From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,INVALID_MSGID autolearn=no autolearn_force=no version=3.4.4 X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 103376,885dab3998d28a4 X-Google-Attributes: gid103376,public From: mheaney@ni.net (Matthew Heaney) Subject: Re: Ariane 5 failure Date: 1996/10/14 Message-ID: #1/1 X-Deja-AN: 189489568 references: <96100111162774@psavax.pwfl.com> <32555A39.E38@lmtas.lmco.com> content-type: text/plain; charset=ISO-8859-1 organization: Estormza Software mime-version: 1.0 newsgroups: comp.lang.ada Date: 1996-10-14T00:00:00+00:00 List-Id: In article , dewar@schonberg.cs.nyu.edu (Robert Dewar) wrote: >As Ken says, checks are not a magic wand. They are a powerful tool, but >like any tool, subject to abuse. A chain saw with a kickback guard on the >end is definitely a safer tool to use, especially for an amateur, than >one without (something I appreciate while clearing paths through the woods >at my Vermont house), but it does not mean that now the tool is a completely >safe one, and indeed a real expert with a chain saw will often feel that it >is safer to operate without the guard, because then the behavior of the >chainsaw is simpler and more predictable. I think we're all in basic agreement. As you stated, exceptions are only a tool. They don't replace the need for (mental) reasoning about the correctness of my program, nor should they be used to guard against sloppy programming. Exceptions don't correct the problem for you, but at least they let you know that a problem exists. And in spite of all the efforts of the Ariane 5 developers, a problem did exist, significant enough to cause mission failure. Don't you think an exception was justified in this case? Yes, I agree that there may be times when you don't need any sophisticated exception handling, and you could safely turn checks off. But surely there are important sections of code, say for a critical algorithm, that justify the use of checks. Believe me, I would love to write a software system that I knew were (formally) correct and didn't require run-time checks. But I am not able to build that system today. So what should I do? Though I may be the most practiced walker of tightropes, I still like having that safety net underneath me. -matt -------------------------------------------------------------------- Matthew Heaney Software Development Consultant mheaney@ni.net (818) 985-1271