Live data from Hacker News

Ada and SPARK enter the automotive ISO-26262 market with Nvidia

adacore.com

101–110 of 113 posts

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#101
post #70

Earlier quoted context omitted.

It will help a lot still. But as I said, Forth it's better than raw ASM. On integers casted into floats, a Forth programmer would use a fixed point in a much saner way, they had experience for decades on it.

C programmers have been using fixed point integer math instead of floats for decades. It's a solved engineering problem in safety critical systems. It's only a problem for clueless devs who look for reason to shit on C and think the magic lies in the right programming language, not in having the right knowledge.

Chuck Moore disagrees. On C, I use OpenBSD and I even adapted some ports (mednafen, c++, but my point remains), one of them (not officially, as a home user) being cpulimit from Free to Open. Still, Forth on small devices it's far more predictable and introspectable than C.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#102
post #58

Earlier quoted context omitted.

C with underfined behaviours it's far worse than a proved embedded Forth. At least you will know how it will behave with the stack/dictionary and so on.

Then why did the auto and aerospace industry standardize on C/C++ instead of Forth? Just because something is sometimes better doesn't mean it's also more economical in production. You're still limited by budget constrains. With that budget you need to hire and/or train SW developer. It doesn't matter that X language might be better if you can't find and/or train people with experience on it. So you're better off usi…

IDK about Airbus, but just have a look at Boeing.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#103
post #74

Earlier quoted context omitted.

The Patriot failures were the result of floating point error. Ada provides facilities specifically to deal with this, while you're left rolling your own in C/C++. Of course Ada won't save you from human bugs, but it's silly to say that you're no better off with a language giving you everything it can to avoid them than one that is a notorious fuckup dispenser.

1. How is Ada better at floating point than C++? 2. In mission critical systems we always used fixed point fractional numbers in C as a representation of floats, to avoid floating point issues, so any issues of the language are moot.

In respect to both points, Ada provides decimal and binary fixed point representations as a first class feature of the language, and in the event you must use floating point, SPARK provides the capability to prove that you're not running into rough edges. It's actually one of the most immediately noticeable features of the language for a firmware developer coming from C, and I'm a bit surprised you don't know about it.

Of course I know that you can do all of this stuff in C. I did it for years. I just don't think there's any sort of honor or expression of skill in getting your balls busted by this stuff being an afterthought, it's just annoying. I know your response will be "get better", and I did, countless people have, and we all still appreciate that these nuisances can be taken care of by the language.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#104
post #73

Earlier quoted context omitted.

I'm near Detroit which has a huge amount of auto industry, and engineering pay is good across pretty much all disciplines. It'll pay for a happy life and then some as long as relentless title climbing and job hopping isn't your definition of happiness. Ada is not some exotic thing that requites SF comp. If it's such a major adjustment coming from C/C++ that it's actually causing you trouble, you have other problems.…

>I'm near Detroit which has a huge amount of auto industry, and engineering pay is good across pretty much all disciplines. I dunno about Detroit since I don't live there, but in Europe the auto industry is on a major downturn with cost cutting, layoffs and hiring freezes. Good luck getting hired anywhere now if you're laid off from the Auto industry and your specialty is some niche stuff only used in the auto indust…

Everywhere is in a downturn. ZIRP is over, this isn't limited to automotive. Just because you're not going to be hired within a few days of looking doesn't mean that everything is doom and gloom. Automotive software engineers aren't working for poverty wages.

You don't outright lose years of experience writing C and C++ just because you learned Ada. You're not going to leave a decade of C experience off your resume just because it wasn't the primary language in your last position. Ada isn't for frontend web development where new "technology" gets chewed up and spat out every year or two. It shines in firmware. There's plenty of vendors that haven't moved past C99.

Chalking up a hypothetical appreciable Ada marketshare in automotive as "niche stuff only used in the auto industry" doesn't make sense in that it sees plenty of use in aerospace, defense, and medical. The point of me bringing up AUTOSAR is that Ada is nowhere close to the pigeonhole scenario that AUTOSAR is.

In the world where you only have Ada experience, and you're not a bad programmer, but HR departments are giving you grief, just lie on your resume. Fuck em. We both know that it's not a major adjustment, so brush up on details before you're interviewed and if they asked what you used C/C++ just say you're not at liberty to speak about it. Nobody is going to hit you with anything along the lines of whether or not it's true that monads are just monoids in the category of endofunctors.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#105
post #92

Earlier quoted context omitted.

