CASE STUDY

How to Develop Reliable Spacecraft
Systems at Lower Cost with theAda Programming Language

How to Develop Reliable Spacecraft
Systems at Lower Cost with the Ada
Programming Language
When SEAKR Engineering decided to upgrade its mission-critical data recorder applications toa new hardware platform, they kept their software in Ada. To improve their Ada code’s
efficiency and reliability, they upgraded their development environment to GNAT Pro.
BAC KG RO U N D

A leader in spacecraft-based data collectionand processing
SEAKR Engineering is a leading supplier of state-of-the-art
spacecraft electronics. They specialize in the design andmanufacture of highly customized systems, including solidstate data recorders, modular command and data handlingsystems, high-performance payload processors, and more.
They were a pioneer in the on-board data recorder field,
replacing the magnetic tape recorders used on early weather
and surveillance satellites with modern solid-state recorders
and support systems that supply data more efficiently tousers on the ground.
Today, SEAKR’s products are on the International SpaceStation, on satellites orbiting the earth, and on probes thathave traveled to Jupiter. They help explore Earth’s
atmosphere and relay climate and operational weather data
critical to global climate science. They fortify U.S. intelligenceand contribute to improving the U.S. battle network byadvancing its space-based capabilities.

THE CHALLENGE

Transferring older software baselines tonew embedded platforms

Customer
SEAKR Engineering is a leading
supplier of state-of-the-art
spacecraft electronics and apioneer in the development ofsolid-state data recorders forsatellites.

Problem
They needed to port their data
recorder application software inAda to a more modern hardwareplatform and to restructure it using
object-oriented techniques.

Solution
SEAKR selected AdaCore’s GNAT
Pro as their new integrated Ada
development environment for its
robust and efficient GNAT
compiler, its comprehensive, easyto-use toolset, and its support forbare metal configurations.

Results
The transition to the new hardware
platform was smooth and efficient.
SEAKR has been extremely pleased
with the performance of the GNAT
Pro compiler and toolset and with
AdaCore’s support services. They
are saving money through early
detection and correction of errors,
thanks to Ada and GNAT Pro.

SEAKR has been using Ada on its data recorders since the late1980s. Previously, most of their systems had used a Tartan
Ada toolset on a MIL-STD-1750 platform—a hardware
configuration which by that time was thirty years old. Whenthey decided to upgrade to a new LEON3 processor a few
years ago to take advantage of its radiation tolerance, they were presented with some challenges.

First, they needed to port over their Ada code from the previous platform, and they wanted torestructure it using more object-based and object-oriented concepts. They also needed a newintegrated development environment (IDE), Ada compiler, and toolset to help them do that
restructuring with greater efficiency.

The benefits of Ada
Ada was chosen because SEAKR’s baseline recorder application was already written in Ada. And Ada
code is highly portable and reusable when moving from one platform to another. At the same time,
SEAKR’s principal software engineer suggested moving development to AdaCore's GNAT Pro tools.
This was great news for Mike Jelks, a staff engineer at SEAKR, who has been programming in Ada forover 30 years. He well understands the benefits of Ada's strong typing, tasking, protected objects, andobject-oriented features.
“By using strong typing properly, you can reduce your errors and catch them at compile time rather thanlater on in the development process,” says Jelks. “Ada discourages or prevents many of the bad
programming practices that typically cause problems in C and C++. Common errors that you'd make ina language like C, you’re much less likely to make in Ada.”

THE ADACORE SOLUTIONGNAT Pro – the comprehensive Ada development solution
GNAT Pro is AdaCore's complete solution for producing critical software systems where high assurance(reliability, safety, security), efficiency, and long-term maintainability are essential. The company offers
an extensive suite of tools and libraries for developing large mission-critical applications. It supports allversions of the Ada standard, from Ada 83 throughAda 2012, as well as some features from Ada 202x
currently undergoing standardization. There are also
GNAT Pro editions for C and C++.

Being able to automaticallyenforce a coding standardwith GNATcheck, rather thanhaving to review codemanually, is a huge time-saver.
Plus, it eliminates potential
human error.

— Mike Jelks, staff engineer, SEAKR Engineering

What Jelks likes most about GNAT Pro is its richintegrated development environment, GNAT
Programming Studio, or GPS (now called GNATStudio).
“GPS is easy to use,” says Jelks. “You just click, andyou find your compilation messages quickly. That's
the tool I use every day.”
Another tool that Jelks finds helpful is GNATcheck,
AdaCore's tool for checking code against an Adacoding standard.

“GNATcheck is really useful because there are many features in Ada that will give you big benefits...ifyou use them,” he says. “A coding standard can force you to label loops, for example. Being able toautomatically enforce a coding standard with GNATcheck, rather than having to review code manually,
is a huge time-saver. Plus, it eliminates potential human error.”

