Re: Ariane5 FAQ

[Hyman Rosen <hyrosen@mail.com>]

Mike Silva wrote:
> And, besides "complaining," what action should the code have taken?  I
> doubt "complaining" alone is an adequate solution!

Well, I'm not necessarily a proponent of this view,
but I assume that those who are would expect that the
code signals a violation in some fashion, perhaps by
throwing an exception, or some other mechanism.

The key here is that an external datum has violated a
constraint of the design. By definition, the code is
not prepared to deal with such a value, and yet it must
do something. That something must be specified in some
fashion, even if that specification is simply to let
the code proceed as if the value were legal.

By inserting such checks into the code, protection is
provided against potential future misuse by verifying
that assumed constraints still hold. When they do not,
the error is signalled at the first place that the
violation is noticed instead of somewhere later down
the road.

It's really no different than using the various forms
of range checking that Ada provides. Some constraints
can't be specified purely through the Ada type system,
but that doesn't mean that they shouldn't be expressed
in the code.

As counter arguments, such checks might be expensive
in terms of time and space, and they add execution paths
which can never be exercised in the normal course of events.
And it's possible that for erroneous data to get damped out
in the course of normal processing, while detecting the error
could abort the system. I don't think there's a unique good
answer to the dilemma.