🚀 go-pugleaf

"        Finally, it is absurd to make elaborate security checks on debugging
        runs, when no trust is put in the results, and then remove them in
        production runs, when an erroneous result could be expensive or
        disasterous.  What would we think of a sailing enthusiast who wears
        his life-jacket when training on dry land but takes it off as soon as
        he goes to sea>"

While generally I would agree, there is one obvious exception.

If you are writing a safety critical program where a failure of a check
indicates a total system failure and is a calamity, then clearly you
have to prove that your system generates no exceptions. Once such a
proof is complete, checks not only can be removed, but generally must
be removed, because otherwise they complicate coverage verfication,
where the check handling becomes deactivated code, for which special
procedures are often necessary (and some environments simply do not
premit deactivated code).

If you are in a space shuttle, it is not much help to see
"Constraint Error at line 34, program Reentry_Guidance aborted"

Now of course in some environments, exception handlers are added anyway
as a defence against hardware errors, but there are other more complete
and reliable methods (e.g. majority voting with separate computers) for
dealing with hardware errors, and in fact the space shuttle uses exactly
that approach.

So it would no surprise me or shock me to learn that if the Space Shuttle
software was coded in Ada, it was compiled with checks off.