+ All Categories
Home > Technology > Developing Software That Matters I

Developing Software That Matters I

Date post: 25-Jan-2015
Category:
Upload: gneuromante-canaladaorg
View: 875 times
Download: 1 times
Share this document with a friend
Description:
 
72
© ACT Europe under the GNU Free Documentation License Developing Software that Matters Franco Gasperoni [email protected] http://libre.act-europe.fr/Software_Matters
Transcript
Page 1: Developing Software That Matters I

© ACT Europe under the GNU Free Documentation License

Developing Software that Matters

Franco [email protected]

http://libre.act-europe.fr/Software_Matters

Page 2: Developing Software That Matters I

2http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Course Home page

►►http://http://librelibre.act.act--europeeurope..frfr/Software_Matters/Software_Matters•• All the course slides are there (PDF and PowerPoint)All the course slides are there (PDF and PowerPoint)

Page 3: Developing Software That Matters I

3http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Copyright Notice

►© ACT Europe under the GNU Free Documentation License

►Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; provided its original author is mentioned and the link to http://libre.act-europe.fr/ is kept at the bottom of every non-title slide. A copy of the license is included in available at:

http://www.fsf.org/licenses/fdl.html

Page 4: Developing Software That Matters I

4http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Course Objectives

►► Help you build software Help you build software systems that are more:systems that are more:

•• DependableDependable•• AdaptableAdaptable•• Fun to developFun to develop

►► Comparing ways to Comparing ways to structure softwarestructure software

•• FunctionalityFunctionality--orientedoriented•• ObjectObject--orientedoriented•• Structural problems Structural problems

with both approacheswith both approaches

►► Show problems & pitfalls in Show problems & pitfalls in CC--derived languagesderived languages

•• C, C++, JavaC, C++, Java

►► Show how Ada 95 addresses these issuesShow how Ada 95 addresses these issues•• Engineering principles we can take from Engineering principles we can take from

Ada and apply in other languagesAda and apply in other languages

Page 5: Developing Software That Matters I

5http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Interesting Links► http://www.fsf.org

• The site of the GNU project and the Free Software Foundation► http://libre.act-europe.fr

• Interesting Free Software projects written in Ada 95► http://www.adahome.com/Tutorials/Lovelace/lovelace.htm

• Lovelace, on line Ada 95 tutorial► http://archive.adaic.com/docs/reports/cada/cada_art.html

• Comparing Development Costs of C and Ada► http://www.eiffel.com/

• The official site of the Eiffel programming language► http://www.misra.org.uk/misra-c.htm

• Guidelines for the Use of the C Language in Vehicle Based Software► http://www.elj.com/cppcv3/

• A critique of C++► http://www.cs.mdx.ac.uk/harold/srf/javaspae.html

• A critique of Java► http://www.web-hits.org/txt/codingunmaintainable.html

• How to write unmaintainable code

Page 6: Developing Software That Matters I

6http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Interesting Books

► Programming in Ada 95, by John Barnes (Addison Wesley)

► High Integrity Ada: The SPARK Approach, by John Barnes (Addison Wesley)

► Object-Oriented Software Construction, by Bertrand Meyer (Prentice Hall)

► Objects Unencapsulated: Java, Eiffel, and C++, by Ian Joyner (Prentice Hall)

► Extreme Programming Explained, by Kent Beck (Addison Wesley)

► C Traps and Pitfalls, by Andrew Koenig (Addison Wesley)

► Effective C++, by Scott Myers (Addison Wesley)

► Java Pitfalls, by Michael C. Daconta et al., (Wiley)

Page 7: Developing Software That Matters I

7http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Course Assumptions

►You are interested in the field of software development

►You have written computer programs in at least one imperative languages• E.g. Ada, C, C++, Eiffel, Fortran, Java, Pascal, …

►Have a basic knowledge of C• … for the section on problems & pitfalls in C-related languages

Page 8: Developing Software That Matters I

© ACT Europe under the GNU Free Documentation License

Background onSoftware Construction Processes

Page 9: Developing Software That Matters I

9http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Your Software Development Experience

►What is the largest software system that you have built?

►How did you build it?• What process?• What programming language?• What tools?• Did you use version control tools?

►How long will the software be used for?• Who will fix, change, or adapt the software that you wrote?

