"Ravenscar-like" profile for C/C++

"Ravenscar-like" profile for C/C++

[Marc Le Roy]

Hello,

ADA Ravenscar is a restricted subset of the ADA language that has been
defined for real-time software development in safety critical applications.
Completed with additional restrictions like the ones defined in the SPARK
profile, it allow to build very deterministic applications that support
automatic static code analysis and schedulability analysis.
http://www.acm.org/pubs/articles/proceedings/ada/289524/p1-dobbing/p1-dobbing.pdf

I would like to know if there is a similar standard for C / C++. I found
only MISRA-C and EC++, but they are rather permissive with respect to the
Ravenscar ADA profile. Moreover, because the ADA standard covers concepts
that are out of the scope of the C/C++ standards, I suppose that an
equivalent of the Ravenscar profile in C/C++ should make reference to an
RTOS.

Marc

-- 

Re: "Ravenscar-like" profile for C/C++

[Marc Le Roy]

Sorry for the incorrect link, the reference document about the Ravenscar
profile is here:
"Guide for the use of the Ada Ravenscar Profile in high integrity systems"
http://polaris.dit.upm.es/~str/proyectos/ork/documents/RP_ug.pdf

Marc

Re: "Ravenscar-like" profile for C/C++

[Jack Klein]

On Sun, 25 Apr 2004 15:23:32 +0200, "Marc Le Roy"
<invalide@invalide.com> wrote in comp.lang.c:

> Hello,
> 
> ADA Ravenscar is a restricted subset of the ADA language that has been
> defined for real-time software development in safety critical applications.
> Completed with additional restrictions like the ones defined in the SPARK
> profile, it allow to build very deterministic applications that support
> automatic static code analysis and schedulability analysis.
> http://www.acm.org/pubs/articles/proceedings/ada/289524/p1-dobbing/p1-dobbing.pdf
> 
> I would like to know if there is a similar standard for C / C++. I found
> only MISRA-C and EC++, but they are rather permissive with respect to the
> Ravenscar ADA profile. Moreover, because the ADA standard covers concepts
> that are out of the scope of the C/C++ standards, I suppose that an
> equivalent of the Ravenscar profile in C/C++ should make reference to an
> RTOS.
> 
> Marc

Why do you think that you have the right to hijack any replies from
comp.lang.c++ or comp.lang.ada and prevent their authors from seeing
them in the group where they posted them?  Either your question is
topical in those groups and replies belong there as well, or it is not
topical in those groups and you shouldn't have cross-posted there in
the first place.

The question is certainly off-topic in comp.lang.c, where all of
"Ravenscar", "ADA", and "C++" are irrelevant, as are real time
operating systems, or indeed any operating systems at all.  MISRA and
any or all other third-party standards are also not topical, the only
standard that is relevant here is ISO.

The newsgroup comp.lang.c discusses the features and use the C
language as defined by the various versions of the ISO/ANSI standards,
and prior to that by the first edition of the "C Programming Language"
by Kernighan & Ritchie.  Subsets or auxiliary standards from any
source are off-topic.

If you want inter-language comparisons, and discussions of software
development methodologies (which is what MISRA-C is, after all) such
groups as news:comp.programming and news:comp.software-eng are
appropriate.  Cross-posting to multiple language groups is not.

-- 
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.learn.c-c++
http://www.contrib.andrew.cmu.edu/~ajo/docs/FAQ-acllc.html

Re: "Ravenscar-like" profile for C/C++

[Jack Klein]

On Sun, 25 Apr 2004 18:11:10 +0300, "Ioannis Vranos"
<ivr@guesswh.at.emails.ru> wrote in comp.lang.c:

> "Marc Le Roy" <invalide@invalide.com> wrote in message
> news:c6gdub$j92$1@news-reader4.wanadoo.fr...
> > Hello,
> >
> > ADA Ravenscar is a restricted subset of the ADA language that has been
> > defined for real-time software development in safety critical
> applications.
> > Completed with additional restrictions like the ones defined in the SPARK
> > profile, it allow to build very deterministic applications that support
> > automatic static code analysis and schedulability analysis.
> >
> http://www.acm.org/pubs/articles/proceedings/ada/289524/p1-dobbing/p1-dobbing.pdf
> >
> > I would like to know if there is a similar standard for C / C++. I found
> > only MISRA-C and EC++, but they are rather permissive with respect to the
> > Ravenscar ADA profile. Moreover, because the ADA standard covers concepts
> > that are out of the scope of the C/C++ standards, I suppose that an
> > equivalent of the Ravenscar profile in C/C++ should make reference to an
> > RTOS.
> 
> 
> There is no reason for such a subset in C++. Use the part of C++ that fits
> your needs. The whole language is designed for maximum run-time/space
> efficiency. I place here the contents of a page of my old web site which i
> think you will find useful:

	[large snip]

You have completely mis-understood the question.