From the documentation you linked, it seems slicing creates a brand new String, which is more like std::string than std::string_view. In other words, it allocates and copies all of the string's characters (although it might allocate on and copy those bytes to the stack). Also, the Unbounded_String owns its copy of the data, as opposed to referencing other data. The difference with String seems to be just that it can…

Allocating a new String, requires... "new String". You issue the "new" command, or the source does. But what Unbounded does is... "U.Reference (U.First .. U.Last)". It returns a reference. It's not duplicating, because that would defeat the point of its entire existence. Its the buffer, containing one or more string objects, and you're just slicing a reference out of it - because that's the point. If you want a Strin…

I tried to get some sort of proof based on Godbolt, to see if it generates any memcpy's, but I couldn't manage to do that after quite a few tries. :(

It's really difficult to understand this given how much I know about Ada, so the best I can do is to keep throwing questions at ChatGPT. And I keep getting results that go against what you said.

I've also tried a couple direct review examples from o4-mini-high, one without the documentation link [1] and one with it [2].

It matches what I've managed to learn as well. I know how LLMs work and that they hallucinate a lot, so I can't tell who here is wrong, since you seem to be really experienced, and I barely know anything... what are your thoughts?

Oh, and I really appreciate you walking me though this! Like, a lot a lot! Thank you very much!

[1] https://chatgpt.com/share/684341e3-8e20-8012-b8d0-9847742af9...

[2] https://chatgpt.com/share/68434538-fe24-8012-bdb7-b07db34371...

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#106
post #92

Earlier quoted context omitted.

Allocating a new String, requires... "new String". You issue the "new" command, or the source does. But what Unbounded does is... "U.Reference (U.First .. U.Last)". It returns a reference. It's not duplicating, because that would defeat the point of its entire existence. Its the buffer, containing one or more string objects, and you're just slicing a reference out of it - because that's the point. If you want a Strin…

I tried to get some sort of proof based on Godbolt, to see if it generates any memcpy's, but I couldn't manage to do that after quite a few tries. :( It's really difficult to understand this given how much I know about Ada, so the best I can do is to keep throwing questions at ChatGPT. And I keep getting results that go against what you said. I've also tried a couple direct review examples from o4-mini-high, one with…

Never, ever, throw any non mainstream language at an LLM. You will get absolutely nothing but bullshit back. They do not comprehend, and so they cannot move away from generalisation to actually speak about the language. There is not a large enough public source to train the model.

If you're throwing something to a con-artist, don't be surprised if everything you get back does not line up with reality.

EDIT:

Here's a simple example on godbolt: https://godbolt.org/z/hcxhvGnTc

As you can see, it just returns a pointer. No copying happens. There's a different length marked along with the pointer, but that's it.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#107

Earlier quoted context omitted.

>I'm near Detroit which has a huge amount of auto industry, and engineering pay is good across pretty much all disciplines. I dunno about Detroit since I don't live there, but in Europe the auto industry is on a major downturn with cost cutting, layoffs and hiring freezes. Good luck getting hired anywhere now if you're laid off from the Auto industry and your specialty is some niche stuff only used in the auto indust…

Everywhere is in a downturn. ZIRP is over, this isn't limited to automotive. Just because you're not going to be hired within a few days of looking doesn't mean that everything is doom and gloom. Automotive software engineers aren't working for poverty wages. You don't outright lose years of experience writing C and C++ just because you learned Ada. You're not going to leave a decade of C experience off your resume j…

>Automotive software engineers aren't working for poverty wages.

How does that help when nobody is hiring right now and you're competing with thousand of laid off engineers?

>so brush up on details before you're interviewed

How do you get interviewed in the first place if they're screening your resume out due to not having the experience with the programming languages they're looking for?

Like I said, having niche languages sends your resume in the bin.

>if they asked what you used C/C++ just say you're not at liberty to speak about it

Unless you worked for government intelligence, this type of response gets you rejected immediately here in Europe/Germany, since they have 100 other candidates who can speak about what they did. Why would they bother with you when you're already making their life hard from the interview stage?

I feel like your US centered viewpoint is way off from the reality of where I live.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#108

Earlier quoted context omitted.

>It’s pretty much that conversation that triggered my move into high tech and away from military. Could you elaborate on this please? What is "high tech" here?

High tech is cutting edge tech, I.e. applied research at big tech.

Do you have any specific example of such jobs?

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#109
post #106

Earlier quoted context omitted.

I tried to get some sort of proof based on Godbolt, to see if it generates any memcpy's, but I couldn't manage to do that after quite a few tries. :( It's really difficult to understand this given how much I know about Ada, so the best I can do is to keep throwing questions at ChatGPT. And I keep getting results that go against what you said. I've also tried a couple direct review examples from o4-mini-high, one with…

Never, ever, throw any non mainstream language at an LLM. You will get absolutely nothing but bullshit back. They do not comprehend, and so they cannot move away from generalisation to actually speak about the language. There is not a large enough public source to train the model. If you're throwing something to a con-artist, don't be surprised if everything you get back does not line up with reality. EDIT: Here's a…

I see it does what you're saying on the "else" branch, but that just returns the previous string unmodified, which makes sense. The more important one is the "if" branch though.

