Re: How would Ariane 5 have behaved if overflow checking were not turned off?

[KK6GM <mjsilva@scriptoriumdesigns.com>]

On Mar 15, 10:32 am, Keith Thompson <ks...@mib.org> wrote:
> Stephen Leake <stephen_le...@stephe-leake.org> writes:
> > Elias Salomão Helou Neto <eshn...@gmail.com> writes:
> >> I have followed the (quite lenghty) on a topic, IIRC, about bitwise
> >> operators, which eventually lead to people mentioning the Ariane 5
> >> case.
>
> >> Since then I have been wondering. If compiler checking where actually
> >> turned on, what would have happened? How could it avoid the disaster?
>
> > Just to remind people; the real problem was that Ariane 4 code was
> > reused on Ariane 5, without carefully considering the design, also
> > without adequate testing.
>
> > Ariane 5 is a bigger rocket; it has bigger accelerations. The range for
> > accelerations in the code, which was correct for Ariane 4, was incorrect
> > for Ariane 5.
>
> > No amount of "defensive programming" can handle such a fundamental
> > design error.
>
> As I recall, the problem was that an exception message was sent
> and interpreted as binary data, because it was incorrectly assumed
> that the exception could never happen.  The exception occurred in
> a subsystem that wasn't even needed at the time.  (It's entirely
> possible I've got this wrong.)
>
> What if the subsystem had handled the exception and quietly
> terminated?

That was only after both primary and secondary guidance computers had
shut down, according to spec, upon having received "impossible" data.
Once both computers stopped running the rocket was doomed.  The
diagnostic data being interpreted as nozzle deflection data (IIRC)
just made that doom more spectacular than it might otherwise have been.