Blue Screens Of Death

The blue screen of death (BSoD) or blue screen error, blue screen, fatal error, bugcheck, and officially known as a stop erroris a critical error screen displayed by the Microsoft Windows operating systems to indicate a system crash, in which the operating system reaches a critical condition where it can no longer operate safely.

The name comes from the blue colored background used predominately on the error screens found in the majority of Windows releases. Possible issues contributing to a BSoD may include hardware failures, an issue with or without a device driver, viruses, malware, and other factors such as intentional user action.

__TOC__

History

Blue screen errors have been around since the very first version of Windows in 1985. In the Beta Release of Windows 1.0, if it detected a version of DOS that is newer than the OS expects, the boot screen would have the text "Incorrect DOS version" alongside other messages detailing what check failed to pass appended into it before starting normally. This behavior remains in the final version released to retail (version 1.01), however the remaining text messages were removed during development in the lead up to Windows 1.0's release, displaying mojibake instead. Contrary to popular belief, this is not a system crash screen; when the operating system actually crashed, it either freezes or unexpectedly exits to DOS. This behavior was retained in Windows 2.0 and Windows 2.1.

Windows 3.0 uses a text-mode screen for displaying important system messages, usually from digital device drivers in 386 Enhanced Mode or other situations where a program could not run. Windows 3.1 changed the color of this screen from black to blue. It also displays a blue screen when the user presses the Ctrl+Alt+Delete key combination to bring up a rudimentary task manager, reserved for quitting any unresponsive programs if they are available. Like previous versions of Windows before 3.0, Windows 3.x exits to DOS if an error condition is severe enough.

The first BSoD to indicate a critical system error appeared in Windows NT 3.1 (the first version of the Windows NT family, released in 1993). The error screens initially started with *** STOP: in its earlier iterations, hence it became known as a "stop error." This format was used on all Windows operating systems released afterwards, with various differences in later versions. Despite popular belief, there are no known genuine equivalents of a BSoD in the Windows Embedded Compact (formerly known as Windows CE) line of embedded operating systems.

BSoDs can be caused by poorly written device drivers or malfunctioning hardware, such as faulty memory, power supply problems, overheating of components, or hardware running beyond its specification limits. In the Windows 9x line of operating systems, incompatible DLLs or bugs in the operating system kernel could also cause BSoDs. Because of the general instability and lack of memory protection in Windows 9x, BSoDs were much more common.

Attribution

On September 4, 2014, several online journals such as ''Business Insider'', ''DailyTech'', ''Engadget'', ''Gizmodo'', ''Lifehacker'', ''Neowin'', ''Softpedia'', ''TechSpot'', ''Boy Genius Report'' (''BGR''), ''The Register'', and ''The Verge'', as well as print and non-English sources like ''PC Authority'' and Austrian tech site ''FutureZone'' all attributed the creation of the Blue Screen of Death to Steve Ballmer, the former CEO of Microsoft. The articles specifically cited a blog post by Microsoft employee Raymond Chen entitled "Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?", which focused on the creation of the first rudimentary task manager in Windows 3.x. The aforementioned task manager shared some visual similarities with a BSOD, with Ballmer writing the messages that appeared on the screen.

Chen took notice of the widespread misinformation and addressed the issue himself in a blog post on September 9, 2014. According to Chen, he was scathing on his evaluation of major tech news sites that had picked up on the incorrect story and performed poor or non-existent research that demonstrated complete ignorance of his original account. He indicated that, in addition to the faulty base story, over half a dozen significant sites had included other embellished or invented details in their stories, including incorrectly naming Chen as a Microsoft executive, treating Chen as an "official company spokesperson", and using unrelated images from Windows NT or Windows 95 as illustrations. In addition, he also pointed out a very special mention for the worst single distortion out of any misinformations, which belonged to ''BGR'' (Boy Genius Report), who "fabricated a scenario and posited it as real" in a rhetorical question to readers. He also found that several sources had conflated the creation of the BSoD with the fact that they occur, thus inverting cause and effect by implying that the invention of BSoDs ''caused'' fatal errors to occur instead of their actual, helpful function of giving the user information about a fatal error ''after'' the system has already become unrecoverable (such incorrect sources transitively blamed Ballmer for the existence of all fatal crashes in Windows). A day after his initial complaint, Chen would follow this up with another blog post on September 10, 2014, claiming responsibility for revising the BSoD in Windows 95. His post said in detail that he was the one who "sort of" created the BSoD in its first modern incarnation in Windows 95.

