The exact opposite of what you suggest already happened: Ada was mandated and then the mandate was revoked. 
It’s generally a bad idea to be the only customer of a specific product, because it increases costs.&gt; And the F35 and America&#x27;s combat readiness would be in a better place today with Ada instead of C++What’s the problem with the F35 and combat readiness? Many EU countries are falling over each-other to buy it.

I&#x27;ve always strongly disliked this argument of not enough X programmers. If the DoD enforces the requirement for Ada, Universities, job training centers, and companies will follow. People can learn new languages. And the F35 and America&#x27;s combat readiness would be in a better place today with Ada instead of C++.

Yeah I find myself wishing it would take off again.I’m sure I’m idealizing it, but at least I’m not demonizing it like folks did back in the day.

<a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20111219004314&#x2F;http:&#x2F;&#x2F;journal.thedacs.com:80&#x2F;issue&#x2F;53&#x2F;158" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20111219004314&#x2F;http:&#x2F;&#x2F;journal.th...</a> (referenced, at least tangentially, in the video) is a piece from the engineering lead which does a great job discussing Why C++. The short summary is &quot;they couldn&#x27;t find enough people to write Ada, and even if they could, they also couldn&#x27;t find enough Ada middleware and toolchain.&quot;I actually think Ada would be an easier sell today than it was back then. It seems to me that the software field overall has become more open to a wider variety of languages and concepts, and knowing Ada wouldn&#x27;t be perceived as widely as career pidgeonholing today. Plus, Ada is having a bit of a resurgence with stuff like NVidia picking SPARK.

&gt; Using the stack or the heap means your variables aren&#x27;t always at the same memory addressWhere do you place the variables then? as global variables? and how do you detect if a memory cell has gone bad?

It is more than that.This is what make remote debugging possible.
It is impossible to do interactive remote debugging over a ultra low bandwidth link.
If everything have static address and deterministic static, you can have a exact copy on ground and debug there.

&gt; This can be bad if a particular memory cell has failed. If every variable has a fixed address, and one of those addresses goes bad, a patch can be loaded to move that address and the mission can continue.This seems like a rather manual way to go about things for which an automated solution can be devised. Such as create special ECC memory where you also account for entire cell failure with Reed-Solomon coding or some boot process which blacklists bad cells etc.

So none of the functions you implement have in&#x2F;out parameters?

If you have memory to spare and are using hardware with an MMU, you can remap your logical address to a different page. Linux can do this, but only for user memory.

Can&#x27;t this be done at runtime? Like the underlying calls can black list hardware address on read&#x2F;write faults?

The same is true for the software that runs many satellites. Use of the STL is prohibited.The main issue is mission assurance. Using the stack or the heap means your variables aren&#x27;t always at the same memory address. This can be bad if a particular memory cell has failed. If every variable has a fixed address, and one of those addresses goes bad, a patch can be loaded to move that address and the mission can continue.

I like rust matching for this reason: You need to cover all branches.In fact, not using a default (the else clause equivalent) is ideal if you can explicitly cover all cases, because then if the possibilities expand (say a new value in an enum) you’ll be annoyed by the compiler to cover the new case, which might otherwise slip by.

The &quot;standard&quot; (typically defined in projects I&#x27;m familiar with, and as of C23, an actual standard) is &quot;unreachable&quot;: <a href="https:&#x2F;&#x2F;en.cppreference.com&#x2F;w&#x2F;c&#x2F;program&#x2F;unreachable.html" rel="nofollow">https:&#x2F;&#x2F;en.cppreference.com&#x2F;w&#x2F;c&#x2F;program&#x2F;unreachable.html</a>

Same. I go one step further and create a macro _STOP which is defined as w&#x2F;e your language&#x27;s DebugBreak() is. And if it&#x27;s really important, _CRASH (this coerces me to fix the issue immediately)

&gt; All if, else if constructs will contain either a final else clause or a comment indicating why a final else clause is not necessary.I actually do this as well, but in addition I log out a message like, &quot;value was neither found nor not found. This should never happen.&quot;This is incredibly useful for debugging. When code is running at scale, nonzero probability events happen all the time, and being able to immediately understand what happened - even if I don&#x27;t understand why - has been very valuable to me.

There are missiles in which the allocation rate is calculated per second and then the hardware just has enough memory for the entire duration of the missile&#x27;s flight plus a bit more. Garbage collection is then done by exploding the missile on the target ;)

Why would the modern environment materially change this? The initialized resource allocation reflects the limitations of the hardware. That budget is what it is.I can&#x27;t think of anything about &quot;modern AI-guided drones&quot; that would change the fundamental mechanics. Some systems support very elastic and dynamic workloads under fixed allocation constraints.

What you are actually doing here is moving allocation logic from the heap allocator to your program logic.In this way you can use pools or buffers of which you know exactly the size.
But, unless your program is always using exactly the same amount of memory at all times, you now have to manage memory allocations in your pool&#x2F;buffers.

How do you think these modern AI-guided drones use their AI? What part of the drone uses it?

&quot;AI&quot; comes in various flavors. It could be a expert system, a decision forest, a CNN, a Transformer, etc. In most inference scenarios the model is fixed, the input&#x2F;output shapes are pre-defined and actions are prescribed. So it&#x27;s not that dynamic after all.

As is common in hard real time code, there is no dynamic allocation during operation:<pre><code> allocation&#x2F;deallocation from&#x2F;to the free store (heap) 
 shall not occur after initialization.
</code></pre>
This works fine when the problem is roughly constant, as it was in, say, 2005. But what do things look like in modern AI-guided drones?

