Re: Boeing and Dreamliner

[Richard Riehle <richard@adaworks.com>]

Hyman Rosen wrote:

> Richard Riehle wrote:
> > And those issues directly support the folly of even thinking about using
> > C++ for this aircraft.
>
> Unsurprisingly, I disagree. You're talking about a situation where every
> arithmetic operation in the code was carefully scrutinized. I'm sure that
> in the cases were protection was left in the Ariane 4 code it did not
> consist of allowing an Ada exception to be raised on overflow, but rather
> coding in such a way that a correct numeric result would be produced. I
> don't see why such scrutiny would not result in equally safe C++ code.

C++ is simply not designed this way.   Ada is.   In C++ it is perfectly legal
to do all kinds of assignment statements where the result is not entirely
predictable.   A key difference between Ada and many other languages is
the absence of structural equivalence in favor of named equivalence.  That
is, the fact that there might be some possible structural compatibility between

objects with different names (or type designations) is never sufficient
justification for a legal operation involving types of different names.

Even unchecked operations, when there is a potential for an erroneous
result, result in a warning in better Ada compilers.  Also, unchecked
assignment (Unchecked_Conversion) only permits assignment in the
direction for which it is instantiated.   This eliminates many kinds of
errors.

Quite simply, the amount of error checking performed by an Ada compiler
is substantially greater than in C++.   This does not mean C++ is evil.  It
simply means it is inappropriate for software that demands a high level of
dependability, especially when one has Ada available as an option.

I really don't want this to sound like C++ bashing.   However, the more I
learn about C++, the more I realize it is an excellent language for certain
classes of problems, but is more dangerous for safety-critical software
than Ada.   By all means, use C++ for graphics, statistical analysis, business
problems, and similar kinds of problems.   But, do not use it for software
where life and safety are involved.   This is simply a matter of selecting
the right tool for the right job.

> > I am also confident that, pressures from resume-builders
> > notwithstanding, they will realize the value of using contemporary Ada,
> > with its excellent record for software safety, instead of a language so
> > characterized by unpredictability that they could never be sure that some
> > undetected behavior might manifest itself long after even the best of
> > testing has been completed.
>
> I obviously disagree with you about the suitability of C++, but I
> certainly agree that Ada is a fine choice as well. As for resume
> building, I would just let such people do their building elsewhere.

I know you are a skilled and experienced C++ developer.   Does it not
occur to you that simple little things such as automatic type promotion,
incorrect placement of curly braces, and errors in pointer arithmetic,
to name a few issues, might result in questionable code?   What about
incorrectly defined destructors?    Or default assignment operations?
Or many more such entertaining features of C++ that add power, but
also add the potential for undetected errors?   You know the list is
even longer than the one I just presented.

Richard Riehle