Test Thrice, Launch Once: Arian 5 disaster.

Authors Avatar

Test Thrice, Launch Once:                 Arian 5 disaster        

The Failure

On June 4, 1996 an unmanned satellite-deploying rocket Ariane 5 was launched in Kourou at 1233 GMT. After about 40 seconds into the flight, the self-destruct of the space rocket was triggered. This was done in accordance with safety regulations due to the rupture of the links between the boosters and the main core stage of the rocket, caused by a dramatic change in direction that had taken place roughly 3 seconds earlier. The rocket was carrying four satellites that were going to be sent into orbit to monitor the sun. Ariane 5 was the result of a £5 billion launcher development by the ESA (European Space Agency), and the explosion itself destroyed the rocket and its payload, at a total cost of £500 million.

The Cause of the Failure

The origin of the failure was narrowed down to the Flight Control System, and more particularly, to the Inertial Reference System (SRI). To investigate the cause of the failure the European Space Agency (ESA) appointed an independent board.

The following chain of events was established:

  • First 36 seconds of the flight were normal.
  • At H0+36.7 active SRI declared an operand error. The reason was a software exception, caused by the data conversion from a 64-bit floating-point number to 16-bit signed integer. That conversion can only be applied to a number less than 216, but was applied to a greater number, representing the horizontal velocity of the craft.
  • On-board computer received from SRI a diagnostic bit pattern, which it tried to interpret as a flight data. The reason why on-board computer could not switch to the back up SRI was that it already shut down for the very same reason as active SRI. And, of course, it would. It was running the very same software as an active SRI.
  • After receiving a fault report from the SRI, on-board computer considering that to be a proper flight data and realising an unexpected course change, sends a command to the solid booster nozzles and the main engine nozzles, to deflect into the utmost position.
  • That led to high aerodynamic loads resulting from an angle of attack of more than 20 degrees. The launcher began to disintegrate at about H0+39 seconds, which led to separation of the booster from the main stage, triggering the self-destruct system.
Join now!

Analysis of the Failure

The primary technical causes of the failure are the operand error, occurred in the conversion of the horizontal velocity, and the lack of protection of this conversion, which caused the SRI to shut down. And this is on top of that the SRI operation was not needed at that stage of the flight.

SRI measures the variable of relative heading of the launcher and its movements in space. It has its own computer, which transmits the converted data through the data bus to the OBC, which in turn controls the movements of the solid booster ...

This is a preview of the whole essay