Re: Not intended for use in medical,

[John Apa <japa@DIE_SPAMMER.dasd.honeywell.com>]

Kaz Kylheku wrote:
> 
> In article <dewar.862270256@merv>, Robert Dewar <dewar@merv.cs.nyu.edu> wrote:
> >John said
> >
> ><<If it were me designing life support systems for medical use I'd:
> >Make use of Appendix H (Safety and Security) in Ada95.
> >Review the object code.
> >And then test the hell out of it like my life depended on it.>>
> >
> >This sounds like depending on testing too much, and on formal methods
> >too little -- there is a balance sure, but the above seems unbalanced.
> 
> Reviewing the object code is (or can be) a formal method. Maybe the
> use of the word ``hell'' shifts the perception of balance. :)

Yes, perhaps I added emphasis to the wrong part. Formal methods are a
great thing if you can get everyone to follow them. To me it seems as if
many people talk about it yet few actually follow it. This is bad. A
team using a well defined and accepted development process and formal
methods can do great things. But it only takes one of the team to "just
make a quick fix" and then the fun begins.

In any case if my life depended on it, I would still test it beyond what
many would consider "acceptable". I have slipped my own schedules in
order to do a little extra testing or desk checking when I (or others)
felt it was required for safety (life and/or data) purposes. I think we
owe our end users that, especially the ones who trust our work to keep
their planes in the air.

To bad MS didn't feel that way about their products.

> 
> It's a pity that this discussion was confined to comp.lang.ada, because I
> missed a lot of it, even though I sparked it with quote from the Intel
> document.
> 
snipped a good example
-- 
***********************************
Standard Disclaimers Apply
John Thomas Apa
Replace "DIE_SPAMMER" with "delphi" to email.
Honeywell Defense Avionics Systems
Albuquerque, New Mexico.
***********************************