According to former Microsoft employee Dave Plummer, the BSoD in the Windows NT family was not based on the rudimentary task manager screen of Windows 3.x, but was actually designed by Microsoft developer John Vert. Additionally, Vert has also stated the reason why the error screens were given the color blue was because the universal color palette of the video hardware at that time was very rudimentary, and he personally used a MIPS OS box and SlickEdit for programming so that both the firmware and editor displayed white text on a blue background, making for a more consistent programming experience.

Formats

BSoDs originally showed silver text on a royal blue background with information about current memory values and register values. Starting with Windows Server 2012 (released in September 2012), Windows adopted a cerulean background. Earlier versions of Windows 11 used a black background, which was changed to dark blue starting with build 22000.348 and then back to black with build 26120.3653. Preview builds of Windows 10, Windows 11, and Windows Server (available from the Windows Insider program) feature a dark green background instead of a blue one. Windows 3.1, 95, and 98 supports customizing the color of the screen whereas the color is hard-coded in the Windows NT family.

Windows 95, 98, and Me render their BSoDs in the 80×25 text mode with a 720×400 screen resolution. BSoDs in the Windows NT family initially used the 80×50 text mode with a 720×400 screen resolution, but changed to use the 640×480 screen resolution starting with Windows 2000 up to 7. BSoDs on Windows 8 and Windows Server 2012 are rendered in higher resolutions than previous versions of Windows, where it uses the highest screen resolution available on UEFI machines. On legacy BIOS machines, they use the 1024×768 resolution by default, but they can also be configured to use the highest resolution available (via the 'highestmode' parameter in Boot Configuration Data). Windows 95, 98, Me, and NT versions prior to Windows 2000 used text mode fonts provided by the graphics adapter, Windows 2000 used its built-in kernel mode font, Windows XP, Vista, and 7 use the Lucida Console font, and Windows 8 and Windows Server 2012 onwards use the Segoe UI font.

Windows 10 builds 14316 and up uses the same format as Windows 8, but has a QR code which leads to a Microsoft Support web page that tries to help users troubleshoot the issue step-by-step. This format was retained in Windows 11, however build 26120.3653 changes the layout to be more consistent with that of Windows 11's UI, removing the QR code among other changes.

Windows NT

In the Windows NT family of operating systems, the blue screen of death (referred to as "bug check" in the Windows software development kit and driver development kit documentation) occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This is usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation is to restart the computer. Because of this, data loss may occur since the restart is unplanned, and the user is not given an opportunity to save their work.

The text on the error screen contains the code of the error and its symbolic name (e.g. "0x0000001E, KMODE_EXCEPTION_NOT_HANDLED") along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. By default, Windows will create a memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which is effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows, WinDBG or KD debuggers from Debugging Tools for Windows are used. A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen is limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP is configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error.

Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. If a stop error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

A BSoD can also be caused by a critical boot loader error, where the operating system is unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation is STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there is no memory dump saved. Since the system is unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.

Details

Earlier versions (NT, 2000, XP, Vista, 7)

BSoDs in the Windows NT family before the release of Windows 8 and Windows Server 2012 displayed the error name in uppercase (e.g. APC_INDEX_MISMATCH) and its respective hexadecimal error number (e.g. 0x00000001), along with four parameters. This is shown together in the following format:

Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, starting with Windows 2000 onwards, the error screens showed up to four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses.