The issues here have nothing at all to do with run-time/space
efficiency, but about, as the OP specifically stated, "safety critical
applications".  The phrase you used in the part of your overly long
pedantic message that I snipped, "mission critical applications", is
not, never has been, and never will be remotely similar.  In fact, it
is nothing more than a marketing buzz word.

This renders your answer meaningless in the context.

-- 
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.learn.c-c++
http://www.contrib.andrew.cmu.edu/~ajo/docs/FAQ-acllc.html

Re: "Ravenscar-like" profile for C/C++

[Jack Klein]

On Sun, 25 Apr 2004 21:12:31 +0200, "Marc Le Roy"
<invalide@invalide.com> wrote in comp.lang.c++:

> Ioannis Vranos wrote:
> 
> > There is no reason for such a subset in C++. Use the part of C++ that
> > fits your needs.
> 
> It seems that you don't know very well the world of high integrity systems,
> especially the ones that require certification according to standards like
> DO178B level A ;-)

It is true that Ioannis completely misunderstood the question.

> You should have a look to this document:
> http://polaris.dit.upm.es/~str/proyectos/ork/documents/RP_ug.pdf
> especially to section 2, that explain why such a restrictive ADA profile has
> been defined.

You should understand that anything in that document is irrelevant in
comp.lang.c++, and your question just as off-topic here as it was in
comp.lang.c.

Even if there were a similar document for C and/or C++, it would be
off-topic in comp.lang.c and comp.lang.c++.

> It is true that the problems in relation with tasking do not exist in C++
> because tasking is not part of the C++ standard, but other remains. In fact,
> having a good experience of using both C and C++ in real time projects [yes,
> they are different languages ;-) ], I have a good idea of what can or cannot
> be used in safety critical systems. But I am pretty sure that both my
> customer and certification authorities will have a greater confidence in a
> established standard than in my opinion :-)
> 
> Marc

Whatever "established standards" there might or might not be, they
would be off-topic in both comp.lang.c and comp.lang.c++, unless they
were part of ISO 9899 and/or ISO 14882.

This discussion, as I already pointed out, belongs in groups like
news:comp.programming and news:comp.software-eng.  Language
subsetting, for whatever purpose, is not defined by the ISO standard
for either C or C++, and is not topical here.  Nor is safety critical
programming.

-- 
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.learn.c-c++
http://www.contrib.andrew.cmu.edu/~ajo/docs/FAQ-acllc.html

Re: "Ravenscar-like" profile for C/C++

[Ioannis Vranos]

"Jack Klein" <jackklein@spamcop.net> wrote in message
news:ev7o80lpud3gfmicusomjs5std2a0dimga@4ax.com...
>
> The phrase you used in the part of your overly long
> pedantic message that I snipped, "mission critical applications", is
> not, never has been, and never will be remotely similar.  In fact, it
> is nothing more than a marketing buzz word.


Why marketing buzz word? You can do something like:


#include <fstream>
#include <string>
#include <cctype>


class DictionaryFileException
{
};


class dictionaryFile
{
 std::ifstream dicFile;
 std::string dicFileName;

public:
 dictionaryFile(const std::string &filePath) throw (DictionaryFileException)
 {
  dicFileName=filePath;
  dicFile.open(filePath.c_str());

  if(dicFile.fail())
     throw DictionaryFileException();

  FileValidation();
 }

 void FileValidation() throw (DictionaryFileException)
 {
  using namespace std;

  char input[256];

  do
  {
   dicFile.get(input,256);

   if(isspace(input[0]) or (input[0]=='\\' and input[1]=='\\'))
    continue;

   else if(!isalpha(input[0]) and !isdigit(input[0]))
    throw DictionaryFileException();

  }while(!dicFile.eof());
 }
};



C++ provides the necessary structures to built very reliable, efficient and
mission critical systems. In the above i define what exceptions are expected
from each member function, and we can also use the Resrource Aquisition is
Initializatization technique which the standard library itself also uses.






