🚀 go-pugleaf

In article
<Pine.SUN.3.91.951013032814.27595F-100000@lagrange.uwaterloo.ca>
Viet-Trung Luu <vluu@lagrange.uwaterloo.ca> writes:

|> On 11 Oct 1995, James Kanze US/ESC 60/3/141 #40763 wrote:

|> > If the program gets a ConstraintError, it aborts, the watchdog kicks
|> > in, and the redundant system takes over.  On the other hand, if it
|> > just reads a random value, it might very well put the plane in a dive,
|> > and declare that all is well.

|> But there are probably other bugs too -- that don't cause the watchdog to 
|> kick in. Such a system would be terrible!

Terrible because it caught some errors that would have gone unnoticed
otherwise?  (If you can call a plane full of people crashing into the
ground `going unnoticed'.)

|> > I've done a lot of critical systems (railway brake systems,
|> > cardiological surveillance (English word, please?), etc.), and in
|> > general, these are precisely the systems where bounds checking is most
|> > essential.  You cannot afford not to.

|> Sure, but on such systems, you'd probably want real redundancy with 
|> voting et al. Then, though bounds checking would help, I'm not sure that 
|> it'd be essential (though it'd be nice for a part of the system to fail 
|> gracefully, rather than for it to just crash -- for railway brake 
|> systems, I suppose that a bounds violation could just trigger emergency 
|> brakes or something... hmmm...).

The problem is difficult.  In many of the systems I've worked on, the
`back-up' system has been a human operator.  For example, in the brake
system, detection of a failure *didn't* apply emergency breaks; it
simply shut the computer down.  There was a hardware watch dog
(developed separatly from the computer); anytime 20 milliseconds went
by without the computer soliciting the watchdog, it triggered an alarm
in the drivers compartment.  The real backup system was the driver,
who could apply the emergency brakes (but might also try cutting power
to loose speed first, depending on circomstances).

|> > But it must.  Any large real system will have bugs.  Even human pilots
|> > make errors.  But the airplane is not allowed to crash because of it.
|> > This is why systems have redundancy (including both a pilot and a
|> > co-pilot).  In real life, critical systems *must* be error tolerant.

|> But, the problem is that the system may give bad results *without* a 
|> technical bug (one which bounds-checking would notice, for example). 
|> Thus, in real life, critical systems need much more than just 
|> bounds-checking and the like.

They need much more, that is sure.  In fact, they need every chance
you can give them.  Including bounds checking.
-- 
James Kanze         Tel.: (+33) 88 14 49 00        email: kanze@gabi-soft.fr
GABI Software, Sarl., 8 rue des Francs-Bourgeois, F-67000 Strasbourg, France
Conseils en informatique industrielle --
                              -- Beratung in industrieller Datenverarbeitung