Re: Ariane 5 - not an exception?

[JP Thornley <jpt@diphi.demon.co.uk>]

In article: <EACHUS.96Jul30184744@spectre.mitre.org>  
eachus@spectre.mitre.org (Robert I. Eachus) writes:
>    First, I think of mission critical as a different category than
> safety critical.  In safety critical systems, fail safe is often an
> option where in mission critical systems you need to fail operational.

Hmmm, hadn't come across that distinction before, but it does seem to 
make sense in some cases.  But making fail operational a defining 
characteristic of mission critical systems seems a bit too strong - how 
many 'glass cockpit' aircraft have no backup suck and blow instruments 
to use when all the screens go blank?

> And yes, systems can be safety AND mission critical.  Those are the
> expensive ones.
> 

Again, in my terminology, the development standards for mission critical 
are wholly subsumed in those for safety-critical code, so classifying 
something both as no real effect on the software development methods 
used.

>    Having said that, this software should have been classed exactly
> that way, given the amount of miscellaneous missle parts that ended up
> scattered over the launch site, and the possibility that a guidance
> failure could put the missle anywhere in the world.
> 

As I read the report, the recommendation that "software should be 
assumed to be faulty until applying the currently accepted best practice 
methods can demonstrate that it is correct" is saying that if the system 
design is to be based on the assumption of correct software then they 
will have to build that software to safety-critical standards.  I wonder 
if they realise just how expensive that is going to be.

Phil Thornley

-- 
------------------------------------------------------------------------
| JP Thornley    EMail jpt@diphi.demon.co.uk                           |
------------------------------------------------------------------------