Re: Critique of Ariane 5 paper (finally!)

[dewar@merv.cs.nyu.edu (Robert Dewar)]

Bertrand said

<<> The definition of reliability which this implies is that a system
> is "highly reliable" if it has been working satisfactorily for,
> say, 30 {seconds | minutes | hours | days | weeks | months | years}
> -- pick one. This is one possible definition of reliability, which gets
> more and more interesting as it moves to the right of the list
> of choices; but it is by no means the only "terms that matter".>>


Incidentally I said nothing of the kind in my message, I said that the
only measure of reliability that made any sense was that a program
behaved in a realiable manner and did what it was supposed to do.

The idea that this implies that I think the only possible test of this
is to run the system and see if it works is an idea created by the
reader not the writer!

There are many ways that one can use to determine if a program is reliable.
For example, in some limited small cases, total proof of correctness may
be a useful tool. Certainly the contstruction of such proofs can be aided
by accurate assertions about the code, but such proofs do not (and cannot)
depend critically on the presence of such assertions.

Similarly, systematic coverage and branch testing are pretty much 
independent of whether DBC was or was not used.

Showing that a program is realiable is a complex process that involves
the use of many tools and techniques. Yes, in some cases, DBC may aid
this process, but the suggestion that no program can be realiable which
does not use DBC is plain unreasonable.