Safety-Critical Survey (Results)

Safety-Critical Survey (Results)

[Robin Rowe]

SAFETY-CRITICAL SYSTEMS COMPUTER LANGUAGE SURVEY RESULTS
========================================================

Here are the results of my recent informal survey of computer 
languages used in safety-critical embedded systems and other 
interesting systems. In responses, Ada was by far the most popular 
language for these systems followed by assembler. There is a list
describing 722 Ada projects that is available via ftp from the Ada
Information Clearinghouse. The current version is 213K in size 
(contact adainfo@ajpo.sei.cmu.edu). I did not attempt to integrate 
that data into this report.

No assertion is intended here that any language is necessarily 
superior to any other.

Aerospace:
---------

 Allied Signal: ?
 Boeing: Mostly Ada with assembler. Also: Fortran, Jovial, C, C++.
         Onboard fire extinguishers in PLM.
         777 seatback entertainment system in C++ with MFC (in 
         development by Microsoft).
         757/767: approximately 144 languages used.  
         747-400: approximately 75 languages used.
         777: approximately 35 languages used.
 Boeing Defense & Space Group: (777 cabin mgmt. system in Ada?)
 DAINA/Air Force: Aircraft mission manager in Ada.
 Chandler Evans: Engine Control System in Ada (386 DOS).
 Draper Labs/Army/NASA: Fault tolerant architecture in Ada/VHDL.
 DuPont: ?
 European Space Agency: mandates Ada for mission critical systems. 
        ISO (Infrared Space Observatory)
        SOHO (Solar and Heliospheric Observatory)
        Huygens/Cassini (a joint ESA/NASA mission to Saturn)
        Companies involved:
             British Aerospace (Space Systems) - Bristol, UK
             Fokker Space Systems - Amsterdam, Holland
             Matra-Marconi Espace - Toulouse, France
             Saab - Sweden
             Logica - UK
             DASA - Germany
             MBB - Germany
 Ford Aerospace: Spacecraft in Ada with assembler.
                 GEOS and INSAT spacecraft in FORTRAN.
                 (Ford Aerospace is now Space Systems/Loral.)
 Hamilton-Standard: (777 air cowling icing protection system in Ada?).
 Honeywell: Aircraft navigation data loader in C.
            (777 airplane information mgmt. system in Ada?)
 Intermetrics/Houston: space shuttle cockpit real-time executive 
                       in Ada '83 with 80386 assembly
 Lockheed Fort Worth: F-22 Advanced Tactical Fighter program in Ada 83
      (planning to move to Ada 94) with a very small amount in
      MIL-STD-1750A assembly. 
      Maintain older safety-critical systems for the F-111 and 
      F-16/F-16 variant airframes primarily done in JOVIAL.  
 NASA: Space station in Ada. (Sources differed on whether it was
       Ada only, or Ada with some C and assembler.)
 NASA Lewis: March 1994 space shuttle experiment in C++ on 386.
 Northrup: B2 bomber control in C++.
 Rockwell Space Systems Div.: Space shuttle in Hal/s and Ada.
                              Defense Initiative in Ada.
                              Other systems in Ada and C.
 Space Systems/Loral: Spacecraft in Ada with assembler.
 Teledyne: Aircraft flight data recorder in C.
 TRW/Air Force: Realtime avionics OS in Ada.
 Wilcox Electric: Navigation aids in C prior to 1990, Ada after.
                  VOR-DME in Ada.
                  Microwave landing system in Ada.
                  Wide Area GPS in C and C++.

Air Traffic Control:
-------------------

 Hughes: Canadian ATC system in Ada.
 Loral FSD: U.S. ATC system in Ada.
 Thomson-CSF SDC: French ATC system in Ada.

