Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #98498

Re: Mars lander crash

From David Brown <david.brown@hesbynett.no>
Newsgroups comp.lang.c
Subject Re: Mars lander crash
Date 2016-12-09 14:53 +0100
Organization A noiseless patient Spider
Message-ID <o2ecu8$v73$1@dont-email.me> (permalink)
References <o2e7s1$ea6$1@dont-email.me> <o2e8sg$hp7$1@dont-email.me>

Show all headers | View raw

On 09/12/16 13:44, Richard Heathfield wrote:
> On 09/12/16 12:26, jacobnavia wrote:
>> The european mars lander hitted the mars surface at 300Km/hr
>>
>> What happened?
>>
>> The altimeter when started working (after the heath shield separation)
>> gave wrong data during one second.
>>
>> The software wasn't prepared for an overflow,
> 
> Well, it should have been. The programmer should have predicted that
> overflow could happen, and chosen data types that made this impossible
> for the (highly predictable) numbers involved. If no native data types
> would do, a suitable data structure should have been devised. It's not
> difficult.

That is not really accurate - the software should not have been prepared
for an overflow.  The data should have been vetted so that there was no
overflow.

There are three correct ways to handle this sort of situation:

1. The code that reads the altimeter should have checked the values, and
made sure they were valid and in a suitable range before passing them on
to the code that uses those values.  It would then be impossible for
that code to experience overflow.

2. The code that used the altimeter values should have checked the
values it received, and either discarded them or "saturated" them to the
maximum valid value.  It would then be impossible for that code to
experience overflow.

3. The code that used the altimeter values should have used types with
sufficient range that there would be no overflow, regardless of the
value it received.  It would then be impossible for that code to
experience overflow.


Overflow checking is about figuring out what went wrong after something
/has/ gone wrong.  Safe coding is about making sure things don't go
wrong in the first place.

Now, there is nothing wrong with understanding that programmers make
mistakes, and adding additional checks or limitations to limit the
damage if there is a software bug - but the prime design point here is
that you do not let overflow happen.


> 
>> and took that wrong data
>> at face value, what produced a NEGATIVE altitude.
> 
> If that's what went wrong (and it's not entirely clear whether an
> overflow was responsible, but let's assume it was), then that is clear
> evidence of inadequate testing of the software. In such circumstances,
> an implementation that tests every operation for overflow would have
> been an invaluable testing tool.

I agree about inadequate testing of the software.  I don't agree that
testing all operations for overflow is helpful.  That merely introduces
a vast number of code paths that cannot be taken, cannot be tested, and
cannot be verified.  In a system that needs to be safe and reliable, you
do not put in extra code (explicitly by the programmer, or implicitly
via the tools) that you cannot test and do not need.  (You do put in
extra checks at boundary points between modules, but you limit these and
check them independently.)

> 
>> The lander then, thinking it had already landed, stopped the rocket
>> motors and started the sequence for after the landing, hitting the
>> ground at more than 200 Km per hour.
>>
>> Overflows are dangerous stuff.
> 
> Right. Nobody is disputing that, are they?

Not that I can see.  Even though I am arguing against hidden
compiler-based overflow detection, except perhaps as a debugging tool
during development, I agree that overflows are dangerous.  That is why I
say they should be avoided, not detected.

> 
>> But not everything went bad. The altitude was calculated much faster
>> than what it would, if they would have tested for overflow at each
>> operation.
>>
>> Speed is important for software. Not the results.
> 
> Nobody has claimed this, apart from you.
>

