Ada: The Language the Pentagon Built

Abstract

By the mid-1970s the US Department of Defense was maintaining software in over 450 programming languages, many obsolete, proprietary, or tied to dead hardware. Its answer was the largest language-design project ever undertaken: requirements documents hammered out in public (Strawman to Steelman), an anonymous four-team design competition won in 1979 by Jean Ichbiah’s French team, and a name that honored the first programmer: Ada, standardized as MIL-STD-1815, the number her birth year. Ada became the language of fly-by-wire jets, air-traffic control, and railways; pioneered mainstream tasking, generics, and later design-by-contract; and in 1995 became the first ISO-standardized object-oriented language. It also became a case study in the limits of decree: the Pentagon’s Ada mandate was repealed in 1997 after a decade of workarounds, and the language that was supposed to end language proliferation settled instead into the niche where its obsessions (catching errors before runtime) were always worth the cost: systems that must not fail.

450 Languages and a Working Group

The DoD’s embedded-software crisis was inventoried in the early 1970s: more than 450 languages in use, no two projects portable, contractors locked in, maintenance devouring budgets. In 1975 the High Order Language Working Group (HOLWG), led by Colonel William Whitaker, set out to select (or commission) one language for all embedded defense systems. Its method became a model of open engineering: successive public requirements documents of increasing rigor, from Strawman (1975) through Woodenman, Tinman, and Ironman to Steelman (1978), refined by hundreds of reviewers worldwide. Steelman’s demands read like a safety engineer’s wish list: strong typing, exception handling, concurrency in the language itself, no dialects, readability over writability. An evaluation of existing languages concluded none qualified, but that a single new one could. Pascal, ALGOL 68, and PL/I were designated as approved starting points.

The Color War

Four contractors were funded to design candidates, anonymized by color to keep the judging blind: Red (Intermetrics), Green (CII Honeywell Bull, led by Jean Ichbiah in France), Blue (SofTech), and Yellow (SRI International). All four built on Pascal. In May 1979 Green won, and the language received its name: Ada, for Ada Lovelace, with the blessing of her descendants. The military standard approved on December 10, 1980 was numbered MIL-STD-1815: Lovelace’s birth year. An ANSI standard (Ada 83) followed in 1983 and ISO adoption in 1987.

Ichbiah’s design bet everything on compile-time rigor: strong static typing with programmer-defined ranges (type Altitude is range 0 .. 50_000, the compiler and runtime police it), packages for modularity ahead of most industry practice, generics before C++ existed, exceptions, and tasking, rendezvous-based concurrency as a language construct, not a library, years before mainstream languages attempted it (see Concurrency and Parallelism).

Not everyone applauded. Tony Hoare, in his 1980 Turing Award lecture The Emperor’s Old Clothes, delivered the most famous warning in language-design history: Ada, he argued, was dangerously over-complex, and reliability could only come from simplicity: “do not allow this language in its present state to be used in applications where reliability is critical.” His broader line about unreliable languages being a greater societal risk than unsafe cars entered the field’s permanent memory (see Tony Hoare and the Science of Programming). History split the difference: Ada was indeed heavy, and Ada-based systems compiled a safety record most languages envy.

The Mandate

The DoD made Ada policy by directive in 1987 and Congress made it law in 1991: DoD software was to be written in Ada where cost-effective. The mandate produced real adoption, and a decade of creative evasion, waiver bureaucracy, and resentment, colliding with the 1990s tide of cheap commercial software written in C and C++. Early compilers were slow, expensive, and late; universities taught what industry used, and industry increasingly used the C family. In 1997 the mandate was dropped in favor of commercial off-the-shelf pragmatism. As a monopoly instrument, Ada failed, proliferation won. What survived the mandate’s repeal was the meritocratic core: the projects that had chosen Ada for engineering rather than compliance kept it.

Where Ada Lives

Ada 95 (led by Tucker Taft) made it the first internationally standardized object-oriented language; Ada 2012 added design-by-contract, pre- and postconditions checked by compiler and runtime. The GNAT compiler (begun at NYU, now maintained by AdaCore) put a full Ada toolchain in the GNU ecosystem for free. The SPARK subset goes furthest: a formally analyzable Ada in which absence of runtime errors can be mathematically proven, used where testing alone is insufficient argument (see Formal Methods and Model Checking), and adopted beyond aerospace, notably by NVIDIA for security-critical firmware.

The deployment list is the point: Boeing 777 flight software, Airbus fly-by-wire components, European and US air-traffic control systems, the TGV and metro signaling, satellites and launchers, the F-22. When Ariane 5 exploded in 1996, the failing code was Ada, and the post-mortem blamed reuse of Ariane 4 assumptions and a disabled range check, not the language; the lesson (an exception raised exactly as specified, from a specification that no longer held) became required reading in software engineering.

⚠️ Dead End: Standardization by Decree

Ada’s instructive failure is the mandate, not the language. The Pentagon reasoned that since it was the world’s largest software customer, it could will a universal language into existence, the same era in which governments bet on Fifth Generation Prolog and OSI networking. All three lost to the same opponent: bottom-up ecosystems with cheaper tools, more programmers, and momentum. A language is not a specification but an economy (compilers, teachers, libraries, job markets) and economies cannot be requisitioned. The irony is that Ada’s design process (open requirements, blind competition, public review) was exemplary and its engineering ideas won everywhere: strong typing, generics, modules, contracts, and language-level concurrency are now table stakes, and Rust (the current darling of safety-minded systems programming) reads in places like Ada’s ideas returning with better marketing. The decree died; the dogma of compile-time safety conquered.

Fun Fact

Ada is the only major programming language named for a historical person by a military standard whose document number is her birth year: MIL-STD-1815. Lovelace’s descendants approved the naming; the 1815 assignment was requested, not coincidence.