Running on bare metal
On its data recorders, SEAKR’s application software runs in a 'bare metal' configuration—directly on
the processor’s logic hardware without an intervening real-time operating system (RTOS)—as istypical for satellite systems. GNAT Pro facilitates bare-metal Ada applications by providing a “microRTOS”—essentially the Ada runtime—which allows the use of tasking and other features that would
normally require an RTOS, but with far lower latency, memory use, and power consumption.

GNAT Pro supports numerous platform configurations—including baremetal—as indicated in the chart at right. SEAKR also runs GNAT Pro
tools on a native Linux environment, which can be used for unit testing.

Seamless resolution of an early configuration issue
During initial discussions with AdaCore, the target hardware
configuration was never really discussed in detail. At the time, GNAT
supported LEON2, but SEAKR had obtained a LEON3 UT699 FPGAevaluation board from Gaisler (now Cobham Gaisler), the LEON3
manufacturer, and quickly discovered that there were some significant
differences between LEON2 and LEON3.
Jelks immediately got back in touch with AdaCore, who agreed tosupport the LEON3 processor without hesitation and at no additional
cost.
AdaCore worked with Gaisler, and together they came up with acustomized UT699 evaluation board and a new, fully tested Adacompiler to go with it.
“They shipped it all to me, gave me the FPGA image to program onto myboard, and provided succinct and proper instructions on how to load anduse it. The whole effort happened seamlessly, and everything worked theway AdaCore said it would.”
SEAKR eventually built their own custom control board for the UT699.
Later, they built another for a UT700 processor. Throughout that evolution, Jelks has been impressedby how AdaCore's GNAT Pro compiler has performed.

Ada saves money through early detection and correction of errors
Jelks thinks that companies who create critical applications—those with a low tolerance for risk—would
do well to use Ada, even if they're more familiar with other languages like C and C++.

“Companies who create criticalapplications—those with a low
tolerance for risk—would do wellto use Ada for those applications,even if they're more familiar withother languages like C and C++.”— Mike Jelks, staff engineer, SEAKR Engineering

He points to early detection and correction oferrors as critical factors, noting that the costof correcting software errors increases
exponentially the later they are detected in
the software lifecycle. Ada and GNAT Pro
save SEAKR money, he says, because Ada
helps prevent many errors that are typical in
C and C++. The GNAT Pro compiler detects
the vast majority of coding errors duringcompilation. Others are caught with standard
Ada run-time checks, and GNATcheck helps
eliminate additional potential errors by
enforcing project-specific Ada coding
standards.

As an example, Jelks likes to cite a study performed by Bell Labs in 1998 that looked at bugs that madeit into a telecom switching system. The study examined millions of lines of code written in C.
Bell Labs classified 17 “logic errors” and 11 “interface errors” that C programmers make frequently.
Twelve of those errors are syntactically impossible to occur in a compiled Ada program. Another nine
are possible but very unlikely in Ada due to the syntactic structure of the language.

R E S U LT S

An Ada compiler and toolset for the 21st century
Jelks says the GNAT Pro development
environment has made Ada much more
efficient and much easier to use than theirearlier toolset.
“Performance has never been an issue withthis compiler,” he says. “And GNAT Pro
provides quick and easy feedback forcompilation errors, coding style problems,things like that.” Jelks has also been pleased
with the GNAT Pro toolset.

“Performance has never been anissue with this compiler. GNAT Pro
provides quick and easy feedback
for compilation errors, coding styleproblems, things like that.”— Mike Jelks, staff engineer, SEAKR Engineering“As soon as I started using it, I found it did everything I expected it to do. We’ve never had to say, ‘This
toolset isn't working for us. We need to go with another approach’.” And since GNAT Pro offers support
for bare metal configurations, SEAKR's code runs without the space or time overhead that an RTOS
would incur.

Praise for AdaCore support
Jelks also has high praise for AdaCore's technical support team.
“When we have had problems, AdaCore has been very responsive,” says Jelks. “Typically, they havegotten back with a solution as quickly and as reasonably as any company could have. The way they
supported us in moving to LEON3 is a great example.”He also likes the way AdaCore treats their customers and the attitude they bring to customer service.

Ada for the future
SEAKR now has a new project under development using Ada and GNAT Pro on a Wind River VxWorks
target platform. Previously, they had used Ada for data recording applications and C/C++ for dataprocessing applications. This new project brings those niches together in one product.

“We can take code we've
developed, and it still works inthese other environments.
Wherever our future lies, Ada isright there, ready to go.”“My primary focus on this new project is toshow that we can have a file system andeverything written for a data recorder thatworks with the processing system, and we
don't have to rewrite all of our code justbecause it was written in a different language,”says Jelks. The GNAT Pro compiler and toolset
help with that because support for C and C++
is available as an add-on.

— Mike Jelks, staff engineer, SEAKR Engineering

Jelks sees SEAKR moving into otherarchitectures and development environments
very soon. He believes Ada and GNAT Pro will be along for the ride.
“We can take code we've developed, and it still works in these other environments,” he says. “Wherever
our future lies, Ada is right there, ready to go.”