Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The C++ standard for the F-35 Fighter Jet [video]

youtube.com

Post reply on HN
Print view View original

71–80 of 451 posts

Re: The C++ standard for the F-35 Fighter Jet [video]

#71

Post by ivanjermakov »

time4tea wrote: post #45

a = a; // misra Actual code i have seen with my own eyes. (Not in F-35 code) Its a way to avoid removing an unused parameter from a method. Unused parameters are disallowed, but this is fine? I am sceptical that these coding standards make for good code!

Zig makes it explicit with

    _ = a;
And you would encounter it quite often because unused variable is a compilation error: https://github.com/ziglang/zig/issues/335

Re: The C++ standard for the F-35 Fighter Jet [video]

#72

Post by cpgxiii »

stefan_ wrote: post #55
msla wrote: post #51

Earlier quoted context omitted.

Especially since there is a widely recognized way to ignore a parameter: (void) a; Every C programmer beyond weaning knows that.

I'm sure thats disallowed for the C-style cast.

Fwiw, unused-cast-to-void is a case that GCC and Clang ignore when using -Wno-old-style-cast, which is what most projects prohibiting C-style casts are going to be using (or whatever the equivalent their compiler provides).

Re: The C++ standard for the F-35 Fighter Jet [video]

#74

Post by mwkaufma »

krashidov wrote: post #49
mwkaufma wrote: post #2

TL;DR - no exceptions - no recursion - no malloc()/free() in the inner-loop

Has anyone else here banned exceptions (for the most part) in less critical settings (like a web app)? I feel like that's the way to go since you don't obscure control flow. I have also been considered adding assertions like TigerBeetle does https://github.com/tigerbeetle/tigerbeetle/blob/main/docs/TI...

Lots of games, and notably the Unreal Engine, compile without exceptions. EASTL back in the day was in part written to avoid the poor no-exception support in Dinkumware STL and STLport.

Re: The C++ standard for the F-35 Fighter Jet [video]

#75

Post by mwkaufma »

msla wrote: post #58
mwkaufma wrote: post #2

TL;DR - no exceptions - no recursion - no malloc()/free() in the inner-loop

At that point, why not write in C? Do they think it's C/C++ and not understand the difference? > no recursion Does this actually mean no recursion or does it just mean to limit stack use? Because processing a tree, for example, is recursive even if you use an array, for example, instead of the stack to keep track of your progress. The real trick is limiting memory consumption, which requires limiting input size.

For a long time, at least in MS and Intel, the C++ compilers were better than the C compilers.

Re: The C++ standard for the F-35 Fighter Jet [video]

#76

Post by cpgxiii »

garyfirestorm wrote: post #31
stackghost wrote: post #27

Earlier quoted context omitted.

Depends on the company in my experience. I've seen some suppliers that basically just wire up the diagram in Matlab/simulink and hit Autocode. No humans actually touch the C that comes out. Honestly I think that's probably the correct way to write high reliability code.

You’re joking right? That autogenerated code is generally garbage and spaghetti code. It was probably the reason for Toyotas unintended acceleration glitch.

In the case of the Toyota/Denso mess, the code in question had both auto-generated and hand-written elements, including places where the autogenerated code had been modified by hand later. That is the worst place to be, where you no longer have whatever structure and/or guarantees the code gen might provide, but you also don't have the structure and choices that a good SWE team would have to develop that level of complexity by hand.

Re: The C++ standard for the F-35 Fighter Jet [video]

#77

Post by elteto »

theICEBeardk wrote: post #37
elteto wrote: post #17

Earlier quoted context omitted.

If you compile with -fno-exceptions you just lost almost all of the STL. You can compile with exceptions enabled, use the STL, but strictly enforce no allocations after initialization. It depends on how strict is the spec you are trying to hit.

Are you aware of the Freestanding definition of STL? See here: https://en.cppreference.com/w/cpp/freestanding.html Large and useful parts of it are available if you run with a newer c++ standard.

Well, it's mostly type definitions and compiler stuff, like type_traits. Although I'm pleasantly surprised that std::tuple is fully supported. It looks like C++26 will bring in a lot more support for freestanding stuff.

No algorithms or containers, which to me is probably 90% of what is most heavily used of the STL.

Re: The C++ standard for the F-35 Fighter Jet [video]

#78

Post by ibejoeb »

shepherdjerred wrote: post #70
jandrewrogers wrote: post #8

For those interested, the F-35 (née Joint Strike Fighter) C++ coding standards can be found here, all 142 pages of it: https://www.stroustrup.com/JSF-AV-rules.pdf

I wonder if they use static analysis to enforce these rules, or if developers are expected to just know all of this

static analysis

Re: The C++ standard for the F-35 Fighter Jet [video]

#79

Post by elteto »

vodou wrote: post #35
elteto wrote: post #17

Earlier quoted context omitted.

If you compile with -fno-exceptions you just lost almost all of the STL. You can compile with exceptions enabled, use the STL, but strictly enforce no allocations after initialization. It depends on how strict is the spec you are trying to hit.

Not my experience. I work with a -fno-exceptions codebase. Still quite a lot of std left. (Exceptions come with a surprisingly hefty binary size cost.)

Not exactly sure what your experience is, but if you work with in an -fno-exceptions codebase then you know that STL containers are not usable in that regime (with the exception of std::tuple it seems, see freestanding comment below). I would argue that the majority of use cases of the STL is for its containers.

So, what exact parts of the STL do you use in your code base? Most be mostly compile time stuff (types, type trait, etc).

Re: The C++ standard for the F-35 Fighter Jet [video]

#80

Post by time4tea »

msla wrote: post #51
time4tea wrote: post #45

a = a; // misra Actual code i have seen with my own eyes. (Not in F-35 code) Its a way to avoid removing an unused parameter from a method. Unused parameters are disallowed, but this is fine? I am sceptical that these coding standards make for good code!

Especially since there is a widely recognized way to ignore a parameter: (void) a; Every C programmer beyond weaning knows that.

The point really was that the unused method parameter should in almost all cases be removed, not that some trick should be used to make it seem used, and this is the wrong trick!
Post reply on HN