The blue screen of death (also known as BSoD, blue screen error, blue screen, fatal error or bugcheck, and officially known as a stop error [1] [2] [3] ) is a critical error screen displayed by Microsoft Windows. It indicates a system crash, in which the operating system reaches a critical condition where it can no longer operate safely.
Possible issues that can cause a BSoD include hardware failures, an issue with or without a device driver, or unexpected termination of a crucial process or thread.
External videos | |
---|---|
Windows 1.0 BSOD (Incorrect DOS Version): Short version, showing a failed Windows startup. | |
Windows 1.01 Blue Screen of Death: Long version, showing installation of MS-DOS 6 and Windows 1.01, and the failed startup of Windows 1.01. |
Blue error screens have existed since the first Beta Release of Windows 1.0; if Windows found a different DOS version than it expected, the error message "Incorrect DOS version" alongside other text messages detailing what check failed to pass would be appended to the boot screen before starting normally. [4] This function still exists in the final release (version 1.01); however, this screen prints out random characters after the "Incorrect DOS version" text as a result of a bug in the Windows logo code after the other text messages were removed. [4] This is not a crash screen, however, as Windows 1.0 will simply lock up or exit to DOS upon crashing. Windows 2.0 and Windows 2.1 mirror Windows 1.0 as they share the same boot screen as well as exiting to DOS upon crashing or if a critical error occurs.
Windows 3.0 uses a text-mode screen for displaying important system messages, usually from digital device drivers in 386 Enhanced Mode or other situations where a program could not run. Windows 3.1 changed the color of this screen from black to blue. It also displays a blue screen when the user presses the Ctrl+Alt+Delete key combination to bring up a rudimentary task manager, reserved for quitting any unresponsive programs if they are available. As with prior versions, Windows 3.x exits to DOS if an error condition is severe enough.
The first Blue Screen of Death appeared in Windows NT 3.1 [5] (the first version of the Windows NT family, released in 1993), and later appeared on all Windows operating systems released afterwards. The error screens started with *** STOP:
in its very early iterations, hence it became known as a "stop error."
BSoDs can be caused by poorly written device drivers or malfunctioning hardware, [6] such as faulty memory, power supply issues, overheating of components, or hardware running beyond its specification limits. In the Windows 9x operating systems, incompatible DLLs or bugs in the operating system kernel could also cause BSoDs. [7] Because of the instability and lack of memory protection in Windows 9x OSes, BSoDs were much more common.
The Windows Embedded Compact (formerly known as Windows CE) line of embedded operating systems do not use a traditional Blue Screen of Death screen. [8]
On September 4, 2014, several online journals, including Business Insider , [9] DailyTech , [10] Engadget , [11] Gizmodo , [12] Lifehacker , [13] Neowin , [14] Softpedia , [15] TechSpot, [16] The Register , [17] and The Verge [18] incorrectly attributed the creation of the Blue Screen of Death to Steve Ballmer, Microsoft's former CEO, citing an article by Microsoft employee Raymond Chen, titled "Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?". [19] The article focused on the creation of the first rudimentary task manager in Windows 3.x which shared visual similarities with a BSoD, with Steve Ballmer writing the messages that had appeared on them. [19] In a follow-up on September 9, 2014, Raymond Chen complained about this widespread mistake, claimed responsibility for revising the BSoD in Windows 95 and panned BGR.com for having "entirely fabricated a scenario and posited it as real". [20]
According to former Microsoft employee Dave Plummer, the Blue Screen of Death (also known as a Stop error) in the Windows NT family was actually designed by Microsoft developer John Vert and was not inspired by the rudimentary task manager screen of Windows 3.x. [21] Additionally, John Vert stated that the Stop error screens were assigned the color blue because the universal color palette of the video hardware at that time was very rudimentary and he personally used a MIPS OS box and SlickEdit for programming, so that the firmware and editor both displayed white text on a blue background, making it for a more consistent programming experience. [21]
BSoDs originally showed silver text on a royal blue background with information about current memory values and register values. Starting with Windows Server 2012 (released in September 2012), Windows adopted a cerulean background. Windows 11 initially used a black background, but starting from build number 22000.348, [22] switched to a dark blue background. [23] Preview builds of Windows 10, Windows 11, and Windows Server (available from the Windows Insider program) feature a dark green background instead of a blue one. [24] [25] [22] Windows 3.1, 95, and 98 supports customizing the color of the screen, [26] whereas in the Windows NT family, the color is hard-coded. [26]
Windows 95, 98, and Me render their BSoDs in the 80×25 text mode. BSoDs in the Windows NT family initially used the 80×50 text mode on a 720×400 screen, and Windows 2000, Windows XP, Vista, and 7 BSoDs use the 640×480 screen resolution. Windows 2000 used its built-in kernel mode font, Windows XP, Vista, and 7 use the Lucida Console font, and Windows 8 and Windows Server 2012 used the Segoe UI font. BSoDs on Windows 8 and Windows Server 2012 are rendered in higher resolutions than previous versions of Windows, where it uses the highest screen resolution available on UEFI machines. On legacy BIOS machines, they use the 1024×768 resolution by default, but they can also be configured to use the highest resolution available (via the 'highestmode
' parameter in Boot Configuration Data). [27] Windows 10 builds 14316 and up uses the same format as Windows 8, but has a QR code which leads to a Microsoft Support web page that tries to help users troubleshoot the issue step-by-step. This format was retained in Windows 11.
