Handling Exceptions

[Ken Garlington <kennieg@nospam.flash.net>]

An article in the most recent issue of Aviation Week
and Space Technology caused me to think once again
about the difficulty of choosing appropriate responses
to raised exceptions.

An avaition display had been designed to perform an
automated reset when a particular parameter exceeded
a particular limit. The limit had been chosen to be
greater than any expected "real" value, such that only
system faults such as a corrupted message would reasonably
be the cause of the error.

A commercial aircraft using this display excountered
extreme turbulence, and the aircraft rocked violently,
causing the parameter to go out of tolerance. The display
performed a reset as required -- causing the data on the
display to become unavailable to the pilot for the 2-3
seconds (s)he needed it most, during the recovery from
the turbulence.

Although the language used in the display is not discussed
in the article, I think Ada users can benefit from considering
the issues this incident highlights. It is also comparing and
contrasting this case and the Ariane 5 disaster.

(More discussion on the problems of choosing good exception
handling is at

   http://www.flash.net/~kennieg/ariane.html#s3.3 )