Hacker News new | ask | show | jobs
by 0xdeadfeed 1937 days ago
NASA just sent a rover on Mars using software written in C. Meanwhile some Rust fanatics are busy telling everyone how it doesn’t work.
4 comments

Wat

The types of analysis and programming practices used to send stuff to Mars is beyond what Rust, or D, or any other safer-systems-language tries to do. It's not that simple.

These types of projects effectively need to prove the absence of bugs using formal verification and very extensive testing. Surprise surprise, C makes it extremely expensive and theoretically difficult too.

For example: NASA wrote this project https://github.com/NASA-SW-VnV/ikos which uses abstract interpretation and would catch bugs in practically any language.

The Rover is not connected to the internet.

Do you know what subset of C NASA limits itself to? Or hw architecture? The rigour of their testing? Should all C developers follow the same restrictions as NASA?

The rover was built by NASA JPL, and they have their own coding standard based on MISRA 2004.

https://andrewbanks.com/wp-content/uploads/2019/07/JPL_Codin...

https://nodis3.gsfc.nasa.gov/displayAll.cfm?Internal_ID=N_PR...

Hardware (according to Wikipedia) is a BAE Systems RAD750 radiation-hardened single board computer based on a ruggedized PowerPC G3 microprocessor (PowerPC 750). The computer contains 128 megabytes of volatile DRAM, and runs at 133 MHz.

https://en.wikipedia.org/wiki/Perseverance_(rover)

Testing sounds pretty rigorous, at least for large projects.

https://www.quora.com/What-does-a-software-engineer-do-at-th...

Personally I firmly believe that "all C developers" do not need to follow these regulations. It might even be counter-productive to slow down the development process for some clients. For safety-critical systems, these rules make sense. For little startups, they don't.

Developers are smart enough to learn these rules, so HR shouldn't ask for "5 years MISRA experience". It's really a choice of business model, time to market, and risk management. If you're a big company looking to cut costs, be careful about outsourcing firmware development to a little startup who might not follow these rules so strictly. I won't follow these rules for the stuff I throw together in my free time and put on Github, but I will be careful before committing code to master for medical device firmware.

C is already a subset. It's basically one step above assembly.
His point is moot anyway. They could have written the entire code base in Rust and compiled it down to C for all we know.
Rovers usually have a timeline of 7-8 years for desigining and building. Rust had not hit 1.0 at the time Nasa probably started designing the rover.

So any indication on what Nasa would use on its Rovers has to be taken from projects that start from the point when Rust released 1.0

According to my information the rover software is in C++. The OS is in C. The C++ classes are mostly autogenerated by python.