Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ada and SPARK enter the automotive ISO-26262 market with Nvidia

adacore.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#61

Post by FirmwareBurner »

tialaramex wrote: post #52
FirmwareBurner wrote: post #48

Earlier quoted context omitted.

Are those bugs because of C++, or because of bad programing skills and practices? No programming language can save you from bugs if you hire people who don't know what they're doing. I used to work in automotive when a lot of the critical safety SW was only assembly and the end product didn't have any critical bugs. Maybe Lockheed just has shitty programmers who don't know what they're doing because the US defense in…

Not all programming languages are equal when it comes to the skill needed to deliver correct software. Since a large project necessarily can expect only to bring merely ordinary skill to the problem if that's not enough they're in trouble, even if superlative skill would have succeeded that's not what they have. C++ iterators are a big example of this problem. In the most skilled hands these are a very powerful techn…

>C++ iterators are a big example of this problem. [...] but they have a lot of footguns.

Bigger than coding in assembly?

>when your ordinary programmers shoot themselves in the foot

Then don't hire non-name foot shooting programmers off the street. Hire versed engineers with background in programing for safety critical systems, then have them train the code monkey engineers on the right way to think and work. Like I said, skill issue, not language issue.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#62

Post by cmrdporcupine »

FirmwareBurner wrote: post #46
seabird wrote: post #8

Earlier quoted context omitted.

Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. I get that there's more tools for C++ but first class formal verification support and a language that's generally designed to save you from yourself seems like something you would stand your ground on. Ada is supremely good at killing people and/or keeping them un-killed, there's a reason…

>Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. Do you think the auto industry will have a easier time finding Ada talent at their pay rates? Or that talent will want to specialize into Ada just to pigeonhole themselves into the Automotive jobs market?

As a Rust + C++ developer (in medical right now, and vehicle before that) I see no reason why I couldn't also pick up Ada as one of many skill sets. I have an Ada95 manual on my bookshelf from years ago that I bought out of curiosity -- frankly for senior level talent the language syntax is the easiest thing to pick up it's the intricacies of an existing code base and business domain that is the hard part of joining a new project and that is generally language independent.

Arguably picking up Rust -- with its frankly exotic value passing and ownership semantics -- is much harder than learning Ada.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#63

Post by FirmwareBurner »

cmrdporcupine wrote: post #62
FirmwareBurner wrote: post #46

Earlier quoted context omitted.

>Everything I've heard about it was that it was pressure from contractors because they didn't like training or finding Ada talent. Do you think the auto industry will have a easier time finding Ada talent at their pay rates? Or that talent will want to specialize into Ada just to pigeonhole themselves into the Automotive jobs market?

As a Rust + C++ developer (in medical right now, and vehicle before that) I see no reason why I couldn't also pick up Ada as one of many skill sets. I have an Ada95 manual on my bookshelf from years ago that I bought out of curiosity -- frankly for senior level talent the language syntax is the easiest thing to pick up it's the intricacies of an existing code base and business domain that is the hard part of joining…

> I see no reason why I couldn't also pick up Ada as one of many skill sets

Low wages and the negative resume drive development might be reasons.

Believe it or not, pigeon holing yourself in niche/uncool tech for years, can and will negatively impact your future hiring prospects at good jobs, since hiring in tech is broken and HR selects resumes on buzzwords and on your "last X years of experience in Y framework".

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#65

Post by cmrdporcupine »

FirmwareBurner wrote: post #48
pjmlp wrote: post #28

Earlier quoted context omitted.

Ever wondered why F-35 is so famous for software bugs, including in-flight reboot from avionics?

Are those bugs because of C++, or because of bad programing skills and practices? No programming language can save you from bugs if you hire people who don't know what they're doing. I used to work in automotive when a lot of the critical safety SW was only assembly and the end product didn't have any critical bugs. Maybe Lockheed just has shitty programmers who don't know what they're doing because the US defense in…

The C++ job market is full of two kinds of developers.

Mediocre talent that struggles with the language and continually make use after free bugs.

And elitist arrogant developers in love with the language, skilled in its use, who continually make use after free bugs.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#66

Post by AlotOfReading »

smokel wrote: post #54
atlgator wrote: post #16

Wow. I developed in Ada in aerospace 17 years ago. I thought the industry would move toward Rust.

