Transcription

Quentin OchemAda for the C or Java DeveloperRelease 1.0Courtesy ofJuly 23, 2013

This work is licensed under a Creative Commons AttributionNonCommercial-ShareAlike 3.0 Unported License.

CONTENTS1Preface12Basics33Compilation Unit Structure54Statements, Declarations, and Control Structures4.1 Statements and Declarations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.2 Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.3 Loops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .779105Type System5.1 Strong Typing . . . . . . . . . . . . . . . . . .5.2 Language-Defined Types . . . . . . . . . . . . .5.3 Application-Defined Types . . . . . . . . . . . .5.4 Type Ranges . . . . . . . . . . . . . . . . . . .5.5 Generalized Type Contracts: Subtype Predicates5.6 Attributes . . . . . . . . . . . . . . . . . . . . .5.7 Arrays and Strings . . . . . . . . . . . . . . . .5.8 Heterogeneous Data Structures . . . . . . . . .5.9 Pointers . . . . . . . . . . . . . . . . . . . . . .131314141617171821226Functions and Procedures6.1 General Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.2 Overloading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.3 Subprogram Contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252526277Packages7.1 Declaration Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7.2 Hierarchical Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7.3 Using Entities from Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292930308Classes and Object Oriented Programming8.1 Primitive Subprograms . . . . . . . . .8.2 Derivation and Dynamic Dispatch . . .8.3 Constructors and Destructors . . . . .8.4 Encapsulation . . . . . . . . . . . . .8.5 Abstract Types and Interfaces . . . . .8.6 Invariants . . . . . . . . . . . . . . . .33333437383840.1

9Generics9.1 Generic Subprograms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9.2 Generic Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9.3 Generic Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4343444510 Exceptions10.1 Standard Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10.2 Custom Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47474811 Concurrency11.1 Tasks . . . . . . . . .11.2 Rendezvous . . . . . .11.3 Selective Rendezvous11.4 Protected Objects . . .494952545512 Low Level Programming12.1 Representation Clauses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12.2 Embedded Assembly Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12.3 Interfacing with C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5757585913 Conclusion6114 References632.

CHAPTERONEPREFACENowadays it seems like talking about programming languages is a bit passé. The technical wars of the past decadehave subsided and today we see a variety of high-level and well-established languages offering functionality that canmeet the needs of any programmer.Python, Java, C , C#, and Visual Basic are recent examples. Indeed, these languages make it easier to write codevery quickly, are very flexible, offer features with highly dynamic behavior, and some even allow compilers to deducethe developer’s probable intent.Why, then, talk about yet another language? Well, by addressing the general programming market, the aforementionedlanguages have become poorly suited for working within the domain of high-integrity systems. In highly reliable,secure and safe applications such as those found in and around airplanes, rockets, satellites, trains, and in any devicewhose failure could jeopardize human life or critical assets, the programming languages used must support the highstandard of software engineering necessary to maintain the integrity of the system.The concept of verification—the practice of showing that the system behaves and performs as intended—is key in suchenvironments. Verification can be accomplished by some combination of review, testing, static analysis, and formalproof techniques. The increasing reliance on software and increasing complexity of today’s systems has made thistask more difficult. Technologies and practices that might have been perfectly acceptable ten or fifteen years ago areinsufficient today. Thankfully, the state of the art in analysis and proof tools and techniques has also advanced.The latest revisions of the Ada language, Ada 2005 and Ada 2012, make enhanced software integrity possible. Fromits inception in the 1980s, Ada was designed to meet the requirements of high-integrity systems, and continues to bewell-suited for the implementation of critical embedded or native applications. And it has been receiving increasedattention recently. Every language revision has enhanced expressiveness in many areas. Ada 2012, in particular, hasintroduced new features for contract-based programming that are valuable to any project where verification is part ofthe engineering lifecycle. Along with these language enhancements, Ada compiler and tool technology has also keptpace with general computing developments over the past few years. Ada development environments are available ona wide range of platforms and are being used for the most demanding applications.It is no secret that we at AdaCore are very enthusiastic about Ada, but we will not claim that Ada is always the solution;Ada is no more a silver bullet than any other language. In some domains other languages make sense because ofthe availability of particular libraries or development frameworks. For example, C and Java are considered goodchoices for desktop programs or applications where a shortened time to market is a major objective. Other areas,such as website programming or system administration, tend to rely on different formalisms such as scripting andinterpreted languages. The key is to select the proper technical approach, in terms of the language and tools, to meetthe requirements. Ada’s strength is in areas where reliability is paramount.Learning a new language shouldn’t be complicated. Programming paradigms have not evolved much since objectoriented programming gained a foothold, and the same paradigms are present one way or another in many widely usedlanguages. This document will thus give you an overview of the Ada language using analogies to C and Java—theseare the languages you’re already likely to know. No prior knowledge of Ada is assumed. If you are working on an Adaproject now and need more background, if you are interested in learning to program in Ada, or if you need to performan assessment of possible languages to be used for a new development, this guide is for you.1

