Re: Ariane 5 - not an exception?

[Alan Brain <aebrain@dynamite.com.au>]

JP Thornley <jpt@diphi.demon.co.uk> wrote:

>As I read the report, the recommendation that "software should be 
>assumed to be faulty until applying the currently accepted best practice 
>methods can demonstrate that it is correct" is saying that if the system 
>design is to be based on the assumption of correct software then they 
>will have to build that software to safety-critical standards.  I wonder 
>if they realise just how expensive that is going to be.

Umm. It appears I may have a small but critical difference of opinion here. IMHO 
safety-critical software _in particular_ should be assumed to be faulty, (perhaps) 
_even though_ shown to be correct.

To make an analogy, on one side you have "guarenteed impenetrable" armour plate, 
surrounding a fragile crystal glass. On the other, you have ballistic gelatine. I 
prefer the latter, as it keeps on working sorta, kinda, even though your basic 
assumptions re Immunity to Murphy may be incorrect.

I've seen error-_tolerance_ work very well in practice. The biggest problem is 
finding the bugs that exist, because the darn thing still works! Only careful 
examination of error logs reveals you're running at 5% efficiency, and encountering 
200 Software Detected Errors per second ( Real figures by the way ).