Ioannis Vranos

Re: "Ravenscar-like" profile for C/C++

[Martin Krischik]

Finallylein wrote:

 
> This discussion, as I already pointed out, belongs in groups like
> news:comp.programming and news:comp.software-eng.  Language
> subsetting, for whatever purpose, is not defined by the ISO standard
> for either C or C++, and is not topical here. 

> Nor is safety critical programming.

Finaly a C / C++ programmer who confesses that safety critical programming
is in deed off topic in C and C++.

Grin

Martin

-- 
mailto://krischik@users.sourceforge.net
http://www.ada.krischik.com

Re: "Ravenscar-like" profile for C/C++

[Martin Krischik]

Ioannis Vranos wrote:

> C++ provides the necessary structures to built very reliable, efficient
> and mission critical systems. In the above i define what exceptions are
> expected from each member function, and we can also use the Resrource
> Aquisition is Initializatization technique which the standard library
> itself also uses.

The problem with savety critical programming in C or C++ is not what is
allowed or possible but what should not be allowed and should be
impossible. And for that I just need two line:

char X[10];
X[10]='A';

With Regards

Martin

-- 
mailto://krischik@users.sourceforge.net
http://www.ada.krischik.com

Re: "Ravenscar-like" profile for C/C++

[Michiel Salters]

Martin Krischik <krischik@users.sourceforge.net> wrote in message news:<1082964421.KuB1viW3U1@linux1.krischik.com>...
> Ioannis Vranos wrote:
>
> The problem with savety critical programming in C or C++ is not what is
> allowed or possible but what should not be allowed and should be
> impossible. And for that I just need two line:
> 
> char X[10];
> X[10]='A';

What's the problem with that code, from a safety perspective? Certainly
a C compiler which is supposed to be suited for safety-critical programs
will diagnose this. The base C and C++ languages have quite a number
of "undefined behavior - no diagnostic required" cases, but a similar
profile may very well tighten that to "undefined behavior - must be 
rejected at compile time". 

The base philosophy in C and C++ is that flexibility can be traded 
for safety, but not vice versa. Certainly, in C++ it is easy to
create a verifiable subset. For instance, it is possible to define
a range template and with it a <int,0,10> type. The toolset would
be hard pressed to prove that the range template is correct and
overflow-free. However, this could be proven by humans. The tool
chain instead only has to check that all possible overflows are
located in this checked range< > code. Together, this would prove
that a body of code is overflow-free.

Regards,
Michiel Salters

Re: "Ravenscar-like" profile for C/C++

[Vinzent 'Gadget' Hoefler]

Michiel Salters wrote:

> Certainly, in C++ it is easy to
>create a verifiable subset.

Not quite true. Or maybe the FIASCO project just did not find it yet?


Vinzent.
-- 
Parents strongly cautioned  --  this  posting  is  intended for mature
audiences  over  18.  It  may  contain some material that many parents
would not find suitable for children and may include intense violence,
sexual situations, coarse language and suggestive dialogue.

Re: "Ravenscar-like" profile for C/C++

[Vinzent 'Gadget' Hoefler]

Vinzent 'Gadget' Hoefler wrote:

>Michiel Salters wrote:
>
>> Certainly, in C++ it is easy to
>>create a verifiable subset.
>
>Not quite true. Or maybe the FIASCO project just did not find it yet?

Damn itchy fingers. Wanted to include the URL, too...
<URL:http://os.inf.tu-dresden.de/vfiasco/>

Still doesn't look too easy to me.


Vinzent.

Re: "Ravenscar-like" profile for C/C++

[Craig Carey]

On Sun, 25 Apr 2004 15:37:23 -0500, Jack Klein @Spamcop wrote:
>On Sun, 25 Apr 2004 21:12:31 +0200, "Marc Le Roy" wrote in comp.lang.c++:
>> Ioannis Vranos wrote:
...
>> You should have a look to this document:
>> http://polaris.dit.upm.es/~str/proyectos/ork/documents/RP_ug.pdf
>> especially to section 2, that explain why such a restrictive [Ada] profile has
>> been defined.
>
>You should understand that anything in that document is irrelevant in
>comp.lang.c++, and your question just as off-topic here as it was in
>comp.lang.c.
>
>Even if there were a similar document for C and/or C++, it would be
>off-topic in comp.lang.c and comp.lang.c++.
>

I was mentioing how Ada 95 is apparently better designed than Zonnon; at
 comp.lang.oberon. 
   Zonnon ( http://zonnon.ethz.ch/ ) is an advancement on Oberon, but it
    has limitations in the multitasking area.

