Re: Ariane5 FAQ

[Hyman Rosen <hyrosen@mail.com>]

Larry Elmore wrote:
> It was a design decision that in that case, there was no point in
 > handling that exception in software. It was not an oversight. It
 > did what it was supposed to do -- if it was flying on an Ariane 4.

If the value of the parameter had exceeded the Ariane 4 maximum but
was less than the 16-bit maximum, there would have been no exception
at all at the conversion point, and the too-high value would have
gone through the rest of the system, doing something else. There was
nothing in the code to handle a too-large value. The code would simply
barge ahead, either working or causing exceptions depending on the
exact number. You may wish to call that behavior "doing what it was
supposed to do" but I think that's a mischaracterization.

I'm not saying that the Ariane 4 people did anything unsuitable for
the Ariane 4. But doing it this way made the code brittle.
The investigation board said
    "No reference to justification of this decision was found
     directly in the source code. Given the large amount of
     documentation associated with any industrial application,
     the assumption, although agreed, was essentially obscured,
     though not deliberately, from any external review."

This is exactly the kind of coding practice that leads to problems
like integer overflow, buffer overflow, and Y2K issues. Shortcuts
are taken in order to optimize a program for local conditions, but
the dependencies are not communicated properly to people who then
go on to use the code in situations where the local conditions no
longer apply.