Re: Ariane5 FAQ

[Richard Riehle <richard@adaworks.com>]

Hyman Rosen wrote:

> But if the Ariane 4 code had carried the specification limits
> within it, as DbC, or as SPARK assertions, or as range checks,
> perhaps someone might have noticed that the Ariane 5 failed to
> meet those constraints.

Yet  they did design the Ariane  4 within those limits.  They would
have had to anticipate some yet unknown information regarding
future projects.

There is  limit to how much checking one can do in any system.
Industrial
Engineers raise the question of 100% checking for 0.0001 % probability
of error.   This becomes a risk management problem  as  well as a
problem in engineering economics.   Every software product carries
a certain amount of risk.   As we weight the consequences of a risk
against the cost of mitigation/prevention and the probability it will
occur, we make choices.   In the case of Ariane 4, the risk was deemed
inconsequential -- a  correct deeming, it seems.   For Ariane 5,  the
risk was significant, but the engineers failed to recognize it.

Richard Riehle