Blue screen of death

**Blue screen of death** (also known as the **blue screen**, **bug check**, or **Stop error**) is a common name for the screen that occurs during a system crash in Microsoft Windows operating systems. It is shown when the operating system can no longer function safely due to a fatal system error.

## History

### Early versions

Contrary to popular belief, Windows 1.0 and Windows 2.x did not have a crash screen. When early Windows is run on a newer version of MS-DOS, it will print out an "Incorrect DOS version" error message, followed by garbled contents of the memory during the boot before loading into the Windows shell, which is often thought to be a crash screen, however, it is only a bug in the logo code. Whenever Windows did crash, it often resulted in a system hang or the shell returning back into DOS.

A modal dialog for displaying important system messages was first introduced in Windows 3.0 and was mostly used by virtual device drivers in 386 enhanced mode. This was a full screen message in text mode, which suspended Windows until being dismissed by the user. Initially, it used a black background, although Windows 3.1 later changed it to blue. The look of the modal dialog was virtually unchanged through the rest of the classic Windows series.

In Windows 3.x, this was mostly used in situations where a program couldn't continue running until the user resolved an issue, such as device conflicts or disk swaps. However, severe system errors still caused Windows to exit back to MS-DOS, similarly to the older versions. The interface was also used for a simple task manager in Windows 3.1, which could be invoked by pressing `Ctrl`+`Alt`+`Del` while running Windows in the 386 enhanced mode. The task manager allowed the user to terminate an unresponsive program, or if there's no unresponsive programs, simply allow the user to exit the screen or press `Ctrl`+`Alt`+`Del` again to reboot the system. Steve Ballmer wrote the original message for the Task Manager warning.

### Windows 9x

Windows 95 used the modal dialogs to report severe system errors instead of exiting to DOS, which earned it the *blue screen of death* nickname. Windows 9x is unique in that it allows the user to continue after a system error, although it often resulted in an unstable system. The user interface was also used in early Windows 98 builds for ACPI subsystem errors, which notably used a red background instead of blue. Early builds of Windows Me briefly replaced the "It is now safe to turn off your computer" with a blue screen modal dialog at one point.

### Windows NT

On Windows NT, blue screens are also commonly known as STOP errors, referring to the `*** STOP` label that introduces the error code. The first known build to implement a blue screen is the October 1991 build of Windows NT 3.1. Earlier builds merely print the error code to a debugger, if attached, and trigger a breakpoint in an infinite loop. According to John Vert, the developer who originally wrote the code in the NT kernel that was responsible for controlling the screen in text mode, the white-on-blue color was chosen in order to match the MIPS' firmware display, as well as the default color scheme of the SlickEdit text editor many NT developers used at the time.

Initially, a system crash only resulted in the error code being printed out to the screen, although later during Windows NT 3.1 development it was extended to also display the stack trace and a list of loaded drivers and their base addresses. From Windows 2000 build 1796.1 onwards, the message was simplified to only include possible instructions for the user should they encounter the blue screen and now renders in 640x480 graphics mode instead of 80x50 text mode. The font was changed to Lucida Console in Windows XP.

During the development of Windows 8, the blue screen has significantly changed. Around build 7850, the blue screen was updated to support higher resolutions using VBE 2.0 and anti-aliasing. At first, this updated blue screen only appeared if the system crashed at boot, however, by the time of build 7880 it was used for all bug checks. It would be quickly replaced to a more simplified black screen in build 7899, and would remain until build 8045 released with a black screen that would resemble the RTM. The black screen was changed back to the blue color in build 8064.

The Japanese version of Windows 8 and later doesn't have the sad emoticon on the BSOD, unlike other languages. The BSOD in Windows Server 2012 and later also lacks a sad face.

In Windows 10 build 14316.1000, a QR code was added to the blue screen, linking to Microsoft's website for diagnosing blue screen errors. Windows 10 build 14993 changed the color and wording of the bug check screen to green for insider builds in order to be able to quickly distinguish between Insider and production build bug reports.

In Windows 10 version 2004 and above, the wording was changed from "Your PC ran into a problem" to "Your device ran into a problem", but otherwise, the layout stays the same.

