Re: Trust but verify (was Re: Papers on the Ariane-5 crash and Design by Contract

[jezequel@irisa.fr (Jean-Marc Jezequel)]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2799 bytes --]


In article <333C4396.795@lmtas.lmco.com>, Ken Garlington <GarlingtonKE@lmtas.lmco.com> writes:
> In any case, I have posted these arguments several times without
> response. If you do not respond to this post, I will assume that
> no response is possible.

Sorry, I've been away from some time, and I'll be again soon.
Don't draw hasty conclusions from lack of answers from the net: like you, I
also have real work to do...

BTW, it seems that other (e.g. Karel Th�nissen) did try to answer your points:

>> is that it provides an additional technique for obtaining quality
>> software, not an replacement for testing.
>
>I disagree. I believe the paper strongly implies that DBC was
>*sufficient*
>for solving this problem. The following statements support that claim.

OK, DBC is like a tool, and as for all tools, it must be used properly to be effective.

>It is true that Mr. Meyer has made many statements *outside* of the
>paper
>that support your statement. I would like to see some of those
>qualifiers
>*inside* the paper. I am, after all, critiquing the paper, not an
>individual!

If that's so important to you, may I suggest that you sum up your points and write a
letter to the editor of "Computer"? It seems that B. Meyer used to put these letters
along with the copy of our paper on his Web site. He might consider keeping on
with this practice. Is that fair to you?

But leaving away the casuistics, I'm not sure we really disagree that much 
on the most important points. We wrote:

>"Does this mean that the crash would automatically have been avoided
>had the mission used a language and method supporting built-in
>assertions and Design by Contract? Although it is always risky
>to draw such after-the-fact conclusions, the answer is probably yes:"

You said:
>Perhaps a better statement would have been:
>
>"Does this mean that the crash would automatically have been
>avoided had the mission used a language and method supporting built-in
>assertions and Design by Contract? By itself, possibly not. However,
>in the context of a well-managed system and software engineering
>process, DBC provides additional capabilities to detect problems of
>this class before they cause a serious impact."
>
>This statement could be debated, but it isn't provably false. 

Was the difference between both statements worth dozens of messages?
Is it not obvious that without "a well-managed system and software engineering
process", you cannot expect a lot of benefits from any software engineering principle?

Regards,

-- 
Jean-Marc Jezequel               Tel : +33 2 99847192         
IRISA/CNRS                       Fax : +33 2 99847171         
Campus de Beaulieu               e-mail : jezequel@irisa.fr 
F-35042 RENNES (FRANCE)          http://www.irisa.fr/pampa/PROF/jmj.html