2 — Strong typing

The width of a number is part of its meaning. The failure behind this chapter: a Modula-2 compiler mapped LONGREAL to the x87 80-bit format, which occupies sixteen bytes in memory — so a loop reading 8-byte doubles off the wire strode through them at the wrong width and read garbage from the second element on. Nothing warned, because the language's own type said "a long real", and what that meant depended on the compiler.

In M9 every numeric type names its width — I8..I64, U8..U64, F32, F64, BYTE — and nothing converts implicitly, not even the "safe" direction:

X2Assign.m9

That diagnostic is real — the gate compiles this file on every run and requires exactly that refusal. The assignment must be written as what it is: a conversion, i := I64 (x) — which brings us to the second rule.

Conversions are calls, and they can fail

I64 (x) is an ordinary-looking call with a checked meaning: if the value does not fit the target, it raises ValueRange. The museum piece behind it: Trunc(NaN) crashed one runtime and, in a well-known array library, silently answers the most negative integer — a number that then flows onward into someone's mean.

MODULE C2Widths ;

(* Chapter 2.  Every integer and real type names its exact width --
   I64, I32, F64, F32 -- and nothing converts by itself.  A
   conversion is a call, the call can fail, and a failing conversion
   RAISES instead of wrapping, truncating, or inventing INT64_MIN
   the way a NaN truncation silently does elsewhere.

Each probe carries its own EXCEPT block: a handler belongs to the
   frame that knows what failure means there.                       *)

IMPORT Io ;

PROCEDURE TryI32 (v: I64) =
  (* narrows v to 32 bits, reporting instead of propagating.

v -- any I64; whether it fits I32 is exactly what the
            conversion checks.  This comment block is a DOCSTRING:
            m9c --doc renders it, chapter 3 shows where.            *)
VAR n : I32 ;
BEGIN
  n := I32 (v) ;
  Io.Write ('I32 fits: ') ;
  Io.WriteI64 (I64 (n)) ;
  Io.WriteLine ('')
EXCEPT
| ValueRange :
    Io.Write ('I32 (') ;
    Io.WriteI64 (v) ;
    Io.WriteLine (') raised ValueRange')
END TryI32 ;

PROCEDURE TryTruncNan () =
VAR
  x : F64 ;
  k : I64 ;
BEGIN
  x := 0.0 / 0.0 ;        (* NaN travels freely in floats ... *)
  k := I64 (x) ;          (* ... and raises at the integer boundary *)
  Io.WriteI64 (k)
EXCEPT
| ValueRange :
    Io.WriteLine ('I64 (NaN) raised ValueRange')
END TryTruncNan ;

BEGIN
  TryI32 (2000000000) ;
  TryI32 (3000000000) ;
  TryTruncNan ()
END C2Widths.

C2Widths.m9

Note the shape: each probe procedure carries its own EXCEPT block, because a handler belongs to the frame that knows what the failure means there. NaN travels freely between floats — that is IEEE arithmetic and it is right — and is stopped at the integer boundary, where "not a number" has no honest representation.

The accounting is exhaustive

A procedure that performs a checked conversion has two options: handle the failure, or declare it. There is no third option in which the signature stays quiet:

X2Raises.m9

This is what makes a RAISES list worth reading: it is not documentation that can rot, it is checked arithmetic over the call graph. When chapter 3 shows a definition promising RAISES TooCold, that promise is proven, not asserted.

When you MEAN wraparound, say so

Checked + raises Overflow — always, in every build, for the reason chapter 1 gave. Sometimes modular arithmetic is the point (hashing, checksums, random-number generators). M9 spells that as different operators — +%, -%, *% — defined modulo 2^64, so the intent is visible in the source and greppable forever:

C2Wrap.m9

MAX (I64) +% 1 lands exactly on the most negative I64, printed with all its digits.