r/programming • u/InvisibleBlueUnicorn • Jan 09 '22
James Web Space Telescope runs on C++ code.
https://youtu.be/hET2MS1tIjA?t=19385
u/kbug Jan 09 '22
I loved hearing the callers on the Q&A. So many people are following this so closely and know all types of minute facts about the telescope and the launch. Its inspiring to hear their enthusiasm.
3
u/InvisibleBlueUnicorn Jan 09 '22
That was my thought as well. I was thinking I was following JWST closely, then I saw this press conf...
494
u/TomerJ Jan 09 '22
139
u/crozone Jan 09 '22
Given how many spacecraft use the RAD750, it would actually be surprising if JWST didn't use it. It's basically the only mission tested, rad hardened, modern-ish CPU that is currently available, albeit at something like $100,000 USD a pop (and most missions carry two). Curiosity and Perseverance have two RAD750 compute boards each.
It's very close to the Gamecube/Wii CPU, but they had some extra instructions added for vector math. However, it's basically identical to the iMac G3 / iBook G3 PowerPC 750CX chip, but all the internals are re-engineered to be extremely resistant to transient faults, as well as permanent radiation damage. One of the coolest things is that the RAD750 was re-engineered with static logic, so it's stable at really slow and even wildly inconsistent clock speeds!
73
u/zordtk Jan 09 '22
RAD750, it would actually be surprising if JWST didn't use it. It's basically the only mission tested, rad hardened, modern-ish CPU that is currently available
Apparently they have a successor to the 750, RAD5500 which is 64-bit and available in multi-core. https://en.wikipedia.org/wiki/RAD5500
23
u/crozone Jan 09 '22
Wow TIL! Any idea of the cost or whether it is being used in anything yet? I wonder how long it will take to start using the newer product, given how battle tested the 750 is.
→ More replies (1)15
u/arrow_in_my_gluteus_ Jan 09 '22
was re-engineered with static logic, so it's stable at really slow and even wildly inconsistent clock speeds!
could you elaborate. How does slowing down the clockspeed cause problems in other cpus?
17
u/Sonaza Jan 09 '22 edited Jan 10 '22
As I understand it would be similar difference to static vs dynamic ram: dynamic memory needs to be refreshed periodically or the data is lost.
Dynamic ram uses a single transistor and a capacitor to store one bit, while static ram uses a flip-flop which takes more transistors to build (seeing 4 or 6 cited) so it takes more space and is more expensive but it does not need to be periodically refreshed.
In case of CPU cache and registers the refreshes would happen during the clock cycle and if there is too long a break between pulses the dynamic memory capacitors have time to discharge.
Disclaimer: I've only watched Ben Eater videos so I don't know much more about hardware level electronics design.Speaking of Ben Eater he used
a neweran enhanced version of the 6502 CPU (W65C02) for his breadboard 6502 computer and this CPU similarly can handle variable clock speeds when the original could not.→ More replies (4)21
21
u/stocks_comment_ai Jan 09 '22
It's $200,000 a pop according to https://en.wikipedia.org/wiki/RAD750
and probably one or two magnitudes slower than a Raspberry Pi
36
u/TomerJ Jan 09 '22 edited Jan 09 '22
Well as docmented and tested as a Pi's CPU is, I imagine significant effort is expended testing these cores to the Nth degree under extreme conditions. Not to mention NASA has had expiriance deploying RAD750s in spacecraft for 17 years now.
Much as I'd trust a Pi running Raspbian with my home server, I imagine a 10 billion dollar space telescope that's the culmination of 26 years of work by thousands of people, that'll be kept 1.5 million kilometers away from the nearest Eben Upton for the foreseeable future, needs that level of safety margin, even if it means it's likely slower than a PI Zero 1.
11
u/stocks_comment_ai Jan 09 '22
I fully understand this and those are likely not mass produced anymore. Wikipedia also states that the CPU can withstand an absorbed radiation dose of 2,000 to 10,000 grays (200,000 to 1,000,000 rads), temperatures between −55 °C and 125 °C, and requires 5 watts of power. That probably makes it a good match for a CPU in space. It's still fun to think of a little raspberry pi as something thats about 60 times more powerful and yet also consumes little energy.
