Boeing Flies on 99% Ada

http://archive.adaic.com/projects/atwork/boeing.html

by galapago • 12 years ago

150 157 12 years ago

archive.adaic.com

Artemis24• 12 years ago

That's not surprising, given that safety-critical software is very often programmed in Ada or SPARK.

yoodenvranx• 12 years ago

If it is so safe and reliable, why isn't used more for normal projects?

wwwwwwwwww• 12 years ago

because choosing a language for a commercial project is rarely about safety or effectiveness - it's about language popularity, availability of libraries, and replaceability of the programmers.

curtis• 12 years ago

It could be that the code is indeed more safe and reliable, but also quite a bit more expensive to write and maintain.

TeMPOraL• 12 years ago

Because safety comes at a price.

I did a little bit of Ada programming, and one of the distinct features it has is you can't do anything clever without being extremely explicit about it. This language has the most aggressive type-correctness checking I have ever seen. When you finally get your code to compile, it's likely that it will work reliably.

awjr• 12 years ago

I was involved in writing the short term collision alert system for the New En Route Centre down in Swanwick, UK. Basically proving something won't kill is extremely important in this environment. The language is almost irrelevant. Proving every single piece of logic has been exercised (an OR statement had to have true true, false true, true false and false false tests...now add multiple ORs to that). Mission critical software is another world.

Probably rather alien to the HN crowd ;)

ghshephard5• 12 years ago

Safety and Reliability are not as relevant for most projects as speed, flexibility, familiarity, availability of frameworks and developers, inexpensive compilers/debuggers,etc... All of these are area in which Ada is not as highly qualified as some of its competitors.

But, for Avionics and Space System, Ada is a well known, and continues to be a well known implementation language.

mwfunk• 12 years ago

The safety and reliability comes at the price of more verbosity and less dynamism. Most programmers don't need (or don't think they need) that level of reliability, and choose not to use languages like Ada (if they are even aware of its existence).

On the other hand, failure is much less of an option when it comes to things like avionics, so much more focus is placed on reliability. In these cases that price starts looking like a bargain, if the use of Ada isn't already mandated (which it probably is).

SkyMarshal3• 12 years ago

I was just asking that recently too [1]. I think it's because most "normal" projects, aka web/desktop/mobile apps aren't safety critical, a large cadre of developers prefers dynamic languages that let them program in a completely bottom-up exploratory manner without thinking about types and the like.

[1] https://news.ycombinator.com/item?id=8245442

jbogp• 12 years ago

A good thread about programming languages in avionics.

https://www.linkedin.com/groups/Which-is-Major-Programming-l...

Having had a lot of my undergrad CS classes in Ada (in Toulouse France, the home of Airbus) I get nostalgic every time I see a post mentioning Ada on HN.

neurotech1• 12 years ago

Google Cache Link: http://webcache.googleusercontent.com/search?q=cache%3Aarchi...

SEJeff2• 12 years ago

FYI I used to date a girl with a Masters in CS who got a job with Boeing. She worked on the OpenGL overlay for the B1 Lancer. She wrote about 3 pages of justification for every 5-6 lines of code she wrote. After 2 years she bounced as the job satisfaction in that type of environment, simply wasn't there. Also OpenGL from ADA is... interesting.

She worked at the Boeing San Diego office, which is quite beautiful.

foobarqux4• 12 years ago

Where do you go after that type of ultra specialized experience?

coldtea3• 12 years ago

Were ever you want?

If you have the kind of skills to write Open GL in Ada for Boeing, then you're not the kind of person who's depending on having rote-learn some latest tech (J2EE, RoR, Node, Go, whatever) and only can get jobs looking for that.

joevandyk2• 12 years ago

Wherever you want. I moved on to Ruby on Rails/e-commerce after leaving Boeing in 2006. At Boeing, I did a lot of C/C++/Ada/OpenGL.

pjmlp14• 12 years ago

Retire to a tropical island with the savings gotten from the hourly rates.

angersock• 12 years ago

OpenGL from Ada?

