Item — HN Reader

Read the original and it explains the purpose of each item:

The original clearly describes that the coding rules primarily target C and attempt to optimize the ability to more thoroughly check the reliability of critical applications written in C. The original author clearly understands what they're doing, and explains lots of other ways to verify C code.

For what it's worth, the rationales in the original all make perfect sense to me. Perhaps this is because I learned C on tiny systems? I learned C for hardware for implanted medical devices, and our lab did similar kinds of guidelines.

6 comments

That pdf reads like the first draft of a guide on "how to write safety-critical code" and probably inspired things like DO-178, LOR1, DAL-A, 882, all sorts of standards.

Writing C code for a safety-critical system running on an RTOS really humbled me. Felt like I should make more than I did relative to peers slinging code using 748mb of ram in a browser tab. ;D

For me too. TFA is, I think, the first coding standard I came across that made sense to me. Except for the "2+ assertions per function" rule. 2 is arbitrary for one thing, and secondly your top priority, in the context of mildly mission critical embedded code, is to do what it takes to keep your system alive and sane (as fault tolerance people put it). Then log the issue if you can. Downtime caused by a program abort followed by a watchdog reboot should be a last resort for things that you really couldn't possibly expect and therefore cannot handle properly - there's no such thing as an "unexpected error".

Also before that, design things so that errors cannot happen; for instance use C's type system, as weak and clunky as it is, to make it is hardly possible to pass out-of-range parameters. There's a trend these days to bash-at-will C for its "unsafe" nature, but a significant part of the issues are "between the keyboard and the chair", that is not doing the right thing because it is tedious - that's probably the main defect of C.

“2+ assertions” could be read as “a precondition, a postcondition, and maybe a loop invariant”. The guideline should perhaps be more explicit about asserting your pre- and postcondition, but that’s a perfectly natural minimum standard.

As for C’s unsafety — it is a poor engineer who doesn’t account for human factors. A language that doesn’t mitigate PEBKACs, and which lacks affordances to make safe code less tedious, is intrinsically unsafe.

Or replace all with zig.

Airbus writes all their flight control software in C, but it's not C as you would find in say your Linux distro, more like a tightly controlled subset of C with its own compilers, toolchains and formal verification. So they're already writing it in a different language, just one that superficially looks like C.

Airbus do seem to use Ada for some things:

• Airbus Chooses GNAT Pro Ada for Development of Unmanned Aerial System https://news.ycombinator.com/item?id=24488986

• https://www.adacore.com/press/a350

• https://www.adacore.com/press/airbus-selects-gnatpro-for-vsr...

Totally makes sense to choose Ada (definitely not a new language!) for green field development. But as I understand it, the Airbus flight control systems are millions and millions of lines of "C", and they ain't getting rewritten any time soon or probably ever. However they do invest a lot in toolchains and formal software verification (in Newport, Wales).

Is Airbus using CompCert?

https://en.m.wikipedia.org/wiki/CompCert

I believe so, but not the upstream version, via their commercial partner: https://www.absint.com/

Zig's safety is at the level of Object Pascal, Modula-2 and similar.

Way better than plain old C, yet there are some weaknesses on the armour, and we know better since AT&T's Cyclone project.

I would advice against writing safety critical software in a software that has yet to get a stable release.

Right. If you want a safer language than C for your safety-critical embedded code, the obvious choice is Ada. The article even mentions Ada specifically.

How does one make an REST Service using Ada without paying for frameworks/tools?

No doubt you could implement a modern web API in Ada, but you wouldn't really be playing to Ada's strengths. Ada is more commonly associated with safety-critical embedded work than with web development.

Ada Web Server (AWS) [0][1] is Free and Open Source software, but that framework doesn't seem to get much use, and it doesn't inspire confidence that [0] mentions SOAP but doesn't mention JSON. I'm not aware of any proprietary/payware Ada web server solutions.

[0] https://www.adacore.com/gnatpro/toolsuite/ada-web-server

[1] https://github.com/AdaCore/aws

Using Ada efficiently just requires too much $$$ for small projects.

We're talking about developing safety-critical software. C and Ada have their pros and cons, but Zig isn't even in the running.

Yes, rewriting all the world's software in boutique untested languages is surely the way to write safe and reliable software.

Because, you know, all the crusty idiots writing software before you didn't know about the wonders of syntactic sugar and automatically installed dependencies.

Today boutique languages are those that target PDP-7.

> The original clearly describes that the coding rules primarily target C

Yes, this is because space engineers don't like so much unpredictable things as Garbage Collectors, which used on nearly all functional languages by definition.

In pure C, one could write code with 100% static allocation, so any step could be checked and ensured to run in very exact time limit. - Typical GC could give instability larger to O(c^n) from size of garbage.

Second reason, in most air-space development companies, main are air-dynamic (hardware) engineers, and all others considered as lover priority (even when practically, now software costs more than half of typical plane), and most hardware engineers don't understand functional programming.

Failure to understand why things are they way they are (aka Chesterton's fence) is why we have some supposedly technically saavy people going on about supposedly fraudulent 150-yo social security beneficiaries born in 1875.

> https://spinroot.com/gerard/pdf/P10.pdf

Originally publicly published in the IEEE Computer journal (doi:10.1109/MC.2006.212):

* https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Dev...

Came here to cite the Power of 10 paper.

There are a couple of talks by Dr Holzmann on youtube regarding JPL high reliability software development process: "Mars Code" is the one that I remember: https://www.youtube.com/watch?v=16dQLBgOwbE well worth the watch I think.

In other words, C is not a great language for the task, but, being forced to use it, NASA had to devise rules that helped static checking, at the cost of making the code harder to write and read.

Were they able to use Ada or even Modula-2 more widely, much of that won't be needed.