Live data from Hacker News

Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

manufacturing.net

181–190 of 203 posts

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#181
post #180

Earlier quoted context omitted.

> it would help if the Rust compiler was formally verified as well As far as I know, the only usable formally-verified compiler (for a serious programming language) is the CompCert C compiler. Even C compilers and Ada compilers intended for use with critical systems, don't tend to be formally verified. Of course, it would still be great if the compiler for Rust (or Ada, or any other language for that matter) could be…

The Rust compiler had some severe bugs in the past which undermined the effectiveness of the memory safety. There is the saying in software engineering that the number of undiscovered errors in the system is proportional to the number of discovered errors. On the other hand Ada compilers used to be subjected to strict validation procedures in the past, and the AdaCore toolchain has an ISO 26262 and IEC 61508 qualific…

Ok, but a formally verified compiler is a very different beast from a high quality compiler. We can realistically hope the Rust compiler team significantly improve the correctness of the compiler, but full formal verification is unlikely.

CompCert is an extremely impressive achievement, and compiles a near-complete subset of standard C. A verified Rust compiler would be an enormous undertaking, and would need a very skilled team. It also wouldn't be worth trying unless the Rust language were very stable, which, if I understand correctly, it isn't.

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#182
post #177
post #48

Earlier quoted context omitted.

When Apple ported their code from the Lisa to the Macintosh they had to rewrite a lot of Pascal code in C and assembly to make it fit into the ROM's. There was also an issue 100% standard Pascal was useless for writing micro computer programs because it couldn't do any IO outside the console and files. C on the other hand through pointers and inline assembly allowed you to directly monkey with the hardware. Thing als…

The Mac was programmed in Object Pascal and assembly. No C anywhere. C compilers for the Mac came along later, and even Apple A/UX Unix System V with BSD extensions, and Gcc. A/UX ran pretty nicely in 8M on an SE/30 (512x342 mono CRT), with a MacOS 9 GUI emulator you could run xterms on.

You are correct I mis-remembered.

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#183
post #112
post #106

Earlier quoted context omitted.

Watch the video, slides are just one part. Part of "Determine the difficulty and learning curve for others".

Rust is also discussed at 35:00 into the presentation, noting the lack of a spec, higher memory util, and no commmercial vendor.

> and no commmercial vendor.

So it's about liability. Makes sense.

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#184
post #89
post #58

Pascal < modula < ada

Only the first ISO Pascal, ISO Extended Pascal is more in line with Modula-2. There there are all the offsprings from UCSD Pascal and Object Pascal, and same applies to Modula, with Modula-2+ and Modula-3.

I was a CS student at York University shortly after Wirth had a residency there in the 1970s. Pascal of that time, was informative of Modula, but Modula was more informing of ADA because it was still a candidate language model going forward before Ichbiah's pick won out. The whole steelman process was the backdrop to my comparative computer language courses

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#185
post #57

Earlier quoted context omitted.

But k&r 2 was the point of comparison, that's c89 right?

K&R 2 represents the bulk of the modern language. You can't be very productive knowing just Ada83.

Right. But the question was historical (so I interpreted it at least).

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#186
post #65

Earlier quoted context omitted.

Because Ada is not a language for quick and dirty. It's a language that is only fun and usable if you apply engineering methods to the whole project (a.k.a requirements, documentation etc.). Most projects out there don't. Quite frankly, it's not a hackers language. EDIT: Oh and the price tag.

It's in gcc. Or available from AdaCore under GPL-3 (yeah, I know). Unless you're in the sort of position where you need a support contract anyway, price isn't really an issue.

Yes, I know it is in gcc. But compared to the AdaCore version, there are way too many bugs (at least when I played with it in 2018). And for any commercial endeavour (even if just a small company, say one or two developers) you really need the support contract (for fast bug fixing the compiler etc.). That's from my experience. Remember, it was about widespread adoption. With the above described small shop situation, there is no pricing that is payable by those shops. And the GPL 3 version does not help here. At least I haven't seen a solo developer going from "I created this amazing thing with the GPL version" to "I can now afford the commercial license of 20000€ per seat".

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#187
post #186

Earlier quoted context omitted.

It's in gcc. Or available from AdaCore under GPL-3 (yeah, I know). Unless you're in the sort of position where you need a support contract anyway, price isn't really an issue.

Yes, I know it is in gcc. But compared to the AdaCore version, there are way too many bugs (at least when I played with it in 2018). And for any commercial endeavour (even if just a small company, say one or two developers) you really need the support contract (for fast bug fixing the compiler etc.). That's from my experience. Remember, it was about widespread adoption. With the above described small shop situation,…

My experience is vastly different from yours. I've been using Ada as my main language for personal stuff for some years now... I can't quite recall when, but call it 5+ years?

I won't say I've never run into some kind of problem with Ada on gcc (aka FSF GNAT), but it's been pretty minimal and easily avoided. I think it's been a grand total of two or three bugs that I've known of in that time. I've also run into known gcc bugs with C++ before so the situation doesn't seem particularly bad to me.

I find it hard to believe a solo or duo dev shop has a real need for a support contract for their compiler. What language can you get a support contract for that is affordable by anyone?

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#188
post #186

Earlier quoted context omitted.