From quickly glancing over a couple of pages, that looks sensible. Which makes me curious to see some exceptions to the &quot;shall&quot; rules. With a project of this size, that should give some idea about the usefulness of such standards.

&quot;shall&quot; recommendations are statically analyzed, &quot;will&quot; are not.

I wonder if they use static analysis to enforce these rules, or if developers are expected to just know all of this

Embedded more so than just lower-spec devices. Depends on the domain too.stdio.h is fine in some embedded contexts, and very very not fine in others

stdio.h is not what you would use in safe code.

In general, are these good recommendations for building software for embedded or lower-spec devices? I don&#x27;t know how to do preprocessor macros anyhow, for instance - so as i am reading this i am like &quot;yeah, i agree...&quot; until the no stdio.h!

The first time I came across this document, someone was using it as an example how the c++ you write for an Arduino Uno is still c++ despite missing so many features.

The font used for code samples looks nearly the same as &quot;The C++ Programming Languages&quot; (3rd edition &#x2F; &quot;Wave&quot;) by Bjarne Stroustrup. Looking back, yeah, I guess it was weird that he used italic variable width text for code samples, but uses tab stops to align the comments!

Interesting font choice for the code snippets. I wonder if that&#x27;s been chosen on a whim or if there is a reason for not going with mono space.

The video goes into the history of why the military eventually accepted c++ instead of enforcing Ada.

Interesting they&#x27;re using C++ as opposed to Ada.

For those interested, the F-35 (née Joint Strike Fighter) C++ coding standards can be found here, all 142 pages of it:<a href="https:&#x2F;&#x2F;www.stroustrup.com&#x2F;JSF-AV-rules.pdf" rel="nofollow">https:&#x2F;&#x2F;www.stroustrup.com&#x2F;JSF-AV-rules.pdf</a>

You&#x27;re right. MISRA is a cult. Actual studies[1][2] have shown many of their rules to be harmful rather than helpful. I have worked in multiple safety-critical industries. MISRA is almost always enforced by bureaucrats who don&#x27;t understand source code at all, or by senior developers who rose up ranks as code monkeys. One such manager was impressed with Matlab because Matlab-generated C code was always MISRA compliant, whereas the code my company was giving them had violations. Never mind the fact that every function of the generated, compliant code had variables like tmp01, tmp02, tmp03, etc.There are many areas of software where bureaucracy requires MISRA compliance, but that aren&#x27;t really safety-critical. The code is a hot mess. There are other areas that require MISRA compliance and the domain is actually safety-critical (e.g. automotive software). Here, the saving grace is (1) low complexity of each CPU&#x27;s codebase and (2) extensive testing.To people who want actual safety, security, portability, I tell them to look at the Linux kernel, SQLite, OpenSSL, FFMpeg, etc. Modern linters (even free ones) are actually valuable compared to MISRA compliance checkers.[1] <a href="https:&#x2F;&#x2F;ieeexplore.ieee.org&#x2F;abstract&#x2F;document&#x2F;4658076" rel="nofollow">https:&#x2F;&#x2F;ieeexplore.ieee.org&#x2F;abstract&#x2F;document&#x2F;4658076</a>[2] <a href="https:&#x2F;&#x2F;repository.tudelft.nl&#x2F;record&#x2F;uuid:646de5ba-eee8-4ec8-8bbc-2c188e1847ea" rel="nofollow">https:&#x2F;&#x2F;repository.tudelft.nl&#x2F;record&#x2F;uuid:646de5ba-eee8-4ec8...</a>

The &quot;good&quot; rules are like &quot;don&#x27;t write off the end of an array&quot;, and the bad ones are like &quot;no early returns&quot; or &quot;variable names must not be longer than 6 characters&quot;. 95% of the &quot;good&quot; rules are basically just longer ways of saying &quot;don&#x27;t invoke undefined behavior&quot;.

Studies have looked at MISRA, I&#x27;m not aware of any for the JSF guidelines. For MISRA there&#x27;s a mix, some of the rules seem to be effective (fewer defects in compliant software), some are the opposite (code which obeys these rules is more likely to have defects) and some were irrelevant.Notably this document is from 2005. So that&#x27;s after C++ was standardized but before their second bite of that particular cherry and twenty years before its author, Bjarne Stroustrup suddenly decides after years of insisting that C++ dialects are a terrible idea and will never be endorsed by the language committee, that in fact dialects (now named &quot;profiles&quot;) are the magic ingredient to fix the festering problems with the language.While Laurie&#x27;s video is fun, I too am sceptical about the value of style guides, which is what these are. &quot;TABS shall be avoided&quot; or &quot;Letters in function names shall be lowercase&quot; isn&#x27;t because somebody&#x27;s aeroplane fell out of the sky - it&#x27;s due to using a style Bjarne doesn&#x27;t like.

Not if you use GCC.<a href="https:&#x2F;&#x2F;godbolt.org&#x2F;z&#x2F;zYdc9ej88" rel="nofollow">https:&#x2F;&#x2F;godbolt.org&#x2F;z&#x2F;zYdc9ej88</a>clang gets this right.

For C, the proper&#x2F;expected&#x2F;standard way to reference a variable without accessing it is a cast to void:<pre><code> (void) a;
</code></pre>
I&#x27;m sure there are commonly-implemented compiler extensions, but this is the normal&#x2F;native way and should always work.

Many coding standards rules have nothing to do with correctness and everything to do with things like readability and reducing cognitive load (“which style should I use here?”)

