4 ms·
At a previous job I was using destructors to ensure motors and other actuators in a telescope would shut down properly, and in the right order. This was very im
by gsliepen 3y ago
At a previous job I was using destructors to ensure motors and other actuators in a telescope would shut down properly, and in the right order. This was very important, because incorrect shutdown could cause damage to equipment and potentially people.
This was actually my main reason for using C++ to program the control software: the fact that constructors and destructors run deterministically, especially when something bad happens and an exception is thrown. And while the language doesn't specify in which order they run for global variables in different compilation units, you still know how they are ordered with respect to `main()`, and if you pay attention to how the linker works, you can actually know how they will all be ordered.
- pizlonator 3y agoOk but couldn’t you have done that prior to calling exit?
- dataflow 3y agoWhat problem would that have solved? Also... can't you make that argument for anything? "Avoid unique_ptr -- can't you just free the memory before exiting?"
- gpderetta 3y agoIf your program crashes or hangs it also doesn't run static destructors. And if this is safety critical you need the cleanup guarantee anyway, for example via a supervisor or watchdog process.
- dataflow 3y agoCan't such a destructor be in the supervisor? Guard g; // ...call subprocess... // Guard::~Guard will run at exit
- gsliepen 3y agoOf course. It is run from a supervisor, which will power off all actuators if the control software crashes. This is less ideal than a more clean shutdown though. And there is a hardware watchdog which will reboot the computer it is running on if the whole thing crashes. And hardware endswitches will physically cut power if the actuators run into a position they shouldn't be.
- gpderetta 3y agoCan't the watchdog also perform the clean shutdown? I strongly subscribe to the Crash-only Software design principle, but it is useful to get feedback from actual experience in the field. edit: to clarify, I'm not dogmatic, I have nothing against implmenting clean shutdown procedures for example to avoid alerts and allow quick restarts that don't need to roll-forward replay logs. I just think that clean shutdown should be best-effort and never required for consistency/durability/safety. We are probably in agreement.
- gsliepen 3y agoIt might be able to, but it doesn't know the state of the system. It could try to determine that somehow, but that would complicate the watchdog a lot, and that is code that is almost never exercised, so the chance that there would be bugs in that code is much higher. If shutdowns were more frequent, a crash-only design might indeed have made more sense.