Re: Boeing and Dreamliner

["Robert I. Eachus" <rieachus@attbi.com>]

Hyman Rosen wrote:

> The report says that these physical constraints were not described in the
> documentation of the SRI software, and therefore the people who attempted
> to reuse it had no clue that it would fail outside of such limits.
> 
> Do you think it's appropriate to write software like that and not tell
> anyone about it? If the code was in C++ and the failure mode was a
> buffer overflow, would you accept that argument, or would you be villifying
> that language?

Be careful, you are asserting something the report does not say. 
Remember this report was much more a political document than an 
engineering document.  The requirements document DID include the Ariane 
4 related requirements.  As anyone who has ever writen control law 
software should know, the physical moments of the system are required 
inputs, and you need the physical limitations of the system to get the 
constraints on the output right.  All those were in the SRI 
specification--for the Ariane 4.  Those values were incorrect for the 
Ariane 5, but no one was PERMITTED to see both the Ariane 5 performance 
specification and the SRI system specification. NO ONE.

Sorry to shout, but that is the key finding of the investigation.  It is 
surrounded by lots of dry language to make it sound like it could happen 
to anyone, but it was pure and simple politics.

The whole discussion of "protecting" the conversion that failed is a red 
herring.  The software people wanted to put in the code, they were 
overruled because in the Ariane 4, that overflow was physically 
impossible.  It was very reasonable for the software designers to want 
to put the check in, and it was very reasonable for management, in the 
context of the overall system, to decide that the default action was 
correct.  If the software engineers or project management had access to 
the Ariane 5 specifications, the decision would have been different.