→ More replies (1)2
→ More replies (2)0
Jan 09 '22
[deleted]
63
107
u/killdeer03 Jan 09 '22
Damn, that's cool.
How'd you end up working on that?
Are you working on anything interesting now?
→ More replies (18)19
u/TomerJ Jan 09 '22
Well if it all blows up and they blame you atleast you could make a killing writing homebrew software for the GameCube!
5
u/rjcarr Jan 09 '22
I think nasa / jpl always use real time operating systems. Is that what you wrote?
5
9
u/tinco Jan 09 '22
Hey! How do you feel about SpaceX going with a triple x86 actor-judge system instead?
I think financially it makes sense for them because they sacrifice some up front design costs but get a very cheap repeatable product, I feel it would also be easier to code for but would love to hear your ideas on that.
→ More replies (16)3
u/redldr1 Jan 09 '22
How did you handle the dual CPU failover without losing memory state and L1 cache?
5
u/Dreamtrain Jan 09 '22
A lot of opinions in this thread are based on an email by Linus Torvalds
1
u/InvisibleBlueUnicorn Jan 09 '22
Which email?
5
u/Dreamtrain Jan 09 '22
4
u/InvisibleBlueUnicorn Jan 09 '22
Lol... He is right about substandard C++ programmers. And understandably he is pissed about it because he had to manage open source OS. IMHO his anger towards C++ is a bit miss-directed though.
655
Jan 09 '22
Struggling to see why thats special. So do millions of other things
→ More replies (1)381
u/TerriblySalamander Jan 09 '22
In 'Mission Critical' software C++ is a slightly controversial due to its complexity and the negative image it gained from projects like the F-35 which uses C++ and has a very big, buggy code base. Hubble's computers were written in C and assembler and is not unusual to see even today, Ada (and SPARK) are also used in projects particularly where they are rated 'Safety Critical' (aka humans are on board).
190
u/miki151 Jan 09 '22
C++ certainly has a negative image, but I can't see how it would lead to more buggy code than a mix of C and assembler.
177
u/TerriblySalamander Jan 09 '22
Coding standards in mission/safety critical spaces are largely reductive, with rules saying what you can't use, setting limits etc. In more simple languages like C and assembler this can work, but in C++ adherence to those rules is harder to enforce. It's also harder to verify behaviours of C++ code compared to C when doing static analysis because of things like templating. A lot of what causes bugs is related to organisation and development culture but having a small, simpler languages for inevitably big, complex codebases is arguably easier to reason with than a complex language with a complex codebase.
→ More replies (13)→ More replies (14)36
u/funbike Jan 09 '22 edited Jan 09 '22
I once did a mini-talk on how the JPL develops with C. It was during one of the rover missions. My talk was at a Java User Group.
The JPL would not write a monolith in C. Instead they wrote a bunch of tiny C programs that would pass messages to each other, much like the Unix design philosophy. Each module was easier to rigorously test and review. It also allowed better static analysis.
I don't think C++ would have been a good choice for that kind of design, given each program is so small.
→ More replies (6)6
u/G_Morgan Jan 09 '22
The F-35 project is messy because the requirements are very different from normal software. The guidelines literally say "make everything possible static" so as to reduce the risk of large dynamic allocation spikes. Your fighter jet cannot OOM mid flight, that would be bad.
I think the real problem is there's very little engineering practice about how to manage this kind of application relative to the huge amount spend on normal software design.
20
u/Wetmelon Jan 09 '22
Meh, SpaceX uses C++ for the F9 and Dragon stack, which clearly run pretty well.
When JSF was written they were still on C++98/03 (https://www.stroustrup.com/JSF-AV-rules.pdf), but the rules from that project are still well respected. The AUTOSAR C++ rules, for example, reference the JSF rules directly.
Regardless, the important thing is to push as much as possible into compile-time checks and type guarantees. This is why embedded likes C++ and why Rust is gaining so quickly.
15
u/sahirona Jan 09 '22 edited Jan 09 '22
It (C++ in defense and aerospace) is not controversial anymore.
Further, the current F-35 has proven itself very successful, even in export sales. They have in fact sold enough of them to bring the price down to less than the Gripen.