I&#x27;ve (unfortunately) written plenty of &quot;safety critical&quot; code professionally and coding standards definitely have a negative effect overall. The thing keeping planes from falling out of the sky is careful design, which in practice means fail-safes, watchdogs, redundancy, and most-importantly, requirements that aren&#x27;t overly ambitious.While maybe 10% of rules are sensible, these sensible rules also tend to be blindingly obvious, or at least table stakes on embedded systems (e.g. don&#x27;t try to allocate on a system which probably doesn&#x27;t have a full libc in the first place).

The standards don&#x27;t remove the need for code review. In fact they provide a standard to be used in code review. Anything you can automate is nice, but when you have exceptions to rules that say &quot;Exception, if there&#x27;s no reasonable way to do X then Y is acceptable&quot; isn&#x27;t really something you can codify into static analysis.

Doesn&#x27;t it make it more likely unused variables stay in the codebase? You want to experiment, the code doesn&#x27;t compile, you add this (probably by automatic tool), the code now compiles. You&#x27;re happy with your experiment. As the compiler doesn&#x27;t complain you commit and junk stays in the code.Isn&#x27;t it just bad design that makes both experimenting harder and for unused variables to stay in the code in the final version?

Golang is exactly the same.It&#x27;s extremely annoying until it&#x27;s suddenly very useful and has prevented you doing something unintended.

Zig makes it explicit with<pre><code> _ = a;
</code></pre>
And you would encounter it quite often because unused variable is a compilation error: <a href="https:&#x2F;&#x2F;github.com&#x2F;ziglang&#x2F;zig&#x2F;issues&#x2F;335" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ziglang&#x2F;zig&#x2F;issues&#x2F;335</a>

Unless it’s there to conform to an interface

An unused parameter should be commented out.

Erm, sorry about the weird typo. Didn’t notice. Can’t edit now.

It’s very weird how none of the sibling comments understood what it were saying is wrong with this.

The point really was that the unused method parameter should in almost all cases be removed, not that some trick should be used to make it seem used, and this is the wrong trick!

I&#x27;m sure thats disallowed for the C-style cast.

Especially since there is a widely recognized way to ignore a parameter:<pre><code> (void) a;
</code></pre>
Every C programmer beyond weaning knows that.

Isn&#x27;t it inevitable for some cases of inheritance? A superclass does something basic and doesn&#x27;t need all parameters, child classes require additional ones.

a = a; &#x2F;&#x2F; misraActual code i have seen with my own eyes. (Not in F-35 code)Its a way to avoid removing an unused parameter from a method. Unused parameters are disallowed, but this is fine?I am sceptical that these coding standards make for good code!

Her ARM assembly tutorial series is really excellent

LaurieWired is an awesome follow on YouTube!

coding standard is a part of the story. mainly it comes down to level of rigor and documenting process and outcomes for audit ability. DO-178c

You’re joking right? That autogenerated code is generally garbage and spaghetti code. It was probably the reason for Toyotas unintended acceleration glitch.

Depends on the company in my experience. I&#x27;ve seen some suppliers that basically just wire up the diagram in Matlab&#x2F;simulink and hit Autocode. No humans actually touch the C that comes out.Honestly I think that&#x27;s probably the correct way to write high reliability code.

&#x2F;?hnlog awesome-safety-criticalFrom <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45562815">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45562815</a> :&gt; awesome-safety-critical: <a href="https:&#x2F;&#x2F;awesome-safety-critical.readthedocs.io&#x2F;en&#x2F;latest&#x2F;" rel="nofollow">https:&#x2F;&#x2F;awesome-safety-critical.readthedocs.io&#x2F;en&#x2F;latest&#x2F;</a> From &quot;Safe C++ proposal is not being continued&quot; (2025) <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45237019">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=45237019</a> :&gt; Safe C++ draft: <a href="https:&#x2F;&#x2F;safecpp.org&#x2F;draft.html" rel="nofollow">https:&#x2F;&#x2F;safecpp.org&#x2F;draft.html</a> Also there are efforts to standardize safe Rust; rust-lang&#x2F;fls, rustfoundation&#x2F;safety-critical-rust-consortium&gt; How does what FLS enables compare to these [unfortunately discontinued] Safe C++ proposals?

Depends on the region. MISRA is widely adopted, and then there are the US MIL standards, ECSS for european aerospace stuff, do-178C for aviation..

Do avionics in general subscribe to MISRA C&#x2F;C++ or do they go even further with an additional (or different) approach?

I wonder if Lockheed Martin has an Electron based future fighter in the works?

surprised not that strict about types. i remember google doesn&#x27;t allow unsigned?

The “90% ban” isn’t about hating C++ — it’s about guaranteeing determinism. In avionics, anything that can hide allocations, add unpredictable control flow, or complicate WCET analysis gets removed. Once you operate under those constraints, every language shrinks to a tiny, fully-auditable subset anyway.

Yeah unfortunately no amount of manoeuvering is a substitute for a kill chain where a distributed web of sensors and relays and weapon carriers can result in an AAM being dispatched from any direction at lightspeed.

