Re: Papers on the Ariane-5 crash and Design by Contract

[Derek Clarke <derek.clarke@gecm.com>]

eachus@spectre.mitre.org (Robert I. Eachus) wrote:
>In article <01bc4021$607eea80$b280400a@gavinspc> "Gavin Collings" <gcollings@sperry-sun.com> writes:
>
>  > Good.  The main point about the Java model, though, is that the compiler
>  > checks that the programmer has at least thought about handling all
>  > exceptions that may be generated in nested calls.  This means that the
>  > programmer HAS to think about dealing with error conditions.
>
>  > So, in the Ariane case, if the precondition existed (as some say it did)
>
>  It did.
Yep.
>
>  > the compiler would have given warnings to the effect that it IF
>  > the error occurred, it would NOT have been handled.
>
>     Not quite, the warning that the developers were presented with
>was that if this exception occured it would be handled by a non-local
>(default) handler.  There were no "unhandled" exceptions as such.
In the sense that the microprocessor executing the instructions hit a 
floating point exception that wasn't covered by the language system.

I'd tend to call that an unhandled exception. 
>
>  > Wouldn't this have made the disaster less likely?
>
>    Hardly.  The message that the Ariane 4 developers got was VERY
>clear.  If this happens, rocket crashes.  
Not true. The message was actually "We don't care about what happens 
because this can situation can never arise".

That was true for Ariane 4.

Well actually it was
>apparently more of a list of conditions under which the guidance
>system would shut itself down and spew failure diagnostics to the
>ground systems.  But I don't get the impression that anyone thought
>this meant anything other than rocket crashes here.
If they seriously believed the situation could arise, they would have 
properly covered (_not_ handled necessarily) the exception. They 
certainly didn't plan on their bit making the launcher blow up.

>
>    Of a list of seven such occurances, local handlers were added for
>either four or five.  The others, including this one, were determined
>to be physically impossible. (Unless, of course, you put the guidance
>system in a different rocket--or launched from a different planet.)
Not _physically possible_. The exceptions weren't covered for efficiency 
reasons. Instead of looking at some way of handling the problem more 
sophisticated than "shall I include this automatic feature or not"...

>    This is the point that Robert Dewar, Ken and myself I have been
>emphasizing again and again--there was no error in software
>development (for the Ariane 4), 
Although I'm rather dubious about the treatment of floating-point 
exceptions as "hardware errors". 

>and ANY reasonable approach to reuse
>would have found the potential problems.  
Only if the re-use specification of the hardware unit had included the 
maximum horizontal velocity that the unit should be subjected to. Can you 
see the likelihood of that popping out of an Eiffel compiler? I can't... 

Remember the actual failure
>sequence involved deflecting the engines beyond the acceptable
>stresses for the Ariane 5, which were apparently less than for the
>rocket the system was designed for.
If Ariane 4 had followed the same flight profile on a launch, it too 
would have broken up.

All liquid-fuel launchers are pressurised tubes of very low wall 
thickness, and none of them could take that abuse!

The biggest bug was surely the flight controller interpreting the 
diagnostic data put on the bus by the crashed SRI(s) as real flight data, 
and swivelling the rockets to suit.

Given the fact the the SRI(s) weren't needed in flight anyway, if the 
flight controller had been able to ignore the rubbish, all would have 
been sweetness and light.

And possibly SRI(s) would harmlessly crash on every other Ariane 5 flight 
thereafter...