Ada for the C or Java Developer, Release 1.0This document was prepared by Quentin Ochem, with contributions and review from Richard Kenner, Albert Lee, andBen Brosgol.2Chapter 1. Preface

CHAPTERTWOBASICSAda implements the vast majority of programming concepts that you’re accustomed to in C and Java: classes,inheritance, templates (generics), etc. Its syntax might seem peculiar, though. It’s not derived from the popular Cstyle of notation with its ample use of brackets; rather, it uses a more expository syntax coming from Pascal. In manyways, Ada is a simpler language—its syntax favors making it easier to conceptualize and read program code, ratherthan making it faster to write in a cleverly condensed manner. For example, full words like begin and end are used inplace of curly braces. Conditions are written using if, then, elsif, else, and end if. Ada’s assignment operator does notdouble as an expression, smoothly eliminating any frustration that could be caused by being used where shouldbe.All languages provide one or more ways to express comments. In Ada, two consecutive hyphens -- mark the start ofa comment that continues to the end of the line. This is exactly the same as using // for comments in C and Java.There is no equivalent of /* . */ block comments in Ada; use multiple -- lines instead.Ada compilers are stricter with type and range checking than most C and Java programmers are used to. Mostbeginning Ada programmers encounter a variety of warnings and error messages when coding more creatively, but thishelps detect problems and vulnerabilities at compile time—early on in the development cycle. In addition, dynamicchecks (such as array bounds checks) provide verification that could not be done at compile time. Dynamic checks areperformed at run time, similar to what is done in Java.Ada identifiers and reserved words are case insensitive. The identifiers VAR, var and VaR are treated as the same;likewise begin, BEGIN, Begin, etc. Language-specific characters, such as accents, Greek or Russian letters, andAsian alphabets, are acceptable to use. Identifiers may include letters, digits, and underscores, but must always startwith a letter. There are 73 reserved keywords in Ada that may not be used as identifiers, and these are:3

Ada for the C or Java Developer, Release ethentypeuntilusewhenwhilewithxorAda is designed to be portable. Ada compilers must follow a precisely defined international (ISO) standard languagespecification with clearly documented areas of vendor freedom where the behavior depends on the implementation.It’s possible, then, to write an implementation-independent application in Ada and to make sure it will have the sameeffect across platforms and compilers.Ada is truly a general purpose, multiple paradigm language that allows the programmer to employ or avoid featureslike run-time contract checking, tasking, object oriented programming, and generics. Efficiently programmed Ada isemployed in device drivers, interrupt handlers, and other low-level functions. It may be found today in devices withtight limits on processing speed, memory, and power consumption. But the language is also used for programminglarger interconnected systems running on workstations, servers, and supercomputers.4Chapter 2. Basics

