Re: Papers on the Ariane-5 crash and Design by Contract

[Thomas Beale <thomas_beale@invest.amp.com.au>]

Jean-Marc Jezequel wrote:
> 
> Yes this is true. But, since the SRI was reused from Ariane4, the problem
> is not with developers, but with the *integration* team.

If the SRI is a black box, and this is taken to mean it is reusable,
doesn't
that imply (by definition) that it should do its job with _any_
trajectory
data (or at least any data for a "reasonable" rocket trajectory)? If
this 
is not true, then you haven't got a "reusable SRI", you have "Ariane-4
SRI". 

So the assertion that the "real problem" was the decision not to supply
Ariane-5
trajectory data relies on the idea of the SRI not really being a
reusable component,
but one that "might work" or something similar.

However, the fact that an explicit decision was made not to use this
data in effect
means that the deciders (whoever they were) tacitly deemed the SRI as
reusable (whether
they realised that or not). (One imagines that this would be true for
all kinds of 
components on the Ariane-5....).

So it seems that the "real problem" was one of the following:

	* the SRI component being deemed (knowingly or unwittingly) as reusable
when it
	  wasn't, and then the development proceeding as if it was a reusable
component.

	* if the SRI component was indeed _supposed_ to be re-usable, meaning
it should have
	  worked with different datasets (among other things), then the fault
is in the
	  implementation of the SRI's notional engineering specification, i.e.
its "contract"
	  to other components.

So either way, it is a re-use error, as originally claimed.

- thomas beale