> I would have thought this is infinitely preferable to silently continuing after an error... It definitely is! However, it still assumes that the exception is

> I would have thought this is infinitely preferable to silently continuing after an error... It definitely is! However, it still assumes that the exception is safely handled. The flaw in Therac 25's development process was that testing did not reveal this bug. Consequently, the error recovery process could have itself been incorrect and remain uncaught. It's tempting to think that, if error recovery is similar each time, testing it once is enough, but error recovery is as susceptible to being impeded by race conditions as any other part of the code. No uncertainty is removed this way. It's also worth noting that a value of 0 (to which the counter overflowed) was actually a legitimate value in the Therac-25 program.