CHAPTERTHREECOMPILATION UNIT STRUCTUREC programming style usually promotes the use of two distinct files: header files used to define specifications (.h,.hxx, .hpp), and implementation files which contain the executable code (.c, .cxx, .cpp). However, the distinctionbetween specification and implementation is not enforced by the compiler and may need to be worked around in orderto implement, for example, inlining or templates.Java compilers expect both the implementation and specification to be in the same .java file. (Yes, design patternsallow using interfaces to separate specification from implementation to a certain extent, but this is outside of the scopeof this description.)Ada is superficially similar to the C case: Ada compilation units are generally split into two parts, the specificationand the body. However, what goes into those files is more predictable for both the compiler and for the programmer.With GNAT, compilation units are stored in files with a .ads extension for specifications and with a .adb extension forimplementations.Without further ado, we present the famous “Hello World” in three languages:[Ada]with Ada.Text IO;use Ada.Text IO;procedure Main isbeginPut Line ("Hello World");end Main;[C ]#include iostream using namespace std;int main(int argc, const char* argv[]) {cout "Hello World" endl;}[Java]public class Main {public static void main(String [] argv) {System.out.println ("Hello World");}}The first line of Ada we see is the with clause, declaring that the unit (in this case, the Main subprogram) will requirethe services of the package Ada.Text IO. This is different from how #include works in C in that it does not, in a5

Ada for the C or Java Developer, Release 1.0logical sense, copy/paste the code of Ada.Text IO into Main. The with clause directs the compiler to make the publicinterface of the Ada.Text IO package visible to code in the unit (here Main) containing the with clause. Note that thisconstruct does not have a direct analog in Java, where the entire CLASSPATH is always accessible. Also, the name‘’Main” for the main subprogram was chosen for consistency with C and Java style but in Ada the name can bewhatever the programmer chooses.The use clause is the equivalent of using namespace in C , or import in Java (though it wasn’t necessary to useimport in the Java example above). It allows you to omit the full package name when referring to withed units.Without the use clause, any reference to Ada.Text IO items would have had to be fully qualified with the packagename. The Put Line line would then have read:Ada.Text IO.Put Line ("Hello World");The word “package” has different meanings in Ada and Java. In Java, a package is used as a namespace for classes.In Ada, it’s often a compilation unit. As a result Ada tends to have many more packages than Java. Ada packagespecifications (“package specs” for short) have the following structure:package Package Name is-- public declarationsprivate-- private declarationsend Package Name;The implementation in a package body (written in a .adb file) has the structure:package body Package Name is-- implementationend Package Name;The private reserved word is used to mark the start of the private portion of a package spec. By splitting the packagespec into private and public parts, it is possible to make an entity available for use while hiding its implementation.For instance, a common use is declaring a record (Ada’s struct) whose fields are only visible to its package and notto the caller. This allows the caller to refer to objects of that type, but not to change any of its contents directly.The package body contains implementation code, and is only accessible to outside code through declarations in thepackage spec.An entity declared in the private part of a package in Ada is roughly equivalent to a protected member of a C orJava class. An entity declared in the body of an Ada package is roughly equivalent to a private member of a C orJava class.6Chapter 3. Compilation Unit Structure

CHAPTERFOURSTATEMENTS, DECLARATIONS, ANDCONTROL STRUCTURES4.1 Statements and DeclarationsThe following code samples are all equivalent, and illustrate the use of comments and working with integer variables:[Ada]--- Ada program to declare and modify Integers-procedure Main is-- Variable declarationsA, B : Integer : 0;C: Integer : 100;D: Integer;begin-- Ada uses a regular assignment statement for incrementation.A : A 1;-- Regular additionD : A B C;end Main;[C ]/** C program to declare and modify ints*/int main(int argc, const char* argv[]) {// Variable declarationsint a 0, b 0, c 100, d;// C shorthand for incrementationa ;// Regular additiond a b c;}[Java]7

