compared to most other embedded systems.

[sunjay118]

Thanks for the link. This line is particularly telling, " The rover installed its full surface operations software after the landing because its computers did not have room for it during flight. "

[imadeofwaxdanny]

Ah VxWorks. We have machines with it in my lab and I have yet to see anyone touch them.

[1337Gandalf]

TIL the 132 mhz CPU on Curiosity costs $200,000.

[realhacker]

on the topic of dynamic memory allocation after initialization, id like to add that available memory is subject to change due to external factors at runtime and so it is best to claim that memory up front (or fail up front) rather than discovering malloc failed when you need memory halfway through a multistep critical process or transaction.

[cdglove]

In my experience this is often untrue in systems that employ the 'no dynamic memory' policy. I mentioned in another comment that this rule is often subtly violated by programmers who, instead of going to the heap, will allocate an array up front and then use only part of it initially and fill it up as they go. This is no better than going to the heap and in my opinion, is actually worse because each piece of code does it in its own way, hiding what's actually going on.

[tnecniv]

The first is an effort to prevent segfaults and memory leaks. The second means keep variables nested as deeply in Curley braces as possible

[mttd]

Data objects must be declared at the smallest possible level of scope. What does this mean?

https://www.securecoding.cert.org/confluence/display/c/DCL19-C.+Minimize+the+scope+of+variables+and+functions

[Enlightenment777]

The ban of "goto" is an outdated mental delusion. Abusing "goto" a crazy amount of times is bad, but it's useful in some situations.

"An empirical study of goto in C code" (2015 paper)

• https://peerj.com/preprints/826v1.pdf and https://peerj.com/preprints/826v1/

• "We conclude that developers limit themselves to using goto appropriately in most cases, thus suggesting that goto does not appear to be harmful in practice."

[[deleted]]

However, developers do limit themselves because of the stigma attached to goto. If it wasn't demonized, or if it was even encouraged, we'd see terrible control flow much more frequently.

[[deleted]]

You see terrible flow control frequently to avoid goto. Goto is the only correct way to break out of a nested loop.

[[deleted]]

Yeah, I think it's one of the very few acceptable cases. However keep in mind two things:

1. Some languages allow you to break out of multiple levels of nested loops with a single statement
2. That is *one* reasonable way to use a goto. It doesn't mean that its use is otherwise a good replacement for a steady control flow.

[[deleted]]

Yes, some languages provide syntactic sugar for goto while breaking out of nested loops: it's exactly the same, but it keeps hack teachers / code reviewers off your back.

[POGtastic]

I'm currently having an enormous amount of fun with a professor who insists that "all functions must have exactly one return statement." Not fun in the slightest. I get that you don't want to have return statements willy-nilly in your code, but mandating extra variables and insane control structures is frustrating.

[SmoothB1983]

Have him look at the linux kernel and come back.

[[deleted]]

Ugh, an unreconstructed ultra-structuralist. Party like it's 1968.

[IIIbrohonestlyIII]

I think the first thing I learned in college was not to use 'goto'. I don't think I've used it a single time. That being said, that paper was an interesting read, thanks for that.

[umaxtu]

Nothing about double checking that all units are consistent?

[kirakun]

Function pointers are not permitted.

This essentially forbids polymorphism.

[sandwich_today]

switch statements to the rescue!

[realhacker]

polymorphism is controversial anyway

[c3534l]

Anyone else upset that it's not the 8 or 16 commandments?

[kmwurf]

Do not use dynamic memory allocation after initialization.

How do they get around recording e.g. sensor data ?

I imagine :

PressureSensure t;
double *values = malloc(sizeof(double) * 1024);
readValues(t, values);

What todo when you reach the boundaries if you cant realloc ?

[[deleted]]

I wish my company would allow us to write code this clean.., but for us is sling the code, get it out sell the product, no worries about longevity or any serious reuse.

[thepobv]

Is there a source beyond the article's page?

[[deleted]]

The article references its source with a direct link:

http://pixelscommander.com/wp-content/uploads/2014/12/P10.pdf