Re: Ada and Java. different behaviour. casting long to int problem.

[Marin David Condic <condicma@bogon.pwfl.com>]

Jean-Pierre Rosen wrote:
> Please read the report.
> The Ariane 501 failure was caused by the *removal* of a necessary
> check.
> Ada then diagnosed correctly the error, and did what the
> specifications required it to do in this case: it made a memory dump
> which was interpreted by the flight computer as positionnal data.
> You can't blame the language for doing exactly what was in the
> specification; the specifications were wrong.
> Of course, without overflow checking, you would'nt have triggered the
> incorrect behaviour required by the specification, but I don't think
> this can be taken as an argument against overflow checking...

This is a debate which has gone on before and you may be letting the
toothpaste get out of the tube. ;-) IMHO, the *real* problem was not
anything to do with language features - it was a fundamental management
problem. They decided to use a piece of very successful, reliable
software in a different application and never bothered to verify that it
would work correctly given an entirely new and different set of
requirements. The code which "broke" was only the immediate cause, but
not the fundamental reason. In my understanding, they explicitly removed
runtime checks from the code in question because of performance issues
(not at all uncommon) but then went and validated that the code would
never see anything out of range given the flight profile of the Ariane 4
rocket. Hence, the code was safe. Moving the code to Ariane 5 which had
a different flight profile changed the requirements - but the code was
never tested against those requirements. Hence the disaster.

MDC
-- 
Marin David Condic
Real Time & Embedded Systems, Propulsion Systems Analysis
United Technologies, Pratt & Whitney, Large Military Engines
M/S 731-95, P.O.B. 109600, West Palm Beach, FL, 33410-9600
***To reply, remove "bogon" from the domain name.***

Visit my web page at: http://www.mcondic.com/