How is dynamic memory allocation handled when extreme reliability is required?

Question

Looks like dynamic memory allocation without garbage collection is a way to disaster. Dangling pointers there, memory leaks here. Very easy to plant an error that is sometimes hard to find and that has severe consequences.

How are these problems addressed when mission-critical programs are written? I mean if I write a program that controls a spaceship like Voyager 1 that has to run for years and leave a smallest leak that leak can accumulate and halt the program sooner or later and when that happens it translates into epic fail.

How is dynamic memory allocation handled when a program needs to be extremely reliable?

Answer 1

Usually in such cases memory won't be dynamically allocated. Fixed sections of memory are used to store arguments and results, and memory usage is tightly controlled and highly tested.

Answer 2

One could also design the system with fault tolerance in mind in case of bugs getting by testing. Checkpoint and recovery techniques could conceivably be used for long running programs like the Voyager example, but are likely tricky to implement when there are stringent real time requirements.

Answer 3

This is the same problem as a long running web server or something like an embedded control system in heating and ventilation heating system.

When I worked for Potterton and then Schlumberger in the Buildings Energy Management Sector we did not use dynamic memory allocation. We had fixed size blocks. A given block would be used for a specified purpose and nothing else. The sizes of the blocks dictated how many of them there could be, so you could choose to have X of this and Y of that functionality etc.

Sounds constrained, but for the fixed, discrete tasks it was enough.

Its important, because if you get it wrong you could blow up a boiler and take half a school building with you :-(

Summary: In some situations, you avoid dynamic memory altogether.

Answer 4

Even without garbage collection and memory leaks, classic malloc/free can fail if you have fragmentation, so a static memory layout is the only sure way to guarantee that no problem arises.