Re: Critique of Ariane 5 paper (finally!)

[Samuel Mize <smize@link.com>]

Robert Dewar wrote:
> 
> Bertrand says
> 
> <<As convincingly as I could, my colleagues and I
> have explained: why in our view
> software technology crucially requires the systematic use of
> Design by Contract; why Design by Contract is a
> necessary condition to avoid more Ariane-like failures;
> and what is missing in this respect in such approaches
> as Java, Ada, C++, IDL.>>
> 
> Your argument at *best* says that DBC might have been a *sufficient*
> condition for avoiding the Ariane failure. Even there, it seems
> over-facile and rather academic, and does not seem to understand
> fully the exact nature of the Ariane problem.

DBC proponents have said that using DBC IMPLIES review of
requirements, review of design, and testing the component.
In this case, the claim that DBC would "probably" have prevented
the crash is nugatory but true.

However, the claim that "widely accepted industry practices" would
not have done so is false.  Requirements review, design review, and
in-situ test are standard for a mission-critical component.  Not
ONE of these was done for the Ariane 5 INS.  To claim that this is
"widely accepted industry practice" is disingenuous at best, and
appears intentionally misleading to a lot of us.

It is this false claim that destroys the argument that DBC is
"a necessary condition to avoid more Ariane-like failures."

It's rather like saying that a new method of navigation would
"probably" have prevented the Exxon Valdez crash.  True, but
only because ANY navigation would have prevented it!


> But to make the jump from sufficient to necessary is completely
> without basis, and can only be regarded as advertising puffery.

Which appeared in a column in IEEE Computer magazine, positioning
it deceptively as a technical item instead of an ad.

Samuel Mize