Land Vehicles:
-------------

 Bosch: Diesel engine controls in C. (Other systems generally in C?)
 Delco: Engine controls and ABS in 68C series (Motorola) assembler.
        C++ used for data acquisition in GM research center.
        '93+ GM trucks vehicle controllers mostly in Modula-GM
        (Modula-GM is a variant of Modula-2. A typical 32-bit 
         integrated vehicle controller may control the engine, the
         transmission, the ABS system, the Heating/AC system, as 
         well as the associated integrated diagnostics and off-board 
         communications systems.)
   Ford: Assembler.
 General Dynamic Land Systems: M1A2 tank tank software in Ada with
        time-critical routines in 68xxx assembler.
        Tank software simulators in C.
 Honda: ?
 Lucas: Many systems in Lucol (Lucas control language).
        Diesel engine controls in C++.
        ABS in 68xxx assembler.
 SAE: ? (Despite considerable effort on my part, I was unable to 
        gather any information on languages or language standards 
        from the Society of Automotive Engineers.)

Ships:
-----

 Vosper Thornycroft Ltd (UK): navigation control in Ada.
 
Trains:
------
 
 AMTRAK: ? 
 BART: ? (One rumor said Ada migrating to C. Can anyone confirm?)
 CSEE Transports (France): TGV Braking system in Ada (68K).
 Denver Airport baggage system: This well publicized problem 
    system is written in C++. (A source familiar with the system
    said the problems were political and managerial, not directly
    related to C++.)
 European Rail: Switching system in Ada.
 EuroTunnel: in Ada.
 Extension to the London Underground: in Ada.
 GEC Alsthom (France): Railway and signal control systems for trains 
      and the TGV (north lines and Chunnel) in Ada.
      Subway network control systems (Paris, Calcutta, and Cairo). 
 TGV France: Switching system in Ada.
 Union Switch & Signal, Pittsburgh: (Switching system in ?)
 Westinghouse Signals Ltd (UK):  Railway signalling systems in Ada.   
 Westinghouse Brake & Signal UK: Automatic Train Protection (ATP) systems
                                 for Westrace project in PASCAL.
 Westinghouse Australia: ATP systems in PASCAL and ADA.

Medical:
-------

 Baxter: Left Ventricular Heart Assist in C with 6811 assembler.
 Coulter Corp.: ONYX hematology analyzer in Ada.
 
Nuclear Reactors:
----------------

 Core and shutdown systems in assembler, migrating to Ada.

SURVEY METHODOLOGY
==================

I operated under the theory that, with regard to what languages 
are really in use, the recollections of the engineers themselves 
are probably the most accurate and open source. In general, I did 
not have enough sources that I could cross check the information. 
In cases where I could, the most interesting discrepancy was that 
companies that thought they had adopted one language as the total 
solution for all their software designs often had something in 
assembler or some other language somewhere. 

Every response to the survey was positive except one. An individual 
at Rockwell Collins said: "The language(s) we do/don't use is a 
matter best left to us, our customers, and the appropriate 
regulatory agencies governing our businesses and markets. All of 
these parties also look out for the public's interests in safety, 
cost, etc. as well." This individual took me to task for not 
contacting the PR department of his company, but was unwilling to 
help me do so. Per his request, I have omitted his company.

If you wish to add information or make a correction please send 
mail to cpp@netcom.com. I'd like to fill in the companies that 
have question marks by them. I'm particularly interested in 
systems written in C++. Names of respondents are held confidential. 
If you respond with a public follow-up on the net, please cc via 
e-mail to me so that I don't miss you. 

Thanks to everyone who helped with this. I meant to post this in
August, but got busy with work and relocating to Monterey and
forgot. Sorry for the delay.

Robin

embedded.svy rev 11-13-94
-- 
-----
Robin Rowe                 cpp@netcom.com  408-375-9449  Monterey, CA 
Rowe Technology            C++ training, consulting, and users groups.

