Re: Ada Core Technologies and Ada95 Standards

[dewar@cs.nyu.edu (Robert Dewar)]

Ken Garlington says:

  1. The ACVC is not an adequate standard of proof, because of inherent
     limitations of a general certification test suite. I'm not sure I fully
     accept that rationale, but as we've already agreed, you're far more
     knowledgeable of the ACVC than I, so I'll have to bow to your expertise.

Ken, it continues to worry me that you could possibly think that a set
of black box tests (no code coverage testing, no path testing) could
possibly be sufficient as proof at any high level of assurance of a
complex program. Surely you do not mean to tell me that safety critical
programs that you write are tested only to this extent (or for that
matter that these programs trust the compiler!)

  2. The real standard of proof should come from the actions of the individual
     vendors. In particular, you said that GNAT has a development and test
     process, and that this process was probably common to other vendors.
     I requested a description of this process. Is this an unreasonable demand
     from potential customers like Mr. McCabe and myself? I know that any
     potential customer can ask for my company's process at any time (in fact,
     we have booths at conferences like the Software Technology Conference
     _promoting_ our process).

We have described our process in a number of forums. It is a long story
which I am not about to post here! In short we have an extensive test
suite that we run every night and before any modification to the system
occurs, but there is much more to the story than that. If you are indeed
a serious potential customer for GNAT, contact support@gnat.com.
(or stop by our booth at STC!)