There have been countless articles claiming the demise and failure of the F35 but that is just one side of the story. There has been an argument started 50 years ago in the 1970&#x27;s about how to build the best next generation fighter jets. One of these camps was called the &quot;Fighter mafia&quot;[0] figure headed by John Boyd. The main argument they bing was the only thing that matters for a jet fighter is how well it performs in one-on-one short ranged dog fighting. They claim that stealth, beyond visual range missiles, electronic warfare and sensors&#x2F;datalink systems are useless junk that only hinders the dog fighting capability and bloat the cost of new jets.The evidence for this claim was found in testing for the F35 where it was dog fighting a older F16. The results of the test where that the F35 won almost every scenario except one where a lightweight fitted F16 was teleported directed behind a F35 weighed down by heavy missiles and won the fight. This one loss has spawned hundreds of articles about how the F35 is junk that can&#x27;t dogfight.In the end the F35 has a lot of fancy features that are not optional for modern operations. The jet has now found enough buyers across the west for economies of scale to kick in and the cost is about ~80 million each which is cheaper than retrofitting stealth and sensors onto other air frames like what you get with the F15-EX[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Fighter_Mafia" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Fighter_Mafia</a>

A lot of people have made careers out of telling you that it&#x27;s a failure, but while not everything about the F-35 is an unquestionable success, it has produced a &quot;cheap&quot; fighter jet that is more capable than all but a handful of other planes.Definitely not a failure.

There&#x27;s a ton of absolutely garbage reporting on it. No like seriously a ton of the articles are just more mainstream media uncritically reposting claims by a couple cranks in Australia that LARP as a think tank.Anyhow, a fair assessment is the program has gone massively over timeline and budget, so in that sense is a failure, however the resulting aircraft is very clearly the best in its class both in absolute capability and value.Going forward there&#x27;s broad awareness in the government that the program management mistakes of the F-35 program cannot be repeated. There&#x27;s a general consensus that 3 decade long development projects just won&#x27;t be relevant in a world where drone concepts and similar are evolving rapidly on a year by year basis. There&#x27;s also awareness the government needs to act more as the integrator that owns the project to avoid lock in issues.

&gt; See the recent deals where it’s been used as a political bargaining chip; it still ended up being a very desirable and capable platform from my understanding.From a european perspective, I can tell you that the mood has shifted 180 degrees from &quot;buy American fighters to solidify our ties with the US&quot; to &quot;can&#x27;t rely on the US for anything which we&#x27;ll need when the war comes&quot;.

The F-35 was in development hell for a while for sure, but it’s far from a failure. See the recent deals where it’s been used as a political bargaining chip; it still ended up being a very desirable and capable platform from my understanding.

My slightly trollish reply: If you have infinite money, it is hard to fail.Ok, joking aside: If it is considered a failure, what 100B+ military programme has not been considered a failure?In my totally unqualified opinion, the best cost performance fighter jet in the world is the Saab JAS 39 Gripen. It is very cheap to buy and operate, and has pretty good capabilities. It&#x27;s a good option for militaries that don&#x27;t have the infinite money glitch.

It freely flies in territory protected by state of the art airdefense made by the country that spreads those claims.

In many regards, the F-35 was the first aircraft explicitly engineered for the requirements of drone-centric warfare. Its limitations are that this capability was grafted onto an older (by US standards) 5th generation tech stack that wasn&#x27;t designed for this role from first principles. I think this is what ultimately limited production of the F-22, which is not upgradeable even to the standard of the F-35 for drone-centric environments.The new 6th generation platforms being rolled out (B-21, F-47, et al) are all pure first-principles drone-warfare native platforms.

You’re confusing clickbait articles with reality.There have been over 1,200 F-35s built so far, with new ones being built at a rate of about 150 per year. For comparison, that’s nearly as many F-35s built per year as F-22s were built ever, and 1,200 is a large amount for a modern jet fighter. The extremely successful F-15 has seen about that many built since it first entered production over 50 years ago.That doesn’t mean it must be good, but it’s a strong indicator. Especially since the US isn’t the only customer. Many other countries want it too. Some are shying away from it now, but only for political reasons because the US is no longer seen as a reliable supplier.In terms of actual capabilities, it’s the best fighter jet out there save for the F-22, which was far more expensive and is no longer being made. It’s relatively cheap, comparable in cost to alternatives like the Gripen or Rafale while being much more capable.There have been a lot of articles out there about how terrible it is. These fall into a few different categories:* Reasonable critiques of its high development costs, overruns, and delays, baselessly extrapolated to “it’s bad.”* Teething problems extrapolated to “it’s terrible” as if these things never get fixed.* Analyses of outcomes from exercises that misunderstand the purpose and design of exercises. You might see that, say, an F-35 lost against an F-16 in some mock fights. But they’re not going to set up a lot of exercises where the F-35 and F-16 have a realistic engagement. The result of such an exercise would be that the F-16 gets shot out of the sky without ever knowing the F-35 was there. This is uninformative and a waste of time and money. So such a matchup will be done with restrictions that actually make it useful. This might end up in a dogfight, where the F-16 is legitimately superior. This then gets reported as “F-35 worse than F-16,” ignoring the fact that a real situation would have the F-35 victorious long before a dogfight could occur.* Completely legitimate arguments that fighter jets are last century’s weapons, that drones and missiles are the future, and the F-35 is like the most advanced battleship in 1941: useful, powerful, but rapidly becoming obsolete. This may be true, but if it is, it only means the F-35 wasn’t the right thing to focus on, not that it’s a failure. The aircraft carrier was the decisive weapon of the Pacific war but that didn’t make the Iowa class battleships a failure.