Ada for the C or Java Developer, Release 1.0/** Java program to declare and modify ints*/public class Main {public static void main(String [] argv) {// Variable declarationsint a 0, b 0, c 100, d;// Java shorthand for incrementationa ;// Regular additiond a b c;}}Statements are terminated by semicolons in all three languages. In Ada, blocks of code are surrounded by the reservedwords begin and end rather than by curly braces. We can use both multi-line and single-line comment styles in theC and Java code, and only single-line comments in the Ada code.Ada requires variable declarations to be made in a specific area called the declarative part, seen here before the beginkeyword. Variable declarations start with the identifier in Ada, as opposed to starting with the type as in C and Java(also note Ada’s use of the : separator). Specifying initializers is different as well: in Ada an initialization expressioncan apply to multiple variables (but will be evaluated separately for each), whereas in C and Java each variable isinitialized individually. In all three languages, if you use a function as an initializer and that function returns differentvalues on every invocation, each variable will get initialized to a different value.Let’s move on to the imperative statements. Ada does not provide or -- shorthand expressions for increment/decrement operations; it is necessary to use a full assignment statement. The : symbol is used in Ada toperform value assignment. Unlike C ’s and Java’s symbol, : can not be used as part of an expression. So, astatement like A : B : C; doesn’t make sense to an Ada compiler, and neither does a clause like “if A : B then .”Both are compile-time errors.You can nest a block of code within an outer block if you want to create an inner scope:with Ada.Text IO; use Ada.Text IO;procedure Main isbeginPut Line ("Before the inner block");declareAlpha : Integer : 0;beginAlpha : Alpha 1;Put Line ("Now inside the inner block");end;Put Line ("After the inner block");end Main;It is OK to have an empty declarative part or to omit the declarative part entirely—just start the inner block with beginif you have no declarations to make. However it is not OK to have an empty sequence of statements. You must at leastprovide a null; statement, which does nothing and indicates that the omission of statements is intentional.8Chapter 4. Statements, Declarations, and Control Structures

Ada for the C or Java Developer, Release 1.04.2 ConditionsThe use of the if statement:[Ada]if Variable 0 thenPut Line (" 0 ");elsif Variable 0 thenPut Line (" 0 ");elsePut Line (" 0 ");end if;[C ]if (Variable 0)cout " 0 " endl;else if (Variable 0)cout " 0 " endl;elsecout " 0 " endl;[Java]if (Variable 0)System.out.println (" 0 ");else if (Variable 0)System.out.println (" 0 ");elseSystem.out.println (" 0 ");In Ada, everything that appears between the if and then keywords is the conditional expression—no parenthesesrequired. Comparison operators are the same, except for equality ( ) and inequality (/ ). The english words not, and,and or replace the symbols !, &, and , respectively, for performing boolean operations.It’s more customary to use && and in C and Java than & and when writing boolean expressions. The differenceis that && and are short-circuit operators, which evaluate terms only as necessary, and & and will unconditionallyevaluate all terms. In Ada, and and or will evaluate all terms; and then and or else direct the compiler to employshort circuit evaluation.Here are what switch/case statements look like:[Ada]case Variable iswhen 0 Put Line ("Zero");when 1 . 9 Put Line ("Positive Digit");when 10 12 14 16 18 Put Line ("Even Number between 10 and 18");when others Put Line ("Something else");end case;[C ]switch (Variable) {case 0:4.2. Conditions9

