4 ms·

Or the missile firmware where the missile is going to explode before they run out of memory: https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 ht

• jnwatson 3y ago
  There was a certain Space Shuttle program that never returned from interrupt. At the end of its interrupt handler, it would just spin. The next interrupt would just add to the call stack. What happens when it runs out of stack? It just resets the stack pointer back to the start.
• tetromino_ 3y ago
  Using warhead explosion as garbage collector might seem like a clever hack, but all it takes is an upgrade by a different team (say, adding a new engine, or longer-range sensors, or repurposing a surface-to-air missile for a surface-to-surface role), and suddenly your guidance software runs out of memory before it explodes, and your missile falls onto an an elementary school or hospital.
  • HideousKojima 3y ago
    You can probably double the ram (or more) again by then.
    • LtWorf 3y ago
      Assuming you know you have to do it.
  • shortrounddev2 3y ago
    I assume they would test the missiles before attesting to its range
  • wegfawefgawefg 3y ago
    But sir!! They were nazi orphans!
  • zlsa 3y ago
    Related: the Ariane 5 rocket failed on its maiden flight because it reused code from its predecessor, which made an assumption that didn't apply to the higher-performance Ariane 5. https://en.wikipedia.org/wiki/Ariane_flight_V88 https://en.wikipedia.org/wiki/Ariane_flight_V88
    • h0l0cube 3y ago
      Seems like a mitigation for this kind of issue would be to simulate the inputs to the system for the expected flight duration.
      • kitd 3y ago
        IIRC it was the higher acceleration value of Ariane5 that the old code wasn't expecting that caused the problem. Some fuzz testing could have worked, I suppose.
        • h0l0cube 3y ago
          I would imagine a simulation would factor in the higher acceleration
        • mpweiher 3y ago
          Except it was worse: 1. The module that failed actually was no longer in use for that part of the flight. 2. The acceleration for the part of the flight where it was in use was within the parameters. 3. Instead of just ignoring / clamping the out-of-bounds values, the no-longer-needed module sent a big error dump. 4. That error dump was sent to the next module in-line, which was expecting...I think numbers, but certainly not big textual error dumps. And so that failed as well. 5. I don't know if that second module was needed. So had the module just (a) processed the incoming data normally or (b) clamped the values silently or (c) dropped the out-of-bounds values silently, the Ariane 5 would not have exploded. Instead it did the "make it impossible to represent invalid states"-thing and exploded. While I understand the appeal of that idea, I think it is overrated with any software that has to interact in some way shape or form with the real world, however indirectly. Because programmers tend to have a pretty limited understanding of what states are valid or invalid in the real world. (See also: the "falsehoods programmers believe about XXX" series)
  • LtWorf 3y ago
    > and your missile falls onto an an elementary school or hospital. Then you just say terrorists were hiding inside…
• queuebert 3y ago
  God, that email takes me back to days when email was much higher signal-to-noise and sig lines were for color, not credentials.