The C++ standard for the F-35 Fighter Jet [video] • Hacker News Board

Re: The C++ standard for the F-35 Fighter Jet [video]

#401

Post by 0xffff2 » Mon, Dec 08, 2025, 6:57 PM UTC

anonymousiam wrote: post #81

The same is true for the software that runs many satellites. Use of the STL is prohibited. The main issue is mission assurance. Using the stack or the heap means your variables aren't always at the same memory address. This can be bad if a particular memory cell has failed. If every variable has a fixed address, and one of those addresses goes bad, a patch can be loaded to move that address and the mission can contin…

For what it's worth, I am an active developer of space flight software. This might be true somewhere, but it's not true anywhere I've ever encountered. The contortions required to avoid using the stack would be insane and cause far more bugs than it could ever prevent. I'm pretty confident asserting that this is simply not a thing. Even heap allocation is very often allowed, but restricted to program initialization only. Furthermore, these rules are relaxing all the time. I am aware of at least one mission currently in space that is flying the C++14 STL with no restrictions on heap allocation and exceptions enabled. Unmodified `std::map` is currently flying in space with no ill effects.

Re: The C++ standard for the F-35 Fighter Jet [video]

#402

Post by jandrese » Mon, Dec 08, 2025, 7:12 PM UTC

bri3d wrote: post #109

https://web.archive.org/web/20111219004314/http://journal.th... (referenced, at least tangentially, in the video) is a piece from the engineering lead which does a great job discussing Why C++. The short summary is "they couldn't find enough people to write Ada, and even if they could, they also couldn't find enough Ada middleware and toolchain." I actually think Ada would be an easier sell today than it was back the…

The funny thing is the promise of Ada was "if it compiles it won't crash at runtime" which has a lot of overlap with Rust.

Re: The C++ standard for the F-35 Fighter Jet [video]

#403

Post by constantcrying » Mon, Dec 08, 2025, 7:13 PM UTC

arein3 wrote: post #378

She said it could be estimated how many cycles it takes to complete a calculation, but there are a lot of different paths which take different cycles. How does the code work with timing? It counts cycles?

Major commercial airliners have system controllers where the measuring is done as follows: Write into the code some instruction which flips some output bit, hook the system up to a test rig and then get an oscilloscope. With the oscilloscope measure how long it takes between bit flips. The instructions for the measurements get commented out for the final release.

Yes, I have done this. By the way, these measurements of course have to be part of the certification.

Re: The C++ standard for the F-35 Fighter Jet [video]

#404

Post by jandrese » Mon, Dec 08, 2025, 7:17 PM UTC

jll29 wrote: post #381

adolph wrote: post #371

Earlier quoted context omitted.

Since when was expense a problem for defense spending? In the video, the narrator also claims that Ada compilers were expensive and thus students were dissuaded from trying it out. However, in researching this comment I founds that the Gnat project has been around since the early 90s. Maybe it wasn't complete enough until much later and maybe potential students of the time weren't using GNU? The GNAT project started…

The DOD could easily have organized Ada hackathons with a lot of prize money to "make Ada cool" if they had chosen to in order to get the language out of the limelight. They could also have funded developing a free, open source toolchain.

Ada would never have been cool.

Ironically I remember one of the complaints was it took a long time for the compilers to stabilize. They were such complex beasts with a small userbase so you had smallish companies trying to develop a tremendously complex compiler for a small crowd of government contractors, a perfect recipe for expensive software.

I think maybe they were just a little ahead of their time on getting a good open source compiler. The Rust project shows that it is possible now, but back in the 80s and 90s with only the very early forms of the Internet I don't think the world was ready.

Re: The C++ standard for the F-35 Fighter Jet [video]

#405

Post by constantcrying » Mon, Dec 08, 2025, 7:18 PM UTC

mainecoder wrote: post #362

Did they really have to tell their programmers this ? (see Page 52) AV Rule 174 (MISRA Rule 107) The null pointer shall not be de-referenced.

Commercial jet airliners, which in all likelihood you have flown with, have system controllers which intentionally dereference the null pointer. Yes, I have seen the code, the intention was an integrity check at startup, which computed a checksum of the memory, which included the value stored at address zero.

Re: The C++ standard for the F-35 Fighter Jet [video]

#406

Post by skepti3 » Mon, Dec 08, 2025, 7:19 PM UTC

jll29 wrote: post #381

adolph wrote: post #371

Earlier quoted context omitted.

Since when was expense a problem for defense spending? In the video, the narrator also claims that Ada compilers were expensive and thus students were dissuaded from trying it out. However, in researching this comment I founds that the Gnat project has been around since the early 90s. Maybe it wasn't complete enough until much later and maybe potential students of the time weren't using GNU? The GNAT project started…

The DOD could easily have organized Ada hackathons with a lot of prize money to "make Ada cool" if they had chosen to in order to get the language out of the limelight. They could also have funded developing a free, open source toolchain.

