Maybe the question sounds a bit strange, so I'll explain a the background a little bit.

Currently I'm working on a project at y university, which will be a complete on-board software for an satellite. The system is programmed in C++ on top of a real-time operating system. However, some subsystems like the attitude control system and the fault detection and a space simulation are currently only implemented in Matlab/Simulink, to prototype the algorithms efficiently. After their verification, they will be translated into c++.

The complete on-board software grew very complex, and only a handful people know the whole system. Furthermore, many of the students haven't program in C++ yet and the manual memory management of C++ makes it even more difficult to write mission critical software.

Of course the main system has to be implemented in C++, but I asked myself if it's maybe possible to use an embedded language to implement the subsystem which are currently written in Matlab. This embedded language should feature:

  • static/strong typing and compiler checks to minimize runtime errors
  • small memory usage, and relative fast runtime
  • attitude control algorithms are mainly numerical computations, so a good numeric support would be nice
  • maybe some sort of functional programming feature, matlab/simulink encourage you to use it too

I googled a bit, but only found Lua. It looks nice, but I would not use it in mission critical software. Have you ever encountered a situation like this, or do you know any language, which could satisfies the conditions?

EDIT: To clarify some things: embedded means it should be able to embed the language into the existing C++ environment. So no compiled languages like Ada or Haskell

  • 5
    What do you mean by C/C++? There is no such language. Pick one or the other. – David Thornley Nov 15 '11 at 20:37
  • 4
    Not that you asked the question, but - students writing the altitude control and fault detection systems?!!! And you want a language that will help catch their mistakes? Why tie them down keeping satellites in the air when there are presumably nuclear facilities and weapons systems that need critical software too? – psr Nov 15 '11 at 21:01
  • 2
    @psr :D shared you concerns too, as i started with the project, but: 1. student satellite projects aren't that uncommon 2. the satellite doesn't have orbit control, if the launch vehicle does its job right, the satellite stays in the orbit 3. many of the students maybe can't program c++, but can design attitude control algorithms and 4. of course there are supervisors who have experience. ;) – Moe Nov 15 '11 at 21:24
  • 2
    Mission critical embedded system... satellite in orbit... students who can design attitude control algorithms but don't know C++... may I venture a guess that this is Embry-Riddle? :) – Travis Christian Nov 15 '11 at 23:18
  • 2
    depending on your redefinition of 'embedded' ada may still fir the bill as you can import/export ada functions to/from c/c++. see adaic.org/resources/add_content/standards/05aarm/html/… – NWS Nov 16 '11 at 10:29

Use C++, do not use any embedded/layered anything.

I am going to answer the question in the negative, and tell you to use C++, hire appropriate resources, and do not layer something else on top. Most of your criteria already fit C++ anyways: strong typing, minimal runtime, etc. (Typing not as strong as Haskell, but better than most scripting languages)

You don't even need to use many classes and objects if you don't want to. Write a more functional style, unless you need higher-order functions and currying. There is no specific sin in using C++ as a better C, unless you do it by accident. If you do it purposefully, then full steam ahead.

Given the presumed mission-criticality, you likely do not want to have the extra layers of complexity and points of failure that an embedded language will bring you.

That said: do write in as modern C++ as you are able, in particular using appropriate smart pointers (if you use heap memory) . C++ has come a long way, and in particular most of the manual memory-management tasks are now better automated using shared_ptr, unique_ptr and the like. If you have to write delete you are doing something wrong.

If you are stuck on wanting embedded something, have a look at Boost Proto.

| improve this answer | |
  • 1
    +1 thanks for the answer. Probably you're right, but i was interested if an embedded language with such criteria exists – Moe Nov 15 '11 at 21:31

I'm not certain what "mission-critical" is, but for what it's worth I have 10+ years of experience in software development for safety-critical embedded systems.

No matter what language you pick, you will definitely need a coding standard. That is, rules for how to write programs, which mechanisms that are allowed and which ones that are banned. The rules should be in the manner of "don't use goto", "don't use function-like macros" etc.

This is particularly important if you have junior programmers participating in the project. Because they might not know what mechanisms that are regarded as good practice and which ones that are bad. And they will almost certainly not know about all the hundreds of obscure and subtle cases of undefined behavior that the language contains, and other such advanced, yet extremely important topics. For example, one can probably write a very thick book just on the topic of all the undefined/unspecified/implementation-defined behavior in C++.

