Re: Ariane5 FAQ

[Vinzent Hoefler <ada.rocks@jlfencey.com>]

Hyman Rosen wrote:

>Vinzent Hoefler wrote:
>> I don't see, how someone can avoid such problem.
>
>By having lots of meetings, and coming up with a
>definite specification for what to do. The result
>will be some hard numbers - if the reading is less
>than this, it's good, otherwise it's suspect.

It is supect. And what to do, if you *suspect* a wrong value? Pop up a
window and let a human operator confirm, everything is still good?
Please also take limited CPU-time into your considerations.

>Then
>the code is written to implement the decision.

I got code here that controls a DAC and the maximum value is (of
course) 255. I *know* that this will never be reached in real world
cases, so if someone comes up with the 255 or even larger it *must* be
wrong.

But to decide when exactly a particular value is really wrong or not
is indefinitely harder to make. There is a gray area and you really
don't want to implement some fuzzy logic in such CPUs.

>It's also perfectly valid to say "go ahead and write
>this code as if this variable will never exceed this
>value".

Yes. But you should ask, what are the results of the rest of the code,
if it exceeds the limit? They don't make sense anymore.

>Now, often that arbitrary way will in retrospect be
>exactly what you wanted, while the range check could
>cause an entire abort, so it's not a given which
>approach to use.

You don't understand. If the DAC value overflows, I definitely *don't*
want to calculate with a modulo value, because this is absolutely
wrong. Definitely. But the calculation will be still *correct* with
255, even if it *might* make not much /sense/ in real world.

>In the Ariane 5 case, it turned out
>that this approach caused an unhappy outcome.

Well, and in my case I almost got a screwed up machine, because
another value underflowed below zero, this underflow was not catched,
and so the result was interpreted as very large unsigned value later
then in the embedded system, because negative values can be considered
plainly impossible there. And you know what? Under certain other
circumstance such a large value could have made sense.


Vinzent.