Re: How would Ariane 5 have behaved if overflow checking were not turned off?

["robin" <robin51@dodo.com.au>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1955 bytes --]

Elias Salom�o Helou Neto wrote in message ...
>I have followed the (quite lenghty) on a topic, IIRC, about bitwise
>operators, which eventually lead to people mentioning the Ariane 5
>case.
>
>Since then I have been wondering. If compiler checking where actually
>turned on, what would have happened? How could it avoid the disaster?

You mean, what if a user-supplied error handler had been provided?

To understand what that might have done, it is necessary to look at what happened.

An integer overflow occurred.
It was not caught by a user-written error handler.
For such an event, the OS was required to place the
error number on the data bus, and shut down the computer.
The assumption was that any such error was a hardware error,
and that the backup computer would then continue correctly.
Because the backup computer was programmed to do exactly
the same thing, a very short time later, it also shut down
[because the error was not a hardware error].
The error number on the data bus was then taken as guidance data,
and the result was catastrophic change of direction.

Thus, had an error handler been provided, the data bus would not have
had an error number placed on it, and that error number would
not have been taken as guidance data.

>Right now I think of three possibilities, the two former seem very
>unlikely to me.
>
>a) It would, even if the problem went undetected during testing, have
>made the developers actually develop code handling this exceptional
>possibility.
>
>b) The compiler default action for unhandled overflows have saved the
>day;

It didn't and couldn't.
What was required was an error handler.

>c) Developers would probably ignore the exceptional flow path and the
>disaster would happen anyway.

Anyone competent in real-time programming would never have
let the software go with unhandled overflow, because such an event
would result in failure of the mission.

>Which one, if any, is close to reality?