Re: A case where Ada defaults to unsafe?

[Simon Wright <simon@pushface.org>]

"Nick Roberts" <nickroberts@adaos.worldonline.co.uk> writes:

> Original code:
> 
> 
>    if Fire_Alarm(Engine) and Gearbox_Alarm(Engine) then -- A
>       Activate_Extinguisher(Engine,Trickle_Mode);
>    end if;
>    if Gearbox_Alarm(Engine) then -- B
>       Display.Activate(Gearbox_Alert(Engine));
>    end if;
> 
> 
> Supposing a programmer comes back to this code, having been told to do her
> best to make indications code precede actions code. She might make the
> following change:
> 
> 
>    if Gearbox_Alarm(Engine) then -- B
>       Display.Activate(Gearbox_Alert(Engine));
>    end if;
>    if Fire_Alarm(Engine) and Gearbox_Alarm(Engine) then -- A
>       Activate_Extinguisher(Engine,Trickle_Mode);
>    end if;
> 
> 
> based on the simple deduction that since the call to Gearbox_Alarm could be
> made before the call to Fire_Alarm in line A, she can assume that Fire_Alarm
> does not need to be called before Gearbox_Alarm, and that it is therefore
> safe to move the call the Gearbox_Alarm in line B to precede the call to
> Fire_Alarm in line A.
> 
> If line A had contained "and then" instead of "and", she would not have been
> able to make this deduction, and may have not made an improvement to the
> code (which just might save a pilot's life one day).

I find it quite hard to imagine this scenario, I must say.

We have a safety-related system where it is important that the
extinguisher is set off as soon as possible and activating the gearbox
alert takes sufficiently long that it can delay the extinguisher
activation beyond tolerance[1]. And we are allowing a programmer to
change this code without any process to ensure that the safety
properties of the system aren't compromised?

[1] If I'm wrong about why you think your example causes a problem,
that (to my mind) reinforces the point that making subtle deductions
about the intent of the designer from details of the implementation is
a big mistake.