Looking at your Godbolt example's assembly, even if I add -O3, I see it does a call to "ada__strings__unbounded__unbounded_slice", but until I know the contents of that I can't say whether the pointer it returns is derived from the same allocation as the original one, or from a new allocation that the string was copied to.

You're using the Unbounded_Slice function [1], which calls To_Unbounded_String [2], which calls `new String` [3], which you mentioned in a previous comment that it will allocate, right?

The kind of operation I'm looking for is something like a "Trim_Whitespace" function that re-uses the old allocation without copying all the data, even when there is whitespace to trim.

[1] https://github.com/gcc-mirror/gcc/blob/master/gcc/ada/libgna...

[2] https://github.com/gcc-mirror/gcc/blob/master/gcc/ada/libgna...

[3] https://github.com/gcc-mirror/gcc/blob/master/gcc/ada/libgna...

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#110
post #106

Earlier quoted context omitted.

Never, ever, throw any non mainstream language at an LLM. You will get absolutely nothing but bullshit back. They do not comprehend, and so they cannot move away from generalisation to actually speak about the language. There is not a large enough public source to train the model. If you're throwing something to a con-artist, don't be surprised if everything you get back does not line up with reality. EDIT: Here's a…

I see it does what you're saying on the "else" branch, but that just returns the previous string unmodified, which makes sense. The more important one is the "if" branch though. Looking at your Godbolt example's assembly, even if I add -O3, I see it does a call to "ada__strings__unbounded__unbounded_slice", but until I know the contents of that I can't say whether the pointer it returns is derived from the same alloc…

It returns a new pointer, with the same buffer, as I said already. "There's a different length marked along with the pointer, but that's it."

You need a slice, which has a different length. That is how you do it, without a new allocation.

It's effectively:

    struct String {
      size_t length;
      char\* buffer
     };

    struct String\* Unbounded_Slice(struct String\* original, size_t Low, size_t High) {
      struct String\* slice = malloc(sizeof(struct String));

      // Bounds checking would go here...

      slice->buffer = original + Low;
      slice->length = High;
      return slice;
     }
(The exact definition of a string is implementation-defined. But that's the concept.)

Ada enforces safe ranges, which means you need to carry the length of the slice somehow. It does not use C's 0-terminated strings. So slicing does not work the same way as strtok or other self-modifying systems - the length isn't guessed, it's known.

But if you change one character in the buffer of the slice, it'll be changed in the original Unbounded_String too.

For trimming whitespace, you're right that Unbounded's standard Trim may reallocate. It carries multiple buffers, and when you Trim sometimes it will just hand it back, other times it'll reallocate. [0] Mostly for performance tradeoff. Keeping the original can make iteration slower, as it holds multiple buffers.

So, to implement our own - with one caveat. Slice can't handle 0-length, because range safety is enforced. So in the case of a wholly whitespace string, we'll be doing a whole new allocation.

    -- This line is just for pasting into godbolt
 pragma Source_File_Name (NTrim, Body_File_Name => "example.adb");

    with Ada.Strings.Unbounded;
     with Ada.Strings.Maps;
     use Ada.Strings.Unbounded;

    function NTrim(Source : Unbounded_String) return Unbounded_String is
        Len : constant Natural := Length(Source);
        First, Last : Natural;
        Whitespace : constant Ada.Strings.Maps.Character_Set := Ada.Strings.Maps.To_Set(" " & ASCII.HT & ASCII.LF & ASCII.CR);
     begin
        if Len = 0 then
           return Source;
        end if;

        First := 1;
        while First = First and then Ada.Strings.Maps.Is_In(Element(Source, Last), Whitespace) loop
           Last := Last - 1;
        end loop;
    
        if First > Last then
           return To_Unbounded_String("");
        end if;
    
        declare
           Trimmed_Length : constant Natural := Last - First + 1;
        begin
           if Trimmed_Length >= 3 then
              return Unbounded_Slice(Source, First, First + 2);
           else
              return Unbounded_Slice(Source, First, Last);
           end if;
        end;
     end NTrim;
The resulting compilation [1] has a few things. Our whitespace map gets allocated and deallocated most of the time. A map is harder to treat as a constant, and the compiler doesn't always optimise that nicely. Most of the code is bounds checking. No off-by-one allowed, here. Where first is greater than last, you get a new full allocation.

[0] https://github.com/gcc-mirror/gcc/blob/master/gcc/ada/libgna...

[1] https://godbolt.org/z/x8Erhqn5n

Post reply on HN