Re: How to get Ada to ?cross the chasm??

[Niklas Holsti <niklas.holsti@tidorum.invalid>]

On 18-05-12 18:45 , Dennis Lee Bieber wrote:
> On Sat, 12 May 2018 12:29:05 +0300, Niklas Holsti
> <niklas.holsti@tidorum.invalid> declaimed the following:
>
>> In my view, if your system has a UART and accumulates incoming
>> characters into a line buffer until in comes a CR to end the line, you
>> are allocating space dynamically in the buffer for each incoming
>> character. Now that is an extreme example, but I hope it shows what I am
>> driving at: in principle, if the program uses up space, when needed, in
>> any "memory" that can fill up, it is allocating that space dynamically,
>> even if this "memory" is not the system heap.
>>
>
> 	By that interpretation, any program using "static arrays" with an index
> tracking "current location" can be considered to be doing "dynamic
> allocation".

Yes, if the static array can become full in a way that prevents the 
program from continuing normally.

As I remember, this discussion started from the common prohibition of 
"dynamic memory allocation" in critical high-reliability SW.

It is probably true that the people who establish and enforce such 
prohibitions mean "dynamic allocation from the system heap", but IMO 
there is a spectrum of "dynamic memory allocation" mechanisms with 
different levels of determinism.

The spectrum starts with the system heap as the least deterministic 
mechanism, passes through "application heaps" or application-defined 
storage pools with more or less dedication to certain types of 
application objects, and ends at the level of the (admittedly extreme) 
example of the UART buffer, which is very deterministic in the sense 
that it contains exactly one type of object (an UART character), and one 
can describe, pretty easily and exactly, the case(s) in which it might 
overflow and what the program should do in those cases.

Anyway, if you are developing SW that "shall not allocate memory 
dynamically", I'm 99% certain that you will satisfy your product 
assurance group if you show that your SW contains no allocators ("new 
sometype") -- even if your SW uses its own memory pools logically 
similar to the system heap. No product assurance person would consider 
the UART buffer as a case of dynamic memory allocation.

The question that interests me is: if dynamic allocation in the system 
heap is too risky for critical SW, where in this spectrum of dynamic 
memory allocation mechanisms does that risk go away, and why? And if 
some risk remains in the mechanism that I would like to use for the SW, 
what should/must I do to defend against that risk?

-- 
Niklas Holsti
Tidorum Ltd
niklas holsti tidorum fi
       .      @       .