In a message dated 9/23/98 6:28:04 PM, [log in to unmask] wrote:

>
>
>Absolutely not.  PL/I provides error interception and recovery, as well
>
>as facilities for testing with simulated error generation.
>
>
>
>A PL/I  programmer experienced in real-time programming would
>
>have routinely included an error handler.
>
>
>
>(In particular, the SIGNAL statement is available to generate such things as
>
>fixed-point overflow or any other condition.)
>
>
>
>The SIGNAL statement enables checkout of the error-handling mechanism,
>
>as well as of course that an error occurring in a given part of the program
>
>in fact has a fall-back (fail-safe) position.
>
>
>
>It is clear that no simulated testing of the procedure was carried out.
>
Robin:

We have had this argument before. Ada in this respect has exactly the same
capabilities as PL/I.

Ada provides error interception and recovery, and its implementations provide
facilities for testing with simulated error generation.



An Ada  programmer experienced in real-time programming would have routinely
included an error handler. In fact for the code in question, about half of the
identified possible occurences of overflow were provided with error handlers
within the procedure that robustly corrected the error. About half were
identified as not physically possible for the Ariane 4, indicating a system
malfunction. The team made the conscious decision that the only system
component that could fail and had a backup was the computer and a reasonable
response was to have the error handle  in the main system shut off the
computer.



(I believe the RAISE statement is available to generate such things as

fixed-point overflow or any other condition.) 



The RAISE statement enables checkout of the error-handling mechanism,

as well as of course that an error occurring in a given part of the program

in fact has a fall-back (fail-safe) position.

The original Ada team did enough testing to identify all possible sources of
overflow which I understand to be the intent of your statement. An explicit
high level decision was made that the code did not require testing and
contractors were not provided (in fact I believe they were denied) access to
simulated flight trajectory data and had no way of knowing that the horizontal
velocity of the Ariane 5 was expected to more than four times that of the
Ariane 4. Shutting down both computers was unexpected.

Ken Garlington has an excellent discussion of this on the net.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%