Re: Ada vs Fortran for scientific applications

["Dr. Adrian Wrigley" <amtw@linuxchip.demon.co.uk.uk.uk>]

On Mon, 29 May 2006 14:21:16 +0200, Jan Vorbr�ggen wrote:

>> The adverse consequences of exceeding bounds can be seen to
>> outweigh the (usually) modest costs in code size and performance that
>> even mature code should ship with checks enabled, IMO.
> 
> I am of the opinion that the Ariane 5 exprience shows that this is not
> true in general. Had that exception been caught and dismissed by a last-
> chance exception handler, the flight would have succeeded. The point is
> that while some exceptions could be generated, there was no clear way of
> handling them in any useful way, so ignoring them at least gives a chance
> of success in such a situation, while just shutting down by default will
> guarantee failure. An operational weather forecast is a similar situation:
> I'd rather have at least some results _now_, instead of restarting the
> prediction (after the bug has been fixed) and getting them just after the
> storm surge has drowned a lot of people.

I think you're saying code shouldn't check for serious errors if
the system shuts down when they're found!  Surely this is
application dependent?  Banking software users might prefer
the program to be stopped, while critical flight control software
users might prefer to pray.

I am comparing code compiled with array bounds and range checks against
code with no such checks.  With no checks, reading and writing of
completely unrelated data sometimes occurs causing unbounded errors.
With checks, exceptions can be raised, and the failure is bounded.
Usually, a system can be designed to do something better than
scribbling over unrelated memory!

You seem to be comparing different ways of handling unanticipated
exceptions.  Shutting down the system vs. dismissal by a last-chance
handler.  I agree with you on this point, for certain applications.

Making a generalisation on error detection from Araine 5 seems
a bit rash though.  Most software is not fail-deadly.  And if it
is, it gets some testing at the task in hand.  And if it can't be
tested, execution errors are checked and handled usefully.
Clearly, Ariane 5's case is not representative of the vast
bulk of real-world code.
--
Adrian