Re: Help Me Please :)

[Simon Pilgrim <simon.pilgrim@gecm.com>]

Robert Dewar wrote:
> 
> In article <8bqcu2$s0p$1@nnrp1.deja.com>,
>   reason67@my-deja.com wrote:

> > "Ladies and Gentlemen, Thank you for flying on the Boeing 777
> Flight
> > 633. Unfortunately, due to a minor bug in the flight control
> software
> > raising a predefined exception and Ada RM section 11.6, the
> flight
> > control software has crashed. We are now heading towards the
> ground at
> > 700 miles per hour. Estimated time of arrival 10 seconds. Have
> a nice
> > day."

As one of the many engineers who have worked on the Boeing 777 Primary
Flight Computer, I'd like to respond to that.

> Well there was no smiley there, so let's assume the (rather
> hard to believe) point is being made seriously.
> 
> In that case it is way way off base. Any safety critical
> software is validated and verified at the object level. You
> never depend on the correctness of the compiler, or the
> correctness of understanding of the high level language
> semantics.

Correct.  The PFC code was module tested at object level.

> Furthermore, in most safety critical software, one would never
> have such a handler? Why not because it might typically be the
> case that the handler code is deactivated, and deactivated code
> is not permitted in many SC protocols.

Right again.
 
> Finally, 11.6 is about optimization, it is almost always the
> case that you want *no* optimization for SC code. Why? Because
> you want the best possible correspondence between source code
> and object code.

Not true for the PFC.  We have a lot of code to squeeze into that frame.
 
> So in short, the scenario above is triply unlikely!

More than that.  We have a triple redundant system, with three PFCs per
airplane.  Within each PFC are three lanes each with a different type of
processor.  The same source code is compiled to the three different
targets with three different compilers.

-- 
Regards,
Simon Pilgrim
Senior Systems Engineer
Avionic Systems Division
BAE SYSTEMS, Rochester, UK

Views expressed above are not necessarily shared by my employer.