Page 10: Developing Software That Matters I

10http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Development PhasesRequirementsRequirements

What needs to be doneWhat needs to be done

AnalysisAnalysisHow it should be doneHow it should be done

DesignDesignCreate a software structure Create a software structure (architecture) around which (architecture) around which code will be built code will be built

CodingCodingFill in the software Fill in the software structure with codestructure with code

TestingTestingCheck that the code does what Check that the code does what it is supposed to (functionality, it is supposed to (functionality, performance, reliability, …)performance, reliability, …)

Project ManagementProject ManagementDevise a plan,Devise a plan, manage manage resources, costs, time, …resources, costs, time, …

Page 11: Developing Software That Matters I

11http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Processes

►A Software Process is• A set of activities (e.g. requirements, analysis, design, coding, testing)

combined and sequenced in a particular fashion to produce software

►Recent trend: Agile Software Development• Customer needs evolve with time• Satisfying customers at delivery time (rather than at project initiation)

is more important than conforming to initial customer requirements

Page 12: Developing Software That Matters I

12http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Example of Software Processes

RequirementsRequirements

AnalysisAnalysis

DesignDesign

CodingCoding

TestingTesting

Time

RequirementsRequirements

AnalysisAnalysis

DesignDesign

CodingCoding

TestingTesting

RequirementsRequirements

AnalysisAnalysis

DesignDesign

CodingCoding

TestingTesting

RequirementsRequirements

AnalysisAnalysis

DesignDesign

CodingCoding

TestingTesting

Scope (customer needs)

Requ

ireme

ntsAn

alysis

Desig

nCo

ding

Testi

ngRe

quire

ments

Analy

sisDe

sign

Codin

gTe

sting

Requ

ireme

ntsAn

alysis

Desig

nCo

ding

Testi

ngRe

quire

ments

Analy

sisDe

sign

Codin

gTe

sting

Requ

ireme

ntsAn

alysis

Desig

nCo

ding

Testi

ngRe

quire

ments

Analy

sisDe

sign

Codin

gTe

sting

Waterfall Iterative eXtreme Programming (XP)

Page 13: Developing Software That Matters I

13http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Phases Related to this Course

DesignDesignCreate a software structure Create a software structure (architecture) around which (architecture) around which code will be built code will be built

CodingCodingFill in the software Fill in the software structure with codestructure with code

TestingTestingCheck that the code does what Check that the code does what it is supposed to (functionality, it is supposed to (functionality, performance, reliability, …)performance, reliability, …)

Page 14: Developing Software That Matters I

© ACT Europe under the GNU Free Documentation License

Software Dependability

Page 15: Developing Software That Matters I

15http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Dependability

Degree of user confidencethat the system will operate as expected

and it will not fail in normal use

Page 16: Developing Software That Matters I

16http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Page 17: Developing Software That Matters I

17http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Page 18: Developing Software That Matters I

18http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

The Blue Screen of Death (BSOD)

Page 19: Developing Software That Matters I

19http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

More BSOD Embarrassments

Page 20: Developing Software That Matters I

20http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Does Software Dependability Matter?

►Certainly at the marketing level ☺☺☺☺• No vendor would say its software is undependable• No team would say it produces undependable software

► In practice there is plenty of software you cannot depend on

►Not all software needs to be dependable

►Useful but not very dependable software can be OK • If this machine crashes while doing this presentation I will reboot• If your word processor crashes while you write an important

document there is no harm if you save your document frequently

Page 21: Developing Software That Matters I

21http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Dependability

►Dependability Usability• E.g. word processor

=/

Dimensions ofDependabilityDimensions ofDimensions ofDependabilityDependability

Availability Reliability Safety Security

Ability of the system to deliver service when requested

Ability of the system to deliver correct

results

Ability of the system to operate without catastrophic failure

Ability of the system to protect itself

against intrusions

Can be measured with defect rates Expressed in terms of integrity levels

Page 22: Developing Software That Matters I

22http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Warning about Defect Rates

►1 document/year lost while word-processing• Great ☺

►2 accidents/month at the International Airport in London•

►22,000 checks/hour drawn from the wrong account in the US•

►1 document/year lost while word-processing• Great ☺

►2 accidents/month at the International Airport in London•

►22,000 checks/hour drawn from the wrong account in the US•

Is a defect rate of 99.9% acceptable? It depends…

Analyze software defect rates in the context of the applicationAnalyze software defect rates in the context of the application

Page 23: Developing Software That Matters I

23http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Failures: Availability

►Denial-of-service attacks• Example: attack against GRC.com

- Attacked by 195 Windows 2000 servers running insecure versions of Microsoft's IIS web server. IIS was the apparent point of hacker entry into the system.

