Re: OT?: AF 447 and avionics software

[Tim Rowe <spamtrap@tgrowe.plus.net>]

Ludovic Brenta wrote:
> The most critical subsystems are usually certified to the DO-178B
> level A standard; this means that unit tests must cover 100% of the
> code and 100% of the decision paths; it's called MC/DC testing
> (Modified Condition/Decision Coverage).

I think the problem is confusion between testing the behaviour of the 
/code/ and the behaviour of the /system/. Even if we could achieve 
perfect confidence in the behaviour of the software, in the case of 
fly-by-wire it's still difficult to be sure that it's what you /want/ it 
to do for all situations the aircraft finds itself in. This requirements 
problem is far from unique, of course, but it's important to remember 
that no language and no amount of proof against requirements will help 
if we're unsure of the requirements!