5 ms·
A bounds check wouldn't have helped. The value would have saturated instead of rolling over, resulting in a similar failure. The mistake was an incorrect speci
by marmetio 4y ago
A bounds check wouldn't have helped. The value would have saturated instead of rolling over, resulting in a similar failure.
The mistake was an incorrect specification. A programming tool can't identify that you've made the wrong thing, which is why we need "rigamarole" to validate the spec. That's what the systems engineers are for.
- wyldfire 4y agoSaturation might have worked, actually. > the main computer interprets the data as real navigation data and considers it as an indication that the rocket is wildly off-course Not clear what sort of magnitudes we are talking about but saturation could have worked here and avoided the problem. But an exception handler could've helped too. > The code wasn’t necessary after takeoff, it was only part of the launch pad alignment process. A supervisor for this task could have decided to ignore an overflow fault after launch.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- kps 4y agoSaturation would have been fine; actually anything would have been fine, since the result was not actually used in flight. However, Ada traps, and the trap was not handled (because resources were tight and overflow was physically impossible on the Ariane 4, for which the code had been written), and the specification required that the system shut down entirely on an unhandled trap.
- deleted 4y ago[deleted]
- marmetio 4y agoTrue. I should have said "if it was needed". Had they validated more, they would have realized they made the wrong thing.