They oxygen delivery system fails and has left pilots hypoxic.<a href="https:&#x2F;&#x2F;www.nwfdailynews.com&#x2F;story&#x2F;news&#x2F;local&#x2F;2021&#x2F;08&#x2F;02&#x2F;f-35-pilot-breathing-system-concerns-u-s-house-subcommittee&#x2F;5414460001&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.nwfdailynews.com&#x2F;story&#x2F;news&#x2F;local&#x2F;2021&#x2F;08&#x2F;02&#x2F;f-3...</a>The electrical system performs poorly under short circuit conditions.<a href="https:&#x2F;&#x2F;breakingdefense.com&#x2F;2024&#x2F;10&#x2F;marine-corps-reveals-what-went-wrong-in-2023-missing-f-35-saga&#x2F;" rel="nofollow">https:&#x2F;&#x2F;breakingdefense.com&#x2F;2024&#x2F;10&#x2F;marine-corps-reveals-wha...</a>They haven&#x27;t even finished delivering and now have to overhaul the entire fleet due to overheating.<a href="https:&#x2F;&#x2F;nationalsecurityjournal.org&#x2F;the-f-35-fighters-2-big-problems-that-wont-go-away&#x2F;" rel="nofollow">https:&#x2F;&#x2F;nationalsecurityjournal.org&#x2F;the-f-35-fighters-2-big-...</a>This program was a complete and total boondoggle. It was entirely the wrong thing to build in peace time. It was a moonshoot for no reason other than to mollify bored generals and greedy congresspeople.

The research and development effort went way over budget, the first couple rounds of production were fraught with difficulty, and the platform itself has design issues from being a “one-size-fits-all” compromise (despite also having variants for each service).I haven’t heard anything particularly bad about the software effort, other than the difficulties they had making the VR&#x2F;AR helmet work (the component never made it to production afaik).

Isn&#x27;t the F35 program considered a failure? Or am I confusing it with some other program?

JFS-CPP bans exceptions because you would lose control over the execution of the problem. The HFT crowds didn&#x27;t like it because you&#x27;d add 10ns to a function call.At least before we had zero-cost exceptions. These days, I suspect the HFT crowd is back to counting microseconds or milliseconds as trades are being done smarter, not faster.

There are at least some HFT players who actually use exceptions to avoid branches on the infrequent-but-speed-critical execution path: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;KHlI5NBbIPY?si=VjFs7xVN0GsectHr" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;KHlI5NBbIPY?si=VjFs7xVN0GsectHr</a>

I wonder how these compare to high frequency training standards. It seems like they&#x27;d have similar speed&#x2F;reliability&#x2F;predictability requirements in the critical paths.

For situations where you do want to handle allocation failure, GLib provides g_try_malloc and related functions that can return NULL. The key insight is making the common case automatic and the exceptional case explicit. The g_new macro is particularly nice because it is type-aware. Instead of writing g_malloc of sizeof times count and then casting, you write g_new of type and count, and it handles the sizing and casting automatically while checking for overflow in the multiplication.Reference counting is another critical component of GLib&#x27;s memory management, particularly for objects. The GObject system, which is GLib&#x27;s object system for C, uses reference counting to manage object lifetimes. Every object has a reference count starting at one when created. When you want to keep a reference to an object, you call g_object_ref. When you are done with it, you call g_object_unref. When the reference count reaches zero, the object is automatically destroyed. This is the same model used by shared_ptr in C++ or reference counting in Python, but implemented in pure C.This also integrates with the autoptr system. Many GLib types are reference counted, and their cleanup functions simply decrement the reference count. This means you can declare a local variable with g_autoptr, the reference count stays positive while you use it, and when the variable goes out of scope the reference is automatically released. If you were the last holder of that reference, the object is freed. If other parts of the code still hold references, the object stays alive. This solves the resource sharing problem that makes manual memory management so difficult in C.GLib also provides memory pools through GMemChunk and the newer slice allocator, though the slice allocator is being phased out in favor of standard malloc since modern allocators have improved significantly. The concept was to reduce allocation overhead and fragmentation for programs that allocate many small objects of the same size. You create a pool for objects of a specific size and then allocate from that pool quickly without going through the general purpose allocator. When you are done with all objects from that pool, you can destroy the entire pool at once. This pattern shows up in many high-performance C programs but GLib provided it as a reusable component.The error handling story in GLib deserves special attention because it demonstrates how automatic cleanup enables better error handling patterns. The GError type is a structure that carries error information including a domain, a code, and a message. Functions that can fail take a GError double pointer as their last parameter. If the function succeeds, it returns true or a valid value and leaves the error NULL. If it fails, it returns false or NULL and allocates a GError with details about what went wrong. The calling code checks the return value and if there was an error, examines the GError for details.The critical part is that GError is automatically freed when declared with g_autoptr. You can write a function that calls ten different operations, each of which might set an error, and you can check each one and return early if something fails, and the error is automatically freed on all code paths. You never leak the error message string, never double-free it, never forget to free it. This is a massive improvement over traditional C error handling where you either ignore errors or write incredibly tedious cleanup code with goto statements jumping to labels at the end of the function.The GNOME developers could have switched to C++ or Rust or any modern language, but instead they invested in making C excellent at what C is good at. They added just enough infrastructure to eliminate the common pitfalls without fundamentally changing the language. A C programmer can read GLib code and understand it immediately because it is still just C. The auto macros are syntactic sugar over a compiler attribute, not a new language feature requiring a custom compiler.This philosophy aligns pretty well with what the F-35 programmers want: the performance and predictability of C with the safety of automatic resource management. No hidden allocations, no virtual dispatch overhead, no exception unwinding cost, no template instantiation bloat. Just deterministic cleanup that happens exactly when you expect it to happen because it is tied to lexical scope, which is something you can see by reading the code.I found it sort of surprising that the solution to modern C was not a new language or a massive departure from traditional practices. The cleanup attribute has been in GCC since 2003. Reference counting has been around forever. The innovation was putting these pieces together in a coherent system that feels natural to use and composes well.Sometimes the right tool is not the newest or most fashionable one, but the one that solves your actual problem with the least additional complexity. GLib proves you can have that feature in C, today, with compilers that have been stable for decades, without giving up the simplicity and predictability that makes C valuable in the first place.

