November 26, 2005
As I recall, the Blue Screen of Death was introduced with Windows NT 3.1 circa 1993:
A blue screen of death occurs when the kernel, or a driver running in kernel mode, encounters an error from which it cannot recover. This is usually caused by a [hardware] driver that throws an unhandled exception or performs an illegal operation. The only action the user can take in this situation is to restart the computer, which results in possible data loss due to Windows not properly shutting down.
Blue screens are known as "Stop errors" in the Windows NT/2000/XP documentation, and are also sometimes referred to as "bugchecks".
The "Stop" message contains the error code and its symbolic name (e.g. 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT and 2000, the second and third sections of the screen contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver.
The BSoD is analogous to a Kernel Panic in the UNIX world, and it became a standard fixture in all subsequent versions of Windows. Here's a chronological pictorial, starting with Win9x and going up to WinXP:
Microsoft catches a lot of flak for the Blue Screen of Death, but as frequently noted throughout the BSoD documentation, most BSoDs are due to faulty third-party hardware drivers.
If you're a glutton for punishment, you can attempt to decipher all that technical jibba-jabba on the BSoD or perform BSoD troubleshooting. If you're like most of us, you just cross your fingers and reboot. You may not see the BSoD much in Windows XP or Windows Server 2003 because the latest versions of Windows are configured to reboot automatically after a BSoD is encountered. Why wasn't it always this way -- after all, what the heck else are you going to do after getting a BSoD? Have a party?
After rebooting, you could celebrate by buying a BSoD T-Shirt:
And for a few laughs, you can install the BSoD screensaver on a coworker's computer when they're not around. This thing is highly authentic-- it even simulates a reboot-- and quite scary when you're not expecting it. In other words, it's hilarious.
The bluescreen is so well known now that it has become a "(color) Screen Of Death" meme. Sometimes it's used correctly, in the case of the Xbox 360 Black Screen of Death -- which appears to be related to overheating*. Sometimes it's expanded incorrectly to include things that have little to do with deep Kernel-level failures, such as the Yellow Screen of Death in ASP.NET:
It's only partially yellow, and only partially a screen o' death. If you see it, your web app may be unavailable, but your server certainly isn't bluescreening.
* See the massive internal Xbox 360 heatsink to see why I think this is the case. It's a common problem with consoles when they're placed on carpet or in restricted areas with limited airflow. My Nintendo 64 used to overheat!
Posted by Jeff Atwood
If you want to find out what caused a crash after the fact, if you have the BSoD turned off, you need to have one of the memory dump options enabled. The default in XP is the 64KB small memory dump. To analyze this, you need the 'Debugging Tools for Windows' package from http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx. I use the WinDbg debugger.
After launching WinDbg, select File Open Crash Dump. The small memory dump option defaults to placing the files in %SYSTEMROOT%\Minidump and are given a name of Minimmddyy-nn.dmp where nn is a two digit sequence number of the crash number in the day. You can then use the '!analyze -v' command to get a detailed analysis of the issue.
For best results, set your _NT_SYMBOL_PATH to point to Microsoft's debugging symbol server. I have mine set to "C:\Windows;C:\Windows\System32;SRV*C:\websymbols*http://msdl.microsoft.com/download/symbols" to pick up the debugging symbols for VC6 first.
If you do get a system crash, it's very much in your interests to use the 'Watson' feature to send the error details back to Microsoft. The default button is 'Don't Send' which I can understand for possible privacy reasons, but Microsoft cannot fix bugs they don't know about.
Having said that, since building this system in April 2003 I've had three crashes (that successfully wrote a dump file), all of which point the finger of blame at nv4_disp.dll, in other words, nVidia's display driver. Expect a similar pattern on machines with ATI graphics cards - the graphics driver, in my experience, is the number one cause of crashes. If the analysis points to a part of Windows or has a peculiar stop code, run some memory diagnostics like memtest86 or Microsoft's "Windows Memory Diagnostic" from http://oca.microsoft.com/en/windiag.asp - and check that your PC isn't overheating.
Mike, I second your comment about the display drivers. I'm on a ATI system and the drivers have been the culprit every time I've had a serious crash. ATI has never really been able to produce decent drivers. They even acknowledge this by including a "feature" to try and restart the driver if it fails. I guess this is like handling any unhandled exceptions and basicly just ignoring them to restart the driver.
Great tips, Mike. If you're having a problem with frequent BSODs, I agree that overheating (as with the Xbox 360, ironically) is the first thing to check.
They even acknowledge this by including a "feature" to try and restart the driver if it fails. I guess this is like handling any unhandled exceptions and basicly just ignoring them to restart the driver.
I think this is required for Vista, since so much of the OS depends on the graphics hardware.
As for ASP.NET, it might not be a kernel error, but it's "o' death" inasmuch as hey, buddy, your Web page is DOA.
I'm amazed when I see these on public Web sites, actually. Yipes.
Windows NT 3.5 BSOD was my favorite. It was very informative, it always helped me to find the culprit (buggy audio driver, in most cases) without even using WinDbg. Is it possible to have the same screen in XP? anybody knows?
Also, on longhorn there is an additional red screen od death.. =)
That has to be the nicest looking BSOD I've seen :)
This one sent a terrifyied chill down my spine:
Please...let it be fake......
Thanks for such a useful website. I have, at last, learned something about why my computer randomly shuts down and reboots. You have confirmed my suspicion that it is my Nvidia graphics card driver. On the other hand Nvidia's website support is totally unhelpful in this respect. The problem isn't listed there at all yet I know its quite common because friends have the same issues with Nvidia drivers.
so whos the girl in your BSoD tshirt pic ?
she's nice !
a better advert than Steph ? :-o
Where's the Vista BSOD screenshot? Isn't it prettier? It uses the Consolas font and all?
This screensaver is great.
I installed it on my housemate's PC at one point, and then totally forgot about it. Several months later - I had actually moved out by this time - he suspiciously asked me if I knew anything about this "blue screen of death screensaver". I immediately burst out laughing.
He had actually been grumbling about his computer not working properly (starting when I still lived there), and I seem to recall him swapping a few parts here and there, but I never thought anything of it at the time. It turns out that the screensaver had indeed been active that entire time (6+ months). Almost every time he went to work on his PC, he would turn on the monitor, and it would have a BSoD, and he would just immediately press the reset button. When he was finished, he would turn off the monitor and walk away, and of course the cycle would repeat itself. (I think I had set the screensaver time to 2 hours so it wasn't quite so obvious.)
The best way to avoid the BSOD is to avoid its maker. Use Linux and the BSOD is gone!! Life just got easier.
I like more the term Black Screen Of Doom wich is caused by missconfigurations of the XF86Config on UNIX.
The Yellow Screen of Death is even less appropriate than the BSOD for users to see. You can override it in the processModel section of your web.config or machine.config (serverErrorMessageFile attribute).
More info here:
"And for a few laughs, you can install the BSoD screensaver on a coworker's computer when they're not around."
There's also a really good hack for XScreensaver, but it can simulate dozens of different systems.