Re: Would You Fly an Airplane with a Linux-Based Control System?

[Adrien Plisson <aplisson-news@stochastique.net>]

Marius Amado Alves wrote:
> This is better. Now, can you prove this? That the ship could get out of 
> control and crash on a city for example? If C had been used instead? Or 
> if the exception had not been catched? (Probably not invoking the backup 
> system.)

ok, let's take an example.

the system seems to control data associated with the trajectory of the 
ship. if a value arrives and overflows and if the exception is not 
catched, there is a lot of chances the value will be truncated and used 
as a normal value.

the result depends on the action you take with this value:

we will first consider the system is using this value to control 
directly the trajectory, by acting on directionnal engines. the value is 
less than the real value. you try to correct the trajectory but don't 
correct enough, the ship is going out of its programmed path.
- at best, it will then miss the orbit it was programmed for: the 
satellites will become useless or eventually crash on other satellites 
on the same orbit, pieces of those satellites may fall down on earth.
- at worst, the correction is so bad the ship continue to be out of the 
path. the more the ship derives, the more the exception arises and is 
not caught, the more the values are wrong. the ship gets out of control, 
  and start to fall down. since it is out of control, we cannot predict 
where it will fall... (maybe on cuba which will think of a strike from 
the u.s. then reply with the atomic bomb. WW3 is starting).

the second case is that those values are stored and used as a reference 
to calculate the absolute position of the ship throughout its journey.
obvioulsy, the ship will never take the right path and we are back in 
the best case of the first consideration.

the predictability of the path the ship will take with these truncated 
values is like predicating the weather: you are able to calculate for 
some times ahead, but rapidly do not hve enough informations to predict 
further.

now i see your next question: what had happened if C had been used 
instead ? well, if C had caught the exception, the software would have 
behaved the same way as the Ada software, and the ship would have 
exploded too... but exception handling is not really easy in C, 
considered that there is NO way in the langauge to do it (maybe the 
exception handling facility that would have been implemented in C would 
have been buggy...)

i can continue for a long time with ifs, maybes and suppositions. "avec 
des si, on mettrais Paris en bouteille". so we will stop the 
suppositions, and believe me, it is better that the ship exploded.

-- 
rien