In SIL world, the C++ issues would not be considered bugs but maybe change requests.
The SIL philosophy (as far as I know it from ASIL) is "unsafe unless convinced otherwise". That seems like a good idea when the lifes of humans are on the line. Without a spec how would you argue that a system/product is safe?
(Aside: Software in itself cannot be safe or unsafe because without hardware it cannot do anything. Safety must be assessed holistically including hardware and humans.)
Fair enough. In practice, we resolve it recursively with a higher level specs and at some point it is just "someone wants that". In commercial software development (where SIL is used) that is a customer who pays for it or some executive.
Welcome to the real world. /s
The specification does not make anything happen but it enables you to say "the implementation is wrong". Of course, you can say that without a spec as well but what does "wrong" mean then? It just means you personally disagree with its behavior. When "wrong" means "inconsistent with the spec" everybody involved can work with more clarity and fewer assumptions. Wrong assumptions can kill people flying rockets.
Better append /s
I think, as GM, the art is what questions to ask.
The GM should keep control of the discussion. There is a big difference between open questions like "what are vampires in this world?" and closed questions like "what is the name of the vampire queen?" It depends on the group how open questions can be without everything devolving into insanity.
Yes. Mausritter also uses the 2-page format a lot and I also like it there.
at this time
Hm, maybe it was intended as a warning to his own company like "get your shit together, there is a threat emerging".
I’m confused. I assume they didn’t let them publish that by accident, so what does Ford try to achieve here?
Nice work! Here is my quick brain dump:
By the way, isn't the light-dark switch inverted?
You definitely can do without a language spec. I heard in aerospace another approach is common: They use whatever compiler and then verify the binary. That means different tradeoffs of course.