Page 24: Developing Software That Matters I

24http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Failures: Reliability

► January 15, 1990: 9 hour nation-wide telecom shutdown• 1 month earlier ATT updated its software in 114 switching stations• Cause: 1 misplaced “break” statement in a C program

► January 2001: 230,000 units new Internet-enabled mobile phone recalled• Users reported that their phones were freezing after accessing certain Web sites,

and when they were powered back on, all stored information (addresses, e-mails, bookmarks, memos) had been lost

► Matracom 6500 PABX (telephone switch)• Random phone messages are garbled• Long phone calls are cut

► Windows 95/98/ME/2000• September 1997: propulsion system of the USS Yorktown ship failed

- Cause: Windows NT 4.0 crashed• An amusing story: Installed an HP scanner on a SONY VAIO with Windows 2000.

Now machine cannot enter suspend mode and when it tries the screen disappears until powered-off (with loss of work )

Page 25: Developing Software That Matters I

25http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Failures: Safety

►1986: Therac 25 radiation machine kills several patients• Cause: poor testing of the software

►June 4, 1996: 1st flight of Ariane 5 aborted: Ariane 5 destroyed• Cause: Code from Ariane 4 guidance system was reused in Ariane 5

but not tested.

►2000: Deadly accident in French highway• Cause: Software malfunction in car braking system. Car manufacturer

acknowledges responsibility.

Page 26: Developing Software That Matters I

26http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Failures: Security

►November 2, 1988 Internet Worm• A self-replicating program was released upon the Internet• This program (a worm) invaded VAX and Sun computers running

versions of Berkeley UNIX, and used their resources to attack still more computers.

• Within the space of hours this program had spread across the U.S., infecting thousands of computers and making many of them unusable due to the burden of its activity.

• Cause: undetected buffer overflow in C routine gets()

►Many interesting virus stories especially on Windows

Page 27: Developing Software That Matters I

27http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

… And 30% of Software ProjectsDon’t Even Get to That Stage

►US Internal Revenue Service Modernization• $4 Billion, dropped in early 1997

►FBI Fingerprint system• $500 million, dropped

►Bell Atlantic 411• Nov 1996, outage, backed out of upgrade

Page 28: Developing Software That Matters I

28http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software & Safety Criticality

►Business-critical• Software failure may result in the business

shutting down• E.g. Bank trading system

►Mission-critical• Software failure may result in mission failure• E.g. Pathfinder on Mars

►Safety-critical• Software failure may result in injury, loss of life or

major environmental damage• E.g. Plane

Page 29: Developing Software That Matters I

29http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Safety Critical Levels

Several standards

►RTCA/EUROCAE DO-178B• The international avionics standard for safety critical software

► IEC 880• Standard for software in nuclear power stations

► IEC61508 / DEF STAN 00-55/56• European safety standards

►Development Guidelines for Vehicle Based Software• Safety standard promoted by the Motor Industry Software Reliability

Association (MISRA)►…

Page 30: Developing Software That Matters I

30http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

DO-178B Software Criticality LevelsConsequences of Software FailingCriticality LevelCriticality Level

Catastrophic (Level A products tell the cockpit crew where they are and keep them from flying into the ground, e.g. flight control systems, air data systems, some displays. )

Level ALevel A

No Effect (Level E system: entertainment system)Level ELevel E

Minor(Level D system: pilot override of the entertainment system)Level DLevel D

Major(Level C systems: communication & data link management)Level CLevel C

Hazardous/Severe-Major(Level B systems: traffic alert & collision avoidance)Level BLevel B

Page 31: Developing Software That Matters I

31http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

IEC61508 Safety-Complexity-Integrity Levels (SCIL)

Consequences of Software FailingSCIL LevelSCIL Level

Death of one or more persons, significant financial loss (Areas: flight-critical aerospace, life-critical medical systems, transport control systems, hazardous process control systems, automotive breaking systems)

