Teaching new tricks to an old dog (C++ -->Ada)

[Turamnvia Suouriviaskimatta]

I 'm following various posting in "comp.lang. ada, comp.lang.c++ ,
comp.realtime, comp.software-eng" groups regarding selection of a
programming language of C, C++ or Ada for safety critical real-time
applications. The majority of expert/people recommend Ada for safety
critical real-time applications. I've many years of experience in C/C++ (and
Delphi) but no Ada knowledge.

May I ask if it is too difficult to move from C/C++ to Ada?
What is the best way of learning Ada for a C/C++ programmer?

[Jim Rogers]

Ioannis Vranos <iv*@remove.thi s.grad.com> wrote in
news:1110099035 .843154@athnrd0 2:

The one remaining, does it support namespaces? :-) What subset of the
procedural paradigm it does not support?

Ada support the concept of namespaces, but there is no reserved word
"namespace" . Ada uses packages to provide encapsulation and namespace.
Packages have been part of the Ada language since its earliest version.

Packages normally appear in two parts. The package specification defines
the interface to the package. The package body contains the
implementation
of all subprograms, tasks, and protected objects declared in the
specification.

Here is a specification for a generic (aka template) package:

generic
type Target_Type is private;
Target_Size : Natural;
package Bit_Utils is
procedure Show_Bits(Item : Target_Type);
end Bit_Utils;
We know this is a generic package because of the reserved word
"generic". The two lines following "generic" define the
generic formal parameters for this package. In this case the
first parameter is a type and the second parameter is an
integer with a minimum value of 0. The package provides an
interface to a single procedure (similar to a function
returning void in C++) named Show_Bits that takes a
single parameter of the same type as the generic formal
type.

The body of this package is:

with Ada.Text_Io;
with Ada.Integer_Tex t_Io;
with System;
package body Bit_Utils is
type Bits_Array is array(Positive range <>) of Boolean;
pragma Pack(Bits_Array );

type Byte is mod 2**8;
type Byte_Array is array(Positive range <>) of Byte;
package Mod_Io is new Ada.Text_IO.Mod ular_IO(Byte);

procedure Show_Bits(Item : Target_Type) is
Bit_View : Bits_Array(1..T arget_Size);
for Bit_View'Addres s use Item'Address;
Byte_View : Byte_Array(1..T arget_Size / Byte'Size);
For Byte_View'Addre ss use Item'Address;
begin
for I in Byte_View'range loop
Mod_Io.Put(Item => Byte_View(I), Width => 4);
end loop;
Ada.Text_IO.New _Line(2);
for I in Bit_View'range loop
Ada.Integer_Tex t_Io.Put(Item => Boolean'Pos(Bit _View(I)),
Width => 1);
if I mod System.Storage_ Unit = 0 then
Ada.Text_IO.New _Line;
end if;
end loop;
end Show_Bits;
end Bit_Utils;

The first 3 lines begin with the reserved word "with".
Those lines declare a dependency upon the compilation units
following the word "with". In this case all three
compilation units are pre-defined packages.
We and the compiler know that this is a package body because
of the use of the phrase "package body" on the line 4.
This package body contains the implementation of the procedure
Show_Bits. It also contains three type definitions and the
instantiation of the generic package Ada.Text_IO.Mod ular_IO for
type Byte. Since none of these types are delcaled in the
package specification, they are invisible to any calling
entity. They are equivalent to C++ private types.

This package was used in a program with the following "main"
procedure:

with Bit_Utils;
with Ada.Text_Io;

procedure Bit_Output is
type My_Type is
record
Name : String (1 .. 4);
Age : Positive;
Weight : Long_Float;
end record;
package My_Bits is new Bit_Utils(My_Ty pe,
My_Type'Size);
package Flt_Bits is new Bit_Utils(Long_ Float,
Long_Float'Size );
Mt : My_Type := ("Jim ", 55, 0.45435);
D : Long_Float := 0.45435;
begin
Ada.Text_Io.Put _Line("Output of My_Type");
My_Bits.Show_Bi ts(Mt);
Ada.Text_Io.Put _Line("Output of Long_Float");
Flt_Bits.Show_B its(D);
end Bit_Output;

The procedure Bit_Output serves the same purpose as does
"main" in C++. Note that Bit_Output is preceeded by two
context clauses. One declares a dependency on the Bit_Utils
package and the other declares a dependency on the
Ada.Text_IO package. Ada does not use a pre-processor.

