🚀 go-pugleaf

On 11 Oct 1995, James Kanze US/ESC 60/3/141 #40763 wrote:

> If the program gets a ConstraintError, it aborts, the watchdog kicks
> in, and the redundant system takes over.  On the other hand, if it
> just reads a random value, it might very well put the plane in a dive,
> and declare that all is well.

But there are probably other bugs too -- that don't cause the watchdog to 
kick in. Such a system would be terrible!

> I've done a lot of critical systems (railway brake systems,
> cardiological surveillance (English word, please?), etc.), and in
> general, these are precisely the systems where bounds checking is most
> essential.  You cannot afford not to.

Sure, but on such systems, you'd probably want real redundancy with 
voting et al. Then, though bounds checking would help, I'm not sure that 
it'd be essential (though it'd be nice for a part of the system to fail 
gracefully, rather than for it to just crash -- for railway brake 
systems, I suppose that a bounds violation could just trigger emergency 
brakes or something... hmmm...).

> But it must.  Any large real system will have bugs.  Even human pilots
> make errors.  But the airplane is not allowed to crash because of it.
> This is why systems have redundancy (including both a pilot and a
> co-pilot).  In real life, critical systems *must* be error tolerant.

But, the problem is that the system may give bad results *without* a 
technical bug (one which bounds-checking would notice, for example). 
Thus, in real life, critical systems need much more than just 
bounds-checking and the like.

- Trung