Re: use of assert in Java [vs. exceptions]
On Sat, 30 May 2009, John B. Matthews wrote:
In article <gvrjm8$m4u$1@news-int.gatech.edu>,
Joshua Cranmer <Pidgeot18@verizon.invalid> wrote:
Giovanni Azua wrote:
[...]
An excellent example on how the defensive programming approach i.e.
check and throw exception can not only give a very subjective sense
of safety but also become "the problem" is the 500 million loss
case of Ariane 5 "The exception was due to a floating-point error:
a conversion from a 64-bit integer to a 16-bit signed integer,
which should only have been applied to a number less than 2^15, was
erroneously applied to a greater number, representing the
"horizontal bias" of the flight. There was no explicit exception
handler to catch the exception, so it followed the usual fate of
uncaught exceptions and crashed the entire software, hence the
on-board computers, hence the mission. "
This strikes me as a strong admission of support for checked
exceptions, not an argument against checking conditions.
This is precisely correct. The claims made in the work cited [1] are
subject to some debate [2].
That Eiffeltard article you link to makes my blood boil.
There's only one thing that would have been guaranteed to catch the error,
and all other kinds of error like it. It's not a funky language, or
self-flagellating development practice, or esoteric philosophy. It's a lot
simpler than that: it's testing.
At no point before the 501 launch did the engineers perform a whole-system
integration test. They never put the whole software package together on a
testbed and see if it worked.
The report spends some time sort of mumbling about why that would have
been really hard and not really practical, but it's self-serving bullshit.
You don't fly a billion euros of hardware that thousands of people have
spent years of their lives building unless you've tested the software to
that level. And if you can't figure out how to do that test, resign, and
we'll find someone who can.
If they had tested the complete system, they would have detected the
problem after 37 seconds. No ifs, no buts.
tom
--
build the roof with holes in