Re: How would Ariane 5 have behaved if overflow checking were not turned off?

[Robert A Duff <bobduff@shell01.TheWorld.com>]

(Sorry for emailing this, Keith.  I meant to post.  Oops.)

Keith Thompson <kst-u@mib.org> writes:

> Stephen Leake <stephen_leake@stephe-leake.org> writes:
>> Just to remind people; the real problem was that Ariane 4 code was
>> reused on Ariane 5, without carefully considering the design, also
>> without adequate testing.
>>
>> Ariane 5 is a bigger rocket; it has bigger accelerations. The range for
>> accelerations in the code, which was correct for Ariane 4, was incorrect
>> for Ariane 5.
>>
>> No amount of "defensive programming" can handle such a fundamental
>> design error.
>
> As I recall, the problem was that an exception message was sent
> and interpreted as binary data, because it was incorrectly assumed
> that the exception could never happen.  The exception occurred in
> a subsystem that wasn't even needed at the time.

I wouldn't call that "the problem" -- I'd call it a symptom of
the problem.  The problem was using (correct!) Ariane 4 software
to control an Ariane 5 rocket, as Stephen Leake says above.

The assumption you mention above was correct!  For Ariane 4,
of course -- that's what they analyzed the assumption for.

>...  (It's entirely
> possible I've got this wrong.)

I don't think so -- your memory (of the symptom!) matches mine.

> What if the subsystem had handled the exception and quietly
> terminated?

I've no idea.  Maybe it would have worked, but that would have
been purely accidental.  All the details of how the exception
or whatever led to the crash seem irrelevant, to me.  You can't
expect software designed for one rocket to work for another
rocket without changing it to meet the new specs.  Apparently,
they didn't even bother to look at it to see if it needed changing.

- Bob