That's a special sort of hell.

sarchertech2• 12 years ago

A friend of mine is rewriting Doom 3 in Ada.

atburrow2• 12 years ago

I worked on the B1-B Lancer as well. We never touched Ada with OpenGL. It was mainly C++ with VAPS (http://www.presagis.com/products_services/products/embedded-...). I'm not certain where they're getting the 99% Ada portion as a lot of it is in C or C++.

I got out of that space though. I do mobile application development now.

ubernostrum• 12 years ago

If she has experience writing 3 pages of justification for every 5-6 lines of code, perhaps she should join the functional-programming community...

eru4• 12 years ago

We don't tend to write that much justification (at least in industry).

atburrow2• 12 years ago

Can I ask what her first name was? I used to work the exact same job. They moved all their operations to Oklahoma City and I helped with the transition.

SEJeff2• 12 years ago

Her name was Genevieve (Gen) and she worked with another girl name Jen. This was a few years back, around 2006-2008

possibilistic• 12 years ago

Considering the importance of not crashing, both literally and figuratively, I can understand the need for that heavy of a software process. Isn't this par for the course in high CMMI [1] [2] organizations? I don't really know much about this side of engineering, but I find it fascinating.

Thanks for sharing the anecdote with us. :)

[1] http://en.wikipedia.org/wiki/Capability_Maturity_Model_Integ...

[2] http://boeing.mediaroom.com/2011-10-26-Boeing-Huntsville-Sit...

drumdance• 12 years ago

Yeah, I can't imagine the QA process for, say, the satellite industry.

genericresponse• 12 years ago

I worked in a CMMI 5 organization and it wasn't even close to this level for our developers. However, for our testers, project managers and business analysts it's probably pretty accurate.

dscrd• 12 years ago

CMMI seems to be mostly a moneymaking scheme directed at business types with no skill. In contrast, Boeing used actually effective engineering disciplines.

a-priori• 12 years ago

I can vouch for this. I once worked on a similar project, an OpenGL-based cockpit display unit for business aircraft (Honeywell DU-875/885).

We wrote it in MISRA C instead of Ada, purely for personal reasons.

pjmlp14• 12 years ago

All software should strive for quality.

Sadly our industry only regards security as a cost that is often imposed by external processes.

It will only charge at large when companies start to be made accountable for their software, like in other industries.

In this regard the industry is still at its infancy.

ilikevideos• 12 years ago

Most software doesn't control a fuel-filled aluminum tube hurling through the air at 500mph.

Get over it.

yoran• 12 years ago

Companies are made accountable if there are human lives at stake. Most of the time there isn't (if there's a bug in some accountancy software which requires the accountant to restart the program, the accountant's life is not at stake) but wasn't there that software bug in one of the Toyota cars (Prius I believe?), where the brakes didn't work anymore under certain conditions? I remember Toyota had to take all those cars back in and had law suits against them, so they were certainly made accountable for the software they wrote for that car.

ArkyBeagle7• 12 years ago

What's ironic to me is that we're shifting the blame from people who attack computer systems - either directly or indirectly through malware - to otherwise innocent ( although demonstrably lacking in one or more competencies ) developers. The developer community won't suffer for the additional rigor any, but still...

Releasing a virus is a tort at best. Cracking a site is a tort at best, and both are probably criminal behavior. Yes, I have this bias.

I've read enough history to know that there have been times when such interlopers ended up as heads on pikes outside city walls. Seems extreme to be sure, but still....

