47
$\begingroup$

Generally speaking, What programming language is used in aviation for (ATC Radio, Radar, ILS, Auto-pilot and on-board avionics)?

  • Is there a standard enforced by ICAO?
  • Does every plane manufacturer use the programming language they like as long as it's reliable and it goes through testing?

I remember watching a documentary on YouTube last year about aviation and it said something about the EU, after WWII, started making standards for aviation systems inside Europe. I will link the video if I can find it

$\endgroup$
  • 8
    $\begingroup$ see this question: programmers.stackexchange.com/questions/153266/… $\endgroup$ – Thunderstrike Apr 28 '14 at 11:24
  • 2
    $\begingroup$ In keynote on Going Native 2012, Bjarne Stroustrup mentions software for F-35 is written in C++ with some limitations. Specifically he mentions exceptions are not used because it was not possible to provide hard real-time guarantee for them. $\endgroup$ – Jan Hudec Apr 28 '14 at 13:16
  • 7
    $\begingroup$ Generally speaking? This sounds a bit like a rabbit hole. Generally speaking, I'm pretty sure avionics manufacturers all do whatever they want, as long as it meets the specs. $\endgroup$ – egid Apr 28 '14 at 15:34
  • 2
    $\begingroup$ @egid The first part of that last sentence is so true! But if they would meet the specs, I'd be only part-time employed! $\endgroup$ – DeltaLima Apr 29 '14 at 14:11
  • 5
    $\begingroup$ @Jan, oh, that explains F-35 cost overruns :) $\endgroup$ – Zeus Jun 6 '16 at 3:22
39
$\begingroup$

There are no language recommendations or requirements, other than what is sensible given the verification requirements in the various standards (e.g., DO-178B/C). For the highest design assurance levels, the generated code must be inspected down at the op-code level to ensure no known processor gotchas are invoked. You also end up having to test every part of every conditional, both the true and the false sides, and ensure that no jump instructions will take you someplace where you didn't expect it to go.

For these reasons, the big three languages in use in embedded avionics today are:

  1. C++ (as a better C. The OO nature is often used only sparingly. Things like polymorphism are just too expensive to verify)
  2. Ada (You may not like it, but a TON of current avionics are written in Ada, and are currently being maintained and updated with new features)
  3. C - As close to the hardware as you want to get and still be highly productive (not intending to offend anyone who is productive in something else)

Assembler is frequently used for specific needs, but it would not be used to a greater degree than one of the above-mentioned languages.

What makes these languages ideal for avionics is that they are relatively close to the hardware and memory structure, not too abstract. Their tools are mature and well-known. People have years of experience certifying software written in them. And there are lots of programmers who can get up to speed in them quickly (Yes, even Ada).

Non-safety critical software, both on and off the aircraft, will be written in any of the big languages of the day: Java, C#, VB, C, C++, Python, Perl, Ruby, etc.

iPads are becoming useful inside the cockpit and are approved in limited situations. iOS apps are written in Objective-C, C, C++, and increasingly, Swift (Apple's new language).

$\endgroup$
  • 5
    $\begingroup$ Historically, FORTRAN was used a lot. Example: X-31. $\endgroup$ – Peter Kämpf Jun 6 '15 at 23:59
  • 3
    $\begingroup$ SPARK is increasingly replacing Ada since it is more assurable and removes a lot of the Ada ambiguities. $\endgroup$ – Simon Jun 10 '16 at 11:00
  • $\begingroup$ A very important component of the stack is the hardware and the operating system.The hardware is usually designed to work with an operating system that runs in realtime. Ensuring a deterministic response to interrupts by the operating system which ensures notifications are handled under one of several models of varying levels of service guarantee. Understanding the hardware and the operating system combination (just hardware without an OS) is important in order to ensure the best choices and practices for software development. $\endgroup$ – jCisco May 8 '17 at 20:47
15
$\begingroup$

As far as I know, there is no directive on which language to use. You have guidelines on how to test and certify software, but as far as these guidelines are concerned, no language is preferred, it is a design choice.

As of today, in my (limited) experience as an engineer/programmer, I have mostly seen that non object oriented languages are preferred, since they reduce the amount of testing required. Usual arguments I have encountered primarily concern explicit memory management in often resource-limited environments.

