F-35 Joint Strike Fighter Coding Standard Documentation

http://www2.research.att.com/~bs/JSF-AV-rules.pdf

by neilwillgettoit • 14 years ago

133 52 14 years ago

www2.research.att.com

kfury2• 14 years ago

There's an error in Rule 52. They specifically say variables shouldnt have any capital letters but their example does.

dododo• 14 years ago

if you're talking about this example:

  const   uint16    max_pressure = 100; 
  enum  Switch_position  {up, down};

``Switch_position'' is not the name of a variable, but an enum type.

gte910h• 14 years ago

No it isn't, it's an enum type.

JL2010• 14 years ago

Just to add to what was already said, the doc said for enumerator values - which are indeed lower case in the example. Not a blanket statement for all variables.

kfury2• 14 years ago

Nevermind. :-)

reledi• 14 years ago

Perhaps I found an error.

AV Rule 69 says to use `const` by default on member functions. Yet in some examples (e.g. AV Rule 122 in Appendix A) they don't use the `const` keyword when they can.

sehugg4• 14 years ago

OH: "Any sufficiently complex DoD coding standard is indistinguishable from Ada"

philwelch• 14 years ago

Maybe that's true in general, but so far this seems like a perfectly sensible C++ coding standard, especially for a stealth fighter.

javert6• 14 years ago

Seems like it would have been much easier to just use Ada, than deal with all the potential pitfalls of C++.

Daniel_Newby• 14 years ago

IIRC, C++ is used for some specialized jobs like signal processing. Ada is used for the avionics and systems management.

jordanb• 14 years ago

Have you ever actually used Ada? The standards document is incredibly clear and well-organized, to the extent that most Ada programmers use it for reference.

sehugg4• 14 years ago

I have -- and I'm not busting on Ada, quite the contrary -- I'm pointing out that many of the rules in the C++ document would not be necessary were they coding in Ada.

(I'm sure they use static analysis tools for C++ that enforce some of these rules, so I'll defer to someone who is more current in that world)

Symmetry2• 14 years ago

"Any sufficiently complicated DoD standard contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Ada."

DanBC• 14 years ago

The buses used on aircraft are interesting. ARINC 429 is used for commercial aircraft. MIL-STD-1553 is used for military aircraft. STANAG3838 is the EU equivalent.

(http://en.wikipedia.org/wiki/ARINC_429)

(http://en.wikipedia.org/wiki/MIL-STD-1553)

Wikipedia suggests a logic analyser for development. That's handy, but you'd be best starting with good continuity buzzing; I've seen some of the cables being made and it's a bit of a bodge.

jauer• 14 years ago

Apparently the F-35 is a bit of a departure from traditional aircraft systems in that it uses Firewire as the bus and Fibre Channel for mass storage: http://www.ttcdas.com/products/rec_mux/pdf/_tech_papers/tp_f...

grumps2• 14 years ago

Most likely using 1553. Since its a military aircraft and most DoD equipment for aircraft use 1553. AIRNC 429 is typically isninly user when trying to integrate a COTS equipment. However 1553 wouldn't be ideal for exchanging large amoints of data.... more like "status" and switching. Its highly deterministic regarding timing of messages.

pmr_2• 14 years ago

The rules seem quite reasonable and less strict than what I had expected. The libraries section mentions "Only DO-178B Level A certifiable" libraries. Are any common open source libraries among those and is there a list available somewhere? Another HN thread mentioned that there are certified C++ standard libraries but I couldn't find any vendor of such.

fshaun• 14 years ago

I suspect not, but I'd be happy to hear otherwise. Certification is as much about process and traceability as it is about the code itself. Open source naturally tends to give visibility into the development process, but there's usually no business driver to spend the money on certification. Think multiple thousands of dollars per line of code.

foobarqux3• 14 years ago

You cannot certify libraries.[1] The best you can do is to provide a certification kit which consists of tests to be run in the target environment and appropriate documentation/traceability.

However, as the GP notes the libraries must merely be "certifiable": You can do all the certification work yourself as long as it is possible with the libraries in question. Having access to the source code and the lack of non-determinism are two big requirements that come to mind.

[1] In fact you cannot even certify software only entire systems.