The C++ standard for the F-35 fighter jet prohibits ninety percent of C++ features because what they are actually after is C with destructors. I was just thinking about how to write C in a modern way today and discovered GLib has an enormous about of useful C++ convieniences in plain C.Reading through the JSF++ coding standards I see they ban exceptions, ban the standard template library, ban multiple inheritance, ban dynamic casts, and essentially strip C++ down to bare metal with one crucial feature remaining: automatic destructors through RAII. When a variable goes out of scope, cleanup happens. That is the entire value proposition they are extracting from C++, and it made me wonder if C could achieve the same thing without dragging along the C++ compiler and all its complexity.GLib is a utility library that extends C with better string handling, data structures, and portable system abstractions, but buried within it is a remarkably elegant solution to automatic resource management that leverages a GCC and Clang extension called the cleanup attribute. This attribute allows you to tag a variable with a function that gets called automatically when that variable goes out of scope, which is essentially what C++ destructors do but without the overhead of classes and virtual tables.The heart of GLib&#x27;s memory management system starts with two simple macros: g_autofree and g_autoptr. The g_autofree macro is deceptively simple. You declare a pointer with this attribute and when the pointer goes out of scope, g_free is automatically called on it. No manual memory management, no remembering to free at every return path, no cleanup sections with goto statements. The pointer is freed whether you return normally, return early due to an error, or even if somehow the code takes an unexpected path. This alone eliminates the majority of memory leaks in typical C programs because most memory management is just malloc and free, or in GLib&#x27;s case, g_malloc and g_free.The g_autoptr macro is more sophisticated. While g_autofree works for simple pointers to memory, g_autoptr handles complex types that need custom cleanup functions. A file handle needs fclose, a database connection needs a close function, a custom structure might need multiple cleanup steps. The g_autoptr macro takes a type name and automatically calls the appropriate cleanup function registered for that type. This is where GLib shows its maturity because the library has already registered cleanup functions for all its own types. GError structures are freed correctly, GFile objects are unreferenced, GInputStream objects are closed and released. Everything just works.Behind these macros is something called G_DEFINE_AUTOPTR_CLEANUP_FUNC, which is how you teach GLib about your own types. You write a cleanup function that knows how to properly destroy your structure, then you invoke this macro with your type name and cleanup function, and from that moment forward you can use g_autoptr with your type. The macro generates the necessary glue code that connects the cleanup attribute to your function, handling all the pointer indirection correctly. This is critical because the cleanup attribute passes a pointer to your variable, not the variable itself, which means for a pointer variable it passes a double pointer, and getting this wrong leads to crashes or memory corruption.The third member of this is g_auto, which handles stack-allocated types. Some GLib types like GString are meant to live on the stack but still need cleanup. A GString internally allocates memory for its buffer even though the GString structure itself is on the stack. The g_auto macro ensures that when the structure goes out of scope, its cleanup function runs to free the internal allocations. Heap pointers, complex objects, and stack structures all get automatic cleanup.What&#x27;s interesting about this system is how it composes. You can have a function that opens a file, allocates several buffers, creates error objects, and builds complex data structures, and you can simply declare each resource with the appropriate auto macro. If any operation fails and you return early, every resource declared up to that point is automatically cleaned up in reverse order of declaration. This is identical to C++ destructors running in reverse order of construction, but you are writing pure C code that works with any GCC or Clang compiler from the past fifteen years.The foundation beneath all this is GLib&#x27;s memory allocation functions. The library provides g_malloc, g_new, g_realloc and friends which are drop-in replacements for the standard C allocation functions. These functions have better error handling because g_malloc never returns NULL. If allocation fails, the program aborts with a clear error message. This might sound extreme but for most applications it is actually the right behavior. When malloc returns NULL in traditional C code, most programmers either do not check it, check it incorrectly, or check it but then do not have a reasonable recovery path anyway. GLib acknowledges this reality and makes the contract explicit: if you cannot allocate memory, the program terminates cleanly rather than stumbling forward into undefined behavior.

AUTOSAR&#x27;s free pdf file Guidelines for the use of the C++14 language in critical and safety-related systems (defined as an update to MISRA C++ 2008) - <a href="http:&#x2F;&#x2F;www.autosar.org&#x2F;fileadmin&#x2F;standards&#x2F;R18-10_R4.4.0_R1.5.0&#x2F;AP&#x2F;AUTOSAR_RS_CPP14Guidelines.pdf" rel="nofollow">http:&#x2F;&#x2F;www.autosar.org&#x2F;fileadmin&#x2F;standards&#x2F;R18-10_R4.4.0_R1....</a>Note that both MISRA and AUTOSAR&#x27;s guidelines have been combined into a single standard &quot;MISRA C++ 2023&quot; which has been updated for C++17.Breaking Down the AUTOSAR C++14 Coding Guidelines - <a href="https:&#x2F;&#x2F;www.parasoft.com&#x2F;blog&#x2F;breaking-down-the-autosar-c14-coding-guidelines-for-adaptive-autosar&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.parasoft.com&#x2F;blog&#x2F;breaking-down-the-autosar-c14-...</a>

You think a fighter jet should run Ruby on rails instead?