> They could also have funded developing a free, open source toolchain.

If the actual purpose of the Ada mandate was cartel-making for companies selling Ada products, that would have been counter-productive to their goals.

Not that compiler vendors making money is a bad thing, compiler development needs to be funded somehow. Funding for language development is also a topic. There was a presentation by the maker of Elm about how programming language development is funded [0].

[0]: https://youtube.com/watch?v=XZ3w_jec1v8

Re: The C++ standard for the F-35 Fighter Jet [video]

#407

Post by Symmetry » Mon, Dec 08, 2025, 7:19 PM UTC

superxpro12 wrote: post #357

mrgaro wrote: post #250

Earlier quoted context omitted.

I remember having this argument with my professor at the school, who insisted that a function should have only one "return" clause at the very end. Even as I tried, I could not get him to explain why this would be valuable and how does this produce better code, so I'm interested on hearing your take on this?

It helps prevent bugs with state. The apple login bypass bug comes to mind. Basically, you have code in an "if" statement, and if you return early in that if statement, you might have code that you needed to run, but didnt. Forcing devs to only "return once" encourages the dev to think through any stateful code that may be left in an intermediate state. In practice, at my shop, we permit early returns for trivial thi…

The rule of thumb I use is to only have one return after modifying state that will persist outside the function call.

Re: The C++ standard for the F-35 Fighter Jet [video]

#408

Post by RealityVoid » Mon, Dec 08, 2025, 7:21 PM UTC

0xffff2 wrote: post #400

adrian_b wrote: post #339

Earlier quoted context omitted.

You have to use the stack for procedure calls on x86/x86-64 CPUs, where the hardware enforces this. In most other surviving CPU ISAs the return address is saved in a register and it is easy to arrange in a compiler to use only procedure arguments that are passed in registers, the only price being paid for this being a reasonable upper limit for the number of parameters of a function, e.g. 12 or 24, depending on the n…

I honestly can't tell if you know a lot more than me or a lot less than me about how computers work... A couple of honest questions: 1. Where do you save the current value of the return address register before calling a function? 2. When parameters are "grouped into a structure" and the structure is passed as an argument to a function, where do you store that structure?

Not OP, but presumably, the answers are:

1) You don't... hence, my question about no nested function calls. If you push it anywhere else, you can call it whatever you want, but you just re-invented the stack. I _guess_ you could do some wierd stuff to technically not get a stack, but... again, it's wierd. And for what, again?

2) Some fixed address. If you have for example:

```c

typeRealBigStructure foo;

void baz(typeRealBigStructure * struct){

    // Do whatever to struct

}

void bar(void){

  baz(&foo);

}

```

The foo will probably end up in the BSS and will take up that space for the whole lifetime of the program. That's not the heap, not the stack, just... a fixed location in memory where the linker placed it.

I guess on big PC's stuff is very dynamic and you use malloc for a lot of stuff, but in embedded C, it's a very common pattern.

Re: The C++ standard for the F-35 Fighter Jet [video]

#409

Post by CWuestefeld » Mon, Dec 08, 2025, 7:21 PM UTC

reactordev wrote: post #329

blub wrote: post #288

Earlier quoted context omitted.

Actually these kinds of projects are chronically over budget and the US military is notorious for wasting money. Using C++ vs wishing an Ada ecosystem into existence may have been one of the few successful cost saving measures. Keep in mind that these are not normal programmers. They need to have a security clearance and fulfill specific requirements.

They need to have very strict security clearance requirements and maintain them throughout the life of the project or their tenure. People don’t realize this isn’t some little embedded app you throw on an ESP32. You’ll be interviewed, your family, your neighbors, your school teachers, your past bosses, your cousin once removed, your sheriff, your past lovers, and even your old childhood friends. Your life goes under…

I was once interviewed by the FBI due to a buddy applying for security clearance. One thing they asked was, "have you every known XXX to drink excessively", to which I replied "we were fraternity brothers together, so while we did often drink a lot, it needs to be viewed in context",

Re: The C++ standard for the F-35 Fighter Jet [video]

#410

Post by constantcrying » Mon, Dec 08, 2025, 7:25 PM UTC

factorialboy wrote: post #110

Isn't the F35 program considered a failure? Or am I confusing it with some other program?

The F-35 program was a complete disaster, with enormous delays, cost overruns and very long lists of issues.

Right now it is also the single most advance combat airplane, built in any number, which exists anywhere in the world and guarantees that the USA will be able to convincingly assert air dominance in any conflict.