$\endgroup$
  • 3
    $\begingroup$ All true, but Ada is highly prevalent in existing avionics because it was designed with verifiability in mind. New development is shifting away from this though. $\endgroup$ – TypeIA Apr 28 '14 at 12:45
  • 3
    $\begingroup$ Worth mentioning that not only your language choice is an issue, but so is your compiler. Frequently, compilers have known bugs, and you must be careful to design to avoid or work around these issues. $\endgroup$ – dougk_ff7 Apr 28 '14 at 22:38
  • 3
    $\begingroup$ non-OO reduces testing? There's a first... OO was in part introduced to improve testability of code. $\endgroup$ – jwenting Apr 29 '14 at 7:14
  • 2
    $\begingroup$ @jwenting given the guidelines linked in the answer, yes. $\endgroup$ – Federico Apr 29 '14 at 7:17
  • 4
    $\begingroup$ Non oo reduce the test when you have to inspect the assembly code. Oo assembly is much harder to decipher. $\endgroup$ – Antzi Jun 7 '16 at 3:41
9
$\begingroup$

The preference of an expert for safety-critical systems I listened to once was

  1. Ada
  2. C with a programming standard (like Misra-C in the automotive industry).

He definitely preferred Ada to C.

$\endgroup$
4
$\begingroup$

This explains everything about the Boeing 777's computer systems: http://archive.adaic.com/projects/atwork/boeing.html

Honeywell was to develop the cockpit's primary flight controls in two projects, the Boeing 777's Airplane Information Management System and its Air Data/Inertial Reference System. For these projects, Honeywell purchased DDC-I, Inc.'s Ada Compiler System, using it as the front-end source for Honeywell's symbolic debugger. The two companies worked together for a year and a half to build the compiler's final debugger and the entire back-end, targeted to an Advanced Micro Devices (AMD) 29050 microprocessor. According to a recent telephone interview with Jeff Greeson, Honeywell's project leader for the 777 project's engineering, the companies "were able to build into the compiler a lot of optimization features specific to our hardware."

Hydro-Aire selected Alsys' Ada software development tools for the brake control system project. The supplier used AdaWorld cross compilers with the Smart Executive and Certification package to ensure meeting real-time and FAA requirements. The compilers are hosted on Hewlett-Packard HP 9000/300 platforms; they targeted the Motorola 58333 microcontroller, making Hydro-Aire one of the first companies to use the new chip.

Each 777's brake control system includes two Motorola microcontrollers programmed entirely in Ada. Harry Hansen, Hydro-Aire's Manager of Software Engineering reported that "We find Ada an excellent language for the development of real-time applications." The processors control the built-in test (BIT) and auto-brake functions. The BIT includes both an on-line interface to the central maintenance computer and off-line maintenance capability. The auto-brake applies the correct amount of brake pressure during landings and applies the maximum amount of pressure -- without causing a tire blow-out -- during aborted take-offs. Additionally, the system includes hardware and software to prevent skids, sensors and transducers to external systems, and hydraulic valves.

Sundstrand, too, chose a compiler from Alsys, Inc. (now Thomson Software Products, Inc.). Running on a PC host, it generated code targeted to an Intel 80186 microprocessor. The Certifiable Small Ada Run Time (CSMART) executive code that interfaces with the language resides inside the run-time controller and, therefore, had to be tested and verified. It was a major undertaking, but not a long-term inconvenience. "Ada continues to be our baseline language for future electrical systems," Teske said, "for reasons of cost and efficiency. We are now able to reuse code. We pull out certain chunks of airplane software and put them into new projects."

In a recent telephone interview, senior software engineer Malkit Rai, who led the effort on the Sundstrand 777 electrical power project, agreed on the importance of Ada's support for reuse. Ada has permanently replaced the shop's previous high-level language, PLM, which was developed by Intel and is based on PL/I. "Ten to 15 percent of the 777 Main Channel Electrical Power Generating System is already in reuse," he said. Two new projects, for the Gulfstream V business jet and the Comanche helicopter, were able to integrate Sundstrand's library of common generic packages written in Ada for the 777.

In fact, the Sundstrand power systems' 80,000 lines of code were in themselves reused by 10 to 15 percent. The embedded software's small size proves that Ada is well-suited for projects under 100,000 lines of code, as well as for large efforts. The 777's Cabin Management System, for example, is a communications module mounted on the 777's back seats and offers passengers a variety of services and is only 70,000 lines.

Putting Together a New Architecture

In comparison, Honeywell's Airplane Information Management System (AIMS) project consists of the largest central computer on the jetliner; it runs 613,000 new lines of code (defined as body semicolons), taking up 15,656 kilobytes (KB) of disk space and 4,854 KB of random-access memory (RAM). With redundancy, the software runs to 46,191 KB and 10,732 KB of RAM. A multiprocessor, rack-mounted system, the AIMS replaced many of the line-replaceable units and reduced hardware and software redundancy.