Ada for the C or Java Developer, Release 1.0cout "Zero" endl;break;case 1: case 2: case 3: case 4: case 5:case 6: case 7: case 8: case 9:cout "Positive Digit" endl;break;case 10: case 12: case 14: case 16: case 18:cout "Even Number between 10 and 18" endl;break;default:cout "Something else";}[Java]switch (Variable) {case 0:System.out.println ("Zero");break;case 1: case 2: case 3: case 4: case 5:case 6: case 7: case 8: case 9:System.out.println ("Positive Digit");break;case 10: case 12: case 14: case 16: case 18:System.out.println ("Even Number between 10 and 18");break;default:System.out.println ("Something else");}In Ada, the case and end case lines surround the whole case statement, and each case starts with when. So, whenprogramming in Ada, replace switch with case, and replace case with when.Case statements in Ada require the use of discrete types (integers or enumeration types), and require all possible casesto be covered by when statements. If not all the cases are handled, or if duplicate cases exist, the program will notcompile. The default case, default: in C and Java, can be specified using when others in Ada.In Ada, the break instruction is implicit and program execution will never fall through to subsequent cases. In orderto combine cases, you can specify ranges using . and enumerate disjoint values using which neatly replaces themultiple case statements seen in the C and Java versions.4.3 LoopsIn Ada, loops always start with the loop reserved word and end with end loop. To leave the loop, use exit—the C and Java equivalent being break. This statement can specify a terminating condition using the exit when syntax. Theloop opening the block can be preceded by a while or a for.The while loop is the simplest one, and is very similar across all three languages:[Ada]while Variable 10 000 loopVariable : Variable * 2;end loop;[C ]10Chapter 4. Statements, Declarations, and Control Structures

Ada for the C or Java Developer, Release 1.0while (Variable 10000) {Variable Variable * 2;}[Java]while (Variable 10000) {Variable Variable * 2;}Ada’s for loop, however, is quite different from that in C and Java. It always increments or decrements a loop indexwithin a discrete range. The loop index (or “loop parameter” in Ada parlance) is local to the scope of the loop and isimplicitly incremented or decremented at each iteration of the loop statements; the program cannot directly modify itsvalue. The type of the loop parameter is derived from the range. The range is always given in ascending order even ifthe loop iterates in descending order. If the starting bound is greater than the ending bound, the interval is consideredto be empty and the loop contents will not be executed. To specify a loop iteration in decreasing order, use the reversereserved word. Here are examples of loops going in both directions:[Ada]-- Outputs 0, 1, 2, ., 9for Variable in 0 . 9 loopPut Line (Integer’Image (Variable));end loop;-- Outputs 9, 8, 7, ., 0for Variable in reverse 0 . 9 loopPut Line (Integer’Image (Variable));end loop;[C ]// Outputs 0, 1, 2, ., 9for (int Variable 0; Variable 9; Variable ) {cout Variable endl;}// Outputs 9, 8, 7, ., 0for (int Variable 9; Variable 0; Variable--) {cout Variable endl;}[Java]// Outputs 0, 1, 2, ., 9for (int Variable 0; Variable 9; Variable ) {System.out.println (Variable);}// Outputs 9, 8, 7, ., 0for (int Variable 9; Variable 0; Variable--) {System.out.println (Variable);}Ada uses the Integer type’s ‘Image attribute to convert a numerical value to a String. There is no implicit conversionbetween Integer and String as there is in C and Java. We’ll have a more in-depth look at such attributes later on.It’s easy to express iteration over the contents of a container (for instance, an array, a list, or a map) in Ada and Java.For example, assuming that Int List is defined as an array of Integer values, you can use:4.3. Loops11

Ada for the C or Java Developer, Release 1.0[Ada]for I of Int List loopPut Line (Integer’Image (I));end loop;[Java]for (int i : Int List) {System.out.println (i);}12Chapter 4. Statements, Declarations, and Control Structures

CHAPTERFIVETYPE SYSTEM5.1 Strong TypingOne of the main characteristics of Ada is its strong typing (i.e., relative absence of implicit type conversions). Thismay take some getting used to. For example, you can’t divide an integer by a float. You need to perform the divisionoperation using values of the same type, so one value must be explicitly converted to match the type of the other (inthis case the more likely conversion is from integer to float). Ada is designed to guarantee that what’s done by theprogram is what’s meant by the programmer, leaving as little room for compiler interpretation as possible. Let’s havea look at the following example:[Ada]procedure Strong Typing isAlpha : Integer : 1;Beta: Integer : 10;Result : Float;beginResult : Float (Alpha) / Float (Beta);end Strong Typing;[C ]void weakTyping (void) {intalpha 1;intbeta 10;float result;result alpha / beta;}[Java]void weakTyping () {intalpha 1;intbeta 10;float result;result alpha / beta;}Are the three programs above equivalent? It may seem like Ada is just adding extra complexity by forcing you tomake the conversion from Integer to Float explicit. In fact it significantly changes the behavior of the computation.While the Ada code performs a floating point operation 1.0 / 10.0 and stores 0.1 in Result, the C and Java versionsinstead store 0.0 in result. This is because the C and Java versions perform an integer operation between two integer13

