We have it on good authority that Ada is widely used for "safety critical software" on at least the US side of the International Space Station.
Of all the possible languages to choose from, what are the aspects of Ada that make made it NASA's choice for such a critical application? What might be the weighting between legacy reasons versus intrinsic suitability?
This Wikibooks link lists its strong points, some of which are:
- An extremely strong, static and safe type system, which allows the programmer to construct powerful abstractions that reflect the real world, and allows the compiler to detect many logic faults before they become errors.
- Modularity, whereby the compiler directly manages the construction of very large software systems from sources.
- Information hiding; the language separates interfaces from implementation, and provides fine-grained control over visibility.
- Readability, which helps programmers review and verify code. Ada favours the reader of the program over the writer, because a program is written once but read many times. For example, the syntax bans all ambiguous constructs, so there are no surprises, in accordance with the Tao of Programming's Law of Least Astonishment. (Some Ada programmers are reluctant to talk about source code which is often cryptic; they prefer program text which is close to English prose.)
- Portability: the language definition allows compilers to differ only in a few controlled ways, and otherwise defines the semantics of programs very precisely; as a result, Ada source text is very portable across compilers and across target hardware platforms. Most often, the program can be recompiled without any changes.
- Standardisation: standards have been a goal and a prominent feature ever since the design of the language in the late 1970s. The first standard was published in 1980, just 3 years after design commenced. Ada compilers all support exactly the same language; the only dialect, SPARK, is merely an annotated subset and can be compiled with an Ada compiler.
The point of readability is an important one, as the life of a software product doesn't end when you finish coding/testing it. The biggest expense (in time and money) is in the maintenance of that product. So, for a long project as the ISS, using a language built to aid in that task, by minimiZing errors and general ambiguity, seems appropiate.
This answer compares it with C and C++:
Ada has a number of safety features built into the language. (Compare with C, where the standard has twelve pages that summarize the undefined behaviors built into the language. Compare with C++, where the undefined behaviors are so numerous that they don't even list them.) Those Ada safety features can have a significant performance cost, and because of this, Ada also supplies the ability to selectively disable those safety features.
Note that is possible to reach the same level of security with C or C++, if you use a subset of the C or C++ languages and commiting to a style guide, but in Ada it comes with the language.
EDIT (Thanks JCRM): The first link also talks about support for low-level programming:
Ada has powerful specialised features supporting low-level programming for real-time, safety-critical and embedded systems. Such features include, among others, machine code insertions, address arithmetic, low-level access to memory, control over bitwise representation of data, bit manipulations, and a well-defined, statically provable concurrent computing model called the Ravenscar Profile.
Where I work, we actually use the address arithmetic and the low-level memory features to load different configuration data without having to compile the product each time, saving a lot of time.
Timing. Ada was developed in the 1970s and 80s with the intent of replacing the plethora of languages used in the US Department of Defense's realtime systems. NASA (and also organizations from Europe) were active participants. The DoD mandated Ada for all major development in 1991. NASA did much the same. The International Space Station had been a paper concept until that time. It started to become real exactly when the Ada mandate took effect.
The DoD dropped its Ada mandate in 1997. NASA did much the same. If the ISS was built today, its flight software most likely would not be in Ada.
So why Ada? Ada was created to address a number of problems. One was the large number of languages in use at the DoD. Another was the perceived lack of safety in those languages, particularly so with respect to realtime systems and embedded systems. Ada did provide several features that were lacking in other languages.
There are many reasons Ada has become a niche language. One is that the excessive strictness and verboseness of the language get in the way of it being a general purpose language. Another problem was that the Ada community missed the boat on the transition from mainframes to minicomputers to desktop computers. The languages at the forefront of these transitions (C and C++) remain widely used. The Ada community also missed the boat on the free software movement. The first free Ada compiler didn't come out until 1995, and that release wasn't complete. By then, it was too late.
I remember taking Computer Science courses in the late 90s. The professor of CS explained to our meager group of CS majors that he was going to teach us C, rather than COBOL or Ada, because it would be more useful in general. At the time, they were the major programming languages colleges were teaching back in the day (every major university in the area with a CS degree taught one of those two). Why would they teach older languages? Because you could still get a job writing code in them. This was around the time the ISS was being built.
The reason Ada came about was because they needed mission critical software that was reliable and Ada was literally made to fit the bill. NASA still has one of the costliest software errors in history (back in the dark ages of punch cards)
A bug introduced by a punch card turned out to be one of the most expensive software bugs in history, when it led to the destruction of the Mariner 1 spacecraft in 1962 (cost in 1962 dollars: 18.5 million; cost in today's dollars: $135 million), before it could complete its mission of flying by Venus.
However, there was a fatal flaw in the software of that guidance system: when the equations that would be used to process and translate tracking data into flight instructions were encoded onto punch cards, one critical symbol was left out: an overbar or overline, often confused in ensuing years with a hyphen. The lack of that overbar, essentially, caused the guidance computer to incorrectly compensate for some otherwise normal movement in the spacecraft.
Ada's main feature is stability
With its emphasis on sound software engineering principles Ada supports the development of high-integrity applications, including those that need to be certified against safety standards such as DO-178B and security standards such as the Common Criteria. For example, strong typing means that data intended for one purpose will not be accessed via inappropriate operations; errors such as treating pointers as integers (or vice versa) are prevented. And Ada’s array bounds checking prevents buffer overrun vulnerabilities that are common in C and C++.
NASA tried to create it's own Ada-esque language called (I am not making this up) HAL/S which the Space Shuttle used and... not much else. All the ground equipment would wind up using Ada by then (standards!)
