Re: Ada and Java. different behaviour. casting long to int problem.

["Robert I. Eachus" <eachus@mitre.org>]

"Samuel T. Harris" wrote:

> As has been said in this thread a couple of times, no feature
> of the language was at fault either by it usage or by is
> avoidance. The analysis, design, and implementation were all
> based on the Ariane 4 flight trajectory and performance
> characteristics. The practices employed are common and accepted
> within the industry performed with due diligence as applied
> to the Ariane 4. The problem was simply one of not reverifying
> reused code in a new situation.

    Amen!  Perfect software is no longer perfect if used outside its
design envelope.
 
> After reading the report, the only software bug I could discern
> was the improper interpretation of diagnostic information provided
> by the failed units to the central processer as _real_ attitude data.
> That strikes me as a design/implementation flaw.
 
    But it was a deliberate design decision made for good and sufficient
reasons.  Since both processors output was covered by telemetry, dumping
the internal state of the "failed" and ignored processor wouldn't hurt. 
The possibility of both processors getting to the same point was
discussed at length.  Because, on the Arianne 4, the only way to get
there was either dual hardware failures, or the rocket being way outside
its intended trajectory, the decision was made that capturing the data
was fine, because the vehicle was about to be destroyed anyway.  So it
was known that the data dump would cause the missle to possibly go
further off course, and it was accepted.

    And as I keep pointing out, none of this destroyed the Arainne 5. 
What did was that other reused software had the Arianne 4 center of
gravity, moments, and structural data built in.  The guidance computer
sent data indicating that the Arianne 5 was off course.  The correction
applied was too great for the Arainne 5 stack (rocket stack not call
stack ;-), and the stack came apart.  This could have happened even if
the guidance computer was operating "correctly."  For example upper
atmosphere winds could have caused the computers to apply a correction
which was too big for the Arianne 5 with the same result.

    The single and only point of failure was that not only did
management decide not to test the software or check it against Arianne 5
requirements, they even refused to let the original programming team SEE
the Arianne 5 engineering specs.
-- 

                                        Robert I. Eachus

with Standard_Disclaimer;
use  Standard_Disclaimer;
function Message (Text: in Clever_Ideas) return Better_Ideas is...