Re: Boeing and Dreamliner

[aek@vib.usr.pu.ru (Alexander Kopilovitch)]

Hyman Rosen wrote:

>Richard Riehle wrote:
>> And those issues directly support the folly of even thinking about using
>> C++ for this aircraft.
>
>Unsurprisingly, I disagree. You're talking about a situation where every
>arithmetic operation in the code was carefully scrutinized. I'm sure that
>in the cases were protection was left in the Ariane 4 code it did not
>consist of allowing an Ada exception to be raised on overflow, but rather
>coding in such a way that a correct numeric result would be produced. I
>don't see why such scrutiny would not result in equally safe C++ code.

There is vague but powerful thing - "expectations". In Ada world it is
natural to expect that a component is suited and perhaps optimized for the
particular purpose, unless otherwise it explicitly stated. The situation in
C++ world is often quite opposite: it is common to expect that a class or
class library provides some kind of acceptable/reasonable behaviour for some
generic range of applications, and that behaviour must be overridden if/when
we have have specific requirements.

Therefore typical C++ programmer will not scrutinize the component unless he
either has specific requirements or is alarmed by something - just because
he *expects* from the component a resonable generic behaviour. And when he
is given an Ada component, his habits - his usual expectations may well be
in effect in the area where they are certainly invalid.

Then to the habit of looking into source code as into a guide for documentation.
It is also a habit of C++ world. Just one real example from Symbian OS C++ SDK
(for SonyEricsson P800 smartphone): for preventing a dialog to be closed on
application deactivation you should implement ShutL() method of CEikDialog
class - this is said in the special separate page of SDK docs. But there is
no ShutL() method in the documentation of the CEikDialog class, as well as
in the documentation for its ancestors. Well, let's look into source code -
CEikDialog class definition - and yes, we see there method ShutL() - it is
private (so it was not included in documentation) but virtual (so it may be
overriden).

Thus C++ programmer often looks into source code, expecting to find there some
clues for documentation.

So, even the C++ habits may lead to disasters when applied in Ada world --
because expectations in these two worlds are quite different. And it is possible
that exactly this thing was a contributing factor in Ariane 5 case.



Alexander Kopilovitch                      aek@vib.usr.pu.ru
Saint-Petersburg
Russia