The Blue Screen of Death is an error screen displayed after a fatal system error.
History The term "Blue Screen of Death" originated
during OS/2 pre-release development activities at Lattice Inc, the makers of an early Windows
and OS/2 C compiler.
During porting of Lattice's other tools, developers encountered the stop screen when null pointers
were dereferenced either in application code or when unexpectedly passed into system API
calls.
During reviews of progress and feedback to IBM Austin, the developers described the stop
screen as the Blue Screen of Death to denote the screen and the finality of the experience.
BSoDs have been present in all Windows-based operating systems since Windows 3.1.
BSoDs can be caused by poorly written device drivers or malfunctioning hardware, such as
faulty memory, power supply issues, overheating of components, or hardware running beyond
its specification limits.
In the Windows 9x era, incompatible DLLs or bugs in the operating system kernel could
also cause BSoDs.
Format
Until Windows Server 2012, BSoDs showed white text on a navy blue background with information
about current memory values and register values.
For visually impaired users, Microsoft has added a utility that allows the user to change
a setting in SYSTEM.INI that controls the colors that the BSoD code uses to any of the
16 CGA colors.
Doing so requires the edit or addition of the "MessageBackColor=X" and "MessageTextColor=X"
lines to the [386enh] section of the SYSTEM.INI, where X is a hexadecimal number from 0 to
F corresponding with a color in the CGA 16-color palette.
Windows Server 2012 and Windows 8 use a cerulean background instead.
Windows 95, 98 and Me BSoDs use 80×25 text mode.
BSoDs of Windows NT family use 80×50 text mode on a 720×400 screen.
Windows XP BSoDs uses the Lucida Console font while the Vista BSoD uses the Consolas font.
Windows Server 2012 uses Segoe UI and renders the BSoD at native resolution.
Windows NT
In Windows NT family of operating systems, the blue screen of death occurs when the kernel
or a driver running in kernel mode encounters an error from which it cannot recover.
This is usually caused by an illegal operation being performed.
The only safe action the operating system can take in this situation is to restart the
computer.
As a result, data may be lost, as users are not given an opportunity to save data that
has not yet been saved to the hard drive.
The text on the error screen contains the code of the error and its symbolic name along
with four error-dependent values in parentheses that are there to help software engineers
fix the problem that occurred.
Depending on the error code, it may display the address where the problem occurred, along
with the driver which is loaded at that address.
Under Windows NT, the second and third sections of the screen may contain information on all
loaded drivers and a stack dump, respectively.
The driver information is in three columns; the first lists the base address of the driver,
the second lists the driver's creation date, and the third lists the name of the driver.
By default, Windows will create a memory dump file when a stop error occurs.
Depending on the OS version, there may be several formats this can be saved in, ranging
from a 64kB "minidump" to a "complete dump" which is effectively a copy of the entire
contents of physical memory.
The resulting memory dump file may be debugged later, using a kernel debugger.
A debugger is necessary to obtain a stack trace, and may be required to ascertain the
true cause of the problem; as the information on-screen is limited and thus possibly misleading,
it may hide the true source of the error.
By default, Windows XP is configured to save only a 64kB minidump when it encounters a
stop error, and to then automatically reboot the computer.
Because this process happens very quickly, the blue screen may be seen only for an instant
or not at all.
Users have sometimes noted this as a random reboot rather than a traditional stop error,
and are only aware of an issue after Windows reboots and displays a notification that it
has recovered from a serious error.
This happens only when the computer has a function called "Auto Restart" enabled, which
can be disabled in the Control Panel which in turn shows the stop error.
Microsoft Windows can also be configured to send live debugging information to a kernel
debugger running on a separate computer.
If a stop error is encountered while a live kernel debugger is attached to the system,
Windows will halt execution and cause the debugger to break in, rather than displaying
the BSoD.
The debugger can then be used to examine the contents of memory and determine the source
of the problem.
A BSoD can also be caused by a critical boot loader error, where the operating system is
unable to access the boot partition due to incorrect storage drivers, a damaged file
system or similar problems.
The error code in this situation is STOP 0x0000007B.
In such cases, there is no memory dump saved.
Since the system is unable to boot from the hard drive in this situation, correction of
the problem often requires using the repair tools found on the Windows installation disc.
Details Before Windows Server 2012, each BSoD displayed
an error name in uppercase, a hexadecimal error number and four parameters.
The last two are shown together in the following format:
error code error name
Depending on the error number and its nature, all, some, or even none of the parameters
contain data pertaining to what went wrong, and/or where it happened.
In addition, the error screens showed four paragraphs of general explanation and advice
and may have included other technical data such the file name of the culprit and memory
addresses.
Windows Server 2012 and Windows 8 have dropped all of the above in favor of a concise description
and an error name.
Mentioned technical details data may be found in the Windows Event Log or interpreted from
memory dumps by person in possession of this knowledge.
Windows 9x
The blue screen of death frequently occurs in Microsoft's home desktop operating systems
Windows 95, 98, and Me.
Here it is usually less serious, but much more common.
In these operating systems, the BSoD is the main way for virtual device drivers to report
errors to the user.
It is internally referred to by the name of "_VWIN32_FaultPopup".
A Windows 9x/Me BSoD gives the user the option either to restart or continue.
However, VxDs do not display BSoDs frivolously — they usually indicate a problem that cannot
be fixed without restarting the computer, and hence after a BSoD is displayed the system
is usually unstable or unresponsive.