Two AIMS boxes handle the six primary flight and navigation displays: two sets are located in front of both the captain and copilot so that they can move from one seat to the other, and two central sets of engine parameters are shared by the pilots. The primary flight instruments indicate pitch and roll attitude, direction, air speed, rate of climb, altitude, etc. The AIMS also includes the central maintenance function, which receives reports from the 777's other computers and then gathers the data into a central maintenance report for the mechanic. Its monitoring system gathers data on how other functions are doing, and can determine, for example, that an engine is degrading, before it actually fails. Other AIMS functions include a data-conversion gateway, flight data acquisition, data loading, an Ada conversion gateway, and thrust management.

Honeywell's massive effort on the 777 involved over 550 software developers. The company built the AIMS computer as a custom platform based on the AMD 29050 processor. It was unique among aviation systems for integrating the other computers' functions; in other systems, each function resides in a different box [the central maintenance had its own box with its own input/output (I/O), its own central processing unit (CPU), etc.]. AIMS combines all these functions and shares the CPU and I/O among them: it uses the same signals for flight management and for displays, so that the data comes in only once instead of twice; one input circuit provides data to all of the functions; each of the functions gets a piece of the CPU, as in a mainframe computer, where systems use part of the CPU but not all of it; and every function is guaranteed its time slot. Engineer Jeff Greeson said that "The federated system is obsolete. Putting all the functions in one box is a jump ahead in technology that we've brought to the industry."

Another innovation is that the disk drive can read files formatted for the Microsoft Disk Operating System, which provides maintenance with access to the terminal communications. The mechanics can transfer files for data loading over the airplane bus, because Honeywell built the program to accept new data and to change the software. In fact, most of the equipment on the airplane has that ability, only a few classic systems do not (such as the ground-proximity warning system, which has proven sufficiently trustworthy and not in need of change).

Designing a new architecture simultaneously with a new language was "quite exciting," Greeson said. "The organizational details were difficult to put together." With Ada, managers were able to delegate the seven main functions to groups of 60-100 software engineers. The separate software entities have minimal interface with other parts of the software, and not all of the software is integrated. By working with loosely coupled pieces, the project leaders were able to farm out the functions to other groups. The loose integration, however, does not tie the software to the 777 platform, and will assist in Honeywell's using the code for other targets. "We needed the maximum ability to port it to other places," Greeson said.

The data interfaces that do exist between the software units are fairly uniform, Greeson said, because Ada helped the software engineers to implement certain rules at compilation time. "Ada forces you keep it straight there rather than at the lab," he said, "where it helped minimize our difficulties in getting it integrated and running." Because of the high level of accuracy during the compilation, less time was spent on debugging the code. Thus, Honeywell's initial study proved correct. "I'm convinced that, because of Ada, we had a minimal amount of interface problems, with which we would have killed ourselves if we had had C or Pascal," Greeson concluded. "It went much smoother than past programs."

$\endgroup$
  • $\begingroup$ This doesn't really answer the question, as this is for one OEM platform (B777) rather than for the industry as a whole. $\endgroup$ – selectstriker2 May 8 '17 at 22:51
  • 1
    $\begingroup$ It's the most informative and detailed source I could find on avionic systems in general. Other sources simply mention that each part has a different isolated chip and is powered by a real-time OS. This article goes way deeper and has some references to the way things were done on older planes as well. $\endgroup$ – erol_smsr May 8 '17 at 23:43
  • $\begingroup$ could you try to paraphrase that? or at least highlight the important bits? $\endgroup$ – Federico Apr 8 at 6:55
  • $\begingroup$ @Federico A question asking which programming languages are being used in aviation is useless, because the answer is simple: C, Assembly, ADA, etc. Doesn't teach you much at all knowing what language they use. What matters is the (implementation) details. This article explains why Ada was chosen, for example see: "I'm convinced that, because of Ada, we had a minimal amount of interface problems, with which we would have killed ourselves if we had had C or Pascal.". It's clearly stated, "interface problems", so Ada was chosen for this reason. That's more informative than just saying "Ada". $\endgroup$ – erol_smsr Apr 8 at 16:04
  • $\begingroup$ what I meant is that if you could try to summarize the article here, and not to have a full copy of it. or at least copy here only the most relevant passages. $\endgroup$ – Federico Apr 9 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.