Re: Safety-Critical Survey (Results)

[James Murphy {75881}]

In article <cppCz89Cz.sH@netcom.com>, cpp@netcom.com (Robin Rowe) writes:

|>Every response to the survey was positive except one. An individual 
|>at Rockwell Collins said: "The language(s) we do/don't use is a 
     ^^^^^^^^^^^^^^^^
|>matter best left to us, our customers, and the appropriate 
|>regulatory agencies governing our businesses and markets. All of 
|>these parties also look out for the public's interests in safety, 
|>cost, etc. as well." This individual took me to task for not 
|>contacting the PR department of his company, but was unwilling to 
|>help me do so. Per his request, I have omitted his company.
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^

Unless my computer is making stuff up, it appears that you didn't.

Not a good idea if you wish others to place their confidentiality into
your trust in the future.

\b-- 
The opinion expressed here are mine, not my employers.  In fact,
opinions are probably the one thing developed at work that
employers do _not_ claim ownership of.

Re: Safety-Critical Survey (Results)

[Robin Rowe]

Your computer must be making stuff up. I didn't name the individual who
responded or say anything more about what the company uses. The identity of 
respondents is safe with me. I was merely explaining that a company was 
deleted from the survey at their request, and therefore I can't use any 
more information about them. (So everybody stop sending it, ok?)

Robin


-- 
-----
Robin Rowe                 cpp@netcom.com  408-375-9449  Monterey, CA 
Rowe Technology            C++ training, consulting, and users groups.

Re: SEI abandons Ada

[Larry Howard]

In article <D6Gqsw.9o8@world.std.com>, srctran@world.std.com
(Gregory Aharonian) writes:

[yet another missive designed to win friends and influence people]

Perhaps Greg answers his own question.  Could it be that the absence of SEI
Ada courseware might signal the presence of a ready supply in the commercial
marketplace?  Of course not.  Such an explanation would tend to cast doubts
on Greg's conspiracy theories and possibly threaten his Great Hope--namely,
delivering the performance of a lifetime as the Woman Scorned in
Ada: The Movie.

Greg, 'til your casting call, GIVE IT A REST--you'll get my vote, and the
Oscar is assuredly yours.

BTW, our team at SEI works extensively, if not exclusively, with Ada.



--
Larry Howard
Software Engineering Institute, Carnegie Mellon University
lph@sei.cmu.edu, (412) 268-6397

SEI abandons Ada

[Gregory Aharonian]

    As the Ada ship continues to drift captainless on the software industry
high seas, threatening to crash and sink on the rocks of DoD mismanagement,
more and more of the rats continue to leave for a better berth.

    Case in point.  For lack of a better moment, a recent brochure from the
Software Engineering Institute is its announcement of the abandonment of Ada.
I just received the 1995 SEI Public Courses catalog, courses directed to
helping companies "improve the practice of software engineering".  Here is
the list of courses:

		Software: profit through process improvement
		Introduction to the Capability Maturity Model
		Defining software processes
		Managing technological change
		Software risk management
		Risk identification and analysis
		Managing software development with metrics
		Engineering an effective software measurement program
		Consulting skills workshop
		Software quality improvement
		CBA lead assessor training
		CMM-based appraisal for internal process improvement
		Instructor training for PSP


Where the hell is Ada?  No courses on Ada's role in software engineering
practices, no mention of Ada in the SEI brochure, nothing, nothing, nothing.
I am sick and tired of all of the recipients of DoD Ada largesse abandoning
the language for greener pastures as the pork dries up, and they have to
start spending their OWN money on Ada as a business.

Besides which, why does this country need a government funded entity like
the SEI offering these courses?  There are enough commercial BUSINESSES
offering software engineering training.  If the SEI wants to be a business,
fine, let's cut off all government funding and make them compete with their
OWN money, especially if the SEI is abandoning Ada, as many of its recent
actions seem to indicate.

Greg Aharonian

Re: SEI abandons Ada

[Dave Marshall]

srctran@world.std.com (Gregory Aharonian) writes:

>    Case in point.  For lack of a better moment, a recent brochure from the
>Software Engineering Institute is its announcement of the abandonment of Ada.
Your powers on insight are truly remarkable.

