Re: Papers on the Ariane-5 crash and Design by Contract

[dewar@merv.cs.nyu.edu (Robert Dewar)]

Bertrand Meyer wrote

<<        !! Does this mean that the crash would automatically have
        !! been avoided had the mission used a language and method
        !! supporting built-in assertions and Design by Contract?
        !! Although it is always risky to draw such after-the-fact
        !! conclusions, the answer is probably yes:>>

Note that this conclusion is completely language independent. In particular
the use of assertions is not language dependent. No method can possibly
*rely* on having actual execution of assertions, since that just reduces
you to relying on testing, but certainly execution of assertions is a
helpful adjunct to testing, and certanly at the level that was needed in
this case, any language can certainly implement runtime assertions.

The main point is that a systematic design using Design by Contract would
indeed probably have avoided the error. However, be careful not to conclude
from this observation that Design by Contract somehow has something special
to say in the Ariane case.

As has become painfully obvious in the aftermath, the Ariane 5 incident
could have been avoided by any number of means, and almost any competent
design approach, formal or informal, should have prevented this particular
software error. Even in the absence of a systematic design approach, 
rigorous testing and/or common sense in approaching the design would have
avoided the problem.

The Ariane 5 crash was spectacular, and therefore acts as a focus for
discussion, but in fact it is not a particularly instructive example of
a BIG BUG. On the contrary it was the kind of simple minded carelessness
that plagues software, and can be reduced or eliminated without any
very specialized techniques if you have competent people working in a 
reasonably systematic manner.