There seems to be no correct "relevance principle that can be buttoned
 onto every Usenet group on programming languages.

Thanks

...
>Whatever "established standards" there might or might not be, they
>would be off-topic in both comp.lang.c and comp.lang.c++, unless they
>were part of ISO 9899 and/or ISO 14882.
>
>This discussion, as I already pointed out, belongs in groups like
>news:comp.programming and news:comp.software-eng.  Language
>subsetting, for whatever purpose, is not defined by the ISO standard
>for either C or C++, and is not topical here.  Nor is safety critical
>programming.

Re: "Ravenscar-like" profile for C/C++

[Martin Dowie]

"Vinzent 'Gadget' Hoefler" <nntp-2004-05@t-domaingrabbing.de> wrote in
message news:p8ih90tob4d617h6tjev9d0jmj20h716lu@jellix.jlfencey.com...
> Well, I'd say that SPARK as an verifiable Ada-subset is quite
> successful in that regard. I doubt that an equally verifiable subset
> of C++ can ever be implemented. But perhaps that's just me.

No, it's not just you - I have asked a senior Praxis person before
if they had plans for a C++ version and they told they had spent
plenty time thinking about how one could achieve something
worthwhile for C++ and similar to SPARK but they just couldn't
think of anything!

Doesn't prove that such a thing could be done, of course, but
they are the people in the best position to attempt such a thing!

That was also ~2001 - things may have changed!

Cheers

-- Martin

p.s. I didn't want to name names! If the Praxis person wants to
verify this conversation from Ada-Europe in Belgium they are
free to do so! :-)

Re: "Ravenscar-like" profile for C/C++

[Peter Amey]

Martin Dowie wrote:
[snip]
> No, it's not just you - I have asked a senior Praxis person before
> if they had plans for a C++ version and they told they had spent
> plenty time thinking about how one could achieve something
> worthwhile for C++ and similar to SPARK but they just couldn't
> think of anything!
> 
> Doesn't prove that such a thing could be done, of course, but
> they are the people in the best position to attempt such a thing!
> 
> That was also ~2001 - things may have changed!
> 
> Cheers
> 
> -- Martin
> 
> p.s. I didn't want to name names! If the Praxis person wants to
> verify this conversation from Ada-Europe in Belgium they are
> free to do so! :-)

Your memory serves you well!  I don't think things have changed that 
much.  My personal view is that any such subset, if it did exist, would 
be so restrictive and unnatural to typical C++ users that they would 
find it unacceptable.  Persuading a potential Ada user of the merits of 
SPARK is a much easier proposition because they have already taken 
several steps down the early error detection route.

Peter

Re: "Ravenscar-like" profile for C/C++

[Martin Dowie]

"Peter Amey" <peter.amey@praxis-cs.co.uk> wrote in message
news:2fvai0F2fcp5U1@uni-berlin.de...
> > p.s. I didn't want to name names! If the Praxis person wants to
> > verify this conversation from Ada-Europe in Belgium they are
> > free to do so! :-)
>
> Your memory serves you well!

Thanks - it was an interesting week and I was trying to remember every word!

:-)

Re: "Ravenscar-like" profile for C/C++

[Alexander Kopilovitch]

Peter Amey wrote:

> > if they had plans for a C++ version and they told they had spent
> > plenty time thinking about how one could achieve something
> > worthwhile for C++ and similar to SPARK but they just couldn't
> > think of anything!
>
> Your memory serves you well!  I don't think things have changed that 
> much.  My personal view is that any such subset, if it did exist, would 
> be so restrictive and unnatural to typical C++ users that they would 
> find it unacceptable.  Persuading a potential Ada user of the merits of 
> SPARK is a much easier proposition because they have already taken 
> several steps down the early error detection route.

How about SPARK-classes for C++? I mean regular C++ classes, but with attribute
SPARK (in GCC you can relatively easily define such additional attributes for
classes, it will look something like __SPARK__), which tells that the class
conforms with SPARK-imposed restrictions. In other words, SPARK in C++ can be
applied for individual classes, which can be mixed in a program (and even in
an individual source file) with other (non-SPARK) classes.

Perhaps many C++ programmers will find this approach acceptable, they may
perceive it as reasonable and useful compromise. (And there will be nothing
heretic in that - even in SPARK applications for Ada it may happen that some
packages are for SPARK examination, while others bypass SPARK for some reasons).



Alexander Kopilovich                      aek@vib.usr.pu.ru
Saint-Petersburg
Russia