Re: Papers on the Ariane-5 crash and Design by Contract

[Paul Johnson <paul.johnson@gecm.com>]

jsa@alexandria (Jon S Anthony) wrote:
>In article <5gp3hd$i0l@mulga.cs.mu.OZ.AU> fjh@murlibobo.cs.mu.OZ.AU (Fergus Henderson) writes:

>> The major difference between C/C++/Ada assertions and Eiffel style
>> design-by-contract is that in the latter, the assertions are part of
>> the interface, not just embedded in the implementation.

>Well, in this particular sort of case, your claim here is not correct
>for Ada:

>subtype Bias_Constraint is Integer range Min_Bias..Max_Bias;
>
>function Convert ( High_Bias : Bias_Constraint ) return Integer;
>
>
>The asserstion is part of the interface, NOT the implementation.

Yes, but this doesn't help.  Sure, the range limit is in the interface
to the conversion routine, but there is no way (other than comments)
to propogate that limit into the interfaces of its callers, and no
methodological rule that says you should.

The point about Eiffel is not merely that it has the syntax to express
these limits, but that it also has the rules and "programmer culture"
that causes these mechanisms to be used routinely.  This might well
have caused the limit in question to documented at a high enough level
to have been noticed by whoever it was that decided to re-use the Ariane
4 inertial guidance system.  Its not certain, but its a lot more likely.

The report said that the limits *were* documented (commented I think)
in the code, but this was essentially invisible to any kind of management
oversight.  Had the limitation been propogated to a high level interface
then its more likely that someone would have noticed.

Having said that, I must admit that this exception was caused by a high
horizontal speed sensed by the unit, rather than external data which
violated preconditions.  Hence the restriction would not have appeared
at the API level for the sensor.

Paul.

-- 
Paul Johnson            | GEC-Marconi Ltd is not responsible for my 
opinions. |
+44 1245 242244         
+-----------+-----------------------------------------+
Work: <paul.johnson@gecm.com>       | You are lost in a twisty maze of 
little
Home: <Paul@treetop.demon.co.uk>    | standards, all different.