Re: Ariane 5 - not an exception?

[Martin Tom Brown <Martin@nezumi.demon.co.uk>]

In article <4u7fdm$e6m@morgan.vf.lmco.com>
           g1006@fs1.mar.lmco.com "Francis Lipski" writes:

>   If all conversions and other possible overflow conditions are protected,
> and then an overflow occurs, what action should be taken?  

The most obvious choice is drop back to a simple, but not necessarily
accurate primitive hardware backup system like levers and gyroscopes.
I have much more faith in the ability of mechanical and electronics
engineers to tolerance their designs for adverse conditions. When my
neck is on the line I like to see physical hardware interlocks in place.

> The system has just had a random hardware failure.  
> Continue to operate with known bad hardware?  

This decision is a hard one, but when the choice is between self-destruct 
now or flag the problem and press on and pray. I know which I'd chose.
It also depends to a large extent on the damage which could occur
if failure is delayed vs the cost to abort the mission.

> In the case of an overflow, set to max value, continue and 
> hope for the best?  

Not ideal, but neither was sending random diagnostic test data 
to the trajectory computation masquerading as IRS data packets.
With hindsight (a wonderful commodity, but in short supply)
we now know that ignoring the overflow would have been OK.

Regards,
-- 
Martin Brown  <martin@nezumi.demon.co.uk>     __                CIS: 71651,470
Scientific Software Consultancy             /^,,)__/