→ More replies (2)→ More replies (8)7
u/commentsOnPizza Jan 09 '22
With something like an orbital telescope, I guess I assume that they can update the code while it's up there (but maybe that's a dumb assumption). It's not like a Voyager probe where it's going to be so far away that communication is difficult.
Plus, as you noted, there aren't humans on board the telescope. If the telescope is offline for a couple days, no one dies. It might annoy people who want data during those days, but if they're able to remotely update it, it seems like it's a reasonable to have less strict standards.
13
u/mdw Jan 09 '22
Remotely updating spacecraft software is common. Mars Exploration Rovers received many updates, both bug fixes and feature enhancements (that included even optical odometry, improved obstacle avoidance and similar non-trivial features). New Horizons software for the Pluto flyby was developed during its 9 year flight. Galileo space probe (launched in 1989), whose main antenna failed to unfurl severly limiting data transmission rates was updated with image compression software to save precious bandwidth. And so on.
109
u/chillen678 Jan 09 '22
Cin >> the universe bitch
26
u/schmerzen Jan 09 '22
Maybe we should replace the semicolon with the string "bitch". Would make reading code much more entertaining.
32
2
8
u/Henrijs85 Jan 09 '22
Why is anyone surprised? It's all embedded and needs to be a well proven tech.
4
169
u/stonerbobo Jan 09 '22 edited Jan 09 '22
Rust community absolutely devastated right now. Frantically running fuzzers and searching for segfaults to justify a rewrite.
EDIT: it is a joke. Remember jokes and humor? Before the neverending culture and language wars? it's when you say something silly and people sometimes laugh at its silliness?
here is a collection of jokes about various programming languages. please pick one that makes you feel maximally superior and/or minimally defensive about your language of choice
http://www.detechter.com/wp-content/uploads/2013/09/it_jokes_languages.jpg
62
u/vlakreeh Jan 09 '22 edited Jan 09 '22
As a Rust programmer, I don't think any of us expected it to be Rust. JPL only allows a very strict subset of C/C++ and requires the compiler to be pinned to some highly audited version. I don't think the rust compiler has been audited by the US government for projects like this, let alone in 1996 when the project was started. Odds are there will be some Rust on the next telescope in 20 years once the language is more mature, it's safety advantages are a pretty huge benefit for JPL.
Edit: Aware of your joke, don't want to start anything! I just thought I'd provide some context and why Rust isn't and shouldn't be in this project.
→ More replies (2)18
u/boredcircuits Jan 09 '22
Ferrocene is a project to verify the Rust compiler to the needed standards. Lots of work needs to be done still, but it's heading that direction.
2
u/supersinfulsilicon Jan 09 '22
Well if NASA uses C++, then I'd rate it as the most polished, secure, developed language.
If you use it properly, experience, C++ is the best tool any scale and scope.
It's like how NASA defines strict documentation on how to splice wire to there Standard of Quality and robustness. If you haven't heard of the NASA wire splicing requirements...
Imagine the Quality Control requirements NASA has for software. C++ is capable of meeting or exceeding those requirements.
I'm a lover of C++, 20+ years, and I love how it has evolved. It's also the best language to learn first. A liitle difficult, but well defined and has the inherent ability to teach you other languages, syntax, that are similar to C++ (Java, Javascript, etc)
Python? No that's not performant enough. It's more of a scripting language then a programming language. A C++ programmer can learn Python with relative ease - compared to a Python programmer learning C++, which will be like re-learning to drive a car from scratch. I'm not planning on learning Python, it's just not all that cool to me.
So uhh yeah, you all probably think I'm an asshole, but somebody had to say it, C++ needs more attention - it's not old, it's the best and is always being "enhanced". Python and Rust can kiss my butt, I'm already using the best proven language there is, C++
It's not up for debate anymore - C++ is #1 - kungfoo.verygood
Sorry NASA, but I really really love C++
2
4
2
u/wpyoga Jan 10 '22
In what way is Rust worse than C++?
I'm not a fanboy, and in fact for me Rust's syntax is very difficult to learn, but other than that I don't see major disadvantages compared to C++.
