Re: Critique of Ariane 5 paper (finally!)

[dewar@merv.cs.nyu.edu (Robert Dewar)]

Bertrand Meyer wrote:
>
> Robert Dewar writes:
>
> > This is demonstrably false. There are lots of examples of highly reliable
> > software written by people who don't even know what a specification is,
> > let alone how to carefully associate them with software elements.
> >
> > If you want details on this, I can send you hundreds of thousands of
> > lines of COBOL code. This code is completely inpenetrable in places,
> > and I consider it pretty horrible, but it is from a completely reliable
> > system, where reliability is measured in the terms that matter, i.e.
> > it does what it is supposed to do in a highly reliable manner.
>
> This is eloquently said, but incorrect all the same.
>
> The definition of reliability which this implies is that a system
> is "highly reliable" if it has been working satisfactorily for,
> say, 30 {seconds | minutes | hours | days | weeks | months | years}
> -- pick one. This is one possible definition of reliability, which gets
> more and more interesting as it moves to the right of the list
> of choices; but it is by no means the only "terms that matter".
>


This is complete nonsense. I am talking about systems which are reliabale
by any conceivable measure.

Now of course if your measure of reliability includes that it must explicitly
use DBC, then you reduce your argument to a meaningless tautology.

Personally I find obviously bloated claims like this (my method is the
only one that can generate reliable code, and it is impossible to 
generate reliable code any other way) to be highly counter-productive.

I have occasionally heard people make similar bogus absolute claims for
Ada -- and in my opinion nothing is more damaging, since it causes people
who know better to simply ignore not only the obviously incorrect claim,
but also more reasonable claims.

In this particular case, the very reasonable point that DBC may be a useful
tool in helping to achieve reliability in some circumstances is getting
submerged by the more absurd claim that it is the only way to achieve this
goal.