Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #98505

Re: Mars lander crash

From Richard Heathfield <rjh@cpax.org.uk>
Newsgroups comp.lang.c
Subject Re: Mars lander crash
Date 2016-12-09 14:22 +0000
Organization Fix this later
Message-ID <o2eel2$614$1@dont-email.me> (permalink)
References <o2e7s1$ea6$1@dont-email.me> <o2e8sg$hp7$1@dont-email.me> <o2ecu8$v73$1@dont-email.me>

Show all headers | View raw

On 09/12/16 13:53, David Brown wrote:
> On 09/12/16 13:44, Richard Heathfield wrote:
>> On 09/12/16 12:26, jacobnavia wrote:
>>> The european mars lander hitted the mars surface at 300Km/hr
>>>
>>> What happened?
>>>
>>> The altimeter when started working (after the heath shield separation)
>>> gave wrong data during one second.
>>>
>>> The software wasn't prepared for an overflow,
>>
>> Well, it should have been. The programmer should have predicted that
>> overflow could happen, and chosen data types that made this impossible
>> for the (highly predictable) numbers involved. If no native data types
>> would do, a suitable data structure should have been devised. It's not
>> difficult.
>
> That is not really accurate - the software should not have been prepared
> for an overflow.  The data should have been vetted so that there was no
> overflow.

That's kind of what I was getting at when I mentioned "highly 
predictable" numbers, but you said it much better than I did.

> There are three correct ways to handle this sort of situation:
>
> 1. The code that reads the altimeter should have checked the values, and
> made sure they were valid and in a suitable range before passing them on
> to the code that uses those values.  It would then be impossible for
> that code to experience overflow.
>
> 2. The code that used the altimeter values should have checked the
> values it received, and either discarded them or "saturated" them to the
> maximum valid value.  It would then be impossible for that code to
> experience overflow.
>
> 3. The code that used the altimeter values should have used types with
> sufficient range that there would be no overflow, regardless of the
> value it received.  It would then be impossible for that code to
> experience overflow.

No argument with any of those. I've left them in for context.

> Overflow checking is about figuring out what went wrong after something
> /has/ gone wrong.  Safe coding is about making sure things don't go
> wrong in the first place.

This is the big problem I see with Jacob's take on overflow. By the time 
overflow happens, it's already too late. That's why it's fine for debug 
mode and test mode, but you don't want to be relying on it in production.

> Now, there is nothing wrong with understanding that programmers make
> mistakes, and adding additional checks or limitations to limit the
> damage if there is a software bug - but the prime design point here is
> that you do not let overflow happen.

Right.

>>> and took that wrong data
>>> at face value, what produced a NEGATIVE altitude.
>>
>> If that's what went wrong (and it's not entirely clear whether an
>> overflow was responsible, but let's assume it was), then that is clear
>> evidence of inadequate testing of the software. In such circumstances,
>> an implementation that tests every operation for overflow would have
>> been an invaluable testing tool.
>
> I agree about inadequate testing of the software.  I don't agree that
> testing all operations for overflow is helpful.  That merely introduces
> a vast number of code paths that cannot be taken, cannot be tested, and
> cannot be verified.

I don't see how you derive that conclusion from what I wrote. Let us 
assume that, /without/ overflow checking, we have a battery of, say, a 
million tests. (This is rocket science, after all. But it's just a 
number. Don't get hung up on it.) And these million tests can be run in, 
say, a week. I see no harm, and some gain, in adding overflow checking 
during these existing tests. Cost? Maybe it runs in 169 hours instead of 
168. No big deal. Potential value in terms of discovering an otherwise 
hidden overflow? Possibly considerable. It's not something I would turn 
down unless there were a very good reason to turn it down.

> In a system that needs to be safe and reliable, you
> do not put in extra code (explicitly by the programmer, or implicitly
> via the tools) that you cannot test and do not need.  (You do put in
> extra checks at boundary points between modules, but you limit these and
> check them independently.)

Not in the production code, no. But for testing, I would disagree. 
Adding extra code can pay off during the debugging and test phases. 
Assertions are an obvious example.

>>> The lander then, thinking it had already landed, stopped the rocket
>>> motors and started the sequence for after the landing, hitting the
>>> ground at more than 200 Km per hour.
>>>
>>> Overflows are dangerous stuff.
>>
>> Right. Nobody is disputing that, are they?
>
> Not that I can see.  Even though I am arguing against hidden
> compiler-based overflow detection, except perhaps as a debugging tool
> during development, I agree that overflows are dangerous.  That is why I
> say they should be avoided, not detected.

Yes, but where is the harm in detecting them anyway (during testing)? If 
you find one, you know you didn't avoid it! And that's useful 
information to the developer.

-- 
Richard Heathfield
Email: rjh at cpax dot org dot uk
"Usenet is a strange place" - dmr 29 July 1999
Sig line 4 vacant - apply within

