Re: Papers on the Ariane-5 crash and Design by Contract

[Ken Garlington <GarlingtonKE@lmtas.lmco.com>]

Jean-Marc Jezequel wrote:
> 
> Unless our English is so bad that it betrays our thinking, we
> *never* implied such a thing. Just a point in a case: Eiffel simply did not exist when they
> worked on Ariane4. Let me quote the relevant section of the paper:
> 
> <<Is it the programming language's fault?
> Although one may criticize the Ada exception mechanism...

Interestingly enough, such a statement is not made about Eiffel
assertions,
although one could criticize those as well (or any feature of any
language, for that matter.)

Later in the paper:

"From the principle of Design by Contract expounded by earlier columns,
we
know that any software element that has such a fundamental constraint
should
state it explicitly, as part of a mechanism present in the programming
language, as in the Eiffel construct..."

Interestingly, all of the coding examples are in Eiffel, although
apparently
any language could have been used. Or could it? From later in the paper:

"To attempt to reuse software without Eiffel-like assertions..."
                                      ^^^^^^

Note that these are not characterized as "design by contract-like"
assertions, but Eiffel-like assertions. The paper goes on to make it
clear that not just any language will do:

"It is regrettable that this lesson has not been heeded by such recent
designs as Java (which added insult to injury by removing the modest
assert
instruction of C!), IDL (the Interface Definition Language of CORBA,
which is intended to foster large-scale reuse across networks, but fails
to provide
any semantic specification mechanism), Ada 95 and ActiveX."

From this we learn that Java and Ada 95 are not properly designed for
Design by Contract. What does a language need to support Design by
Contract?
We are told... 

"For reuse to be effective, Design by Contract is a requirement. Without
a precise specification attached to each reusable component --
precondition,
postcondition, invariant -- no one can trust a supposedly reusable
component."

I wonder which languages have built-in precondition, postcondition, and
invariant statements...

It's bad enough that you post statements that are explicitly
contradicted
by the Ariane V final report (e.g. that the IRS could not be tested in
a black-box environment). When you post statements that are contradicted
by your *own* paper...

> 
> --
> Jean-Marc Jezequel               Tel : +33 2 99847192
> IRISA/CNRS                       Fax : +33 2 99847171
> Campus de Beaulieu               e-mail : jezequel@irisa.fr
> F-35042 RENNES (FRANCE)          http://www.irisa.fr/pampa/PROF/jmj.html

--
LMTAS - The Fighter Enterprise - "Our Brand Means Quality"
For job listings, other info: http://www.lmtas.com or
http://www.lmco.com