Re: Certified C compilers for safety-critical embedded systems

["Robert I. Eachus" <rieachus@comcast.net>]

Georg Bauhaus wrote:

> That is, I might presume that color Red is not too different from
> Light_Red. I might know that the number of bits used for values
> in the two types will be the same (char in C terms, say).  Still the
> compiler will not let me use Light_Red_Index's value 101 and
> Red_Index's value 101 interchangeably.

Well, it would be better to say that the compiler won't let you mix 
Light_Red_Index and Red_Index implicitly.  You can always say:

if buffer(Red_Index(some_val)) then...

If the two types are represented the same, then there will be no real 
run-time cost for the conversion.  (If both Red_Index and 
Light_Red_Index were SUBtypes of Integer, then you could write:

if buffer(some_val) then... and there would be a range check associated 
with the indexing operation.  With Red_Index and Light_Red_Index as 
separate types, there will be a range check now associated with the 
conversion instead of the subscripting.  But assuming that the 
representations of the types are identical, the code should be identical.

>                                        The assembly listing shows
> 8bit register use on i686 when the index range permits, even with
> numbers ranging beyond 255 (or > 65535 for that matter).
> 
>    type Light_Red_Index is range 92_000 .. 92_200;
>    for Light_Red_Index'Size use 8;
> 
> In short, convenient, checked at compile time, and efficient :-)

Yep, and if you do a type conversion as above, the compiler will add the 
bias back in (or add the net difference if there are two different 
biases).  This means you can write your code in meaningful units and 
allow the compiler to remember and generate any conversions.  This is 
real handy when you have a sensor that for example, returns a 12-bit 
encoding of an angle.  You can write the code using units of degrees (or 
radians or grads if you want) and the compiler will convert your 
constants at compile time.  Get a new sensor with a 16-bit ADC, and all 
you have to change is the type declaration (and of course, recompile and 
test).

-- 
                                           Robert I. Eachus

"The war on terror is a different kind of war, waged capture by capture, 
cell by cell, and victory by victory. Our security is assured by our 
perseverance and by our sure belief in the success of liberty." -- 
George W. Bush