Re: Ariane 5 - not an exception?

[john@assen.demon.co.uk (John McCabe)]

>    If they were running at 80% utilization without runtime checks,
>    including the checks might have left an unacceptable risk. If they
>    had run with checks in place and were at 98% utilization and hit a
>    "corner case" in the software which drove them over 100%, we'd be
>    able to sit here now and criticize them for failing to remove the
>    checks to leave a safety margin on utilization.

True, but even with a maximum limit of 80% utilisation, it's going to
be very difficult to guarantee that you are never going to exceed
100%.

The program I am on now has a 70% loading requirement, but we have
~8us on a 10MHz 1750A processor to do some work. Now, as you will know
from your own experience of 1750A, 8us is not a lot of instructions!
There is no way we can satisfy the loading requirement (which would
allow us ~5.6us) on that particular case, in actual fact we use about
7us nominally. There is nothing more we can do about it though as we
have already coded that section in assembler, but we have analysed the
consequences of going over 100% and taken account of them in our
system design. 

The point I am trying to make here is that I believe that the success
of a mission should never be traded off against such an arbitrary
requirement as a loading margin.

Best Regards
John McCabe <john@assen.demon.co.uk>