You raise a good point. No trolling: I wonder what languages they seriously considered? Example: I am sure the analysis included C in the mix. Also, I wonder if they considered compiler extensions. Example: Since C doesn&#x27;t have destructors, maybe you could add a compiler extension to add the defer keyword to allow people to schedule object destruction. Even when they decided upon C++, I am sure there was a small holy war to decide what features were allowed. When they started the JSF programmed in the 1990s, C++ compilers were pretty terrible!

what would be so obviously better choice of language in your opinion?

Ahhh. They use C++.....That explains all the delays on the F-35....,

There isn&#x27;t much of a conversation to be had here. For low-level systems code, exceptions introduce a bunch of issues and ugly edge cases. Error codes are cleaner, faster, and easier to reason about in this context. Pretty much all systems languages use error codes.In C++, which supports both, exceptions are commonly disabled at compile-time for systems code. This is pretty idiomatic, I&#x27;ve never worked on a C++ code base that used exceptions. On the other hand, high-level non-systems C++ code may use exceptions.

I guess a bigger conversation could be had in regards to:what leads to better code in terms of understandability &amp; preventing errorsExceptions (what almost every language does) or Error codes (like Golang)are there folks here that choose to use error codes and forgo Exceptions completely ?

program like a fighter pilot? that makes no sense.

I think the late Robert Dewar once quipped that modern jet fighters aren&#x27;t safety-critical applications because the aircraft disintegrates immediately if the computer system fails.

&quot;Launching nuclear rockets&quot; just became literal.

You mean fighters ARE coded in C++? My god

Her point about exceptions vs error codes was that one failed to catch exception of particular and and things went south meanwhile if we instead &quot;catch&quot; error code all will be nice and dandy. Well one might fail to handle error codes just as well.That is of course not to say that exceptions and error codes are the same.

In 1994 C++ compilers were buggy, and a modernization of the C++ allowed features list is still stuck in a committee somewhere?

If in 1994 Joe Armstrong and Alan Kay were to list 7 alternative languages to C++ for programming fighter jets, what would they have done?

Paging our Ada fanboys! You&#x27;re missing it!

I worked on the same for many years; same deal - playout system for broadcast, years of uptime, never miss a frame.The C++ was atrocious. Home-made reference counting that was thread-dangerous, but depending on what kind of object the multi-multi-multi diamond inheritance would use, sometimes it would increment, sometimes it wouldn&#x27;t. Entire objects made out of weird inheritance chains. Even the naming system was crazy; &quot;pencilFactory&quot; wasn&#x27;t a factory for making pencils, it was anything that was made by the factory for pencils. Inheritance rather than composition was very clearly the model; if some other object had function you needed, you would inherit from that also. Which led to some object inheriting from the same class a half-dozen times in all.The multi-inheritance system given weird control by objects on creation defining what kind of objects (from the set of all kinds that they actually were) they could be cast to via a special function, but any time someone wanted one that wasn&#x27;t on that list they&#x27;d just cast to it using C++ anyway. You had to cast, because the functions were all deliberately private - to force you to cast. But not how C++ would expect you to cast, oh no!Crazy, home made containers that were like Win32 opaque objects; you&#x27;d just get a void pointer to the object you wanted, and to get the next one pass that void pointer back in. Obviously trying to copy MS COM with IUnknown and other such home made QueryInterface nonsense, in effect creating their own inheritance system on top of C++.What I really learned is that it&#x27;s possible to create systems that maintain years of uptime and keep their frame accuracy even with the most atrocious, utterly insane architecture decisions that make it so clear the original architect was thinking in C the whole time and using C++ to build his own terrible implementation of C++, and THAT&#x27;S what he wrote it all in.Gosh, this was a fun walk down memory lane.

I&#x27;ve worked on a playout system for broadcast television. The software has to run for years at a time and not have any leaks, We need to send out one frame of television exactly on time, every time.It is &quot;C++&quot;, but we also follow the same standards. Static memory allocation, no exceptions, no recursion. We don&#x27;t use templates. We barely use inheritance. It&#x27;s more like C with classes.

They also can simply fail, if you are out of memory or your heap is hopelessly fragmented. And they take an unpredictable amount of time. That&#x27;s very bad if you&#x27;re trying to prove that you satisfy the worst-case timing requirement.

yup, same for any real time code, new&#x2F;malloc&#x2F;free&#x2F;delete use hidden mutexes and can cause priority inversion as a result - heisenbugs, that audio&#x2F;video dropout that happens rarely and you can&#x27;t quite catch - best to code to avoid them

That&#x27;s standard in the games industry as well. Plus many others like no rtti, no huge dependencies like boost, no smart pointers, generally avoid ctors &#x2F; dtors, etc.

Most large open-source projects ban exceptions, often because the project was originally converted from C and is just not compatible with non-local control flow. Or the project originated within an organization which has tons of C++ code that is not exception-safe and is expected to integrate with that.Some large commercial software systems use C++ exceptions, though.Until recently, pretty much all implementations seemed to have a global mutex on the throw path. With higher and higher core counts, the affordable throw rate in a process was getting surprisingly slow. But the lock is gone in GCC&#x2F;libstdc++ with glibc. Hopefully the other implementations follow, so that we don&#x27;t end up with yet another error handling scheme for C++.