In rare cases, the BSOD would be truncated, sometimes not showing the error name, codes, or the four paragraphs of advice. Instead, it would often show different formats of the error screen depending on the type of error that occurred. For instance, BSoDs related to the termination of the Winlogon process (e.g. "0xC000021A, WINLOGON_FATAL_ERROR") displayed the following message in this format:

On Windows 2000, the above message is sometimes displayed alongside the four paragraphs of general instructions and advice, the latter of which are absent on Windows XP to Windows 7.

Another example is that when Windows finds a corrupt registry file that is critical to the operating system (e.g. "0xC0000218, STATUS_CANNOT_LOAD_REGISTRY_FILE"), it would display the following message:

Also, hardware errors that can prevent Windows from booting properly will also display this rare message (This example is 0x00000080 (NMI_HARDWARE_FAILURE); note that the error code is not shown in this example below):

Additionally, when the system is performing a memory dump on the BSoD, the following message is displayed after the memory dump is done (after the "Physical memory dump complete" sentence):

From Windows XP to Windows 7, the layout of the BSoD was slightly altered, specifically the hexadecimal error number and the four parameters were moved to the bottom of the screen after the four paragraphs under the label "Technical information:". The error screens also began with the following infamous message:

On BSoDs with error code 0x000000F4 (CRITICAL_OBJECT_TERMINATION), which determines that a critical process has been exited or terminated unexpectedly by various factors (including intentional action by the user), the following message would be displayed in place of the error name:

Additionally, on 64-bit versions of Windows XP, Vista and 7, the BSoD would oftentimes have the four parameters extended, where the parameters are extended to about 16 characters long ("0x0000000000000000") instead of 8 ("0x00000000"). This applies to all future versions of Windows using the 64-bit architecture.

Later versions (Server 2012 and 8 onwards)

With the release of Windows 8 and Windows Server 2012, the BSoD was changed. It removed all of the above in favor of the error name and a concise description. Windows 8 also adds a sad emoticon to the error screen, which is absent from Japanese releases or its Windows Server counterparts. The hexadecimal error code and parameters can still be found in the Windows Event Log or in memory dumps, however some BSoDs which used a truncated format from previous BSoDs such as those relating to Winlogon termination may have the aforementioned hexadecimal error code in place of the error name. Hardware errors causing an BSoD also uses the same format as the normal BSoD, including the use of the error name instead of an error code. One such example are BSoDs with the error name "NMI_HARDWARE_FAILURE" (error code 0x00000080).

This format was retained in Windows 10 and Windows 11 (as well as its Server counterparts). Windows 10 build 14316 adds a QR code to the screen for quick troubleshooting, and all references to "PC" were changed to the word "device" starting from Windows 10 v2004 onwards. The BSoD was once again changed starting with Windows 11 build 26120.3653, which included the removal of the QR code and the sad emoticon from the error screen as well as changes to the layout to be more consistent with that of Windows 11.

Windows 9x

The Windows 9x line of operating systems used the Blue Screen of Death as the main way for virtual device drivers to report errors to the user. This version of the BSoD, internally referred to as "_VWIN32_FaultPopup", gives the user the option either to restart the computer or to continue using Windows, allowing the user to save their work before any data could be lost. Depending on the type of situation it may have occurred, however, the options to either continue or restart may or may not work at all. This is in contrast to the Windows NT version of BSoDs, which prevented the user from using the computer until it has been powered off or restarted (usually automatic for the latter).