Yes, I know it is in gcc. But compared to the AdaCore version, there are way too many bugs (at least when I played with it in 2018). And for any commercial endeavour (even if just a small company, say one or two developers) you really need the support contract (for fast bug fixing the compiler etc.). That's from my experience. Remember, it was about widespread adoption. With the above described small shop situation,…

My experience is vastly different from yours. I've been using Ada as my main language for personal stuff for some years now... I can't quite recall when, but call it 5+ years? I won't say I've never run into some kind of problem with Ada on gcc (aka FSF GNAT), but it's been pretty minimal and easily avoided. I think it's been a grand total of two or three bugs that I've known of in that time. I've also run into known…

As I said, I tried the FSF version at about 2018. Might be way better now, I don't know. My experience with gcc (C, not C++) for personal projects is exactly zero bugs. So, you see, experiences can differ ;-).

When saying "you need the support contract" I mean getting the commercial compiler version. I think (theoretically?) AdaCore does not charge you for the compiler, but for support. And you only get access to the commercial compiler and libs if you have a support contract, no?

I admit I might be one of those who does not completely understand the legal circus around GNAT, AdaCore and the FSF version.

P.S.: You can get commercial support from IAR for the C compiler and RTOS, which is next to useless ;-).

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#189
post #173
post #142

Earlier quoted context omitted.

I've seen that before - is there an implementation, and also, how do the usual users of Ada feel about it? I feel like one of the attractions to Ada for this sort of use case is its maturity, and "here's a proposal for a complicated feature, inspired by Rust, a language which young and rapidly evolving and in particular switched to a new borrow checker implementation less than two years ago and shipped it with known…

Where is the quoted text from ( "here's a proposal... as we speak" )? > I imagine that people writing airplane control software are probably going to prefer something less powerful that hasn't changed in decades True, depending on the design assurance level a certified compiler is required. > I suspect that community simply does not care about safe dynamic allocation See the reference in my former post. Whether and w…

Sorry, the text in quotes is my own, I'm not quoting anything. Probably I should have found a way to write that without quotation marks.

Rust added a new borrow-checker implementation, "non-lexical lifetimes" (NLL) in December 2018, as part of introducing the 2018 "edition" (a compile-time flag that says what compatibility level you're targeting, roughly analogous to --std=c99). In 2019, they backported it to the original 2015 edition and removed the original implementation, "AST borrowck". As the names imply, NLL has the ability to handle more complex patterns without assuming borrows are live for the entire lexical scope just because it's accessed somewhere in a pair of braces; this turns out to be very useful in practice, since a lot of natural patterns (including those written by beginners not trying to do anything complicated) trip up the older implementation. However, NLL initially accepted some code that was invalid, and it was shipped anyway, and at least a couple of production Rust users ended up writing things incorrectly accepted by NLL. See https://lkml.org/lkml/2020/8/23/214 for my summary of what happened with some links. (I don't think this caused any problems in practice; my sense is that it was undefined behavior, which shouldn't be possible in safe Rust, but the compiler almost certainly chose a behavior that happened to match the intended semantics.) And there's work in progress on a new borrow-checker implementation called "Polonius."

All this is to say that, if you wrote a paper in 2018 saying that Rust's (AST-based) borrow-checker feature is great and Ada should pick it up, you're still behind Rust because there's a new one. If you wrote a paper in 2019 and based your work on NLL, you stood a nonzero chance of picking up that bug. If you write one today, maybe you should base your work on Polonius, but Polonius will itself probably take a fair bit of real-world use to shake out its own bugs.

> It's easy to find projects on Github where dynamic allocation is used; e.g. https://github.com/ghdl/ghdi

Thanks, that's useful!

Though (and maybe this is my unfamiliarity with Ada), from some quick looking around to see where it dynamically allocates, I find https://github.com/ghdl/ghdl/blob/master/src/synth/synth-hea... , which seems to bind the C malloc function and intentionally not bind free and leak all memory, am I reading that right? That's definitely safe but suboptimal.

Re: Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System

#190
post #180

Earlier quoted context omitted.

> it would help if the Rust compiler was formally verified as well As far as I know, the only usable formally-verified compiler (for a serious programming language) is the CompCert C compiler. Even C compilers and Ada compilers intended for use with critical systems, don't tend to be formally verified. Of course, it would still be great if the compiler for Rust (or Ada, or any other language for that matter) could be…

The Rust compiler had some severe bugs in the past which undermined the effectiveness of the memory safety. There is the saying in software engineering that the number of undiscovered errors in the system is proportional to the number of discovered errors. On the other hand Ada compilers used to be subjected to strict validation procedures in the past, and the AdaCore toolchain has an ISO 26262 and IEC 61508 qualific…

> There is the saying in software engineering that the number of undiscovered errors in the system is proportional to the number of discovered errors.

I think that's true for software developed under similar processes, but (for instance) if you're comparing software that has unit tests and software that doesn't, the constants are probably wildly different. Your tests (or even the process of thinking about writing testable code) will discover a number of errors but will hopefully drive the number of actual errors down.

To be clear, I'm not making a statement on whether Rust or Ada is better-tested or better-developed, but I will note that Rust goes out of its way

I'm also curious about these bugs - I'm aware of bugs in the standard library (which is developed in the same repo as the compiler), but they only undermine memory safety against hostile source code, and hostile source code has lots of other options (unsafe, /proc/self/mem, ptrace, ...), i.e., the Rust compiler is not a sandbox. I'm not aware of severe bugs in the compiler, and I'm not aware of standard library bugs against hostile user input by well-intentioned source code - e.g., there shouldn't be things like the 2001 sudo "vudo" exploit.

Post reply on HN