SCIL 4SCIL 4

No inconvenience(Areas: student project, research)SCIL 1SCIL 1

Inconvenience or disappointment to the public(Areas: small consumer goods, point of sale equipmt.)SCIL 2SCIL 2

Serious injury or financial loss(Areas: automotive engine management)SCIL 3SCIL 3

Page 32: Developing Software That Matters I

32http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

MISRA Integrity Levels

Reasonably Reasonably possiblepossible

UnlikelyUnlikely

RemoteRemote

Very remoteVery remote

Extremely Extremely improbableimprobable

Acceptable Acceptable Failure RateFailure Rate

Nuisance OnlyNuisance Only

DistractingDistracting

DebilitatingDebilitating

Difficult to controlDifficult to control

UncontrollableUncontrollable

Controllability by Controllability by vehicle occupantsvehicle occupants Examples of Software FailureIntegrity Integrity

LevelLevel

Loss of power assisted steering44

Radio/CD system failing00

Electrical window system failure11

Windshield wiping system failure22

Braking system failure33

Page 33: Developing Software That Matters I

33http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Security Levels

►TCSEC (Orange Book)• Trusted Computer Security Evaluation Criteria

►Common Criteria For Information Technology Security Evaluation (ISO/IEC 15408-1)• Evaluation criteria for IT security• 7 security levels

Page 34: Developing Software That Matters I

34http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Evaluation Assurance Levels (EALs)

Structurally testedEAL2

Methodically tested and checkedEAL3

Methodically Designed, Tested & ReviewedEAL4

Semi formally Designed & TestedEAL5

Semi formally Verified Design & TestedEAL6

Formally Verified Design & TestedEAL7

Functionally testedEAL1

Constraints on the Software DevelopedEAL

Page 35: Developing Software That Matters I

© ACT Europe under the GNU Free Documentation License

Software Evolution

Page 36: Developing Software That Matters I

36http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Needs to Evolve

►Bug Fixes

►Port to new architectures• Software lasts for a long time

- E.g. Y2K problem• Most useful software outlives the hardware it was designed to run on

- E.g. VAX/VMS• When new hardware becomes available it’s cheaper to port existing

applications than rewrite everything from scratch- E.g. Intel IA-64

►Enhancements & new features• E.g. Dos, Windows 3.1, Windows 95/98/ME, Windows NT/2000/XP

Page 37: Developing Software That Matters I

37http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Investment Costs in 2001

►Typical software productivity is:• Between 2 and 20 lines of working code (LOC) per programmer per day

►Average cost of a programmer per day (loaded with all costs):• Between 150 and 500 USD/day

►Average cost to write a line of code (LOC)• Between 10 and 50 USD

►Cost to develop a 100,000 LOC application• Typically between 1 M USD to 5 M USD

Page 38: Developing Software That Matters I

38http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Evolution is a Must

► You cannot just throw away software and redo it• Cost is one thing• But time-to-market is usually even more important

► Your software might not need to be very dependable, but…

► … it must be capable to evolve• In a timely fashion• At a reasonable cost

► Examples• The GNU Ada/C/C++ compiler is approx 1 M LOC• Emacs editor is approx 1.4 M LOC• GNU/Linux is approx 4 M LOC

Page 39: Developing Software That Matters I

39http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Trend

New software is increasingly developedby extending and modifying existing systems

Page 40: Developing Software That Matters I

40http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Summary

Depending on your application domain

►Some or all of the software dependability parameters are probably important• availability, reliability, safety, security

►… but in almost all cases

software evolution is fundamental

Page 41: Developing Software That Matters I

© ACT Europe under the GNU Free Documentation License

Programming Languages

Page 42: Developing Software That Matters I

42http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

The Construction Analogy*

Development tools:•Editor, compiler, debugger•Config. mgmt, testing tools,…

Tools

•Programming languages•Libraries•Reusable components

Materials

Analysis & design documents(e.g. UML diagrams)

Architecturaldrawings

Software ConstructionBuilding Construction

Class1

Class2 Class3«uses»

*Analogy from Tucker Taft invited talk at the Tools USA 99 conferencehttp://www.tools-conferences.com/usa_99/keynotes.html#taft

Page 43: Developing Software That Matters I

43http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Software Phases Affected by the P.L.