In addition, industry safety standards like DO178B or IEC 61508 enforce the use of a well-defined subset of the programming language, and then you must have a coding standard.

The sensible thing to do if you have no experience of coding standards is to pick one of the pre-made, widely recognized ones that are industry de-facto standard: MISRA-C, MISRA-C++, SPARK ADA, Cert C etc. The advantage of such industry coding standards is that there are already software testing tools, aka static/dynamic code analyzers with support for them. Don't even consider this project without a proper code analyzer tool!

(Parenthesis regarding technical specifics: you will any form of dynamic memory management banned with bold letters in any coding standard for high integrity systems, no matter language. Generally, it doesn't make sense for such systems to behave in non-deterministic ways, and dynamic memory only makes sense in non-deterministic scenarios.)

| improve this answer | |

I'll suggest Haskell as food for thought, even though it doesn't meet all your criteria:


  • very good type system, lots of compiler checks -- it's extremely hard to get Haskell to even condescend to look at your program, much less compile it! :)
  • no manual memory management
  • pure functional programming language, full complement of FP features


  • very few people know Haskell, and may be hard to learn
  • not similar to mainstream languages -- different idioms, methodologies
  • writing memory-efficient programs is possible, but very hard


  • what an embedded language is
  • numerical support -- not sure what you need
| improve this answer | |
  • 2
    see edit. and i don't think haskell is easier than C++ ;) – Moe Nov 15 '11 at 20:03
  • @Moe -- Apologies for not knowing what an embedded language is. As to your comment -- what do you mean? I didn't claim that it was, or that it wasn't. – user39685 Nov 15 '11 at 20:06
  • 1
    i'm searching an easy solution to implement some subsystem of the satellite. many of the students have only limited programming skills, so Haskell as a mainly academical language would not be the right choice. – Moe Nov 15 '11 at 20:15
  • @Moe -- I guess I should have put that under cons. In my head, I did -- it was the same thing as very few people know Haskell! :) – user39685 Nov 15 '11 at 20:21

You might be looking for Ada. You might have trouble finding someone outside of NASA who has written code in it though.

| improve this answer | |
  • 2
    +1 for mentioning Ada. -1 for assuming C++ and MATLAB programmers can't learn any other language. – John R. Strohm Nov 15 '11 at 20:39
  • Good point, definitely didn't meant to imply that, fixed the answer up a bit. – Wyatt Barnett Nov 15 '11 at 21:04
  • Lots of people make that assumption, or use it to justify C++ over Ada. The claim is "we can't use Ada because no schools teach Ada". (Some of them should know better, having done highly successful JOVIAL projects when no schools ANYWHERE taught JOVIAL.) – John R. Strohm Nov 15 '11 at 22:59
  • I know plenty of Ada programmers, outside of nasa. – NWS Nov 16 '11 at 10:27

Ada is a very good mission critical language. In fact Esterline Avista in Platteville, Wisconsin uses ADA for their contracts with Boeing and are CMMI level 5 certified. The Universtity of Wisconsin Platteville currently teaches Ada as part of the CSSE department's Programming Language Structures class.

Ada was originally developed for the DoD from 1973 to 1983 and is used in avionics, railroad, banking, military, and space technologies.


  • Strongly Typed
  • Great for embedded systems
  • Great for real-time systems
  • object oriented
  • has high-level dynamic memory management


  • strange notion of OO
  • higher learning curve than other imperative or ALGOL-like languages
| improve this answer | |
  • 1
    I observe that you do not compare the Ada learning curve with the C++ learning curve. – John R. Strohm Nov 15 '11 at 20:34
  • Ada would be a cool answer, if only the question didn't specify: No Ada or Haskell... – yannis Nov 15 '11 at 20:37
  • 1
    I completely overlooked the fact that it said no compiled languages like Ada or Haskell. I got excited. @JohnR.Strohm I actually found learning Ada easier than learning C++. – NexAddo Nov 15 '11 at 21:03
  • @YannisRizos : that was an added qualification after he got a few answers saying ada or haskell . .. – Wyatt Barnett Nov 15 '11 at 21:35
  • @WyattBarnett Yes, but the answer came 30 minutes after the clarification was added (check the edit log for the question, as there are more recent edits). That's why I commented on this answer and not the others suggesting Ada or Haskell. Wasn't trying to be obnoxious though, just point the fact. – yannis Nov 15 '11 at 21:37