Ferrocene [1] apparently offers an ISO-26262 certified version of Rust. I am thoroughly confused about these certification processes, but it also seems that AdaCore itself [2] has adapted the Rust compiler to be certified as well. [1] https://ferrocene.dev/ [2] https://www.adacore.com/press/adacore-announces-the-first-qu...

Certification roughly means "we have a pile of paperwork to help convince auditors that you followed a reasonable process".

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#67

Post by zppln »

firesteelrain wrote: post #49
anthk wrote: post #43

Earlier quoted context omitted.

It helps on security and correctness. Either you are a Forth like guy/gal stating how a firmware will work at every level (low, med, high, every one), cutting down every flaw by getting it as small and predictable as possible (even by ditching floats for rationals and decimal scaling), or a high level Lisp/CL/Java/C# guy with a garbage collector and some memory safety. And Java/C# and some Lisps aren't nowhere as str…

I have worked on safety crucial systems and applications that interact with safety critical systems in a non safety critical language. Each time it never had anything to do with the language and everything to do with systems engineering and project management. The projects that were successful had excellent systems engineering and project management. Language choice was never a factor.

This is my experience as well.

People need to ask themselves what benefits Rust would bring to an high assurance system (e.g. DO-178C Level A). You're not gonna want to malloc mid-flight even if you have a borrow checker.

The entire point of e.g. DO-178C is to show that the software only does exactly what it is supposed to do under all assumptions and have any derived behavior fed back to the safety process for evaluation. Software can never in itself make a system safe.

All that aside, modern tooling may be more ergonomic etc so I'm not saying languages like Rust shouldn't be considered, they just aren't as useful here as I think a lot of people assume.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#68

Post by FirmwareBurner »

cmrdporcupine wrote: post #65
FirmwareBurner wrote: post #48

Earlier quoted context omitted.

Are those bugs because of C++, or because of bad programing skills and practices? No programming language can save you from bugs if you hire people who don't know what they're doing. I used to work in automotive when a lot of the critical safety SW was only assembly and the end product didn't have any critical bugs. Maybe Lockheed just has shitty programmers who don't know what they're doing because the US defense in…

The C++ job market is full of two kinds of developers. Mediocre talent that struggles with the language and continually make use after free bugs. And elitist arrogant developers in love with the language, skilled in its use, who continually make use after free bugs.

And you think enthusiasts of niche languages like Ada, will be more skilled and less elitist than C++ devs?

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#69

Post by cmrdporcupine »

FirmwareBurner wrote: post #68
cmrdporcupine wrote: post #65

Earlier quoted context omitted.

The C++ job market is full of two kinds of developers. Mediocre talent that struggles with the language and continually make use after free bugs. And elitist arrogant developers in love with the language, skilled in its use, who continually make use after free bugs.

And you think enthusiasts of niche languages like Ada, will be more skilled and less elitist than C++ devs?

I think I'm tired, after 20+ years of being around the language, of hearing C++ developers tell people "they're holding it wrong" every time something blows up. Blaming the victim.

C++ is a language seemingly designed with footguns built in on purpose. Even worse it has a community full of elitism and obscurantism.

Rust isn't perfect (I have my gripes), but it has the right idea with ownership management at the static type system level. Ada has its own positives around explicitness and bounds checking etc

C++ for new projects in safety critical sectors makes zero sense to me.

Re: Ada and SPARK enter the automotive ISO-26262 market with Nvidia

#70

Post by anthk »

FirmwareBurner wrote: post #59
zoom6628 wrote: post #53

Earlier quoted context omitted.

THIS. I knew someone a while back who worked on Patriot missile software. It was Ada. And Patriot still a formidable weapon.

You mean the Patriot that ended up getting 28 people killed due to a SW bug?[1] That Patriot? Let me repeat myself again, Ada won't save you from human bugs. If you hire bad programmers or have bad dev and test practices, there's no magic programming language that will save you from your calculation and logic mistakes. You can code in raw machine code like you're 1960's NASA, and still have less bugs than a clueless…

It will help a lot still. But as I said, Forth it's better than raw ASM.

On integers casted into floats, a Forth programmer would use a fixed point in a much saner way, they had experience for decades on it.

Post reply on HN