Re: Ada in command / control systems

[Maciej Sobczak <see.my.homepage@gmail.com>]

> Because the tool is claimed to state the "requirements". There can be 
> nothing above that.

What do you mean "nothing above that"? There can be many levels of requirements. Simulink (and such) is typically used at the level called Low Level Requirements (LLR for short). There is *a lot* above that. There might be even other models above that. And Simulink might not be the only thing used at its level, or not for all artifacts.
The notion that the model is still at the level of requirements comes from the fact that a programmer might pick the model and write code from it, contributing perhaps from his experience and technical expertise. The fact that there are people who don't understand the source code but are still comfortable looking at the diagram means that there is some abstraction in it ("useful lie" - a very good term). The fact that Simulink can generate code automatically is actually not important here, because that functionality need not be used - which, interestingly, makes your arguments about s-functions irrelevant. The s-functions might be just dummy blocks and as long as the programmer understands what should be provided in their place, the diagram as a whole is still useful. It might be even used for formal reasoning about some of the system properties.
Of course, the concept can be also misused. Which might even happen more often than we would like. But this would not be an argument against models, rather against our lack of skills in using them.

> The source code is complete per definition, otherwise you could not 
> compile and build the solution from it.

Which also means that it is the lowest level representation of the system that we should care about. The question is, whether it is the only representation that we need. If we need something above that, what it should be?

> There are lots of concerns when calling s-function, e.g. when the block 
> containing this function is in the feedback loop.

Sure, and there are concerns about source code being reentrant or not, or being thread-safe or not, or being exception-safe or not, or being recursive when it should not be, and so on. It's not like source is concern-free.

> Models are extremely 
> fragile.

So is source. So much that people believe it makes sense not to write it.

> Programming languages have means 
> for proper encapsulation and insulation the side effects. 
> Domain-specific languages have nothing of this sort.

Why? I see no reason why they should not have it.

> It is the same paradigm and after a half of century we more or less know 
> how to write reusable components in C and Ada.

And you have the whole libraries (built-in and COTS) of reusable modules or operators in Simulink (and similar), too. People just drag'n'drop filters, amplifiers, counters, and whatever other stuff they need into their projects and it seems to work. Why should they come back to source?

-- 
Maciej Sobczak * http://www.inspirel.com