Google style bans them: <a href="https:&#x2F;&#x2F;google.github.io&#x2F;styleguide&#x2F;cppguide.html#Exceptions" rel="nofollow">https:&#x2F;&#x2F;google.github.io&#x2F;styleguide&#x2F;cppguide.html#Exceptions</a>

Lots of games, and notably the Unreal Engine, compile without exceptions. EASTL back in the day was in part written to avoid the poor no-exception support in Dinkumware STL and STLport.

Has anyone else here banned exceptions (for the most part) in less critical settings (like a web app)?I feel like that&#x27;s the way to go since you don&#x27;t obscure control flow. I have also been considered adding assertions like TigerBeetle does<a href="https:&#x2F;&#x2F;github.com&#x2F;tigerbeetle&#x2F;tigerbeetle&#x2F;blob&#x2F;main&#x2F;docs&#x2F;TIGER_STYLE.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tigerbeetle&#x2F;tigerbeetle&#x2F;blob&#x2F;main&#x2F;docs&#x2F;TI...</a>

If you compile with -fno-exceptions you just lost almost all of the STL.You can compile with exceptions enabled, use the STL, but strictly enforce no allocations after initialization. It depends on how strict is the spec you are trying to hit.

Large parts of the standard library malloc&#x2F;free.

What industry do you work in? Modern RAII practices are pretty prevalent

i.e. standard practice for every C++ code base I&#x27;ve ever worked on

In C, tail recursion is a fairly simple rewrite. I can&#x27;t think of any complications.But ... that rewrite can increase the cyclomatic complexity of the code on which they have some hard limits, so perhaps that&#x27;s why it isn&#x27;t allowed? And the stack overflow, of course.

The tail recursion operator is a nice idea, but the extra `become` keyword is annoying. I think the syntax should be `return as`: it uses existing keywords, is unambiguous and starts with `return` which tail recursion is a special case of.

Forbidding recursion is pretty annoying. One of the nice things that&#x27;s on the distant horizon for Rust is an explicit tail recursion operator perhaps named `become`. Unlike naive recursion, which as this video (I haven&#x27;t followed the link but I&#x27;m assuming it is Laurie&#x27;s recent video) explains risks stack overflow, optimized tail recursion doesn&#x27;t grow the stack.The idea of `become` is to signal &quot;I believe this can be tail recursive&quot; and then the compiler is either going to agree and deliver the optimized machine code, or disagree and your program won&#x27;t compile, so in neither case have you introduced a stack overflow.Rust&#x27;s Drop mechanism throws a small spanner into this, in principle if every function foo makes a Goose, and then in most cases calls foo again, we shouldn&#x27;t Drop each Goose until the functions return, which is too late, that&#x27;s now our tail instead of the call. So the `become` feature AIUI will spot this, and Drop that Goose early (or refuse to compile) to support the optimization.

Relax the dynamic-memory restriction to &quot;limit per-event memory allocation to the bump allocator&quot; and it&#x27;s still mostly true for many AAA&#x2F;AAAA games I work on today.

This is basically video games prior to 2010

Semi serious idea: A lot of people (including me) write C++ but it&#x27;s basically C plus a small set of really ergonomic and useful C++ features (eg references). This should be standardised as a new language called C+

For a long time, at least in MS and Intel, the C++ compilers were better than the C compilers.

You may still want to use classes (where they make sense), references (cleaner syntax than pointers), operator overloading, etc. For example, a linear algebra library is far nicer to write and use in C++.

Re: recursion. She explains in her video. Per requirements, the stack capacity has to be statically verifiable, and not dependent on runtime input.

At that point, why not write in C? Do they think it&#x27;s C&#x2F;C++ and not understand the difference?&gt; no recursionDoes this actually mean no recursion or does it just mean to limit stack use? Because processing a tree, for example, is recursive even if you use an array, for example, instead of the stack to keep track of your progress. The real trick is limiting memory consumption, which requires limiting input size.

TL;DR- no exceptions- no recursion- no malloc()&#x2F;free() in the inner-loop

It probably does! It is just that in your problem space the price of failure is low enough that you can get away with it. But most experienced programmers tend to stick to a very rigid subset of simple and reliable constructs and stay as far away from any architecture astronaut inspired features as they can.

Most of their reasoning doesn&#x27;t apply to my problem space.

I don&#x27;t consider C# a very large language. Most of what has been added removed boilerplate code. Swift, a much younger language, is way more complicated IMO

Check C# 10, Python 3.14, D, Haskell,...

even with 90% of c++ features banned, the language remains ~5x larger than every other programming language

PDF: <a href="https:&#x2F;&#x2F;www.stroustrup.com&#x2F;JSF-AV-rules.pdf" rel="nofollow">https:&#x2F;&#x2F;www.stroustrup.com&#x2F;JSF-AV-rules.pdf</a>

The C++ standard for the F-35 Fighter Jet [video]

Turtletoy

Emacs is my new window manager

Damn Small Linux

I failed to recreate the 1996 Space Jam website with Claude

Bag of words, have mercy on us

Dollar-stores overcharge customers while promising low prices

Mechanical power generation using Earth's ambient radiation

Google Titans architecture, helping AI have long-term memory

Work disincentives hit the near-poor hardest (2022)

Uninitialized garbage on ia64 can be deadly (2004)

An Interactive Guide to the Fourier Transform

Solving Rush Hour, the Puzzle (2018)

The Anatomy of a macOS App

<a href="https:&#x2F;&#x2F;archive.is&#x2F;jEJAj" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;jEJAj</a>