>I just received the 1995 SEI Public Courses catalog, courses directed to
>helping companies "improve the practice of software engineering".  Here is
>the list of courses:

[list of courses deleted]

>Where the hell is Ada?  No courses on Ada's role in software engineering
>practices, no mention of Ada in the SEI brochure, nothing, nothing, nothing.
Where the hell is anything else?  Your article could just as easily been 
titled "SEI Abandons C," "SEI Embraces COBOL," "SEI Abandons Every 
Language Except Ada," or whatever silly title one cares to choos.

>Besides which, why does this country need a government funded entity like
>the SEI offering these courses?  There are enough commercial BUSINESSES
>offering software engineering training.  If the SEI wants to be a business,
>fine, let's cut off all government funding and make them compete with their
>OWN money, especially if the SEI is abandoning Ada, as many of its recent
>actions seem to indicate.

Perhaps you might convince one or two people if you offered more than a 
brochure as evidence that the SEI is abandoning Ada.

-- 
Dave Marshall
dmarshal@netcom.com

Re: SEI abandons Ada

[David Weller]

In article <1995Apr5.154046.9325@sei.cmu.edu>,
Anthony Gargaro <abg@sei.cmu.edu> wrote:
>
>In addition to Gary's team, the SEI ASM team is revising the existing Ada 83
>Object Connection Architecture mapping to use Ada.
>

In addition to Raj's, Larry's, Gary's, and Anthony's team, I also
found Greg's post annoying. :-)

(Oh, yeah, I'm using GNAT too :-)
(For a real-time thingy also :-) :-)
(But not for/with the SEI...yet :-)


-- 
      Frustrated with C, C++, Pascal, Fortran?  Ada95 _might_ be for you!
	  For all sorts of interesting Ada95 tidbits, run the command:
"finger dweller@starbase.neosoft.com | more" (or e-mail with "finger" as subj.)
		if u cn rd ths, u r gd enuf to chg to Ada   :-)

Re: SEI abandons Ada

[Ragunathan Rajkumar]

In article <1995Apr3.144201.25942@sei.cmu.edu>, lph@sei.cmu.edu (Larry Howard) writes:
|> 
|> In article <D6Gqsw.9o8@world.std.com>, srctran@world.std.com
|> (Gregory Aharonian) writes:
|> 
|> [yet another missive designed to win friends and influence people]
|> ...
|> BTW, our team at SEI works extensively, if not exclusively, with Ada.

In addition to Larry's team, our SEI team looking at dependable real-time
systems is currently using GNAT on a POSIX-compliant COTS real-time OS.  This
is being done with generous help from the GNAT NYU and Florida State folks,
thanks!  GNAT compiled code is already up and running on our x86-based
distributed testbed, and our plans include significant steps to follow up on
this front.

Sorry if this disrupts somebody's misconceptions!

---
Raj




------------------------------------------------------------------------------
Ragunathan (Raj) Rajkumar				 Phone: (412) 268-8707
Software Engineering Institute				 Fax:   (412) 268-5758
Carnegie Mellon University				 Email: rr@sei.cmu.edu

Re: SEI abandons Ada

[Gary Chastek]

In article <1995Apr5.120908.12482@sei.cmu.edu>, rr@sei.cmu.edu (Ragunathan Rajkumar) writes:
|> 
|> In article <1995Apr3.144201.25942@sei.cmu.edu>, lph@sei.cmu.edu (Larry Howard) writes:
|> |> 
|> |> In article <D6Gqsw.9o8@world.std.com>, srctran@world.std.com
|> |> (Gregory Aharonian) writes:
|> |> 
|> |> [yet another missive designed to win friends and influence people]
|> |> ...
|> |> BTW, our team at SEI works extensively, if not exclusively, with Ada.
|> 
|> In addition to Larry's team, our SEI team looking at dependable real-time
|> systems is currently using GNAT on a POSIX-compliant COTS real-time OS.  This
|> is being done with generous help from the GNAT NYU and Florida State folks,
|> thanks!  GNAT compiled code is already up and running on our x86-based
|> distributed testbed, and our plans include significant steps to follow up on
|> this front.
|> 
|> Sorry if this disrupts somebody's misconceptions!
|> 
|> ---
|> Raj