On the GUI-based members of the MS-DOS-Win95 stream of operating systems and reportedly
OS/2, the most common BSoD is the 25x80 screen which is in fact the operating system's way
of reporting an interrupt due to a processor exception; it is therefore a more serious
form of the Illegal Operation GPF/IPF error boxes seen in a couple of forms on these operating
systems.
Indeed, the memory address of the error is given and the error type is a hexadecimal
number from 00 to 11 and is most commonly 0E or 0D, with invalid opcode, division by
zero, and stack fault being less common and Overflow and the Double Fault forming a third
tier of more rare processor exception errors.
Assembly language and graphics programmers may see some of the others on occasion but
as a rule 0E and 0D are the fatal exceptions that may crop up in everyday use.
The error codes are as follows: 00: Division fault
02: Non-Maskable Interrupt 04: Overflow Trap
05: Bounds Check Fault 06: Invalid Opcode Fault
07: "Coprocessor Not Available" Fault 08: Double Fault
09: Coprocessor Segment Overrun 0A: Invalid Task State Segment Fault
0B: Not Present Fault 0C: Stack Fault
0D: General Protection Fault 0E: Page Fault
10: Coprocessor Error Fault 11: Alignment Check Fault
Common reasons for BSoDs are: Problems that occur with incompatible versions
of DLLs: Windows loads these DLLs into memory when they are needed by application programs;
if versions are changed, the next time an application loads the DLL it may be different
from what the application expects.
These incompatibilities increase over time as more new software is installed, and is
one of the main reasons why a freshly-installed copy of Windows is more stable than an "old"
one.
Faulty or poorly written device drivers Hardware incompatibilities
Damaged hardware may also cause a BSoD.
In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con"
or "c:\aux\aux" on the hard drive.
This could be inserted on a website to crash visitors' machines.
On 16 March 2000, Microsoft released a security update to resolve this issue.
The BSoD can appear if a user ejects removable media while it is being read on 9x/ME.
This is particularly common while using Microsoft Office: if a user simply wants to view a document,
they might eject a floppy disk before exiting the program.
Since Microsoft Office always creates a temporary file in the same directory, it will trigger
a BSoD upon exiting because it will attempt to delete the file on the disk that is no
longer in the drive.
This type of blue screen is no longer seen in Windows NT, 2000, and XP.
In the case of these less serious software errors, the program may still crash, but it
will not take down the entire operating system with it due to better memory management and
decreased legacy support.
In these systems, the "true" BSoD is seen only in cases where the entire operating system
crashes.
Perhaps the most famous instance of a Windows 9x BSoD occurred during a presentation of
a Windows 98 beta by Bill Gates at COMDEX on April 20, 1998.
The demo PC crashed with a BSoD when his assistant connected a scanner to the PC, trying to demonstrate
Windows 98's support for Plug and Play devices.
This event brought thunderous applause from the crowd and Gates replied after a nervous
pause: "That must be why we're not shipping Windows 98 yet."
Windows CE
The simplest version of the blue screen occurs in Windows CE except the versions for Pocket
PC.
The blue screen in Windows CE 3.0 is similar to the one in Windows 95 and 98.
Windows 3.1 Windows 3.1 was the first version of Windows
to use the Blue Screen of Death.
In Windows 3.1's 386 enhanced mode, the Blue Screen is also displayed when Control-Alt-Delete
is pressed.
In a beta version of Windows 3.1, the screen basically looked the same, but it used a black
background instead of a blue one.
Similar screens
OS/2 and MS-DOS suffered the Black Screen of Death.
Windows 98 and early builds of Windows Vista displayed the red screen a boot loader error.
Stop errors are comparable to kernel panic in OS X, Linux, and other Unix-like systems.
Xbox
Although the Microsoft Xbox usually shows a Green Screen of Death when a critical error
occurs, a model was seen showing a BSOD during the presentation of Forza Motorsport at the
CeBIT computer fair in Hannover in March 2005.
Mac OS X 10.5 Leopard Leopard features a blue screen but not that
of death.
Leopard's blue screen was part of a regular boot process in some situations.
Some users, upgrading from Mac OS X 10.4 Tiger to Mac OS X 10.5 Leopard and having installed
Application Enhancer, experienced a similar experience to a blue screen of death: on booting,
the screen remained blue for an indefinite period of time because Application Enhancer's
framework was not compatible with the new handlers that Leopard included.
However, Apple became aware of the problem and posted a solution.
Nevertheless, Leopard's blue screen was not meant to inform and/or describe an error as
the blue screen is just a consequence of the regular boot process.
In the new Finder sidebar, all Windows PCs connected to the same local network of a Mac
running Leopard are shown with an icon representing an Old CRT monitor displaying the blue screen
of death.
iPhone 5s In September and October of 2013, mainstream
outlets reported iPhone 5s randomly showing a blank blue screen after which reboots occur,
as well as random reboots without a blue screen.
The Verge attributes the blue screen and reboots to iWork, a bundled app of iPhone 5s.
More possible problems for the BSOD are iWork apps, when people multi-task, FaceTime, Safari,
Camera, and when people press the home button.
Another issue could be if one uses an app that isn't made for iOS 7 or that the app
isn't updated to run the new iPhone 5s's 64 bit processor.
References
External links Bug Check Codes
SysInternals BlueScreen Screen Saver v3.2 Original report of RSoD from a Microsoft employee
"PC Stats Beginners Guide: Troubleshoot BSOD