Symmetry2• 14 years ago

That's why the DoD loves RedHat so much, they let you pay them money for their distribution, and then you can use all the libraries that come with it.

grumps2• 14 years ago

I don't believe they are just sitting out there like open source. I believe you will have to purchase this libraries. Just like you. However, the problem boils down to the fact that you will be developing on custom hardware, thus the libraries will probably not be reusable. Basically you have to prove that all lines of code are part of the requirements, no dead code. You will also have to prove that all code fails in a fail safe manner. I.e. the plane won't crash Level A cert is for flight critical systems, I.e. flight controls.

foobarqux3• 14 years ago

This is your best bet. http://www.open-do.org/about/

javert6• 14 years ago

Very interesting site. Thanks for sharing.

Unfortunately, it looks like it's been static since 2010.

mseebach• 14 years ago

This made me laugh:

AV Rule 6 Each deviation from a “shall” rule shall be documented in the file that contains the deviation. Deviations from this rule shall not be allowed, AV Rule 5 [specifying the process to deviate from a "shall" rule] notwithstanding.

Karunamon2• 14 years ago

Definitely reads like stereotypical government-associated-anything, then.

batista3• 14 years ago

Yes, such needless bureaucracy.

Let's fly a crazy fast jet plane that has it's software written by some throw-caution-in-the-wind Node.js hackers instead.

If it's agile enough, and has some test coverage, we should be fine.

nn2• 14 years ago

AV Rule 25 (MISRA Rule 127) The time handling functions of library <time.h> shall not be used.

Yes everyone reinventing their own broken flat tire date routines is the way go. If they used the same silly rule on the F22 that explains http://blog.utest.com/international-date-line-bug-caused-fig...

Time related code is really hard to write.

gamegod• 14 years ago

You mean nobody told you about the time.h backdoor? It's a classic.

kenver• 14 years ago

It says this in the article:

The problem arose not from the time change, but from the change in longitude

I don't think you can blame the time handling for that one! Although you are right in the broader sense that is really difficult to write code that handles times and dates correctly, and you generally shouldn't write you're own. I'd imagine the guys writing this stuff are pretty good though and can probably handle it.

raverbashing2• 14 years ago

I remember reading this some years ago (unless this is a new version)

Dear C++ programmers: follow this! (with exceptions accordingly)

exDM69• 14 years ago

> Dear C++ programmers: follow this! (with exceptions accordingly)

These strict C++ programming guidelines apply only to embedded and safety critical programming and the programs that are being written work under a very restricted runtime environment and with a less than state of the art compiler.

So if you're a regular application programmer working with C++, feel free to ignore most of these rules. Modern compilers and runtimes will work nicely with most of the stuff forbidden in these guidelines.

raverbashing2• 14 years ago

True, but not most rules

There are some limitations there relating to embedded systems (for example, they explicitly forbid the use of atoi because obviously you want to be sure of no undefined behavior while flying at Mach 2 at 20kft)

For example, section 3 are very general good rules

Av Rule 84/85 are very relevant as well (just an example)

It's very easy to exaggerate when using C++ and hence some limits are needed.

greenyoda• 14 years ago

Interesting that this document is stored on Bjarne Stroustrup's (creator of C++) web site at AT&T Labs. I wonder whether he had any part in writing it?

pkmays• 14 years ago

He did. From http://www2.research.att.com/~bs/bs_faq2.html:

> ...I consider it a pretty good set of rules for safety critical and performance critical code. If you do embedded systems programming, you should consider it. Caveat: I had a hand in the formulation of these rules, so you could consider me biased...

xer0x• 14 years ago

With rules like that, this plane is going to be vapourware for a long time!

SamReidHughes• 14 years ago

No. That's complete nonsense.

iRobot• 14 years ago

if(enemy=true) FireWeapons(); // (sic)

gaius• 14 years ago

I wonder if you meant == or this was some clever satire ;-)

rmATinnovafy• 14 years ago

My brother works for Lockheed writing technical manuals. He is the guy who writes those things. I mean, I can't even read them without runing away screaming.

He studied IT, but never got a job in it. I keep bugging him to get a job coding, but he thinks he can't.

Anyone got a job coding for someone who writes those amazingly complex manuals?

F-35 Joint Strike Fighter Coding Standard Documentation

Related Stories