The package Bit_Utils is instantiated for two different types
inside Bit_Output. Each instantiation is given a unique name,
prividing a unique namespace.

Also I saw that under severe constraints the run-time safety of the
language is better to be switched off.

If the program has been proved to be correct without the safety elements,
and there is a sufficient performance improvement, yes you should turn
off the run-time safety elements. You have control of the elements you
want to turn of through simple pragma statements.

I do not know much on the language, but can one define general-purpose
containers with Ada's generics that do range checking and throw an
exception when there is an attempt to access outside the boundaries of
the container, even if the aforementioned run-time safety is switched
off?

Yes you can. You can always program in your own checks manually.
The drawback of doing that is that you cannot simply turn them off
with a pragma, nor can the compiler so effectively optimize those
checks out of your program when they are unneeded.

Jim Rogers

[Wouter van Ooijen]

>By way of example, someone in this thread posted an example using a

Day_of_Month type. It would never occur to a C programmer that the day of
the month was anything other than an integer.

C was the first language I used to write moderately large programs,
and I was always annoyed by the fact that the compiler could not help
me distinguish integers that represented different things. Maybe that
disqualifies me as a C programmer?
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>You can do everything in Ada that you can in C and C++. It is more

work in Ada to "force" things together than in C++. So Ada is not as
forgiving, when you have a bad design to begin with.

I am not sure I agree fully, but it sounds like a good thing: Ada as
bad-design filter!
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

> You can do everything in Ada that you can in C and C++.

Computationally speaking you can do everything in 'real' serious
language. So for the above statement to have real meaning it needs to
be much moer specific.

I suppose you mean in the application-programming domain. But I do not
think this is true in the systems programming domain, that is
efficiency under *severe* run-time and space constraints.
No problem with Ada.
Also I am not sure if ADA is suitable for library writing, or you will
have to switch to another language to do that.

I don't see why you would want to use another language?
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>Out of curiosiy, could you give some few examples where Ada catches faults

not found by a C++ compiler. I assume - of course - code written in modern
C++: no casts, functions instead of macroes, a limited use of pointers and
so on.

Your 'of course' requires some tool (preferrably automated) that
ensures that only the 'safe' subset of C++ is used. In effect this
creates a new language.
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>My conclusion is that there are some nice ideas out there, but that they

mainly protect against the "sloppy" programmer.

You are absolutely right.

The point that you are probably missing is that *everyone* is a sloppy
programmer every once in a while. The frequency of this sloppiness of
course varies, but it is never zero. So every sloppy mistake caught by
the compiler is a good thing.
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>Once again, I have nothing against learning Ada, however personally I

like the most powerful languages. The next thing I am going to learn
after C++ (because I haven't learned it all yet), is probably some form
of assembly language.

If you want to realy broaden your perspective I would suggest
something in the lazy-functional field like Haskell.
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>> What other mechanism would you suggest?

Termination of the program. Some might argue that they can't tolerate such
an event. But can such an environment tolerate a faulty running program?

Imagine a space rocket 1 second after launch. Terminating the control
program means the rocket will probably topple and destroy the launch
site. And exception raised + caught can try to use and alternative
algorithm, or any other means to continue as best as possible.

Note: the first Ariane 5 launch was a failure roughly because the
(Ada!) code was (out of necessity) written without exception handling.
(The real story is a bit longer, and explains that this was *not* a
software failure - it was a mangagement misjudgement).
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>Ada can teach C++ how to do templates properly.

I am definitely an Ada fan, but C++ templates are much much more
powerfull. AFAIK C++ is the only language in which you can create a
'unit' based type system that is almost fully compile-time checked.
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics

[Wouter van Ooijen]

>In my book that was a management bug - If the managers had ordered to run

the testsuite only once the problem would have shown. The hardware was so
incompatible it would have failed all the time.
I assume you do know that it was not the computer hardware but the
phyiscal paremeters (acceleration) of the rocket itself?
Last not least: Runtime check where disabled for that incident. So if
anything: this incident speak in favor of runtime checks.

They were disabled in the Ariane 4 software after it was *proven* that
the exceptions could simply not occur on an Ariane 4. If the runtime
checks were not disabled the software would not fit so the rocket
would not fly. I am not sure that's the preferrable alternative.

If this accident speaks for anything IMHO it speaks for sensible
management. Which is apparently a problem on both sides of the ocean
:(
Wouter van Ooijen

-- ------------------------------------
http://www.voti.nl
Webshop for PICs and other electronics
http://www.voti.nl/hvu
Teacher electronics and informatics