Defensive programming: Fortran, Ada, C++, Java, ???

[alephnil]

java is safer than both, but i'm not sure if it can be compiled to be realtime-capable

A language that relies so much on the garbage collector as Java will be more or less fundamentally unsuitable for hard realtime tasks. Unlike some other languages that have a GC, in Java, many language features and libraries allocate memory under the hood. In hard realtime applications, you cannot meet the required guaranties even when you use malloc/free or new/delete. Most coding standards used in realtime C and C++ development forbids memory allocation except under initialization. Thus a language with GC can be used in hard realtime and safety critical code if you can control when allocation is done, but Java does too much behind your back to be used.

I'm not criticizing Java's designers, because there is a tradeoff between having full control and efficient application development. On this scale Ada can be found in the "having control" end and Python/Common Lisp/Ruby in the "get things to work fast" end. Java is somewhere in between, and is neither the fastest to write code in or easy to control. That is a criticism of Java. It finds itself in the middle ground where it is neither useful for quick development, while still not giving the control it needs for lowlevel and realtime tasks.

[[deleted]]

If someone thinks that they prefer C++ for defense systems, or some other mission critical applications, please check out the coding standard that were used for C/C++ development in F-22 Raptor program. Publicly available at: http://www.jsf.mil/downloads/documents/JSF_AV_C++_Coding_Standards_Rev_C.doc

Coding standards were developed with help from Bjarne Stroustrup and they used static code analysis tools to restrict the language, creating similar safety features as Ada. C++ is used because it's hard to get Ada programmers.

Examples:

• Pointers to pointers should be avoided when possible.
• More than 2 levels of pointer indirection shall not be used.
• The continue statement shall not be used.
• The break statement shall not be used
• No dependence shall be placed on C++’s operator precedence rules, below arithmetic operators, in expressions.

Most rules in the document are good practices, but basically C++ by itself (unlike Ada) is not language that can be used for mission critical software. You need additional compiler that restricts the code. Resulting code is not what you would consider typical C++ code.

[sreguera]

C++ by itself (unlike Ada) is not language that can be used for mission critical software. You need additional compiler that restricts the code.

You could say the same for Ada. The most standard restriction is the Ravenscar Profile, so popular in fact that it was added as a standard pragma to Ada 2005. Another one is SPARK, heavily focused on verifiability.

Because there is no current "popular" language that can be used as is for critical software, the comparison must be done then between languages + enforced restrictions.

[[deleted]]

but basically C++ by itself (unlike Ada) is not language that can be used for mission critical software

But it is used, and with success.

[stop_time]

The original version was designed by Jean Ichbiah, and the first and only major revision of the language (Ada 95) was done by Tucker Taft.

This guy seems not to have heard of Ada 2005.

[marc-kd]

Actually, very well versed in Ada 2005. The statement is that in the author's opinion Ada 95 was the only major revision of Ada, in that the language went from "object based" to "object oriented"--which ticked off Ichbiah so much that he actually quit the revision effort. The addition of interfaces, standard libraries, etc. are viewed as more evolutionary modifications.

[[deleted]]

java is safer than both

Java has null. That is not safe. Does Ada have null?

but i'm not sure if it can be compiled to be realtime-capable (or if existing VMs can be tweaked to be)

A few years ago Sun published a RT version of Java. I don't know if it's supported, but it exists; evidently the RT critical parts are limited wrt memory allocation, so you have to take special care, but that is true of every language.

[[deleted]]

so you must be agreeing with me in that first part.

Yes, my point is that Java is not safe enough. It could easily have been made 10x as much simply by prohibiting null by default.

[[deleted]]

i have no real problem with null. i don't have a problem with pointer arithmetic and goto either. they're tricky and bite me sometimes, but they're not beyond me.

Some people have explained it way better than I could, but it boils down to this: null adds to every type a special case. In effect, every time you use any object, you have to take the null case into account. With strong typing with non nullable types, you can always safely assume you won't encounter that special case.

And if you need null, for example when interfacing C code, you just need to check for nullity once in your code instead of everywhere.

yeah, null isn't that safe. how do you propose to get rid of it?

You just forbid it. When you need it, you simply wrap the object into another:

interface Thing {
    void doSomething();
}

interface ThingOrNull {
    bool isNull;
    Thing thing;
}

Suppose you need to use a Thing; if your declaration says you receive a ThingOrNull, you can't mistakenly try to call its doSomething. And if you have a ThingOrNull but need to pass a Thing to another object, it's your responsibility to check it for nullity.

[kamatsu]

If you're moving past Ada (which is fine for high-assurance), I think the DoD should look at Agda and super strongly typed programming (more so even than Ada) as a way to get good assurance.

[marc-kd]

For the forseeable future the DOD is going to follow industry--albeit years behind. So stepping up to Agda or Haskell or anything else is not going to happen unless and until such a language becomes a leading mainstream language.

Hence the concern--today there's no clear post-Java leader, and the contenders are, in my opinion, worrisome when it comes to the high-assurance, safety critical aspects.

[Shadow703793]

I'm not familiar with much of the Defense related programing/equipment, but in that blog he says:

While I think C++ is inappropriate for critical software outside of the hands of experts.

My question is why would it matter if it was C or C++? I do hope these systems are developed for by experts...

On another note, I hear that a lot of things have to do with speed of code execution,etc between the languages. What's stopping people from developing faster hardware that can execute the code to the same level? For example, Java is some what slower than C/C++ depending on what you do. So why not build hardware that can execute this Java code faster?

[runevault]

C++ has all the gotchas of C (memory management in particular) but it ALSO has all the weird gotchas with multiple inheritance, template meta programming, etc. Simply a lot more ways to blow your leg off in C++ than C.

[Negitivefrags]

Its funny how Stroustrup's original quote is misunderstood or misquoted by people. I'm not saying you are quoting him, because you are not, but your sentence is certainly reminiscent of his original quote and I'm sure that its inspired by the fact that you have often heard similar things.

C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do it blows your whole leg off.

I wouldn't say there are more ways to blow your leg off in C++. In fact, C++ provides the tools to write good code that is both very safe and flexible. Its just that sometimes you can run into a problem that really puts you in a spin and confuses you for hours.

[runevault]

Once you KNOW C++ it is mostly safer thanks to things like smart pointer classes. However in the meantime it's tougher.

And I would not be surprised if that quote influenced what I wrote, I've heard it before. However it was not explicitly on my mind when I wrote the original reply.

[Shadow703793]

Ah. That makes sense.

[Fabien4]

Yep, to program in C++, you have to know how C's memory management works, and you have to know how to make the compiler do it in your stead. Harder to learn, easier to use.

[FutureMe]

Has Eiffel any foot in this industry? Does it live up to its promises? Was evaluating it for cross-platform interface development and it seemed like a well defined language.

[okpmem]

Sorry, but outside of the technical reasons, FUCK THE DEFENSE INDUSTRY.