From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,INVALID_MSGID
	autolearn=no autolearn_force=no version=3.4.4
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 103376,d901a50a5adfec3c
X-Google-Attributes: gid103376,public
X-Google-Thread: 1094ba,9f0bf354542633fd
X-Google-Attributes: gid1094ba,public
From: Niklas Holsti <nholsti@icon.fi>
Subject: Re: Fortran or Ada?
Date: 1998/10/04
Message-ID: <3617AA49.340A5899@icon.fi>#1/1
X-Deja-AN: 397658676
Content-Transfer-Encoding: 7bit
References: <36068E73.F0398C54@meca.polymtl.ca>
     <slrn70dv6k.2qp.gisle@krake.ii.uib.no>
     <m3n27sqhms.fsf@visar.physast.uga.edu> <6u8r5o$aa4$1@nnrp1.dejanews.com>
     <m3zpbq24wq.fsf@visar.physast.uga.edu> <360A3446.8AD84137@lmco.com>
     <6udre0$ha1$1@nnrp1.dejanews.com>
     <19980925.185359.250@yktvmv.watson.ibm.com>
     <6uifdr$dog$1@nnrp1.dejanews.com>
     <19980928.184428.604@yktvmv.watson.ibm.com>
     <wclodius-2909981741110001@clodius.lanl.gov>
 <19980929.214309.386@yktvmv.watson.ibm.com> <3615E297.57D3ED15@icon.fi>
 <6v5116$hr4$1@newnews.nl.uu.net> <36164A60.FA563BB0@icon.fi>
 <6v5t20$ecr$2@newnews.nl.uu.net>
Content-Type: text/plain; charset=us-ascii
Organization: Space Systems Finland Ltd
Mime-Version: 1.0
Newsgroups: comp.lang.fortran,comp.lang.ada
Date: 1998-10-04T00:00:00+00:00
List-Id: <comp.lang.ada>

Toon Moene wrote:
> 
> In my mind, an exception is a sign that the assumptions behind the
> (physics/mathematics) of your model is wrong, and - even though that pertains
> to a large extent also to rocket ascent - this would not lead to a reasonably
> safe procedure here.

Yes, this is one category of exceptions (the other category is where
exception handling is used to catch rare but foreseeable situations,
such
as errors in input data files -- END= and ERR= labels, for example).

It seems that the designers of the Ariane 4 guidance system had this
view, except that their "model" included the processing hardware in
addition to the models encoded in the software. To decide how to handle
the overflow exception, they had to guess which part of their model was
at fault -- whether the hardware or the software was wrong. They guessed
"hardware error". In the context of Ariane 4, it hasn't been shown that
this was the wrong thing to do.

The odds in this guess must depend on how well the software models were
verified and validated. I haven't seen any claims that the software
models were not correct for Ariane 4.

Niklas Holsti
Space Systems Finland Ltd
(This comment expresses personal opinion and not Space Systems Finland
policy.)