The Rocket That Lasted 37 Seconds
01:37 · Point of failure
On 4 June 1996 the first Ariane 5 was destroyed less than a minute into its maiden flight. An alignment routine inherited from Ariane 4, with no purpose once the rocket left the pad, converted a horizontal velocity value too large for a 16 bit integer, and the backup unit ran the same software and had already failed the same way.
Editions
- Watch
- The episode on YouTube2:05
- Read
- The technical debrief on ZOF.aizof.ai
Incident
- Topics
- integer overflow · code reuse · redundancy · assumptions
- Point of failure
- An alignment routine that served no purpose after liftoff was kept for commonality with Ariane 4, and its conversion was never checked against a trajectory that built horizontal velocity five times faster.
Transcript
The maiden flight
Europe spent a decade building its new rocket. It flew for thirty seven seconds. The bug had been asleep in the code for years. This is The Point of Failure, episode sixteen.
Inherited software
June 4th, 1996. Ariane 5 lifts off for the first time. Inside its guidance system runs software inherited from its little brother, Ariane 4, software with a flawless record across dozens of flights. Why rewrite what works?
The number that stopped fitting
Because Ariane 5 is not its brother. It is bigger, and it flies a steeper, faster climb. And deep in that inherited code, one routine converts a large 64 bit number, tied to horizontal velocity, into a small 16 bit box. On Ariane 4, the number always fit. On Ariane 5's trajectory, thirty seconds in... it does not.
An echo, not redundancy
The guidance unit fails. No problem, there is a backup. Except the backup runs the exact same software... and died the same death milliseconds earlier. Two copies of the same mistake is not redundancy. It is an echo.
Gibberish read as commands
The broken units spit out diagnostic data, and the flight computer reads that gibberish as steering commands. The nozzles slam sideways. The rocket lurches, the airframe starts to tear, and the self destruct does its job. Thirty seven seconds. Around three hundred seventy million dollars. Four science satellites, gone in the fireball.
Work it did not need done
Point of failure
The cruelest detail: the routine that overflowed had no function after liftoff at all. It was legacy alignment code, left running because it always had. The most expensive software failure of its era was work the rocket did not even need done.
Every failure has a story. Every story was preventable. I'm Kevin. See you at the next one.
Sources
ARIANE 5 Flight 501 Failure Report by the Inquiry Board
The board's clock starts at the main engine ignition command and liftoff follows 7.5 seconds later, so the guidance loss at 37 seconds is 30 seconds after liftoff. It attributes the overflow to Ariane 5 building horizontal velocity about five times more rapidly than Ariane 4, and records no such failure on Ariane 4 flights using the same system. The document is a scan without a text layer.
PR 33-1996: Ariane 501 - Presentation of Inquiry Board report
Carries the inquiry board's conclusion in readable form, including that the alignment function served a purpose only before liftoff but remained operative afterwards.
Ariane-5: Learning from Flight 501 and Preparing for 502
Most elements of the four satellites were recovered from the ground east of the launch pad, and none was still flightworthy.
The Resurrection of the Cluster Scientific Mission
No agency published a valuation of the loss. ESA put the predicted cost of rebuilding the four satellites to the original design at 351 million accounting units, which is a rebuild estimate and excludes the launcher.
Design by Contract: The Lessons of Ariane
Calls the error possibly the costliest in history in dollar terms, and attributes the half a billion dollar figure to media reports rather than to an agency. Its description of the conversion differs from the inquiry board's; the mechanism above follows the board.
The ten years and the 7 billion dollars are the cost of the development programme, not of the flight that was lost.
Related
- 03
The Song That Broke YouTube's Math
Gangnam Style's view count approached the maximum value of a signed 32-bit integer. YouTube widened the counter before it overflowed, a friendly example of a failure mode that is much less friendly in systems that cannot be patched in time.
- 18
The Bank That Lost Its Customers' Money for a Month
In June 2012 an upgrade to the batch scheduler at RBS was backed out along a path nobody had tested, and the two versions turned out to be incompatible. Jobs stopped reaching the overnight queues, the backlog compounded night after night, and at least 6.5 million customers of RBS, NatWest and Ulster Bank lost reliable access to their money, some of them for weeks.
- 14
The Power Cut in Ghana That Saved Global Shipping
On 27 June 2017 the NotPetya malware destroyed Maersk's global network within minutes, including every domain controller. As Wired reported, one copy survived in the company's Ghana office, offline after a power cut, and it seeded a rebuild the company put at about ten days.