Back to comp.lang.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 13:26 +0100
  Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 12:44 +0000
    Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 14:53 +0100
      Re: Mars lander crash already5chosen@yahoo.com - 2016-12-09 05:58 -0800
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:11 +0100
        Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 16:56 +0100
          Re: Mars lander crash supercat@casperkitty.com - 2016-12-09 08:51 -0800
          Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 02:23 -0800
            Re: Mars lander crash Gareth Owen <gwowen@gmail.com> - 2016-12-11 10:57 +0000
          Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-11 12:34 -0500
            Re: Mars lander crash Robert Wessel <robertwessel2@yahoo.com> - 2016-12-11 23:33 -0600
      Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:22 +0000
        Re: Mars lander crash asetofsymbols@gmail.com - 2016-12-09 06:30 -0800
          Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:48 +0100
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:46 +0100
          Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:55 +0000
            Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:08 +0100
              Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 15:52 +0000
          Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 17:35 +0100
            Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 18:35 +0100
              Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 19:10 +0100
                Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-09 19:18 -0500
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-09 16:49 -0800
                Re: Mars lander crash "J. Clarke" <j.clarke.873638@gmail.com> - 2016-12-20 20:03 -0500
                Re: Mars lander crash <william@wilbur.25thandClement.com> - 2016-12-09 22:04 -0800
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-10 10:59 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 13:22 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 14:18 +0100
                Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 06:03 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 15:08 +0100
                Re: Mars lander crash already5chosen@yahoo.com - 2016-12-11 06:20 -0800
                Re: Mars lander crash luser droog <luser.droog@gmail.com> - 2016-12-11 07:08 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 11:56 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 21:05 +0100
                Re: Mars lander crash jameskuyper@verizon.net - 2016-12-11 12:57 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 21:26 +0000
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 09:23 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 14:01 +0000
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 15:11 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 18:57 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 19:23 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 19:55 +0100
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 20:52 +0100
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 23:37 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 16:10 -0800
                Re: Mars lander crash BartC <bc@freeuk.com> - 2016-12-12 01:13 +0000
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 09:53 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-12 08:30 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 09:25 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 10:36 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-11 18:46 +0000
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-11 09:12 -0800
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 18:53 +0100
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 12:09 -0800
                Re: Mars lander crash Jean-Marc Bourguet <jm@bourguet.org> - 2016-12-11 21:30 +0100
                Re: Mars lander crash Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2016-12-11 15:50 -0500
                Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-11 23:02 +0100
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 18:29 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 12:03 -0800
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-11 11:55 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-11 23:42 +0100
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-11 14:53 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 17:09 +1300
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 10:00 +0100
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:20 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 01:28 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:38 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 02:43 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 08:20 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-12 12:57 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 14:14 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 01:19 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-13 22:56 +1300
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 05:16 -0800
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-14 18:05 +1300
                Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-13 08:19 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-13 17:01 +0000
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 10:48 -0800
                Re: Mars lander crash Geoff <geoff@invalid.invalid> - 2016-12-13 11:56 -0800
                Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-13 13:37 -0800
                Re: Mars lander crash Geoff <geoff@invalid.invalid> - 2016-12-13 19:11 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-13 20:13 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-13 11:45 -0800
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-13 23:10 +0000
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-14 10:18 +0100
                Re: Mars lander crash Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-12-14 12:37 +0000
                Re: Mars lander crash Tim Rentsch <txr@alumni.caltech.edu> - 2016-12-14 21:31 -0800
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-15 13:26 +0100
                Re: Mars lander crash Ian Collins <ian-news@hotmail.com> - 2016-12-12 22:40 +1300
                Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-12 13:22 +0100
                Re: Mars lander crash supercat@casperkitty.com - 2016-12-12 08:35 -0800
        Re: Mars lander crash supercat@casperkitty.com - 2016-12-09 08:43 -0800
      Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 09:47 -0500
        Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:11 +0100
          Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:49 -0500
  Re: Mars lander crash already5chosen@yahoo.com - 2016-12-09 05:53 -0800
    Re: Mars lander crash asetofsymbols@gmail.com - 2016-12-09 06:04 -0800
      Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 15:09 +0100
        Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:06 -0500
          Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:32 +0100
    Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 17:30 +0100
      Re: Mars lander crash BartC <bc@freeuk.com> - 2016-12-09 16:42 +0000
      Re: Mars lander crash Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2016-12-09 11:43 -0500
      Re: Mars lander crash Keith Thompson <kst-u@mib.org> - 2016-12-09 08:59 -0800
      Re: Mars lander crash "J. Clarke" <j.clarke.873638@gmail.com> - 2016-12-20 19:36 -0500
  Re: Mars lander crash "Rick C. Hodgin" <rick.c.hodgin@gmail.com> - 2016-12-09 06:46 -0800
    Re: Mars lander crash Richard Heathfield <rjh@cpax.org.uk> - 2016-12-09 14:57 +0000
      Re: Mars lander crash Noob <root@127.0.0.1> - 2016-12-09 16:07 +0100
    Re: Mars lander crash David Brown <david.brown@hesbynett.no> - 2016-12-09 16:03 +0100
      Re: Mars lander crash "James R. Kuyper" <jameskuyper@verizon.net> - 2016-12-09 12:41 -0500
    Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 10:52 -0500
      Re: Mars lander crash jameskuyper@verizon.net - 2016-12-09 12:13 -0800
        Re: Mars lander crash jacobnavia <jacob@jacob.remcomp.fr> - 2016-12-09 21:56 +0100
          Re: Mars lander crash jameskuyper@verizon.net - 2016-12-09 14:11 -0800
        Re: Mars lander crash Jerry Stuckle <jstucklex@attglobal.net> - 2016-12-09 22:46 -0500
          Re: Mars lander crash <william@wilbur.25thandClement.com> - 2016-12-09 22:34 -0800
          Re: Mars lander crash James Kuyper <jameskuyper@verizon.net> - 2016-12-10 18:38 -0500
      Re: Mars lander crash Malcolm McLean <malcolm.mclean5@btinternet.com> - 2016-12-11 06:06 -0800
  Re: Mars lander crash "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2016-12-10 01:17 +0800
  Re: Mars lander crash Ken Brody <kenbrody@spamcop.net> - 2016-12-13 14:28 -0500
  Re: Mars lander crash Ken Brody <kenbrody@spamcop.net> - 2016-12-13 14:30 -0500

csiph-web