Re: The utility of standard's semantics for overflow

[Robert Dewar <dewar@adacore.com>]

Michael Veksler wrote:

> If the programmer wants a robust application,
> then casting to unsigned must be present for almost any
> usage of int.

If you have a variable in your program that is signed but must
always be in the range of int, then int is the appropriate
representation. If the pressure in a tank must be in the
range -2**31 .. +2**31-1, it does not make the application
more robust to ensure that if the pressure goes "over" the max, it
suddenly turns negative. That's likely to be just as
disastrous as any other behavior in this serious error
situation.

In practice of course, the pressure in this example is
likely to be in a much more constrained range, and part
of making a "robust application" will be to ensure that
the value always remains in the required range. In a more
expressive language like Ada, the corresponding type would
be declared with the appropriate range, and an exception
would be raised if the value is outside this range.

In practice in a critical application, you are likely to
not want any exceptions, so proving such a program exception
free is one of the tasks that faces the applications programmer
in writing a reliable program. See for example:

http://www.praxis-cs.com/pdfs/Industrial_strength.pdf