The most common BSoD is displayed on an 80×25 text-mode screen, which is the operating system's way of reporting an interrupt caused by a processor exception; it is a more serious form of the general protection fault dialog boxes. The memory address of the error is given and the error type is a hexadecimal number from 00 to 11 (0 to 17 decimal). The error codes are as follows:
* 00: Division fault
* 01: Startup Error
* 02: Non-Maskable Interrupt
* 03: Shutdown Error
* 04: Overflow Trap
* 05: Bounds Check Fault
* 06: Invalid Opcode Fault
* 07: "Coprocessor Not Available" Fault
* 08: Double Fault
* 09: Coprocessor Segment Overrun
* 0A: Invalid Task State Segment Fault
* 0B: Not Present Fault
* 0C: Stack Fault
* 0D: General Protection Fault
* 0E: Page Fault
* 0F: Error Message Limit Exceed
* 10: Coprocessor Error Fault
* 11: Alignment Check Fault

Reasons for BSoDs include:
* Problems that occur with incompatible versions of DLLs: Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed. It is one of the many reasons why some people said that a clean install of Windows is more stable than an "old" one (or an in-place upgrade).
* Faulty or poorly written device drivers.
* Hardware incompatibilities.
* Damaged hardware may also cause a BSoD.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con", "c:\aux\aux", or "c:\prn\prn" on the hard drive. This could be inserted on a website to crash visitors' machines as a prank. In reality, however, they are reserved device names for DOS systems; attempting to access them from Windows causes a crash, which in turn brings up said BSoD. Creating the aforementioned directories within Windows will also not work and may cause the same BSOD to occur. On March 16, 2000, Microsoft released a security update to resolve this issue.

One famous instance of a Windows 9x BSoD occurred during a presentation of a Windows 98 beta given by Bill Gates at COMDEX on April 20, 1998: The demo PC crashed with a BSoD when his assistant, Chris Capossela, connected a scanner to the PC to demonstrate Windows 98's support for Plug and Play devices. This event brought thunderous applause from the crowd and Gates replied (after a nervous pause): "That must be why we're not shipping Windows 98 yet."

Similar screens

Stop errors are comparable to kernel panics in macOS, Linux, and other Unix-like systems, and to bugchecks in OpenVMS.

A black screen of death can occur upon hardware or software failures. Windows 3.1 displays a black screen of death instead of a blue one. Some versions of macOS (notably OS X Lion) display a black screen of death instead of a kernel panic, usually pointed to a graphics card or sleep/wake issue, it may also display a black screen when the operating system fails to boot properly. The Xbox series of consoles (which includes the original Xbox, Xbox 360, Xbox One and the Xbox Series X/S) also display a black screen when a hardware or software error occurs.

In some cases, a differently-colored error screen is used. Beta versions of Windows 98 display a red error screen raised by the Advanced Configuration and Power Interface (ACPI) when the host computer's BIOS encounters a problem. The bootloader of the first beta version of Windows Vista originally displayed a red screen background in the event of a boot failure, which was changed to black afterwards. As mentioned earlier, the insider builds of Windows 10 and later, as well as Windows Server 2016 and later, display a green screen instead of blue. Windows 10 and later (and Windows Server 2016 and later) also display an orange screen in an extremely rare case where a hardware issue with the GPU or a graphics driver problem is encountered.

ReactOS, an open-source operating system designed to achieve binary compatibility with Windows, implements a version of the Blue Screen of Death similar to that used in Windows NT operating systems. systemd, a software suite providing system components for Linux operating systems, also implements a version of the Blue Screen of Death similar to that of Windows, albeit not as a replacement to the kernel panic in Linux (see above), but rather was used in the event of a bootup failure. This iteration uses systemd-bsod, which was added on December 6, 2023 starting with version 255 of systemd.

See also

* Screen of death
** Guru Meditation
** Kernel panic
** Purple Screen of Death
** Sad Mac
** Black screen of death
* Red Ring of Death
* Hang (computing)
* Machine-check exception (MCE)
* Windows Hardware Error Architecture (WHEA)

References

External links

Bug Check Code Reference

SysInternals BlueScreen Screen Saver v3.2

Blue Screen of Death
on MalWiki.

{{Error messages

Computer errors
Windows administration
Screens of death