A proposal for a NASA standard ground-based version of HAL named HAL/G for "ground" was proposed, but the coming emergence of the soon to be named Ada programming language contributed to Intermetrics' lack of interest in continuing this work.
Oh, HAL/S has one other minor problem
The weakness of Hal/S is that it is readily available only when hosted on the IBM 360/370 series of mainframe computers. Intermetrics has also hosted Hal/S on the Modcomp IV and Classic, and on Data General Eclipse minicomputers. But the Modcomp implementation is used only by JPL, and the Eclipse development is no longer in use because address-space limitations reduce compile speed to around 30 lines/minute.
As such, it's not surprising that in the early 90s (when PCs were on the rise) it was much cheaper to source more standard computing devices (my bet is IBM was able to make Ada run on more standard hardware, since they were already supplying astronauts with Thinkpads round that time). Fun fact: Thinkpads running Linux are used to interface with the station computer
"It was just the applicational needs," he said, describing how the laptop software that talked to the station's command and control systems in those early days was designed to run on a Linux-based OS.
By contrast, the curiousity rover (early 2000s) ran on C
It's running 2.5 million lines of C on a RAD750 processor manufactured by BAE.
From the website:
AdaCore tools can be used to meet verification objectives including coding standard compliance, code accuracy (prevention of errors such as buffer overrun, integer overflow, and references to uninitialized variables), and structural coverage analysis up to MC/DC. Specialized high-assurance run-time libraries, including one that implements the Ravenscar tasking profile, are simple enough to be included in qualified systems but expressive enough to support the needed functionality for hard real-time space software. Qualification material for the run-time libraries can be developed for the ECSS standard and adapted to new project contexts.
C and C++ do not prevent those errors (bar costly addons), and Java is not hard real-time (bar nonstandard VMs).
When lives are on the line, it's best to rule out runtime errors and delays by design:
with Ada.Text_IO; use Ada.Text_IO;
procedure Learn is
subtype Alphabet is Character range 'A' .. 'Z';
begin
Put_Line ("Learning Ada from " & Alphabet'First & " to " & Alphabet'Last);
end Learn;
Here, Alphabet cannot contain any value other than A to Z. This rather unique language feature, among others, helped a team of students complete the 2013-2015 CubeSat mission:
As one example of Ada in an undergraduate setting, students at Vermont Technical College in the U.S. used the SPARK language (a formally analyzable subset of Ada) to develop the software for a CubeSat satellite that recently completed a successful two-year orbital mission. SPARK was chosen because of its reliability benefits. The students had no previous experience in Ada, SPARK, or formal methods, but were able to quickly come up to speed.
Of the twelve CubeSats from academic institutions that were included in the launch, the one from Vermont Tech was the only one that completed its mission. Many of the others met their doom because of software errors. The Vermont Tech group credits its success to the SPARK approach, which, for example, allowed them to formally demonstrate the absence of run-time errors.
Of all the possible languages to choose from, what are the aspects of Ada that make it NASA's choice for such a critical application? What might be the weighting between legacy reasons versus intrinsic suitability?
Ada is a language designed for this very kind of situation, i.e. fault intolerant, real-time and (often) embedded systems used to control critical equipment or processes
Ada's evolution was much more focussed and tightly managed from the very outset. Both its originators and its evaluators were handpicked experts in the language development field with a strong sense of duty to both their profession and the Ada project. Just as West Coast values permeate Java, the selfless modesty of Ichbiah, Dewar and Taft set a tone for Ada that still prevails and one that must appeal to an organization like NASA.
Ada has a formally-defined subset language called SPARK that allows ready mapping of a formally-verified system design onto its code
Ada is one of the fastest languages around, moreover with parallel processors
The Ada industry (companies like AdaCore, Altran, Green Hills, Wind River, etc, etc) has developed numerous support tools for critical system development in Ada/SPARK
There are few capable alternative languages to Ada
Alternative languages such as formally-defined C do not have the same depth of experience or support as Ada/SPARK do
I've no idea what the detailed system requirements were nor how tight the tendering guidelines were in relation to weighting of legacy and intrinsic suitability. But it seems rational to me that Ada/SPARK would score high in both categories. Legacy factors should include things like
NASA was an original sponsor of the Ada project and had used it from the outset on prior systems
System building company's likely greater familiarity with Ada/SPARK, know-how in deploying its constructs effectively for the new critical system's requirements
Likely existing use of Ada/SPARK by subcontractors, e.g. embedded systems for ancillary equipment like radar, x-ray scopes, etc, to the project and data interfacing between main and sub-systems
Ada is SGML of programming languages (and Java/C# is XML). Both are built in a new base for a complete solution. And both failed to become popular due to their complexity and oddity. (Minority knows SGML but everyone understands HTML: simplicity is strength.) We learnt Ada in '91 and loved it even we came from Modula-3 and not from junk Pascal or C. (Not even mentioning assembly.) Ada looked perfectly built in general and in details. But none of us used it because the only Ada environment was for IBM 360 (or a russian clone of it) and no Ada compiler appeared for many years for PC. And it became a "shining diamond in a glass cabinet", theoretically perfect but untouchable. We wrote code for Sieve of Eratosthenes but there were no resource to run it with log(log(10e9)) tasks. (That day they counted RAM in hundred of KBs.) Meanwhile good C++ environments came (with usable class libraries!) and most programmer used it as primary platform until Java appeared a decade later. And even there was no good development tools for Java but there were usable ones and cheap PCs can run them.
