Update_until calls Update in a loop and later if a partial timestep update is requested. In both cases, Update could return BMI_FAILURE but that error path is not handled.