Re: Papers on the Ariane-5 crash and Design by Contract

[Ken Garlington <GarlingtonKE@lmtas.lmco.com>]

Gavin Collings wrote:
> 
> --
> Joachim Durchholz <joachim.durchholz@munich.netsurf.de> wrote  > The class
> EXCEPTION with several subclasses does exist as part of the
> > standard libraries. Exception handlers can decide what to do based on the
> 
> > run-time class of the exception. This facility does not seem to be in
> > wide-spread use, but it's all there.
> 
> Good.  The main point about the Java model, though, is that the compiler
> checks that the programmer has at least thought about handling all
> exceptions that may be generated in nested calls.  This means that the
> programmer HAS to think about dealing with error conditions.  So, in the
> Ariane case, if the precondition existed (as some say it did) the compiler
> would have given warnings to the effect that it IF the error occurred, it
> would NOT have been handled.  Wouldn't this have made the disaster less
> likely?

No, for two reasons:

1. There was a top-level hander for exceptions. So, it was handled, just
   not in the proper manner.

2. The development team had already decided that the exception would not
   occur in practice, and so would have discounted the warning.

Both of these are noted in the final report.

If the software had been recompiled when reused for the Ariane 5,
it might have helped (although there are other aspects of this
incident that would probably have defeated this feature). However,
there's no evidence in the final report that it was recompiled.
The report implies that the total system was reused as a "black box."

> 
> Gavin.

--
LMTAS - The Fighter Enterprise - "Our Brand Means Quality"
For job listings, other info: http://www.lmtas.com or
http://www.lmco.com