Re: Ariane-5: can you clarify? (Re: Please do not start a language war)

[Ken Garlington <GarlingtonKE@lmtas.lmco.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2816 bytes --]


Nick Leaton wrote:
> 
> Ken Garlington wrote:
> >
> > Nick Leaton wrote:
> > >
> > > Karel Th�nissen wrote:
> > >
> > > > > From personal experience I have found this to be the case. Being able to
> > > > > test your comments is very useful!
> > > >
> > > > I fully agree, and every one should do this. But do you get this taught
> > > > in software engineering class or do software engineering methods or
> > > > languages enforce this? Do project managers require this?
> > > > To further clarify my/our point. Right now tens of thousands of
> > > > programmers wish that assumptions were more accurately documented in the
> > > > code - on the spot - if only by means of informal comments. These
> > > > programmers are making our software ready for the Y2000, they know the
> > > > assumptions made, if only they could easily find those spots.
> > >
> > > I was very sceptical about assertions until I started using Eiffel. I am
> > > now converted.
> > >
> > > I would however be interested in a discussion on how exceptions should
> > > be handled.
> > >
> > > 1) Report and fail
> > > 2) Have logic. In the Ariane case, just shut down the SRI after launch
> > > 3) Fix and retry - could just be wait and retry
> > > 4) Try method B
> > >
> > > Are there any others?
> >
> > I wouldn't recommend #2 in the Ariane 5 case, since that is exactly what
> > the SRI did in response to the exception!!!!!
> >
> > In reality, there is no "one size fits all" response to exceptions. Each
> > case must be analyzed separately - which is part of what makes writing
> > good assertions so difficult.
> 
> You misunderstand me, probably because 2) is not as explicit as I
> originally intended.
> 
> SRI raises exception.
> Exception handler receives exception.
> Exception handler checks launch status and finds out that
> the rocket is launched. Since SRI is used for alignment, it is
> now redundant so can be shutdown/ignored.

Actually, the SRI is used during the entire flight profile. There
was an alignment *function* that was contained *within* the SRI
that should have been shut down as soon as the Ariane took off
(alignment functions do not typically work well with moving
platforms!) It would probably have been reasonable to shut down
the process doing the alignment function of the SRI, assuming the
processes were partitioned in a way that allowed the other
necessary functions to continue, although there was no need to
wait until an exception was raised to do this.

So, in this particular case, it was probably reasonable to shut
down part (but not all) of the SRI. Other parts of the SRI may not
be able to shutdown under ANY circumstances.

> 
> --
> 
> Nick

--
LMTAS - The Fighter Enterprise - "Our Brand Means Quality"
For job listings, other info: http://www.lmtas.com or
http://www.lmco.com