Matlab has a page on DO 178 compliance. FAA requires DO-178 compliance for avionics software, and private space shots require FAA clearance. Adacore has products for C++, C and Ada; as well as stuff to support DO-178. They have a program for universities, so you might be able to get what you want at a reduced price (or free, maybe).

| improve this answer | |

A couple of things spring to mind;

First of all, get this into the head of everyone working on the project:

Don't assume anything. If you don't know; find out, and verify. Then let someone else verify.

Secondly, the language you choose is largely irrelevant; you can screw up in everything, including Ada. Yes, the protection is there, but so are the means to circumvent it.

If you can work with C++, stick with C++; you want to minimize complexity, and adding an embedded language on top of it doesn't. If you can't, get [good] programmers on the team ASAP and let them do their thing while you do yours. Get/write tight code standards, and stick to them. Avoid anything that might go haywire (as in, e.g. point where it shouldn't, or run out of memory), and try to keep the code as simple as possible. Then test, verify and test some more. Do ruthless code reviews.

Do not optimize unless you have no other option; reliability trumps everything.

Oh, and you probably want/need to read up on DO-178B.

Lastly; if you don't trust it, don't fly it.

| improve this answer | |
  • +1 "If you don't trust it, don't fly it." --Will use this approach for my school's satellite. – Rubber Duck Nov 16 '11 at 8:09

The language chosen for mission critical software is only one small part of the equation. Testing of course is a huge part of it, many layers of testing by different groups of people. the team writing the code does some testing but it needs a lot of testing by others not on that team, and then as the component is integrated into larger portions of the vehicle it is re-tested as part of that (sub-) system.

Back to the software team. The lower level language you can stand without increasing human error is better, less things the compiler can do wrong. Usually disable optimization completely, again take the compiler out of the loop as much as possible. peer reviews, code walk through, justify and verify every line of code. for mission critical code expect no more than one line of debugged code per day (from experienced developers) less than that for first timers, one line a week perhaps. I am not joking that is how it is in that business. You can cut that down yes by adding more people in the review process, instead of a few lines of code a year.

I would at least take a little time to examine the compiler output even if the compiler has been used for DO-178 work.

go with languages and compilers that have been used by the aerospace or automotive (or medical) industries. ada being the traditional, but as mentioned, how many ada programmers are you going to find, and are they going to do a good job learning the language on their first project when that is a mission critical project? no. C or C++ has been used as well, one or both being the language of choice today for this type of work.

| improve this answer | |

You should look again at your requirements and conditions. While C++ is a fine language for the numeric processing parts of your application, trying to go to having everything in a single language is going to be troublesome anyway (different languages have peak expressivities on different classes of problem). You've identified some of the reasons why, especially the fact that your students don't know C++ when they start. You're also not going to get perfect safety through the use of a complex type system; there's always higher level problems that can trip you up given that total correctness proofs are really difficult.

What you would ideally have is some kind of development environment that mimics the environment of the satellite. (Well, without the problems with rebooting caused when everything goes wrong.) Once you've got such a situation, you can do some real testing of things before you put the software into deployment; that's got to be a good idea, yes?

You perhaps should look at using a multi-language solution, using a higher-level language to do major coordination of components and a lower-level language to provide implementations of those components. C++ is a reasonable language to write components in, but Lua is better suited to coordination (and of course you don't write everything in Lua; it's not meant to be used that way!). What's more, this multi-language approach is commonly used in industrial critical systems (e.g., control of heavy plant, running oil refineries) and that's an area where it really is important to get things right as lives are on the line.

(Lua is not the only candidate for an integration language: I know for a fact that Tcl is used quite a bit in this area and would be unsurprised at seeing either Python or Ruby used for this too. The other common languages for low-level components are probably C and Fortran, though anything conforming properly to the C ABI for functions is tractable here. I wouldn't recommend languages with very large runtimes — e.g., Java, C# — for component providers; they're nasty to integrate with unless you do everything within the runtime.)

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.