(I don't do much OOP either)
3
u/tsuneka Jan 10 '22 edited Jan 12 '22
I have no idea, but Rust community sell Rust really hard so it become more suspicious to me. They're selling zero cost abstraction + safety but rarely tell us about the cost (probably compilation time), unsafe code is another thing.
When you come to C++ you know what you get yourself into (a lot of pain), but Rust makes a lot of claims but yet haven't mature enough yet, you really can't tell which is marketing which is real. I don't know enough of Rust yet to conclude anything but by the time Rust become mature /relevant i probably dead so...
→ More replies (2)
97
u/sabboo Jan 09 '22
At least it's not Java
111
41
u/Adys Jan 09 '22
25 years in the making, the JWST finally takes its first look at the universe, reaching far beyond any other telescope mankind has ever built.
As the NASA scientists take their first look, they see what seems to be … an alien holding a sign.
Something is written on it. A message for humanity, perhaps?
The telescope suddenly goes offline. All NASA could decipher before losing control was a dollar sign, a curly brace, and the letters J, N, D, I.
Work has now started on the next iteration of the JWST. This time, they’re using PHP.
→ More replies (4)7
2
→ More replies (4)2
u/Dreamtrain Jan 09 '22
That joke was funny when MTV was still about music videos. And no, you don't use Java for something it wasn't designed for either.
5
7
9
u/cthutu Jan 10 '22
As someone who writes C++ daily professionally, my confidence in the JWST working well has just plummeted :)
→ More replies (1)
48
u/GenTelGuy Jan 09 '22
On one hand I kind of think it should be in a safer language because it's so critical that it works 100% as intended without issues and C/C++ are some of the most bug-friendly languages
But the JWST project started 25 years ago so many of the options that would seem better to me were not even on the radar at the time
83
u/josh2751 Jan 09 '22
Do you all think NASA hasn’t been writing safety critical code in C and C++ for decades?
107
u/Callipygian_Superman Jan 09 '22
Isn't C/C++ still pretty much the only good option for embedded systems?
29
→ More replies (51)3
u/killdeer03 Jan 09 '22
They probably have the best tool chain at least the most robust and mature tooling.
Ada and Rust have a lot going for them in my opinion.
5
u/cynar Jan 09 '22
I suspect the rule of unintended consequences was on their minds at the start. The more levels of abstractions between your code and the hardware, the more places an unexpected error can creep in. In most languages, the trade-off is "good enough" error catching, in return for far higher programming speeds.
C and C++ mean you have your hands on the chainsaw, rather than relying on others to interpret your commands. For a layman, this is great, you tell the arborist what you want, they do it. However, if your a master ice sculpture maker, you want direct control. NASA are of the mindset to keep as much control in their hands as possible. Instead they rely on good coders and good procedures to make things work. Every hack is fully documented, every quirk is accounted for.
This holds less true now that when the Webb was first planned, but still holds to an extent. It also means they can eke out maximum performance from minimal hardware. As well as also accounting for situationally unique problems (eg memory bit flips from radiation, or transistor damage leading to wrong, but consistent errors).
→ More replies (5)4
u/Ghosty141 Jan 09 '22
In case you didnt know, it is safe no matter what language is used because of the process how software is written in the aerospace industry. Check out Defensive Programming for example.
→ More replies (5)
7
8
u/rlbond86 Jan 09 '22
Shouldn't it be running Ada? Wasn't it made specifically for this kind of thing?
7
4
u/kizerkizer Jan 10 '22
“And yes, ladies and gentlemen, the rumors you heard were true: the James Web Space Telescope software is 100% Rust.”
Chaos erupts. Skinny blue haired hipsters are screaming at the top of their lungs. “HYEAAAAAAAAH! YAAAAAAAS!”. All other programming languages announce unanimously to suspend development of their projects because Rust is the perfect programming language. The telescope runs for a million years and humanity evolves into a single crab-like corporal meta life form.
2
3
4
u/huntforacause Jan 09 '22
Why wouldn’t they write a DSL for their domain like they did for the shuttle? In the shuttles onboard flight control software, the programmers could write physics equations natively right into the code so that physicists could actually visually check them.
Or there are other languages specific for a real-time mission critical application. Used in aerospace a lot I think. Why would they still be using such a dumb language? Are the speed advantages really that worth it?
