Re: The stupidity of all the Ariane 5 analysts.

[Ken Garlington <kennieg@flash.net>]

Robert Dewar wrote:
> 
> Robert White said
> 
> <<  One could argue that the above is just a nit (flawed example) and
> the overall premise of DBC/Eiffel as a "silver bullet" panacea versus
> conventional "aerospace industry software engineering process" is
> the real issue.
> >>
> 
> Unfortunately the Ariane crash was the result of just such a nit!
> 
> I would think experience would teach us to be very suspicious of any
> claims by anyone to have a silver bullet panacea wjhen it comes to
> software engineering for large systems.
> 
> However tools and techniques that help, even a little bit, are welcome
> even if they are not a panacea (I consider Ada to be in this category,
> and I always find it annoying when people advertise Ada as being
> a silver bullet panacea).

I agree with this, but I also think every tool and technique has both
advantages _and risks_. Failing to understand the risks, and where they
are (and aren't) important, can lead to extremely dangerous choices made
with the best of intentions. I view executable assertions (Ada, Eiffel,
etc.) in this category. In some environments, they are clear wins. In
other
environments, I think it is at least debatable whether their advantages
outweigh their risks.

Complicating this factor is that many people confuse the abstract Good
Thing
(e.g. well-documented assumptions) with a specific implementation of the
Good Thing. They consider the Good Thing so obvious that they don't
consider
(a) what Bad Things may also be associated with the _implementation_ --
the
proponents of the implementation aren't always candid about this part
(or are
sometimes just blind to it) and (b) whether, for a given project, there
are better
ways to achieve the Good Thing.

As you've said in the past, Computer Science is in part a misnomer in
that
there doesn't seem to be much in the way of controlled experiments. So,
a
lot of these risk/reward analyses are based on incomplete data, at best.
This doesn't mean that they shouldn't be done, however. Ignoring the
risks
(or worse, dismisssing them as "they just haven't seen the light yet,"
as
Mr. Meyer did recently) is not smart in any environment, and certainly
not
in safety-critical systems.