In addition to Raj's team, our SEI team is working an a preliminary Ada 
95 binding for POSIX.21, Real-Time Distributed Systems Communications.
We also are currently using GNAT.

Re: SEI abandons Ada

[Anthony Gargaro]

In article <1995Apr5.152551.7763@sei.cmu.edu>, gjc@sei.cmu.edu (Gary Chastek) writes:

|> 
|> In addition to Raj's team, our SEI team is working an a preliminary Ada 
|> 95 binding for POSIX.21, Real-Time Distributed Systems Communications.
|> We also are currently using GNAT.

In addition to Gary's team, the SEI ASM team is revising the existing Ada 83
Object Connection Architecture mapping to use Ada.


\"""/ -- Anthony Gargaro                 E-Mail: abg@sei.cmu.edu -- \"""/
(###) -- SEI Resident Affiliate          Tel No: 1 412.268.5780  -- (###)
~`|'~ -- Computer Sciences Corporation   Fax No: 1 412.268.5758  -- ~`|'~

Re: SEI abandons Ada

[Gregory Aharonian]

>Perhaps Greg answers his own question.  Could it be that the absence of SEI
>Ada courseware might signal the presence of a ready supply in the commercial
>marketplace?  Of course not.  Such an explanation would tend to cast doubts
>on Greg's conspiracy theories and possibly threaten his Great Hope--namely,
>delivering the performance of a lifetime as the Woman Scorned in
>Ada: The Movie.

Larry,
	Your illogic reflects the illogic governing the rest of Ada policy.
You say SEI is not offering an Ada course because the private sector is
already offering Ada courses, so why duplicate?  Well if SEI really believed
that lie, it would also argue that the private sector is already offering
most of the other courses listed, so SEI shouldn't be offering them either.
But since SEI is offering courses that the private sector is offering, it
should also offer a course about Ada's superior role in software engineering.
Therefore the exclusion of Ada by SEI is a meaningful signal that the SEI
is less and less interested in Ada.
	After all, this reflects signals like when your boss co-authored
the Defense Science Board report on computing in the DoD, a report which
was almost completely silent on Ada even though the Mandate in theory
should affect all aspects of the SEI.
	Face it, just like all of the other porkers, the SEI is following the
commercial instincts of IBM and distancing yourself further and further from
Ada.  And given that SEI does little that the private sector isn't already
doing a hundred-fold more in scope, explain why this country should continue
to dump taxdollars into the SEI?  If what you are doing is of relevance to
anyone, then you, like the STARS program, should be able to earn your money
on the open market.  If not, then why should we waste tax dollars on it.
Maybe if you publicly were evangelizing Ada I could see it, otherwise not.

	I don't offer conspiracy theories, which you assert, but greed
theories.  A lot of contractors got tons of money from the DoD to say they
liked Ada, knowing that the DoD would be unable to effectively manage Ada
policies and be unable to do anything to the contractors when they abandoned
the language as the pork ran out.   I regret that these contractors didn't
want to apply these commercial exploitation skills to helping Ada, instead
of trough dollars.

	So your excuses for SEI's not offering an Ada course don't hold up.
Any such excuse would apply equally as well to the other courses, which SEI
is offering.  Why?  Because the SEI wants to come off as a software engineering
guru kind of place, and you can do that (based on Ada contractor behavior)
by publicly associating yourself with Ada.

