Ariane 5 launcher failure

The Ariane 5 Launcher Failure
Ian Sommerville

Ariane launcher failure, Case study, 2013

Slide 1

June 4th 1996
Total failure of the Ariane 5
launcher on its maiden flight


Slide 2

Ariane 5
• A European rocket designed to
launch commercial payloads
(e.g.communications satellites, etc.)
into Earth orbit
• Successor to the successful Ariane
4 launchers

Slide 3


Slide 4

• Ariane 5 can carry a heavier payload
than Ariane 4
• Now the standard launch vehicle for the
European Space Agency


Slide 5


Slide 6

Launcher failure
• First test launch of Ariane 5 in June
1996
• Appoximately 37 seconds after a
successful lift-off, the Ariane 5 launcher
lost control


Slide 7


Slide 8

• Incorrect control signals were sent to the
engines and these swivelled so that
unsustainable stresses were imposed on
the rocket
• The vehicle started to break up because
of the stresses imposed and selfdestructed

Slide 9

The problem
• The attitude and trajectory of the
rocket are measured by a
computer-based inertial reference
system.

• The IRS transmits commands to the
engines to maintain attitude (the
angle to the vertical) and direction

Slide 10

• The system failure was a direct result of
a software failure.
• However, it was symptomatic of a more
general systems validation failure


Slide 11

Sensors

IRS 1

IRS 2

Instructions to engine control system

Slide 12

• The IRS had both a primary and a
backup computer
• The backup computer was included to
cope with hardware failure but both the
primary and the backup system ran the
same software.

Slide 13

• The IRS software in both the primary and the backup
computer shut itself down 37 seconds after take-off

• Diagnostic data about the shutdown was sent to the
engine control system
• This system did not expect such data and interpreted
these as real data
•

The values were such that the system swivelled the
rocket engines to an extreme position


Slide 14

Software failure
• Software failure occurred when an
attempt to convert a 64-bit floating point
number representing the horizontal
velocity to a signed 16-bit integer caused
the number to overflow (become too
big).

Slide 15

0 111111111111111
Sign


16-bit integer

Max value (32768)

Slide 16

• There was no exception handler associated with the
conversion so the system exception management
facilities were invoked. These shut down the software
controlling the IRS.

• Redundant but not diverse software
• The backup software was a copy and behaved in
exactly the same way i.e. the number overflowed and
the system was shut down


Slide 17

Avoidable failure?
• The software that failed was reused from
the Ariane 4 launch vehicle. The
computation that resulted in overflow
was not used by Ariane 5.
• The calculations had been transferred to
a ground-based system in Ariane 5

Slide 18

Implementation decisions
• Decisions were made
– Not to remove the facility as this could introduce
new faults
– Not to test for overflow exceptions because the
processor was heavily loaded.
– For dependability reasons, it was thought desirable
to have some spare processor capacity

Slide 19

Why not Ariane 4?
• The physical characteristics of Ariane 4 (A smaller
vehicle) are such that it has a lower initial acceleration
and build up of horizontal velocity than Ariane 5
• The value of the variable on Ariane 4 could never
reach a level that caused overflow during the launch
period.
• This calculation had been carried out during the
development of Ariane 4 and it was therefore decided
that no overflow check was required

Slide 20

Validation failure
• As the facility that failed was not required
for Ariane 5, there was no requirement
associated with it.
• As there was no associated requirement,
there were no tests of that part of the
software and hence no possibility of
discovering the problem.

Slide 21

Simulator-based testing
• During system testing, simulators of the
inertial reference system computers
were used.

• These did not generate the error as
there was no requirement for the unused
code to be included in the simulator

Slide 22

Review failure
• Review failures?

• The inertial reference system software was not
reviewed because it had been used in a previous
version
• The review failed to expose the problem or that the
test coverage would not reveal the problem
• The review failed to appreciate the consequences of
system shutdown during a launch

Slide 23


Slide 24

Lessons learned
• Don’t run software in critical systems unless it is
actually needed
• As well as testing for what the system should do, you
may also have to test for what the system should not
do
• Do not have a default exception handling response
which is system shut-down in systems that have no
fail-safe state

Slide 25

Lessons learned
• In critical computations, always return best effort
values even if the absolutely correct values cannot be
computed
• Wherever possible, use real equipment and not
simulations
• Improve the review process to include external
participants and review all assumptions made in the
code

Slide 26

Ariane 5 launcher failure

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (20)

Similar a Ariane 5 launcher failure

Similar a Ariane 5 launcher failure (20)

Más de sommerville-videos

Más de sommerville-videos (10)

Último

Último (20)

Ariane 5 launcher failure