In the Windows NT family of operating systems, the blue screen of death (referred to as "bug check" in the Windows software development kit and driver development kit documentation) occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This is usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation is to restart the computer. Because of this, data loss may occur since the restart is unplanned, and the user is not given an opportunity to save their work.
The text on the error screen contains the code of the error and its symbolic name (e.g. "0x0000001E, KMODE_EXCEPTION_NOT_HANDLED") along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. [28] By default, Windows will create a memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which is effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows, WinDBG or KD debuggers from Debugging Tools for Windows are used. [29] A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen is limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP is configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error.
Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. If a stop error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.
A BSoD can also be caused by a critical boot loader error, where the operating system is unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation is STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE). [30] In such cases, there is no memory dump saved. Since the system is unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.
Before Windows Server 2012, each BSoD displayed an error name in uppercase (e.g. APC_INDEX_MISMATCH), a hexadecimal error number (e.g. 0x00000001) and four parameters. The last two are shown together in the following format: [31]
error code (parameter 1, parameter 2, parameter 3, parameter 4) error name
Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, the error screens showed four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses.
With the release of Windows Server 2012, the BSoD was changed, removing all of the above in favor of the error name and a concise description. Windows 8 also added a sad-emoticon as well (except on Japanese versions or Windows Server releases [32] ). The hexadecimal error code and parameters can still be found in the Windows Event Log or in memory dumps. The only exception to this rule was the "Fatal System Error" BSoDs, which had the hexadecimal error code "0xc000021a" in place of the error name.
Since Windows 10 build 14316, the screen features a QR code for quick troubleshooting. In Windows 10 (2004–22H2) and Windows 11, the text on the BSoD was slightly changed, with the text "Your PC ran into a problem" being reworded as "Your device ran into a problem".
The Windows 9x line of operating systems used the Blue Screen of Death as the main way for virtual device drivers to report errors to the user. This version of the BSoD, internally referred to as "_VWIN32_FaultPopup
", gives the user the option either to restart the computer or to continue using Windows, allowing the user to save their work before any data could be lost. Depending on the type of situation it may have occurred, however, the options to either continue or restart may or may not work at all. This is in contrast to the Windows NT BSoDs, which prevents the user from using the computer until it has been powered off or restarted (usually automatic for the latter).
The most common BSoD is displayed on an 80×25 text-mode screen, which is the operating system's way of reporting an interrupt caused by a processor exception; it is a more serious form of the general protection fault dialog boxes. The memory address of the error is given and the error type is a hexadecimal number from 00 to 11 (0 to 17 decimal). The error codes are as follows: [33]
Reasons for BSoDs include:
In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con
", "c:\aux\aux
", or "c:\prn\prn
" on the hard drive. This could be inserted on a website to crash visitors' machines as a prank. In reality, however, they are reserved device names for DOS systems; attempting to access them from Windows causes a crash, which in turn brings up said BSoD. Creating the aforementioned directories within Windows will also not work and may cause the same BSOD to occur. On March 16, 2000, Microsoft released a security update to resolve this issue. [34]
One famous instance of a Windows 9x BSoD occurred during a presentation of a Windows 98 beta given by Bill Gates at COMDEX on April 20, 1998: The demo PC crashed with a BSoD when his assistant, Chris Capossela, connected a scanner to the PC to demonstrate Windows 98's support for Plug and Play devices. This event brought thunderous applause from the crowd and Gates replied (after a nervous pause): "That must be why we're not shipping Windows 98 yet." [35]
systemd, a software suite providing system components for the Linux operating systems, implements a blue screen of death similar to those of Microsoft Windows using a systemd unit called systemd-bsod since August 2023, which was fully added on December 6, 2023 starting with version 255 of systemd. [36] It does not replace the kernel panic featured within Linux (see below); rather, it is only used in the event of a boot failure. [37]
Stop errors are comparable to kernel panics in macOS, Linux, and other Unix-like systems, and to bugchecks in OpenVMS. Windows 3.1 display a Black Screen of Death instead of a blue one. [20] Some versions of macOS (notably OS X Lion) display a Black Screen of Death instead of a kernel panic, usually pointed to a graphics card or sleep/wake issue. [38] The Xbox series of consoles (which includes the original Xbox, Xbox 360, Xbox One and the Xbox Series X/S) also display a Black Screen of Death upon hardware or software error. [39] Beta versions of Windows 98 display a red error screen raised by the Advanced Configuration and Power Interface (ACPI) when the host computer's BIOS encounters a problem. [40] The bootloader of the first beta version of Windows Vista also display a red error screen in the event of a boot failure. [41] [42] [43] Windows 10 and later display an Orange Screen of Death when there is a driver incompatibility present.[ citation needed ]
As mentioned earlier, the insider builds of Windows Server 2016 and later, Windows 10, and Windows 11 display a green screen. [24] [25] [22]
ReactOS, an opensource operating attempting to achieve binary compatibility with Microsoft Windows, implements a version of the Blue Screen of Death.