Greg Aharonian

Re: SEI abandons Ada

[Larry Howard]

In article <3lvkjk$7hm@hops.entertain.com> cjames@hops.entertain.com
(Colin James III) writes:
>In article <1995Apr3.144201.25942@sei.cmu.edu>,
>Larry Howard <lph@sei.cmu.edu> wrote:
>>
>>BTW, our team at SEI works extensively, if not exclusively, with Ada.
>
>And Larry, what might that team be: trivial ?  Please educate us.
>

Our team addresses architectural designs for real-time simulation, especially
in training applications such as flight simulators.  The work is known to many
by the name of the architectural device we employ, namely structural models.
The work is distinguished by a collaborative approach within this engineering
community, where contractors, government, and vendors have worked together to
address community-wide engineering problems.  It has been generously supported
by the USAF Program Office for Simulators and Trainers (ASC/YW), and would not
have happened without the continued effective leadership of Mr. Bill Schelker
at WPAFB, who we humbly thank.

--
Larry Howard
Software Engineering Institute, Carnegie Mellon University
lph@sei.cmu.edu, (412) 268-6397

Re: SEI abandons Ada

[Garlington KE]

Larry Howard (lph@sei.cmu.edu) wrote:
: Our team addresses architectural designs for real-time simulation, especially
: in training applications such as flight simulators.  The work is known to many
: by the name of the architectural device we employ, namely structural models.
: The work is distinguished by a collaborative approach within this engineering
: community, where contractors, government, and vendors have worked together to
: address community-wide engineering problems.  It has been generously supported
: by the USAF Program Office for Simulators and Trainers (ASC/YW), and would not
: have happened without the continued effective leadership of Mr. Bill Schelker
: at WPAFB, who we humbly thank.

And, in case anyone sees this as just another wasted academic study, this
work has been incorporated into some of the ground-based Ada software for the
F-22.

--------------------------------------------------------------------
Ken Garlington                  GarlingtonKE@lfwc.lockheed.com
F-22 Computer Resources         Lockheed Fort Worth Co.

If LFWC or the F-22 program has any opinions, they aren't telling me.

Re: SEI abandons Ada

[David Weller]

In article <3m1m3q$550@butch.lmsc.lockheed.com>,
Garlington KE <l107353@cliffy.lfwc.lockheed.com> wrote:
>Larry Howard (lph@sei.cmu.edu) wrote:
>: Our team addresses architectural designs for real-time simulation, especially
>: in training applications such as flight simulators.  The work is known to many
>: by the name of the architectural device we employ, namely structural models.
>
>And, in case anyone sees this as just another wasted academic study, this
>work has been incorporated into some of the ground-based Ada software for the
>F-22.
>
It is also the framework for several other simulators.  Many
companies use the Structural Model: Boeing, Hughes, Lockheed,
Link^H^H^H^HHughes, Loral, etc.

It is a very interesting framework that exhibits tremendous reuse
potential.  Lord knows it makes integration a snap compared to the
"old ways".  It is without a doubt that the Structural Model (first
documented by the Air Force's ASC/YW) has saved millions of dollars
across several projects.

IMHO, it is the first example of a successfully applied "pattern"
that seems to be such a hot topic in the OO community (the Structural
Model goes back to around 1982).

-- 
      Frustrated with C, C++, Pascal, Fortran?  Ada95 _might_ be for you!
	  For all sorts of interesting Ada95 tidbits, run the command:
"finger dweller@starbase.neosoft.com | more" (or e-mail with "finger" as subj.)
		if u cn rd ths, u r gd enuf to chg to Ada   :-)

Re: SEI abandons Ada

[Robert Dewar]

"Sorry if this disrupts someones misconceptions"

I understand why you might be concerned over this, but don't worry, there
is no possibility that your facts will disrupt these misconceptions :-)

Re: SEI abandons Ada

[Robert Dewar]

"Your illogic reflects"

Now there's a word that isn't even in the second edition of the OED :-)