## Implementation

In classic Windows, the blue screen is implemented by the `SHELL_SYSMODAL_Message` routine in the Shell VxD. The routine temporarily halts the system and then proceeds to tell the display driver to switch the display to text mode. It sets the background and foreground color, clears the screen and displays the message. It then waits for a valid keypress before switching back to graphics mode and resuming operation. On Windows 9x, it is most commonly called from `VWIN32_BlueScreenPopup` in `VWIN32.VXD`, which displayed the infamous message about an exception that has occurred.

The blue screen on NT-based systems is implemented in the `KeBugCheck` and `KeBugCheckEx` functions, which are contained in the kernel executable. The difference between the two functions is that the former accepts only the bugcheck code as an integer parameter, while the latter also accepts four more integers as bugcheck parameter codes, which can have different meaning depending on the bug check code. A component running in kernel mode can call either function to bring the system down in controlled manner if it detects a fatal uncorrectable error that can lead to data corruption. The respective function then takes care of switching to a compatible video mode, rendering the blue screen itself, saving a memory dump, and, if enabled, restarting the system. User mode processes can also trigger a bug check if they hold the shutdown privilege by using the `NtRaiseHardError` system call in `ntdll.dll` with the `OPTION_SHUTDOWN_SYSTEM` flag, which transitions the system to kernel mode and then triggers a `FATAL_UNHANDLED_HARD_ERROR` bug check.

## Gallery

### Classic Windows

Windows 3.0.55 Swap File Warning.pngCorrupt swap file warning in Windows 3.0 build 55Windows31-3.1.043e-CtrlAltDelWarning.pngTask Manager warning in Windows 3.1 build 043eWindows31Build68TaskManWarning.PNGTask Manager warning in Windows 3.1 build 068Windows31-RTM-TaskManagerWarning.pngTask Manager warning in Windows 3.1Windows-ME-4.90.3000-Crash.pngSystem crash in Windows 95, Windows 98 and Windows Me
### Windows NT

WindowsNT31-October1991-BSOD.pngSystem crash in the October 1991 build of Windows NT 3.1WindowsNT3.1-3.1.340-BSOD.pngSystem crash in Windows NT 3.1 build 340.1WindowsNT35-3.5.782-BSOD.pngSystem crash in Windows NT 3.1, Windows NT 3.5x, and Windows NT 4.01631.1 - BSOD.pngSystem crash in Windows 2000 build 1631.1Windows2000-5.0.1796.1-stoperror.pngSystem crash in Windows 2000 build 1796.1 (note the black background and gray text)Windows2000-5.0.1848-BSOD.pngSystem crash in Windows 2000 build 1835.1 (note the darker text)Win2000BSoD.PNGSystem crash in Windows 2000System crash in Windows XPWindowsVistaBSOD.pngSystem crash in Windows Vista and 77880-crash.pngSystem crash in Windows 8 build 78807899-bsod.pngSystem crash in Windows 8 builds 7899 to 8032Windows8-6.2.8056-BSOD.pngSystem crash in Windows 8 build 8045 and 8056Windows8-6.2.8102-BSOD.pngSystem crash in Windows 8 build 8064 and 8102.101WindowsServer2012-6.2.8250-BSOD.pngSystem crash in Windows Server 2012 build 8250Windows8-RTM-BSOD.pngSystem crash in Windows 8, Windows 8.1, and Windows 10 versions 1507 (RTM) and 1511Win10-1607bsod.pngSystem crash in Windows 10 versions 1607 to 1909Win10GSOD.pngSystem crash in most Insider Preview builds since build 14993
## References

1. ↑ https://devblogs.microsoft.com/oldnewthing/20140909-00/?p=44123
2. ↑ https://devblogs.microsoft.com/oldnewthing/20140902-00/?p=93
3. ↑ https://devblogs.microsoft.com/oldnewthing/20140910-00/?p=44113
4. ↑ https://www.quora.com/Who-designed-the-original-Windows-Blue-Screen-of-Death
5. ↑ https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-kebugcheck
6. ↑ https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-kebugcheckex