Test Thrice, Launch Once:                 Arian 5 disaster        

The Failure

On June 4, 1996 an unmanned satellite-deploying rocket Ariane 5 was launched in Kourou at 1233 GMT. After about 40 seconds into the flight, the self-destruct of the space rocket was triggered. This was done in accordance with safety regulations due to the rupture of the links between the boosters and the main core stage of the rocket, caused by a dramatic change in direction that had taken place roughly 3 seconds earlier. The rocket was carrying four satellites that were going to be sent into orbit to monitor the sun. Ariane 5 was the result of a £5 billion launcher development by the ESA (European Space Agency), and the explosion itself destroyed the rocket and its payload, at a total cost of £500 million.

The Cause of the Failure

The origin of the failure was narrowed down to the Flight Control System, and more particularly, to the Inertial Reference System (SRI). To investigate the cause of the failure the European Space Agency (ESA) appointed an independent board.

The following chain of events was established:

• First 36 seconds of the flight were normal.
• At H0+36.7 active SRI declared an operand error. The reason was a software exception, caused by the data conversion from a 64-bit floating-point number to 16-bit signed integer. That conversion can only be applied to a number less than 216, but was applied to a greater number, representing the horizontal velocity of the craft.
• On-board computer received from SRI a diagnostic bit pattern, which it tried to interpret as a flight data. The reason why on-board computer could not switch to the back up SRI was that it already shut down for the very same reason as active SRI. And, of course, it would. It was running the very same software as an active SRI.
• After receiving a fault report from the SRI, on-board computer considering that to be a proper flight data and realising an unexpected course change, sends a command to the solid booster nozzles and the main engine nozzles, to deflect into the utmost position.
• That led to high aerodynamic loads resulting from an angle of attack of more than 20 degrees. The launcher began to disintegrate at about H0+39 seconds, which led to separation of the booster from the main stage, triggering the self-destruct system.

So, the software for the SRI had been ported from the previous generation rocket Ariane 4. And why not? It worked fine. However, what software engineers did not consider, was that the horizontal velocity of the Ariane 5 have been up to five times faster than that of Ariane 4. Nevertheless, the SRI supplier can not be held responsible for that. It was provided with certain specifications – in the event of detected exception, the failure should be reported to the on-board computer, error context should be stored in an EEPROM memory, and the processor was to be stopped – which were successfully met. It was jointly decided not to include in the SRI requirements and specification the actual Ariane 5 trajectory. That error-handling mechanism proved to be fatal.

The board of enquiry that was set up after the incident to research and report their finding on the incident, has made a suggestion. They say that the SRI should have continued to provide its ‘best estimate’ of the craft’s attitude after the software exception has occurred. If the SRI had done this, it should have performed the conversion of the floating point number, if it was

Insufficient budget and an easy and tempting way out pushed the designers to take a shortcut and reuse the perfectly working module. The money saved – boom – the money lost.

References

• James Gleick Internet site (1996) “A Bug and a Crash”

web address: http://www.around.com/ariane.html.

• Naval Postgraduate Schools (Systems Technology Battle Lab) Internet site (1998) “Software Bug Crashes European Rocket, Ariane 5”

web address: http://stl.nps.navy.mil/~josmund/SWBug/SWBug.htm.

• European Space Agency Internet site (1997) “Official Report from the Inquiry Board: Ariane 5, Flight 501 Failure”

web address: http://www.esrin.esa.it/htdocs/tidc/Press/Press96/ariane5rep.html.

• Jezequel, J-M. (1997) Institut de Recherche en Informatique et Systemes Aleatoires Internet site “Put it in the contract: The lesson of Ariane”

web address: http://www.irisa.fr/pampa/EPEE/Ariane5.html

• The Radio Amateur Satellite Corporation Internet site (1996) “Ariane 501 Inquiry Board Reports”

web address: http://www.amsat.org/amsat/amsat-na/press/news9604.html.

• CNN Inc. Internet site (1996) “Unmanned European rocket explodes on first flight”

web address: http://www.cnn.com/WORLD/9606/04/rocket.explode/

• Mathematics Department, University of Florida Internet site (1996) “Inquiry Board Traces Ariane 5 Failure to Overflow Error”

web address: http://www.math.ufl.edu/~cws/3114/ariane-siam.html