Re: How would Ariane 5 have behaved if overflow checking were notturned off?

[Shark8 <onewingedshark@gmail.com>]

On Mar 16, 2:52 pm, Hyman Rosen <hyro...@mail.com> wrote:
> On 3/16/2011 3:40 PM, KK6GM wrote:
>
> > Here's the alternative, for the Ariane situation.  A float value gets
> > converted to a 16-bit integer.  The float value is too big to fit
> > (let's say it's 33000).  What 16-bit int will that get converted to?
> > -31000?  Some random value?  How does continuing along with bogus data
> > make the situation better?  Will the control loops really work OK with
> > bogus feedback data?
>
> Why are we converting floats to 16-bit integers? It's hard to tell
> from the report, but was this a result of using an Ada fixed type?
> Or the result of similar scaling based on knowing the range?
>
> > If you have determined via thorough analysis that the variable in
> > question can only _ever_ have a valid range of e.g. -20000 to 20000,
> > and it goes to 33000, what _is_ the right action?
>
> <http://web.archive.org/web/20000815230639/www.esrin.esa.it/htdocs/tid...>
> Recommendation R3 says "Do not allow any sensor, such as the inertial
> reference system, to stop sending best effort data." So if your sensor
> can report data over a certain range, you should probably not use a
> restrictive subtype that represents what you believe the possible
> observed range will be. Otherwise, when Scotty is trying to nudge a
> fraction more warp factor out of the engines, the Enterprise is going
> to shut down and doom the Federation.

Not quite.
In the "nudge a fraction more warp factor out of the engines" there is
indeed a valid range limitation: since we are talking about speeds*
there can NEVER be a negative value as "speed*" is an absolute-value."

*Velocity, to be more technically correct.