DesignDesignCreate a software structure Create a software structure (architecture) around which (architecture) around which code will be built code will be built

CodingCodingFill in the software Fill in the software structure with codestructure with code

Testing (Unit Testing)Testing (Unit Testing)Check that the code does what Check that the code does what it is supposed to (functionality, it is supposed to (functionality, performance, reliability, …)performance, reliability, …)

Page 44: Developing Software That Matters I

44http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Importance of Tools’ & Materials’ Quality

Imagine working with a compiler that crashes every 3 compilations or that generates executables that run very slowly

Imagine using a hammer whose head flies off if you do not hit the nails perfectly

Imagine using a graphics library where 1 in 4 routines has a bug

Imagine building a wall where 1 in ever 4 bricks breaks when you place it on the wall

Imagine programming with a language which accepts everything that you type and tries to guess what to do

Imagine nailing wooden panels where nails bent if you do not hit them perfectly in their axis

Software ConstructionBuilding Construction

Page 45: Developing Software That Matters I

45http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

The Programming Language Matters

►A “good” programming language helps you build software that is:• Reliable• Safe• Secure• Evolvable

A good programming language will make your life easier. It will NOT do the job for you.

Page 46: Developing Software That Matters I

46http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

►A “poor” programming language will make it harder to build software that is:• Reliable• Safe• Secure• Evolvable

It is possible to write good software with a poor language. It will require more experienced engineers.In any event it will take longer and will be more COSTLY than with a good language.

Page 47: Developing Software That Matters I

47http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Facts of Life in Software Construction

Human FactorsAffecting Programming

► Humans make mistakes

► People move on• The code authors are not the

ones that will fix bugs, port or add new features to the software

► Software evolves constantly

Properties of a Good Programming language

► Make it harder to write incorrect code

► Support abstraction

► Help write readable code

► Support modular software organization

► Portable

Page 48: Developing Software That Matters I

48http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Why?

Software evolves constantly. You must deliver software to your clients before it is actually finished (important to have feedback). Furthermore, once delivered you have to correct bugs, and add new features.

Support modular software organization

Software evolves constantly. You must port it to new hardware.Portable

Humans make mistakes. Especially programmers who are constantly submersed with work.

Make it harder to write incorrect code

People move on. Especially programmers. To preserve your software investment other people must be able to understand the code quickly.

Help write readable code

Humans make mistakes & People move on. Be able to write a program at a conceptual level close to the application domain. This makes the code easier to write & understand.

Support abstraction

ExplanationRequirement for a GoodProgramming Language

Page 49: Developing Software That Matters I

49http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

A Programming Example

►Can you tell in less than 20 seconds whether the following 3 routines in the following 3 programming languages do the following correctly:

►Return the n-bit field of a 32 bit word from • Bit position p• To bit position p-n+1

►Bit position 0 is at the right end

………Bit0

………Bit

p-n+1…………

Bit p

Bit 31

n bits

Page 50: Developing Software That Matters I

50http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Pentium Assembly Language_getbits:

pushl %ebpmovl %esp,%ebppushl %ebxmovl 16(%ebp),%ebxmovl 12(%ebp),%eaxsubl %ebx,%eaxincl %eaxmovl 8(%ebp),%edxmovl %eax,%ecxshrl %cl,%edxmovl $-1,%eaxmovl %ebx,%ecxsall %cl,%eaxmovl -4(%ebp),%ebxnotl %eaxmovl %ebp,%espandl %edx,%eaxpopl %ebpret

Page 51: Developing Software That Matters I

51http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

C

unsigned get_bits (unsigned x, int p, int n) {return (x >> (p-n+1)) & ~(~0 << n);

}

Page 52: Developing Software That Matters I

52http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Ada 95

function Get_Bits (X : Bit_Array; P : Bit; N : Offset) return Bit_Array isbegin

return X (P – N + 1 .. P);end Get_Bits;

Page 53: Developing Software That Matters I

53http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

1950 1960 1970 1980 1990 2000

Fortran(54)

PL/I(66)

Ada(95)

Java(96)

Basic(66)

C(72)

Pascal(70)

Cobol(58)

Algol(60)

Simula(67) Smalltalk(80)

C++(89)

imperative

A S

S E

M B

L Y

Eiffel (86)

History of Some Imperative Languages

Ada(83)

Page 54: Developing Software That Matters I

54http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

1970 1980 1990 2000

Ada(83)

Ada(95)

Java(96)

C(72)

Pascal(70)

C++(89)

Eiffel (86)

ISO C++(98)

Ada(0X)

???

