Ada: The Language the Pentagon Built

Abstract

In the mid-1970s the US Department of Defense counted over 450 programming languages in its software. Its fix was one more: a language specified in public requirements documents and designed in a blind four-team competition, which Jean Ichbiah’s French team won in 1979. It was named Ada, after Ada Lovelace, and its military standard got the number MIL-STD-1815, her birth year. A Pentagon Ada mandate followed in 1987 and was dropped in 1997. Ada stayed where errors caught before runtime are worth the cost: aircraft, air-traffic control, railways, and other systems that must not fail.

450 Languages and a Working Group

The DoD inventoried its embedded software in the early 1970s and found more than 450 languages in use. No two projects were portable, contractors were locked in, and maintenance was eating the budgets. In 1975 the High Order Language Working Group (HOLWG), led by Colonel William Whitaker, set out to select or commission one language for all embedded defense systems. It worked in the open. A series of public requirements documents, each stricter than the last, ran from Strawman (1975) through Woodenman, Tinman, and Ironman to Steelman (1978), and hundreds of reviewers worldwide commented on them. Steelman asked for strong typing, exception handling, concurrency in the language itself, no dialects, and readability over writability. An evaluation of existing languages found that none qualified but that a single new one could, and named Pascal, ALGOL 68, and PL/I as approved starting points.

The Color War

Four contractors were funded to design candidates, anonymized by color to keep the judging blind: Red (Intermetrics), Green (CII Honeywell Bull, led by Jean Ichbiah in France), Blue (SofTech), and Yellow (SRI International). All four built on Pascal. In May 1979 Green won, and the language received its name: Ada, for Ada Lovelace, with the blessing of her descendants. The military standard approved on December 10, 1980, was numbered MIL-STD-1815: Lovelace’s birth year. An ANSI standard (Ada 83) followed in 1983 and ISO adoption in 1987.

Ichbiah’s design put its weight on compile-time checking. Types could carry programmer-defined ranges (type Altitude is range 0 .. 50_000), enforced by compiler and runtime. Packages provided modularity before most of the industry practiced it, generics arrived before C++ existed, and exceptions were built in. Tasking, rendezvous-based concurrency defined in the language rather than added as a library, came years before mainstream languages tried it (see Concurrency and Parallelism).

Not everyone applauded. Tony Hoare, in his 1980 Turing Award lecture The Emperor’s Old Clothes, gave the most famous warning in language-design history. Ada, he argued, was dangerously over-complex, and reliability could only come from simplicity: “do not allow this language in its present state to be used in applications where reliability is critical.” His broader line, that unreliable languages were a greater risk to society than unsafe cars, is still quoted (see Tony Hoare and the Science of Programming). Ada did turn out heavy, and Ada-based systems also built a strong safety record.

The Mandate

The DoD made Ada policy by directive in 1987, and Congress made it law in 1991: DoD software was to be written in Ada where cost-effective. The mandate produced real adoption. It also produced a decade of evasion, waiver bureaucracy, and resentment, just as cheap commercial software written in C and C++ was spreading. Early compilers were slow, expensive, and late; universities taught what industry used, and industry increasingly used the C family. In 1997 the mandate was dropped in favor of commercial off-the-shelf software. As a way of forcing one language on everyone, it had failed. The projects that had chosen Ada for engineering reasons rather than compliance kept it.

Where Ada Lives

Ada 95, led by Tucker Taft, was the first internationally standardized object-oriented language. Ada 2012 added design-by-contract, with pre- and postconditions checked by compiler and runtime. The GNAT compiler, begun at NYU and now maintained by AdaCore, put a free Ada toolchain into the GNU ecosystem. The SPARK subset can be analyzed formally, so that the absence of runtime errors can be mathematically proven. It is used where testing alone is not enough (see Formal Methods and Model Checking), and outside aerospace as well: NVIDIA adopted it for security-critical firmware.

Ada runs Boeing 777 flight software, Airbus fly-by-wire components, European and US air-traffic control systems, TGV and metro signaling, satellites and launchers, and the F-22. When Ariane 5 exploded in 1996, the failing code was Ada. The inquiry blamed reused Ariane 4 assumptions and a disabled range check, not the language: an exception was raised exactly as specified, by a specification that no longer held. The case became required reading in software engineering.

⚠️ Dead End: Standardization by Decree

Congress could require Ada, but it could not supply what a language needs to spread: cheap compilers, teachers, libraries, and programmers looking for jobs. C and C++ had all of these. The Pentagon, as the world’s largest software customer, had assumed its purchasing power would be enough. In the same era, governments made similar bets on Fifth Generation Prolog and OSI networking, and both lost to bottom-up ecosystems in the same way. Ada’s ideas did better than its mandate. Strong typing, generics, modules, contracts, and language-level concurrency are now standard, and Rust, today’s favorite for safety-minded systems programming, reads in places like Ada’s ideas with better marketing.

Fun Fact

Ada is the only major programming language named for a historical person by a military standard whose document number is her birth year: MIL-STD-1815. Lovelace’s descendants approved the naming; the number 1815 was requested, not a coincidence.