Re: Is C++ used in life-critical systems?
On Dec 31, 9:21 am, Nick Keighley <nick_keighley_nos...@hotmail.com>
wrote:
On Dec 30, 7:46 pm, James Kanze <james.ka...@gmail.com> wrote:
On Dec 30, 3:49 pm, Nick Keighley <nick_keighley_nos...@hotmail.com>
wrote
On Dec 15, 10:10 pm, "Marc" <xmarc...@spot.net> wrote:
Read up on the Ariane bug its
quite enlightening (once you get past the pontificating ("if they'd
use Blub this would never have happened!")). The space shuttle
software development process is quite interesting as well.
Just a reminder: there was no bug in the Ariane's software.
I didn't say there was. But when a rocket falls from the sky we can
safely say there was a bug in something!
Definitly. But in this case, not the software.
Management decided to just reuse it in a different context: the
software did what it was supposed to do, for the system it was
written for. (In other words, stating that there was a bug in
the software is like saying that your C++ compiler has a bug
because it doesn't correctly compile someone's Ada program.)
error: the system behaves in manner not expected by a reasonable user
The software behaved in the manner it was supposed to behave.
It is an interesting point with regards to the the question at
hand: at a larger level, the requirements of the system are to
auto-destruct if a bug is found. (The Ariane auto-destructed
because the software determined that the systems providing its
input were defective, since the values were impossible.)
I understood it was destroyed by the range safety officer
No. The software received an "impossible" input, which it was
not capable of processing. That triggered an exception, which
lead to "fast failure", and the backup took over. The backup
which was running the same software, and seeing the same inputs.
Once all of the backups had failed as well, hardware safety
systems triggered the auto-destruct.
If you
aren't sure that you have full control, better to auto-destruct
than to risk crashing into a populated city.
are there many near the Ariane launch site?
The Ariane lauch pad sends them out over the Atlantic. But
those things move pretty fast, and if it was without reliable
navigation, it could easily reach western Europe before it hit
the ground. The whole point of auto-destruct is to ensure that
it didn't reach Europe.
--
James Kanze