Re: Can OO be successful in real-time embedded systems?

[Ken Garlington <garlingtonke@lmtas.lmco.com>]

Robert A Duff wrote:
> 
> Run-time dispatching is just like a case-statement, except the branches
> are scattered all over the code.  To do white-box testing, you have to
> track down all overridings of a given procedure.  Having done that, it's
> no harder than testing a case statement.  So, I think you want a tool to
> do that tracking down.  I use "grep" for that purpose, but one could
> imagine something more helpful.

For safety-critical systems, you might also want to use pragma Reviewable,
coupled with a tool that reads the resulting analysis file, to examine
the object code for each dispatch and verify that the case-ish object code meets
certain criteria. We do this now for case statements, and I would expect that
we would extend the technique for dispatching.

The real difference between dispatching and case statements, in my mind, is
that case statements usually only generate different code if the case statement
itself is changed. Even if the range of the case selector is changed, for
example, the case itself usually has the same object code. Thus, you can sometimes
limit the scope of analysis for regression test purposes.

For dispatching, this isn't going to be the case (so to speak.) We're going to
have to be more careful about doing analysis of dispatch points. However, with
reasonable tools and CM practices, this should not be insurmountable.

Overall, I don't have any real fear of using dispatching in our safety-critical
systems. Of course, I haven't tried to use it in practice, yet.

> But beware: there's a lot more to safety than is codified in the SS Annex.

That's certainly true. Further, I don't see the annex as being all that much
"over-kill." Except for Normalize_Scalars and 'Valid, you can pretty much have the
whole annex with current Ada 83 tools (although the implementation is
not the same, of course). I would like to believe that, for safety and security
related applications, the annex would serve as a perfectly reasonable tool kit.

> 
> - Bob

-- 
LMTAS - "Our Brand Means Quality"