Puppet_Sock a écrit :
I work on an aeronautic embedded system with real time and fault
tolerant cobstraints. It is pretty critical and I can tell you the
asserts are still in the code when it takes off.
I'm a nuke. If one of the control computers did an
assert, the operator would come and find me. This
would not end well.
I don't think you mean the same thing by "assert"
that I do. When a program hits an assert and fails,
the program stops. All over, bang, goodbye, only
way to get it back is to restart the program.
This is something you put in your aircraft?
An assert should not be thought of as a safety belt.
This is the "known unknown" divide I talked about.
A safety belt is intended for expectable conditions:
A car in a crash. An assert is intended for implentation
errors: The steering wheel is not connected to the
steering mechanism because it's in the trunk.
You put the "safety belt" stuff into the interface
design, putting the details into the spec (the contract).
I don't know what you call a "known unknowns" but exception are not part
of debug process but rather of design. If you want to design an
exception aware code, you'd better know who is likely to throw and if
you wan to recover from it, you'd better know what is thrown.
Um. That's pretty much the point I'm making. The exceptions
are the "safety belt" stuff. An assert is a tool for detecting
implementation errors. An exception is part of the design.
I don't see how you can put a contract on let say the number of
connection a server is holding or outputting the state of a system.
Um. You don't? You put it in the spec. Then you make
the code check how many it has before it adds one, and
if it would be over the limit it does whatever the right
thing is about that. Maybe send a denial message to the
request, or pass it to another server, or some other
specified thing.
I'm just guessing, but what I'm guessing is that you are
a bigtime Unix coder.
You step through your code to catch stupid mistakes. I've
seen this lots of times where guys put code back into the
codebase without ever stepping through it. And when I come
along to see why the smoke is getting out (Electronics all
runs on smoke, which is shown by it always stopping when
the smoke gets out.) I find that the code branches the wrong
way or does not assign the calculated value, or has some
stupid thing like the classical for(yada yada); thing.
Which would have been instantly obvious as soon as you
stepped through the code and watched the values and the
execution. You can also catch off-by-one errors, and often
see non-initialized variables, wild pointers, etc. etc.
I've also had the case where the coder refused to believe
there was anything wrong with his code till I fired it
up in the debugger and showed him the bad behaviour.
Note that I'm not saying you step through the code as
a replacement for any other activity. I'm saying you do
this in addition to all other good practices. It's very
easy in a good debugger. And it's quite quick.
Note also that I'm not saying step through every line
of code every time you touch the app. Just the changed
or new lines.
Socks