Re: Ariane 5 - not an exception?

[Steve O'Neill <smoneill@sanders.lockheed.com>]

++ robin wrote:
> ---I think the real lessons are that
> 1. real-time programming requires special expertise.

Agreed wholeheartedly

> 2. the choice of language is suspect.  A better-established
>    language such as PL/I -- specifically designed for
>    real-time programming -- with robust compilers, and
>    with its base of experienced programming
>    staff could well have prevented this disaster.

I disagree completely!  The language was not the problem the design decisions in how the language 
was used were.  Ada is completely capable the realm of real-time programming, has robust 
compilers and tools, and has quite a few experienced software engineers capable of implementing 
just about any requirements thrown their way (been there, done that).  

Had the designers of the system allowed the implementors to use Ada exception mechanisms fully 
and properly they could have localized the failure to, at worst, the alignment function (which 
was not necessary at the time of the failure anyway) without shutting down the entire device.  
Instead, as is common practice in the safety-critical world, local exception handlers are 
frequently banned and a global 'shut it all down' handler is the only stop gap measure.  
Unbelievably the rationale for disallowing local handlers is because they make it difficult to 
verify complete code coverage since they are only executed in the case of exceptional conditions 
(i.e. given the expected data (Ariane 4 profile) the handlers are not executed and therefore we 
can't prove that all of our code has been exercised at least once). I find this logic suspect in 
the extreme!  As somebody once said "expect the unexpected". In addition to trying for fault 
avoidance through analysis we should also be planning for fault resiliency in the presence of 
reality.

You're other conclusions are right on target though - you should never shut a system down 
(unless its presence is impacting system performance as in the case of babbling nodes et.al.) but 
do indicate its distress to a higher authority who then can take this into account in using the 
information provided.

-- 
Steve O'Neill                      | "No,no,no, don't tug on that!
Sanders, A Lockheed Martin Company |  You never know what it might
smoneill@sanders.lockheed.com      |  be attached to." 
(603) 885-8774  fax: (603) 885-4071|    Buckaroo Banzai