Command Cancellation

Whether the software is carrying out a specific command or performing a routine task, there is usually a chance that the operation isn't permitted, or that something can go wrong and cause a failure. This is Command Cancellation.

Command Cancellation should be thought of as a cross-cutting concern because it affects all parts of the software. The code might be executing deep within the call stack when a limit is violated or a numeric error appears. There could be a hardware failure or an unexpected software state that keeps the operation from completing. The approach that is taken by the software should be reasoned and consistent.

There are two main considerations:

1. How is the flow of control handled in the software?
2. Who is responsible for dealing with the situation?

The real-time embedded critical software systems I am familiar with address the second question with an entity that is situated near the top of the call stack, and is responsible for handling such situations. Whether these are called "controllers" or "managers" or "applications", they have the local knowledge to deal with the specific circumstance, as well as the authority to execute a corrective or mitigating action.

I have seen some answers to the first question (sometimes in combination):

1. Ignore the problem.
2. Patch over the problem where it is found.
3. Log (event logging) the problem.
4. Throw an exception.
5. Return an error code.
6. Restart.
7. Call a user-provided callback.

I strongly recommend against options 1 and 2. Option 3 can and should be used in combination with either 4 or 5. Answer 6 is used in the telecommunications sector and under extreme conditions in satellite flight software.

N.B. Fault Handling is a different topic. https://www.foonathan.net/2017/12/exceptions-vs-expected/#more https://www.foonathan.net/2017/01/exceptions-constructor/

Introduction