Re: How would Ariane 5 have behaved if overflow checking were not turned off?

["Vinzent Hoefler" <0439279208b62c95f1880bf0f8776eeb@t-domaingrabbing.de>]

robin wrote:

> Simon Wright wrote in message ...
>> "robin" <robin51@dodo.com.au> writes:
>>
>>> Anyone competent in real-time programming would never have let the
>>> software go with unhandled overflow, because such an event would
>>> result in failure of the mission.
>>
>> The engineers, being competent in tightly-constrained real-time
>> programming, found that installing exception handlers cost cpu cycles
>> they could not afford, so looked at all the potential overflow sites and
>> found that _this_ one could only occur if there was a hardware
>> failure.
>
> Nonsense.  The Full Report says nothing of the kind.

But the documentation does. :P

> No, the exception handler could have done something sensible,
> such as using the maximum integer value, thus allowing the trajectory to continue.
> Better still would have been to include a magnitude test in the code that avoided
> the need for an error handler.

And then what? Using a bogus value to continue the flight? Admitted,
it might even have been worked for Ariane 5, but the system was designed
for Ariane 4 and I DO NOT think that using such a large value to continue
the calculation would have done anything good there, because using flight
parameters well outside of any operational limits simply can't be a
good idea. If it was, you could just get rid of all sensors and replace
them by random generators.

> There were 7 places in the code in the vicinity where overflow could occur.
> Four were chosen for protection, but three were not.
> That was the fatal flaw.

If they had protected all theoretically possible overflows, the software
wouldn't have been able to fulfill the mission due to missing its deadline.

I don't see how _this_ could possibly be considered flawless.


Vinzent.

-- 
A C program is like a fast dance on a newly waxed dance floor by people carrying
razors.
   --  Waldi Ravens