Back to comp.lang.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 13:26 +0100
  Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 12:44 +0000
    Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 14:53 +0100
      Re: Mars lander crash already5chosen@yahoo.com - 2016-12-09 05:58 -0800
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:11 +0100
        Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 16:56 +0100
          Re: Mars lander crash supercat@casperkitty.com - 2016-12-09 08:51 -0800
          Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 02:23 -0800
            Re: Mars lander crash Gareth Owen <gwowen@gmail.com> - 2016-12-11 10:57 +0000
          Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-11 12:34 -0500
            Re: Mars lander crash Robert Wessel <robertwessel2@yahoo.com> - 2016-12-11 23:33 -0600
      Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:22 +0000
        Re: Mars lander crash asetofsymbols@gmail.com - 2016-12-09 06:30 -0800
          Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:48 +0100
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:46 +0100
          Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:55 +0000
            Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:08 +0100
              Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 15:52 +0000
          Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 17:35 +0100
            Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 18:35 +0100
              Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 19:10 +0100
                Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-09 19:18 -0500
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-09 16:49 -0800
                Re: Mars lander crash "J. Clarke" <j.clarke.873638@gmail.com> - 2016-12-20 20:03 -0500
                Re: Mars lander crash <william@wilbur.25thandClement.com> - 2016-12-09 22:04 -0800
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-10 10:59 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 13:22 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 14:18 +0100
                Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 06:03 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 15:08 +0100
                Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 06:20 -0800
                Re: Mars lander crash luser droog <luser.droog@gmail.com> - 2016-12-11 07:08 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 11:56 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 21:05 +0100
                Re: Mars lander crash jameskuyper@verizon.net - 2016-12-11 12:57 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 21:26 +0000
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 09:23 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 14:01 +0000
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 15:11 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 18:57 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 19:23 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 19:55 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 20:52 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 23:37 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 16:10 -0800
                Re: Mars lander crash BartC <bc@freeuk.com> - 2016-12-12 01:13 +0000
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 09:53 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-12 08:30 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 09:25 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 10:36 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 18:46 +0000
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 09:12 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 18:53 +0100
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 12:09 -0800
                Re: Mars lander crash Jean-Marc Bourguet <jm@bourguet.org> - 2016-12-11 21:30 +0100
                Re: Mars lander crash Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2016-12-11 15:50 -0500
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 23:02 +0100
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 18:29 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 12:03 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 11:55 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 23:42 +0100
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-11 14:53 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 17:09 +1300
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 10:00 +0100
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:20 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 01:28 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:38 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 02:43 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 08:20 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 12:57 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 14:14 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 01:19 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 22:56 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 05:16 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-14 18:05 +1300
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-13 08:19 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-13 17:01 +0000
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 10:48 -0800
                Re: Mars lander crash Geoff <geoff@invalid.invalid> - 2016-12-13 11:56 -0800
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 13:37 -0800
                Re: Mars lander crash Geoff <geoff@invalid.invalid> - 2016-12-13 19:11 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-13 20:13 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-13 11:45 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-13 23:10 +0000
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-14 10:18 +0100
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-14 12:37 +0000
                Re: Mars lander crash Tim Rentsch <txr@alumni.caltech.edu> - 2016-12-14 21:31 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-15 13:26 +0100
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:40 +1300
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 13:22 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-12 08:35 -0800
        Re: Mars lander crash supercat@casperkitty.com - 2016-12-09 08:43 -0800
      Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 09:47 -0500
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:11 +0100
          Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:49 -0500
  Re: Mars lander crash already5chosen@yahoo.com - 2016-12-09 05:53 -0800
    Re: Mars lander crash asetofsymbols@gmail.com - 2016-12-09 06:04 -0800
      Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:09 +0100
        Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:06 -0500
          Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:32 +0100
    Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 17:30 +0100
      Re: Mars lander crash BartC <bc@freeuk.com> - 2016-12-09 16:42 +0000
      Re: Mars lander crash Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2016-12-09 11:43 -0500
      Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-09 08:59 -0800
      Re: Mars lander crash "J. Clarke" <j.clarke.873638@gmail.com> - 2016-12-20 19:36 -0500
  Re: Mars lander crash "Rick C. Hodgin" <rick.c.hodgin@gmail.com> - 2016-12-09 06:46 -0800
    Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:57 +0000
      Re: Mars lander crash Noob <root@127.0.0.1> - 2016-12-09 16:07 +0100
    Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:03 +0100
      Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-09 12:41 -0500
    Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:52 -0500
      Re: Mars lander crash jameskuyper@verizon.net - 2016-12-09 12:13 -0800
        Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 21:56 +0100
          Re: Mars lander crash jameskuyper@verizon.net - 2016-12-09 14:11 -0800
        Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 22:46 -0500
          Re: Mars lander crash <william@wilbur.25thandClement.com> - 2016-12-09 22:34 -0800
          Re: Mars lander crash James Kuyper <jameskuyper@verizon.net> - 2016-12-10 18:38 -0500
      Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-11 06:06 -0800
  Re: Mars lander crash "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2016-12-10 01:17 +0800
  Re: Mars lander crash Ken Brody <kenbrody@spamcop.net> - 2016-12-13 14:28 -0500
  Re: Mars lander crash Ken Brody <kenbrody@spamcop.net> - 2016-12-13 14:30 -0500

csiph-web