A kernel panic is a safety measure taken by an operating system's kernel upon detecting an internal fatal error in which either it is unable to safely recover or continuing to run the system would have a higher risk of major data loss. The term is largely specific to Unix and Unix-like systems. The equivalent on Microsoft Windows operating systems is a stop error, often called a "blue screen of death".
NTLDR is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOOTMGR bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.
Windows 9x is a generic term referring to a series of Microsoft Windows computer operating systems produced from 1995 to 2000, which were based on the Windows 95 kernel and its underlying foundation of MS-DOS, both of which were updated in subsequent versions. The first version in the 9x series was Windows 95, which was succeeded by Windows 98 and then Windows Me, which was the third and last version of Windows on the 9x line, until the series was superseded by Windows XP.
A general protection fault (GPF) in the x86 instruction set architectures (ISAs) is a fault initiated by ISA-defined protection mechanisms in response to an access violation caused by some running code, either in the kernel or a user program. The mechanism is first described in Intel manuals and datasheets for the Intel 80286 CPU, which was introduced in 1983; it is also described in section 9.8.13 in the Intel 80386 programmer's reference manual from 1986. A general protection fault is implemented as an interrupt. Some operating systems may also classify some exceptions not related to access violations, such as illegal opcode exceptions, as general protection faults, even though they have nothing to do with memory protection. If a CPU detects a protection violation, it stops executing the code and sends a GPF interrupt. In most cases, the operating system removes the failing process from the execution queue, signals the user, and continues executing other processes. If, however, the operating system fails to catch the general protection fault, i.e. another protection violation occurs before the operating system returns from the previous GPF interrupt, the CPU signals a double fault, stopping the operating system. If yet another failure occurs, the CPU is unable to recover; since 80286, the CPU enters a special halt state called "Shutdown", which can only be exited through a hardware reset. The IBM PC AT, the first PC-compatible system to contain an 80286, has hardware that detects the Shutdown state and automatically resets the CPU when it occurs. All descendants of the PC AT do the same, so in a PC, a triple fault causes an immediate system reset.
The Installable File System (IFS) is a filesystem API in MS-DOS/PC DOS 4.x, IBM OS/2 and Microsoft Windows that enables the operating system to recognize and load drivers for file systems.
The Advanced Host Controller Interface (AHCI) is a technical standard defined by Intel that specifies the register-level interface of Serial ATA (SATA) host controllers in a non-implementation-specific manner in its motherboard chipsets.
The black screen of death is a fatal system error displayed by some versions of Microsoft Windows after encountering a critical system error.
The bomb icon (💣) has several different applications in computing, and typically indicates a fatal system error.
The architecture of Windows NT, a line of operating systems produced and sold by Microsoft, is a layered design that consists of two main components, user mode and kernel mode. It is a preemptive, reentrant multitasking operating system, which has been designed to work with uniprocessor and symmetrical multiprocessor (SMP)-based computers. To process input/output (I/O) requests, it uses packet-driven I/O, which utilizes I/O request packets (IRPs) and asynchronous I/O. Starting with Windows XP, Microsoft began making 64-bit versions of Windows available; before this, there were only 32-bit versions of these operating systems.
WinDbg is a multipurpose debugger for the Microsoft Windows computer operating system, distributed by Microsoft. Debugging is the process of finding and resolving errors in a system; in computing it also includes exploring the internal operation of software as a help to development. It can be used to debug user mode applications, device drivers, and the operating system itself in kernel mode.
A fatal system error occurs when an operating system halts because it has reached a condition where it can no longer operate safely.