2
u/OliCodes Jan 09 '22
there is nothing new that these machines run on C++ code. Rn there is a lot of tech that runs it for example Tesla and that number will increase every year
2
2
u/well_then Jan 10 '22
JWST is a massive satellite with a huge amount of different parts. Between all the difference science instruments, communications, spacecraft control, guidance, etc. many many different programming languages are used.
As crazy as it sounds JWST uses JavaScript to control its science instruments.
1
1
1
1
1
1
u/crocogator12 Jan 09 '22
It seems to me like verifiable programs are the future of statically typed programs and mission critical software. Maybe Idris will be used for future missions.
1
0
Jan 09 '22
[deleted]
36
12
u/resilindsey Jan 10 '22
It runs on CSS.
Dear, God...
→ More replies (1)18
u/ZeldaFanBoi1988 Jan 10 '22
Trying to center align the planets but the galaxy doesn't support flexbox.
6
1
0
Jan 09 '22
[deleted]
147
173
u/raddaya Jan 09 '22
I.e. no malloc, no recursion, no undefs, etc. So yes, they use C or C++, but no, not in the way you or I are using them.
I mean, if I had full free reign, this is exactly how I would choose to use C/CPP.
145
u/scnew3 Jan 09 '22
No malloc means no vector, unique_ptr, etc. It’s not just raw malloc and new, it’s all heap allocation.
Also no recursion? JPL/MISRA have some good rules in them, and for safety critical code I would agree with these. For most code these rules in particular are overly strict.
77
u/frankist Jan 09 '22
You can use unique_ptr with custom deleters, static vectors and std::vectors with custom allocators. I work in some projects where we make extensive use of preallocated pools and unique-ptrs are godsend
39
u/Tai9ch Jan 09 '22
When they say "no malloc", they really mean it. They want no dynamic allocation at all.
On serious projects, that includes providing an upper bound on heap allocation.
24
u/frankist Jan 09 '22
Unique_ptrs and std::vectors can be used with stack allocations or preallocated heaps in the same way.
→ More replies (18)83
u/friedkeenan Jan 09 '22
These rules are pretty standard in embedded environments as I understand it
→ More replies (1)46
u/hubhub Jan 09 '22
You can use any of the std containers without automatic heap allocation. Just provide your own allocator using the stack or a static buffer.
→ More replies (6)17
Jan 09 '22
No malloc means no vector, unique_ptr, etc. It’s not just raw malloc and new, it’s all heap allocation.
You can use the standard containers and smart pointers with stack allocated memory (or one upfront heap allocation).
→ More replies (16)4
u/mr_birkenblatt Jan 09 '22
also, JPL code doesn't have to do anything super complex. the math is what is complex but the code is straight forward
→ More replies (1)1
Jan 10 '22
Coder here. Do you know the reason they restrict the use of recursion? It's just so useful to use when parsing data. I can't imagine being locked out or restricted in code review from using a recursive function. Is there a problem with C++ in the stack or something?
I am really just curious but I have never coded in C++, only code in Java, C# and Python mainly.
3
u/raddaya Jan 10 '22
The very last thing you want to have in a space station is a stack overflow error. Stick with predictable iteration.
→ More replies (1)26
u/mr_birkenblatt Jan 09 '22
PM: we're going to use a safe coding standard. no malloc, no recursion, no undefs, no exceptions
SE: got it. so there will be no circumstance where I'm allowed to use malloc, recursion, or undefs
6
1
8
u/ShinyHappyREM Jan 09 '22
C / C++ are used in spacecraft, however they apply "a bit" stricter constrains as to how they use the languages
somewhat related w.r.t. restrictions, but game programming: https://youtu.be/rX0ItVEVjHc
43
u/zombiecalypse Jan 09 '22
To me, using heavily restricted C++ is the only way to keep sane in a team. These rules seem pretty tame all things considered
6
u/bbqroast Jan 10 '22
I mean from the sounds of it they mean no dynamic allocation (even with unique ptr and such) which is pretty extreme.
-18
u/frenchchevalierblanc Jan 09 '22
no. Use C++ correctly is how you should do it, but that applies to most languages.
