Lecture 2 — Programming languages for safety-critical systems

Give 3 common reasons for program errors

Failure to initialise; aliasing; expression evaluation errors (out-of-range index, div by zero, overflow, compiler differences).

Aliasing (definition).

Two or more distinct names refer to the same storage location.

Why are side effects in expressions dangerous?

Result can depend on evaluation order if function calls have side effects.

What evaluation order does Java guarantee

Left-to-right for operands of operators.

Wild jumps criterion?

Whether a program can jump to an arbitrary memory location

Overwrites criterion?

Whether a program can overwrite arbitrary memory locations.

Semantics criterion?

Whether semantics are defined precisely enough to analyse correctness.

Model of mathematics criterion?

Rigorous definition of integer/float arithmetic (overflow/errors).

Operational arithmetic criterion?

Ability to check the target processor follows the arithmetic model (e.g., IEEE floating point).

Why safe subsets instead of new languages?

New languages have limited industrial use; safe subsets reuse existing compilers/tools + add a checker + annotations.

One reason C is considered unsuitable

Problematic type conversions; array indices not checked.

One reason Ada is considered suitable

Overflow checks (exceptions) + analysable ranges; designed for critical systems.