An error message is the information displayed when an unforeseen problem occurs, usually on a computer or other device. Modern operating systems with graphical user interfaces, often display error messages using dialog boxes. Error messages are used when user intervention is required, to indicate that a desired operation has failed, or to relay important warnings. Error messages are seen widely throughout computing, and are part of every operating system or computer hardware device. The proper design of error messages is an important topic in usability and other fields of human–computer interaction.
The Native API is a lightweight application programming interface (API) used by Windows NT and user mode applications. This API is used in the early stages of Windows NT startup process, when other components and APIs are still unavailable. Therefore, a few Windows components, such as the Client/Server Runtime Subsystem (CSRSS), are implemented using the Native API. The Native API is also used by subroutines such as those in kernel32.dll that implement the Windows API, the API based on which most of the Windows components are created.
ntoskrnl.exe, also known as the kernel image, contains the kernel and executive layers of the Microsoft Windows NT kernel, and is responsible for hardware abstraction, process handling, and memory management. In addition to the kernel and executive layers, it contains the cache manager, security reference monitor, memory manager, scheduler (Dispatcher), and blue screen of death.
The Client/Server Runtime Subsystem, or csrss.exe
, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem. In modern versions of Windows, it is primarily involved with process and thread management, console window handling, side-by-side assembly loading and the shutdown process. Historically, it had also been responsible for window management and graphics rendering, however, these operations have been moved to kernel mode starting with Windows NT 4.0 to improve performance.
In computing, a screen of death, colloquially referred to as a blue screen of death, is an informal term for a type of a computer operating system error message displayed onscreen when the system has experienced a fatal system error. The fatal error typically results in unsaved work being lost and often indicates serious problems with the system's hardware or software. These error screens are usually the result of a kernel panic, although the terms are frequently used interchangeably. Most screens of death are displayed on an even background color with a message advising the user to restart the computer.
Driver Verifier is a tool included in Microsoft Windows that replaces the default operating system subroutines with ones that are specifically developed to catch device driver bugs. Once enabled, it monitors and stresses drivers to detect illegal function calls or actions that may be causing system corruption. It acts within the kernel mode and can target specific device drivers for continual checking or make driver verifier functionality multithreaded, so that several device drivers can be stressed at the same time. It can simulate certain conditions such as low memory, I/O verification, pool tracking, IRQL checking, deadlock detection, DMA checks, IRP logging, etc. The verifier works by forcing drivers to work with minimal resources, making potential errors that might happen only rarely in a working system manifest immediately. Typically fatal system errors are generated by the stressed drivers in the test environment, producing core dumps that can be analysed and debugged immediately; without stressing, intermittent faults would occur in the field, without proper troubleshooting facilities or personnel.
The Linux console is a system console internal to the Linux kernel. A system console is the device which receives all kernel messages and warnings and which allows logins in single user mode. The Linux console provides a way for the kernel and other processes to send text output to the user, and to receive text input from the user. The user typically enters text with a computer keyboard and reads the output text on a computer monitor. The Linux kernel supports virtual consoles – consoles that are logically separate, but which access the same physical keyboard and display. The Linux console are implemented by the VT subsystem of the Linux kernel, and do not rely on any user space software. This is in contrast to a terminal emulator, which is a user space process that emulates a terminal, and is typically used in a graphical display environment.
In computing, rebooting is the process by which a running computer system is restarted, either intentionally or unintentionally. Reboots can be either a cold reboot in which the power to the system is physically turned off and back on again ; or a warm reboot in which the system restarts while still powered up. The term restart is used to refer to a reboot when the operating system closes all programs and finalizes all pending input and output operations before initiating a soft reboot.
Timeout Detection and Recovery or TDR is a feature of the Windows operating system (OS) introduced in Windows Vista. It detects response problems from a graphics card (GPU), and if a timeout occurs, the OS will attempt a card reset to recover a functional and responsive desktop environment. However, if the attempt was unsuccessful, it results in the Blue Screen of Death (BSOD). The recovery tries to mitigate the scenario where an end user superfluously reboots their device should it become unresponsive.
In the final release of Windows, these detailed messages were hastily removed. The code that would print them, however, was not, and this is what produces the garbage output.
While Microsoft is switching to a Black Screen of Death in Windows 11, the screen is identical to the one found in Windows 10 otherwise. The sad face remains, as does the stop code and crash dump. The current preview of Windows 11 includes a green BSOD, a color that Microsoft has been using for Windows Insider builds since 2016.
BSOD stands for Blue Screen Of Death. One can customize the colors of this screen by setting a couple of variables in the 386Enh section of SYSTEM.INI: MessageTextColor and MessageBackColor. The user can only customize the BSOD under Windows 3.1, 95, and 98. These changes do not work under the Windows NT variants.
{{cite web}}
: CS1 maint: unfit URL (link)