I am a great admirer of C.A.R. Tony Hoare, but virus writers and system crackers give him a "bootleggers and Baptists" common cause with them.

eduardordm• 12 years ago

The actual language has little to do with the current widespread use of Ada in critical aviation software. The main reason lies in the certification process and reuse of certified tools. I wrote a little about it here: http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviat...

foobarqux4• 12 years ago

C is usually supported as well as or better than Ada so it does have to do with the language.

seanmcdirmid2• 12 years ago

With certified tools?

coolsunglasses• 12 years ago

A certified C compiler a la CompCert is still nothing like Ada Spark. C just lends itself too easily to error.

ghshephard5• 12 years ago

This is an awesome article - there are a ton of interesting excerpts all in one place, that I haven't seen before, such as this one:

One compelling reason behind the extensive pre-testing was Boeing's desire to meet the Federal Aviation Agency's (FAA's) Extended Twin Operations (ETOPS) standards ahead of schedule. The original ETOPS rule was drafted in 1953 to protect against the chance of dual, unrelated engine failures. Unless a newly designed and produced aircraft has at least three engines, it usually had to wait, sometimes as long as four years, before the FAA and the Joint Airworthiness Authorities (JAA) will allow it to fly more than one hour from an airport; after a time, the new aircraft is deemed a "veteran" and is allowed to fly three hours away. A shortened trial period would drastically increase Boeing's sales."

It hadn't occurred to me that a 777 is always three hours away from an Airport. I'll have to look more closely on the map.

superuser2• 12 years ago

Since it's mostly 747 and similarly large planes on intercontinental flights anyway, I doubt this is much of an issue. I wonder if there actually is anywhere in the CONUS that's more than 3 hours from at least a rural airstrip?

ghshephard5• 12 years ago

The reason why I thought it might be an issue, is that according to Wikipedia, The 777-200LR is the world's longest-range airliner and can fly more than halfway around the globe; it holds the record for the longest distance flown non-stop by a commercial aircraft. . It hadn't occurred to me that because the 777 is a twin engine, it can't really use all that range. It needs to stay near airports.

idlewords2• 12 years ago

It's not the size of the aircraft, but the number of engines on it that matters. And twin jets on intercontinental service outnumber quad jets.

Avshalom• 12 years ago

Three hours at ~500 mph is halfway across the USA diagonally.

rlease• 12 years ago

PBS did an interesting, long documentary filming the build and certification process for the 777. It's broken into 5 different, hour long parts that can be found on Youtube (https://www.youtube.com/watch?v=0oyWZjdXxlw - First part). The last part goes into detail about what they did to meet FAA regulations in a short amount of time.

idlewords2• 12 years ago

This is a nice mapping web app that lets you see allowed and forbidden areas for different ETOPS levels: http://gc.kls2.com

At 3 hours, it's mostly the Southern Ocean that's off-limits.

ghshephard5• 12 years ago

Thanks - that's a great site. It turns out that 3 Hours can take you pretty much anywhere in the world. This was a nice briefing on ETOPS - http://gc.kls2.com/faq.html#etops-138

toomuchtodo• 12 years ago

http://gc.kls2.com/faq.html#etops-240

I had no idea Boeing was subsidizing Midway Island in order to provide an ETOPS alternate airport.

Also, 5.5 hour ETOPS? That's crazy long!

http://gc.kls2.com/faq.html#etops-330

jacquesm4• 12 years ago

I wrote some fuel estimation software once long ago and that particular item was one of the more complex features to get right.

And don't forget about alternates!

theoutlander• 12 years ago

What is the other 1%? (I was only able to glance through pieces of the article for now)

ajb• 12 years ago

Probably the coffee machine. Although given the effort required to write safety critical code, I wouldn't be surprised if the coffee machine had more lines of code than the rest of the airplane.

twistedpair• 12 years ago

The galley is a main source of in flight fires. I'd expect such systems to be classified as critical to flight safety. Obviously not as much as the auto pilot, but it is still a system that could bring the plane down if an oven or cofee pot shorts. IFE, on the other hand, is not.

userbinator• 12 years ago

I wouldn't be surprised if the coffee machine didn't have a single microcontroller in it, but a simple old-fashioned analogue controller. The prevailing attitude in safety-critical systems is "if it works (and has been certified with much $$$), leave it alone".

Narkov• 12 years ago

Presumably PHP.

raverbashing• 12 years ago

If I had to bet it would be the non-safety systems, like lighting

Or just their website and intranet maybe?

ghshephard5• 12 years ago

Given how reliably the video system fails on the 777, I'm going with the In Flight entertainment system.

saryant• 12 years ago

Boeing doesn't manufacture those. AFAIK Panasonic is the leading vendor today.

