Re: How to get Ada to ?cross the chasm??

[Niklas Holsti <niklas.holsti@tidorum.invalid>]

On 18-05-11 02:15 , Dennis Lee Bieber wrote:

   [about restrictions imposed in critical SW]

> 	Even Ada's tasking wasn't allowed -- apparently because the RTL isn't
> deterministic enough.

In my experience of such cases, the crux is usually not non-determinism, 
but the requirement to validate, or qualify, the Run-Time System. A 
"full Ada" RTS is complex, which means that it is hard and/or expensive 
to qualify for a certain target system.

> Instead, some minimal RTOS was embedded into the
> application environment and Ada procedures were activated as tasks in the
> RTOS (with defined stack sizes, priorities, etc.).

If the minimal RTOS is smaller or less complex (and of course also less 
expressive and less functional) it is also cheaper to qualify to the 
same level of trust. It may also be easier to reuse the minimal RTOS for 
different applications on different target systems, with smaller 
changes, and therefore with less effort for requalifying the RTOS for 
new target systems, spreading the qualification cost over many 
applications and users.

Several Ada compiler vendors provide simplified Ravenscar RTSes, and 
some provide even simpler and more restricted RTS versions for more 
critical applications. (I forget what these are called. I don't know of 
any standard Ada RTS profile that is more restrictive than Ravenscar, so 
the names are probably vendor-specific.)

In the space domain, it is not unusual for some highly critical SW to be 
forbidden to use any real-time kernel, forcing the SW to be 
single-threaded. This is common for any SW that resides in (true) 
read-only memory and cannot be patched in flight. Typical cases are the 
"boot SW" or some fall-back "recovery" SW that takes over when the main 
SW fails and is used only to analyse the problem and to patch the main SW.

-- 
Niklas Holsti
Tidorum Ltd
niklas holsti tidorum fi
       .      @       .