Re: "Subtract C, add Ada"

[R_Tim_Coslet@cup.portal.com]

>Samuel Mize (smize@Starbase.NeoSoft.COM) wrote:
>: Sure you do, if there was a programmer error, or a hardware glitch,
>: or a bad memory location, etc.  These are the things you don't want.
>: Given that you can't eliminate those, oh *boy* do you want exceptions,
>: given the alternative (core dump at 30,000 feet -- how do I reboot
>: my F-16?!?!?!?)
>
>However, for systems with the capability to degrade cleanly, exceptions are
>a very good thing and in fact are widely used in embedded avionics software.
>
>--------------------------------------------------------------------

The software I'm currently working on for a cockpit display system
was specificly designed to USE exceptions to gracefully degrade the
system functionality in the presence of serious hardware problems.

Each 16ms display frame consists of a series of calls to the various
CSCs controlling the sybsystems of the display. If no fatal hardware
problems occur it runs completely without exceptions. But in the
case of fatal hardware failures (e.g. inability to access a subsystem)
an exception is raised within that CSC, terminating any further
processing for that subsystem for that frame, letting the other CSCs
have the "extra" unused time. Thus the system will gracefully degrade,
mo matter how deep it had gotten into the CSC for a given subsystem
when the hardware died. No exception is ever allowed to propagate
outside of the top level CSC in which it occured to the main task.

The exception processing is a little expensive (about 1ms/exception),
but with several CSCs consuming 4 or 5ms in normal operation and the
overall time budget a bit tight, the exception usually saves time
making the remaining 3ms or more available to other CSCs immediately
in that frame when such a failure occurs.

Same thing with a serious programmer error that was not detected in
test: the affected CSC dies gracefully and the system functionality
degrades... BUT the REST of the system continues to function!

Such graceful degradation in function would have been MUCH harder
to implement in this system WITHOUT exceptions.

                                        R. Tim Coslet

Usenet: R_Tim_Coslet@cup.portal.com
        technology, n.  domesticated natural phenomena