The chain of events leading to the destruction
of Ariane 5's maiden voyage, flight 501, began
well before the launch. When the launch vehicle is
sitting on its launch table, on-board computers
use inertial measurements to make sure the vehicle
knows its exact location on Earth. The rotation
of the Earth and the sway of the vehicle in the
wind must be taken into account so that the
launcher can precisely place its payload in
orbit. Instruments take measurements of the
accelerations the vehicle is experiencing, and the
Inertial Reference System (SRI) computer takes
this information does a few operations on it, and
then passes it to the on-board computer, which
uses it to compute the position of the
vehicle. Once the vehicle lifts off, it
is no longer necessary to compute where the
vehicle is on Earth, but the computers continue to
analyse the data for about forty seconds after
liftoff. This only occurs because it was required
for Ariane 4, from which Ariane 5 inherited its
tried and true SRI units. However, Ariane 5
operates on a different time line and flight path
than did Ariane 4, and the software running the
SRI units on Ariane 5 wasn't changed to take this
into account. This was largely because the SRI
units were believed to be the most reliable parts
of Ariane 5 since they had already been
extensively tested on Ariane 4.
After flight 501 lifted off, the vehicle
experienced accelerations much greater than it did
on the ground. Because the accelerations are much
greater, the numbers used to represent
accelerations in the SRI computers became very
large. About 39 seconds after liftoff, the number
related to horizontal acceleration became so large
that when it was converted from a 64 bit floating
point number to a 16 bit integer so that it could
be passed to the on-board computer, an error
occurred, which caused the SRI computers to shut
down. Ariane 5 is equipped with two SRI units, so
that one can take over if the other fails. In this
case, both units failed in exactly the same way,
so the data received by the on-board computer was
not correct data, but instead a diagnostic pattern
generated by the SRI computers after they had
shutdown.
The on-board computer interpreted the
diagnostic pattern as flight data, and that caused
it to incorrectly command the engine nozzles on
the solid rocket boosters and on the main engine
to deflect as much as possible. For the rocket,
this was like making a very sharp turn in a car
that's moving very fast; the car will roll, or in
Ariane 5's case, large aerodynamic forces caused
the solid rocket boosters to separate from the
main stage. At this point, Ariane 5 did what it
was supposed to; it exploded.
An inquiry into the failure of flight 501 found
the defect in the ADA code that performed the
unprotected type cast, and the larger design
defect that allowed that specific bit of code to
run after Ariane 5 had lifted off. These defects
were fixed, and haven't bothered Arianespace
since.
References
Arianespace,
Ariane 5 Failure - Full Report, 19 July 1996,
http://www.esa.int/htdocs/tidc/Press/Press96/ariane5rep.html
Kunzig, Robert. "Europe's Dream."
Discover,
May 199?: ??.
(Try Discover.com, search the archives for
Arianespace)
Node your homework!