WildUtah• 12 years ago

The hardware access routines, real time operating system, and bottom level I/O can't be written in ADA. CPUs accept only machine code, so those programs have to be written at least partly in machine code.

Likewise the compiler has to generate CPU instructions,the opcodes and operands of which are embedded in the code generator as binary data. That is code that isn't in ADA either.

amock• 12 years ago

Ada get compiled to machine code, so of course it can run directly on the CPU.

There's also no reason it can't be used to write a compiler and there's probably several Ada compilers written in Ada. I'm not sure what you mean about binary data having to be embedded in the code generator; you can easily generate arbitrary binary data from almost any language.

axman64• 12 years ago

The hardware access routines, real time operating system, and bottom level I/O can't be written in ADA.

I disagree, Ada has fantastic tools for writing these sorts of code; you can precisely define data types down to the bit level and their precise locations and endianess in memory. Have a look at pages 50-68 of [1] to see these in action. you don't have to know Ada to be able to see what's being defined, and that's it exactly matches the specification of the memory mapped IO registers. Some reference c code is given, but there is no guarantee that the compiler will do what you want; the Ada language does guarantee it.

[1] http://cs.anu.edu.au/student/comp4330/Lectures/RTES-03%20Int...

pjmlp14• 12 years ago

It seems you never programmed in Ada...

cpeterso• 12 years ago

What new languages are being developed that could be even safer than Ada for safety critical systems? Are Agda, Haskell, or Rust as safe or strongly typed as Ada?

tjr4• 12 years ago

Weirdly, avionics development seems to be moving away from Ada toward C! I personally think something like OCaml would be a better choice...

I think the problem is, there is so much momentum built up around Ada and C usage in the avionics world that there just isn't the infrastructure and culture built up around better languages, so it's hard to make the switch. Even if you have to write a brand new codebase for some small avionics project, how do you justify the expense of doing it all in OCaml when there is already certified compilers and support for Ada?

It ought to happen, though.

en4bz• 12 years ago

Yes, cause one definitely wants "Stop the World" GC in a real-time system.

damian2000• 12 years ago

There's a relevant Programmers.SE post on this ...

http://programmers.stackexchange.com/questions/153266/what-o...

According to comments there, some modern aircraft run an RTOS (real time operating system) on top of the bare hardware, which then lets you run Ada or C code. Those mentioned include VxWorks[1] for the Boeing 787 and Integrity[2] used by the Airbus A380.

[1] http://en.wikipedia.org/wiki/VxWorks

[2] http://en.wikipedia.org/wiki/Integrity_(operating_system)

xarien2• 12 years ago

Most bootloaders (of components) if nothing else will be wrapped in vxworks.

xarien2• 12 years ago

Ada is by far the strongest typed language I've used in my 2 decades of programming. In the defense / aviation industry, it's very common to have multiple sub-contractors working on different pieces of the platform. Due to this trait, interfaces between these sub-systems / components are heavily scrutinized. Using a language such as Ada to ensure that large amounts of bitwise data structures are clearly defined and match eases the burden (at least a little).

warriar• 12 years ago

Anyone else thinking that Public Write and Execute would be bad for an Airplane?!

SkyMarshal3• 12 years ago

According to Brian Pflug, engineering avionics software manager at Boeing's Commercial Airplane Group, most companies disliked the idea of a standard language at all, and then seriously objected to Ada as too immature.

By what measure did they consider Ada "too immature" I wonder? It's one of the oldest languages, an open international standard, and has been through several major updates over three decades. On the surface there are few if any languages that claim more maturity than that.

Padding3• 12 years ago

There's no compiler (and standard library implementation) that has faced public scrutiny like other popular languages have. Aditionally, there are no IDEs for Ada comparable to the IDEs of other comercial languages (e.g. C++, C# or Java). Which is understandable given how little interest there is in Ada, amongst the "general public" of developers, which is understandable given how there's no proper free implementation of for Ada.

