Re: Contracted exceptions for Ada

[Simon Wright <simon.j.wright@mac.com>]

"Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> writes:

> On Sun, 09 Dec 2007 18:39:31 +0000, Simon Wright wrote:
>>     In Ariane IV the maximum horizontal velocity is X.
>> 
>>     Therefore we can convert the hardware input to this-type without
>>     worrying about overflow.
>
> Hardware input had a type different from one used later in the
> control circle, because it needed to be converted. So what was the
> contract of that conversion?

The Ariane IV system engineers said to themselves, and probably in the
design documentation, "The maximum horizontal velocity is X. Therefore
the conversion to the fixed-point type _Whatever_ cannot
overflow. Therefore we do not need to handle exceptions for this
conversion, so (given we are short of CPU power) we will not do any
extra processing to avoid exceptions."

Not sure they would have recognised "contract" in that context.

> My point is that the fault could be detected (assuming that
> conversion was in Ada), under the condition that the compiler vendor
> would not make the same mistake while porting the compiler... (:-))

Not if there was no port, and the exact same hardware with the exact
same software was reused! (I'm not sure if that was in fact the case)