🚀 go-pugleaf

Sam Kendall <kendall> wrote:

>ark@research.att.com (Andrew Koenig) wrote:
>>In article <44uccq$lkd@theopolis.orl.mmc.com> Theodore Dennison <dennison@escmail.orl.mmc.com> writes:
>>
>>> Using C:
>>>    Symptom    : Machine 3 locks up.
>>
>>>    Actual Bug : C code on Machine 1 has "off by one" error.
>>
>>Symptom when run under rigorously checking C compiler
>>(of which there are a few commercially available):
>>Code on machine 1 halts with a diagnostic message explaining
>>the problem.

>Well, that assumes you can figure out which program on which machine caused the
>problem.  Then you can rebuild it with a runtime checker, rerun the program,
>and try to reproduce the conditions that caused the crash.  (Even so, your
>checker may miss the error, because most of them miss lots of errors.)

>This all is necessary because almost nobody deploys or ships programs built
>with a C/C++ checker.  Why don't they?  Because checkers impose large space and
>time penalties.  So C/C++ developers wear a life jacket in the harbor and throw
>it away on the open sea.

>--Sam Kendall

>P.S.  The life jacket metaphor isn't mine.  Anyone remember who said it?

	Finally, it is absurd to make elaborate security checks on debugging 
	runs, when no trust is put in the results, and then remove them in 
	production runs, when an erroneous result could be expensive or 
	disasterous.  What would we think of a sailing enthusiast who wears 
	his life-jacket when training on dry land but takes it off as soon as 
	he goes to sea>

From C, A, R, Hoare in "Hints on programming language design" in 

	C Bunyan (ed.); Computer Systems Reliability, State of the art Report
	Vol 20, pp 505-34.

Reprinted in 

	C. A. R. Hoare, C. B. Jones (ed); Essays in Computing Science; 
	Prentice Hall; 1989; ISBN 0-13-283027-8

This is a book every programmer should read.

Michael M Rubenstein