Re: Multiple reasons for failure of Ariane 5 (was: Re: Ariane 5 - not an exception?)

[rav@goanna.cs.rmit.edu.au (++ robin)]

	johndoe@zaphod.nosc.mil (Kirk Beitz) writes:

	>after reading the failure analysis, it seems a little irresponsible to even
	>hint about the failure of the rocket being based solely on the lack of proper
	>exception handling.  

---The failure of the project was, as the report stated, "ultimately"
due to the exception handler which shut down the system (in fact, both
the main system and the backup system, since they both experienced the
problem at the same time).

	>yes, it does seem clear that this was the final straw, and one of the heavy
	>hands from within the report comes down on the initial specification that
	>exceptions should be handled in such a manner.  but there were several
	>choices made over the course of a long period of development that helped lead
	>to the situation.

---The basic problem was due to 3 programming errors:

1. Converting from double precision foating-point to integer,
   without a magnitude check.  The conversion was programmed,
   and lacked the check.

2. assuming that a 58-bit value was going to fit into
   a 15-bit integer.

3. failure to include an error handler in the immediate routine
   to trap trivial errors (such as fixed-point overlow), and
   continuing.

The other failures were:

1. failure to simulate the effects of the error arising
   (can be done easily with PL/I's SIGNAL statement).

2. failure to OBJECT to the stupid design of the error
   handler, which was to shut down the system.  An experienced
   real-time programmer would have done this.  And certainly,
   a PL/I programmer would have NOT written an error-handler to shut
   down the system in the event of a fixed-point overflow.