Ada for the C or Java Developer, Release 1.0variables: 1 / 10 is 0. The result of the integer division is then converted to a float and stored. Errors of this sort can bevery hard to locate in complex pieces of code, and systematic specification of how the operation should be interpretedhelps to avoid this class of errors. If an integer division was actually intended in the Ada case, it is still necessary toexplicitly convert the final result to Float:-- Perform an Integer division then convert to FloatResult : Float (Alpha / Beta);In Ada, a floating point literal must be written with both an integral and decimal part. 10 is not a valid literal for afloating point value, while 10.0 is.5.2 Language-Defined TypesThe principal scalar types predefined by Ada are Integer, Float, Boolean, and Character. These correspond to int,float, bool/boolean, and char, respectively. The names for these types are not reserved words; they are regularidentifiers.5.3 Application-Defined TypesAda’s type system encourages programmers to think about data at a high level of abstraction. The compiler willat times output a simple efficient machine instruction for a full line of source code (and some instructions can beeliminated entirely). The careful programmer’s concern that the operation really makes sense in the real world wouldbe satisfied, and so would the programmer’s concern about performance.The next example below defines two different metrics: area and distance. Mixing these two metrics must be done withgreat care, as certain operations do not make sense, like adding an area to a distance. Others require knowledge of theexpected semantics; for example, multiplying two distances. To help avoid errors, Ada requires that each of the binaryoperators “ ”, “-”, “*”, and “/” for integer and floating-point types take operands of the same type and return a valueof that type.procedure Main istype Distance is new Float;type Area is new Float;D1 : Distance : 2.0;D2 : Distance : 3.0;A : Area;beginD1 : D1 D2;-- OKD1 : D1 A;-- NOT OK: incompatible types for " " operatorA : D1 * D2;-- NOT OK: incompatible types for ": " assignmentA : Area (D1 * D2); -- OKend Main;Even though the Distance and Area types above are just Floats, the compiler does not allow arbitrary mixing ofvalues of these different types. An explicit conversion (which does not necessarily mean any additional object code)is necessary.The predefined Ada rules are not perfect; they admit some problematic cases (for example multiplying two Distancesyields a Distance) and prohibit some useful cases (for example multiplying two Distances should deliver an Area).These situations can be handled through other mechanisms. A predefined operation can be identified as abstract tomake it unavailable; overloading can be used to give new interpretations to existing operator symbols, for example allowing an operator to return a value from a type different from its operands; and more generally, GNAT has introduceda facility that helps perform dimensionality checking.14Chapter 5. Type System

Ada for the C or Java Developer, Release 1.0Ada enumerations work similarly to C and Java’s enums.[Ada]type Day ay,Sunday);[C ]enum Day ,Sunday};[Java]enum Day ,Sunday}But even though such enumerations may be implemented using a machine word, at the language level Ada will notconfuse the fact that Monday is a Day and is not an Integer. You can compare a Day with another Day, though. Tospecify implementation details like the numeric values that correspond with enumeration values in C you includethem in the original enum statement:[C ]enum Day y 10,11,12,13,14,15,16};But in Ada you must use both a type definition for Day as well as a separate representation clause for it like:[Ada]for Day use(MondayTuesdayWednesdayThursdayFriday 10,11,12,13,14,5.3. Application-Defined Types15

Ada for the C

The word “package” has different meanings in Ada and Java. In Java, a package is used as a namespace for classes. In Ada, it’s often a compilation unit. As a result Ada tends to have many more packages than Java. Ada package specifications (“package specs” for short) have the