There's essentially just the AdaCore implementation that costs $$$, the GPL'd AdaCore implementation that requires you to publish your source code (because of the libraries) and then there's some unsupported GCC implementation.

I like Ada, and I would like to see it gain more market share. If it had, things like Rust and Go may have been superfluous. But the way things are, I just don't see it happening. Unless you're some big enterprise Ada is essentially a non-option, due to licensing, and if you're a big enterprise it's essentially a non-option since there's very few devs around for it. And so it remains an obscure language used in very niche applications (albeit with great success there?).

sgt101• 12 years ago

Really strange about the tooling, if I were BAE or Boeing I'd be standing up a project to create an IDE on top of Eclipse - ~2 man year effort for vast productivity gains!

dons asbestos pants in expectation of anti eclipse comments!

pjmlp14• 12 years ago

Out of my mind there are at least 4 commercial compilers to choose from and two of them offer reasonable IDEs as well.

reacweb• 12 years ago

I have developed many years in Ada. It is a marvelous language. Many mistakes are found during compilation. Very often, when it compiles, it works. Since Ada95, the multitasking features are really awesome. The overhead of the verbosity is real for short programs, but becomes less relevant for big projects.

Ada is not in the hype anymore. It is getting more and more difficult (and expensive) to have developers with a good knowledge in Ada.

In my current society, some projects are still in Ada, but the quality of the code is becoming lower and lower, with a lot of type cast. It seems people are thinking in C (C++) and are painfully writing their ideas in Ada.

ArkyBeagle7• 12 years ago

It is an absolute shame that Ada did not take its place as a dominant player early on. But people have difficulties reasoning about cost in computing. The verification cost for the toolchains pretty much kept places I worked at out of it. It is too bad that those costs were not treated as public goods and paid for out of tax money. I expect it would have been a good investment.

donquichotte2• 12 years ago

I recently applied for a job at a company that makes civilian drones (rescue, police). They required knowledge of the Oberon language, I'm pretty sure they use HelyOS [1] for real-time control of their coaxial helicopters.

It's quite interesting how these Pascal derivatives seem to find their niche in high-reliability or real-time applications, although I don't quite understand why. That may have been part of the reason why I didn't get the job.

[1] http://en.wikipedia.org/wiki/XOberon

nimrody• 12 years ago

No pointers.

Range limited types, e.g.

     Type Day = (0..7);

     Days = (monday,tuesday,wednesday,thursday,friday,  
             saturday,sunday);

blueskin_• 12 years ago

...and now I will always want to fly on an Airbus instead.

Reminds me of the joke:

At a recent real-time Java conference, the participants were given an awkward question to answer:
"If you had just boarded an airliner and discovered that your team of programmers had been responsible for the flight control software, how many of you would disembark immediately?"
Among the forest of raised hands only one man sat motionless. When asked what he would do, he replied that he would be quite content to stay aboard. With his team's software, he said, the plane was unlikely to even taxi as far as the runway, let alone take off.

enjoy-your-stay• 12 years ago

...and now I will always want to fly on an Airbus instead.

Reminds me of a joke I was once told by a QA consultant:

His colleague was on his way to deliver a revision of software which had been extensively tested and many serious bugs discovered and fixed. The software was so important that it was to be delivered in person by the consultant on a laptop to the customer.

On the walkway to the plane, he happened to glance up and see the aeroplane he was about to board was an Airbus. In fact the very revision that had the same software he'd just been testing and had found to be full of bugs.

Oh no.

Suddenly getting very cold feet and desperately thinking of a way not to get on the plane he takes a drastic step and deliberately drops and destroys the laptop with the software he was going to deliver.

Happy now he returns to the office and declares 'well, that's a shame - but I think I'll take the train next time'

- was told to me as a true story, and you never know...

Artemis24• 12 years ago

I've heard from an airline pilot that Airbuses are a lot more driven by the central computer, while in Boeing planes, the pilot has more freedom.

Boeing Flies on 99% Ada

Related Stories