ANSI C(88) ISO C(99)

2005

Page 55: Developing Software That Matters I

55http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Programming Language Design Goals

►C• A portable, higher-level assembly language• No reliability, safety, and security concerns

►C++• An object-oriented language upwardly compatible with C• No reliability, safety, and security concerns

►Java• Fix C++ insecurity problems (i.e. cannot create a virus in Java)• No reliability, and safety concerns

Page 56: Developing Software That Matters I

56http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

SECURE != RELIABLESECURE != SAFE

►Java is a secure language• That is you cannot create viruses with Java programs

►Java (like C and C++) is NOT a reliable or safe language• It is easy for a programmer to make mistakes in Java both during

regular development and during software evolution - and create programs that behave incorrectly

►Sun Microsystems does not want Java to be used in safety-critical contexts

Page 57: Developing Software That Matters I

57http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Contents of the Windows 2000 LicenseNOTE ON JAVA SUPPORT

THE SOFTWARE PRODUCT MAY CONTAIN SUPPORT FOR PROGRAMS WRITTEN IN JAVA.

JAVA TECHNOLOGY IS NOT FAULT TOLERANT AND IS NOT DESIGNED, MANUFACTURED, OR INTENDED FOR USE OR RESALE AS ON-LINE CONTROL EQUIPMENT IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE, SUCH AS IN THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, DIRECT LIFE SUPPORT MACHINES, OR WEAPONS SYSTEMS, IN WHICH THE FAILURE OF JAVA TECHNOLOGY COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR ENVIRONMENTAL DAMAGE.

Sun Microsystems, Inc. has contractually obligated Microsoft to make this disclaimer.

Page 58: Developing Software That Matters I

58http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Ada► Industrial-strength version of Pascal designed to build:

1. Reliable, safe, and secure software2. Software that needs to evolve3. Systems where software matters (e.g. real-time systems)4. Mixed-language software

► Language designed by an international team• 1983: First version of the language

- Object- based language, not object oriented• 1995: First standard revised (e.g. OO programming added)

- First object-oriented language to be an ISO standard

► Only language to have a formal compiler validation procedure• Validation procedure is an ISO standard (> 4,000 compiler tests)

Page 59: Developing Software That Matters I

59http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Ada: Use it for Safety-Related Systems

►Safety standards recommend the use of Ada for the highest integrity levels

►Even the MISRA-C document recommends the use of Ada:Guidelines for the Use of the C Language in Vehicle Based Software• “… it should be recognized that there are other languages available

which are in general better suited to safety-related systems, having (for example) fewer insecurities and better type checking. Examples of Languages generally recognized to be more suitable than C areAda and Modula 2. If such languages could be available for a proposed system then their use should be seriously considered inpreference to C.” page 3.

Page 60: Developing Software That Matters I

60http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Ada-Inspired Programming Features

►C++• Templates (Generics)• Exceptions

►Java• Array index checking• Division by zero checks

Page 61: Developing Software That Matters I

61http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Some Languages Derived from Ada

►SPARK• Subset of Ada used to design the most safety-critical systems

►VHDL• Used for chip design

►PL SQL• New programming language designed to extend SQL and make it a

full programming language

Page 62: Developing Software That Matters I

62http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Some Industrial Applications in Ada

► Business-critical• Canal+ Technologies: Pay-per-view, access control• BNP: Trading Language• Philips: Semiconductor assembly equipment• Helsinki radiotelescope

► Mission-critical• Astree: European-wide railroad signaling• Weirton Steel - process controller• Mondex electronic money• Scanning Electron microscope

► Safety-critical • Airbus A340• Boeing 777

Page 63: Developing Software That Matters I

63http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

0000

200200200200

400400400400

600600600600

800800800800

1000100010001000

1200120012001200

1400140014001400

1600160016001600

1800180018001800

350350350350 700700700700 1,0501,0501,0501,050 1,4001,4001,4001,400 1,7501,7501,7501,750 2,1002,1002,1002,100