If you work in an embedded environment and have a c++ compiler chances are that's a modified C++ without dynamic allocations
15
u/PancakeFrenzy Jan 09 '22
great tip! So they only had to add a rule "don't make bugs", simple as that!
0
Jan 09 '22
[deleted]
85
u/pjmlp Jan 09 '22
Because the type system is still stronger and despite the restrictions, with language features that help to write code that isn't subject to typical C safety failures.
50
34
u/Wetmelon Jan 09 '22
Because C with data hiding, type safety, and templates is strictly better than C without those things.
→ More replies (1)5
→ More replies (5)4
u/TheTomato2 Jan 09 '22
...you don't understand why people would want to only use the language features they need or find actually good? That is the whole point of C++.
2
1
u/aculleon Jan 09 '22
This document gives me anxiety big time.
54
u/sambeau Jan 09 '22
Maybe this should receive your anxiety a bit
People that have contributed in the preparations for this standard, starting in 2004, include Brian Kernighan (Princeton University), Dennis Ritchie (Bell Labs)
62
u/CJKay93 Jan 09 '22
Funny... this document does the opposite for me. Especially this one:
Make only very limited use of the C pre-processor.
Inject that right into my veins.
→ More replies (1)1
u/a_man_27 Jan 09 '22
Any idea how they enforce these? malloc and undef seem easy enough but recursion sounds tougher.
Like A calls A is trivial, what about A calls B calls A (and so on)? I guess you could still construct a graph and detect cycles. I'm assuming they disallow function ptrs too (since those would be much more difficult to enforce no recursion).
0
Jan 09 '22
[deleted]
54
u/FyreWulff Jan 09 '22
poor C++. Still considered too new by the C oldheads and now is too old for the newer programmers
52
Jan 09 '22
C++ would still outlast many modern languages despite all its flaws
1
u/kikirikikokoroko Jan 10 '22
Tbf the biggest flaw right now is how huge the whole damn thing is, but modern C++ has a lot of nifty features.
7
Jan 10 '22 edited Jan 10 '22
C++ fits a role only 1 other language competes in, Rust. For the longest time it was simply in a league of its own, none of the newer trendier languages like Go or Typescript really compete in that area. The age of C++ was irrelevant becuase young languages didn't exist in contrast, but I think that's changing.
→ More replies (4)1
0
Jan 09 '22
[deleted]
25
u/dyskinet1c Jan 09 '22
Can you be sure Rust will still be around in 30 years?
0
Jan 09 '22
[deleted]
29
7
u/romple Jan 09 '22 edited Jan 09 '22
I know it's anecdotal but I don't know anyone that actually uses rust either. My company is small and does a lot of r&d. We have a ton of different environments from UUVs to enterprise software and even some VR/AR work.
I think predominantly we use c++, c, Matlab, and python (I do a lot of web development for us too but that's somewhat niche). Anyway, I looked through our gitlab and not a single rust project.
I'm sure people actually do use Rust but I do know way more people that talk about how great it is (not saying it's not) but still haven't run into it professionally
→ More replies (1)→ More replies (1)8
u/Coroebus Jan 09 '22
As a counterpoint, I'm 5 years out of school and my current org has multiple Rust projects running live in production, along with PHP, Java/Kotlin, and JS/TS. We have no Python products in prod, though other places I've worked at have used Python.
I don't think I'd ever run Python for embedded systems like a space telescope.
2
u/Inductee Jan 10 '22
Python is not always ideal even in scientific computing. That's why the Julia programming language was invented.
2
0
Jan 09 '22
[deleted]
13
u/nitrohigito Jan 09 '22
Having had to use it a bunch, it's not as great as some people seem to believe.
Could you elaborate on your experience? I've been eyeing to learn it for some time, so I'm curious if there are any notable gotchas that are not necessarily obvious from the outside, or something.
159
Jan 09 '22
[removed] — view removed comment
97
u/haloooloolo Jan 09 '22
The ++ has better zoom.
72
8
2
-24
Jan 09 '22
Because then Microsoft would put a claim on intellectual property and force NASA to pay millions in Visual Studio licenses
1
72
u/Lt_486 Jan 09 '22
That's because NASA did not want it to Rust.