111–120 of 451 posts
TL;DR - no exceptions - no recursion - no malloc()/free() in the inner-loop
Has anyone else here banned exceptions (for the most part) in less critical settings (like a web app)? I feel like that's the way to go since you don't obscure control flow. I have also been considered adding assertions like TigerBeetle does https://github.com/tigerbeetle/tigerbeetle/blob/main/docs/TI...
Earlier quoted context omitted.
Depends on the company in my experience. I've seen some suppliers that basically just wire up the diagram in Matlab/simulink and hit Autocode. No humans actually touch the C that comes out. Honestly I think that's probably the correct way to write high reliability code.
You’re joking right? That autogenerated code is generally garbage and spaghetti code. It was probably the reason for Toyotas unintended acceleration glitch.
Earlier quoted context omitted.
For C, the proper/expected/standard way to reference a variable without accessing it is a cast to void: (void) a; I'm sure there are commonly-implemented compiler extensions, but this is the normal/native way and should always work.
Not if you use GCC. https://godbolt.org/z/zYdc9ej88 clang gets this right.
Earlier quoted context omitted.
Modern autogenerated C code from Simulink is rather effective. It is neither garbage nor spaghetti, it is just... peculiar.
It’s also much, much more resource intensive (both compute and memory) than what a human would right for the same requirements.
TL;DR - no exceptions - no recursion - no malloc()/free() in the inner-loop
This is basically video games prior to 2010
a = a; // misra Actual code i have seen with my own eyes. (Not in F-35 code) Its a way to avoid removing an unused parameter from a method. Unused parameters are disallowed, but this is fine? I am sceptical that these coding standards make for good code!
Zig makes it explicit with _ = a; And you would encounter it quite often because unused variable is a compilation error: https://github.com/ziglang/zig/issues/335
It's extremely annoying until it's suddenly very useful and has prevented you doing something unintended.
Isn't the F35 program considered a failure? Or am I confusing it with some other program?
I haven’t heard anything particularly bad about the software effort, other than the difficulties they had making the VR/AR helmet work (the component never made it to production afaik).
Earlier quoted context omitted.
> It was probably the reason for Toyotas unintended acceleration glitch. Do you have any evidence for "probably"?
I know for the fact simulink generates spaghetti and spaghetti code was partially blamed for Toyotas problems. Hence the inference See https://www.safetyresearch.net/toyota-unintended-acceleratio...
a = a; // misra Actual code i have seen with my own eyes. (Not in F-35 code) Its a way to avoid removing an unused parameter from a method. Unused parameters are disallowed, but this is fine? I am sceptical that these coding standards make for good code!
Studies have looked at MISRA, I'm not aware of any for the JSF guidelines. For MISRA there's a mix, some of the rules seem to be effective (fewer defects in compliant software), some are the opposite (code which obeys these rules is more likely to have defects) and some were irrelevant. Notably this document is from 2005. So that's after C++ was standardized but before their second bite of that particular cherry and…
Earlier quoted context omitted.
It’s also much, much more resource intensive (both compute and memory) than what a human would right for the same requirements.
For control systems like avionics it either passes the suite of tests for certification, or it doesn't. Whether a human could write code that uses less memory is simply not important. In the event the autocode isn't performant enough to run on the box you just spec a faster chip or more memory.