Function PointsFunction PointsFunction PointsFunction Points

10

00

s o

f 1

99

4 D

oll

ars

10

00

s o

f 1

99

4 D

oll

ars

10

00

s o

f 1

99

4 D

oll

ars

10

00

s o

f 1

99

4 D

oll

ars

AdaAdaAdaAdaOther HOLsOther HOLsOther HOLsOther HOLsCCCC

Source: MITRE (Avionics domain)

270,000 LOC

225,000 LOC

150,000 LOC

135,000 LOC

112,500 LOC

75,000 LOC

Ada and Software Costs (1995 Study)

Page 64: Developing Software That Matters I

64http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Ziegler’s Study: Comparing C & Ada►1995 study on the VADS compiler

• 60 engineers, from 1984 ..1994 with MS degrees in computer science• All knew C at hire. All programmed in both C and Ada.

►VADS • About 4.5 million lines of code, 22000 files, cost >$28m over 10 years

0

500000

1000000

1500000

2000000

2500000

C Code Ada Code Make Scripts Miscellany

All Li

nes

Page 65: Developing Software That Matters I

65http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Costs Per Feature During Implementation

cost/feature:

$0

$50

$100

$150

$200

$250

$300

$350

C C, including Makef iles ADA

Page 66: Developing Software That Matters I

66http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Post-Delivery (User-Reported) Defects

0

200

400

600

800

1000

1200

Critic a l De fe c ts S e ve re De fe c ts Mino r d e fe c ts T o ta l De fe c ts

C

Ad a

Page 67: Developing Software That Matters I

67http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Summary

►Developing software in Ada is 60% cheaper than in C►Code developed in Ada has 9 times less bugs than in C

►Was Ada consistently better? *YES*• Over different subsets of VADS• For experienced AND inexperienced programmers• For both C experts AND Ada experts• For the highest AND lowest rated programmers

►Was Ada harder to learn? *No*►Was Ada code more reliable? *YES*

See http://archive.adaic.com/docs/reports/cada/cada_art.html

Page 68: Developing Software That Matters I

68http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Some Non-Reasons for Ada’s Advantage

►Not because of people: • The same people used both languages

►Not because of process: • The same process was used, for design, for testing, for debugging,

for source control, for management, and so forth• C required ‘makefiles’, but had tighter coding standards

►Not because of Ada’s highest level constructs:• VADS used few generics or tasks

►Not because of reuse:• This study considers only unique code, factoring out reuse

Page 69: Developing Software That Matters I

69http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Some Reasons for Ada’s Advantage

►Ada Enabled Better Error Locality• Most errors caught at compile-time• Runtime errors are easier to trace

►Ada Enabled Better Tool Support• Ada’s richer semantic model allows computers to help more• For example, builds are automated and guaranteed consistent

►Ada Reduced Effective Complexity• Function of language complexity and application complexity• Standard language complexity is easier to learn and use

►Ada Encouraged Better Program Organization• Packages, with specifications and private parts

Page 70: Developing Software That Matters I

70http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

From an Education Perspective

►Ada is a good language to teach good software practice• Reliability, safety, security

►Ada 95 allows to design functionality-oriented as well as object-oriented software• Ada allows the construction of software that can evolve

►Today there is a Free Software high-quality Ada 95 compiler available to all• GNAT (GNU Ada)• Linux, Solaris, Windows, …

Page 71: Developing Software That Matters I

71http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

You Should Know Several Languages

►No single programming language is appropriate in every circumstance

►Today most systems use a mixture of programming languages

Page 72: Developing Software That Matters I

72http://libre.act-europe.fr © ACT Europe under the GNU Free Documentation License

Example: MULTOS CA

►Multiple application OS for smart cards

►30%: SPARK (Ada subset)• “Security kernel” of tamper- proof software• Certified at the HIGHEST security level

►30%: Ada 95 Infrastructure • (concurrency, inter- task and inter- process communications,

database interfaces etc.), bindings to ODBC and Win32►30%: C++

• GUI (Microsoft Foundation Classes)►5%: C

• Device drivers, cryptographic algorithms►5%: SQL Database stored procedures


Recommended