We also intend that the controller should
not experience any generic failures such as program crashes (unhandled exceptions
in .NET), deadlocks, or endless cycles that get nowhere. Despite our intentions,
we observe examples of all of these (which we can reproduce by coding unit
tests).
In this run, CommandWhenWaiting, a calibrate command is ignored even though the
sensor is OK. The command arrives when the controller is waiting for a message;
no handler runs.
?Timeout, Timeout, Error
Reset
?Message ??™99.9??™, Message, Error
CheckMessage ??™99.9??™, compare to 99.9, OK
?Timeout, Timeout, OK
Poll
?Command, Message, OK
Overview 45
?Message ??™100.0??™, Message, OK
CheckMessage ??™100.0??™, compare to 99.9, OK
In this run, OutOfRangeMessageWhenIdle, the controller carries out a calibrate command
using an out-of-range temperature value. The message carrying this value was
late; it arrived after the time-out expired, and was not checked.
?Timeout, Timeout, Error
Reset
?Message ??™99.9??™, Message, Error
CheckMessage ??™99.9??™, compare to 99.9, OK
?Timeout, Timeout, OK
Poll
?Timeout, Message, OK
ReportLostMessage
?Message ??™999.9??™, Timeout, OK
?Command, Timeout, OK
Calibrate ??™999.9??™
In this run, LostMessageWhenIdle, the controller reaches a deadlocks. The sensor
does not reply to the initial reset command. The controller does not restart the timer;
polling never begins.
Pages:
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83