Software Design (CSC-223 97F)

[News] [Basics] [Syllabus] [Outlines] [Assignments] [Studies] [Examples] [Readings] [Projects] [API]

The Ariane 5 Failure

Summary: The first mission of the ESA's Ariane 5 failed about 40 seconds into the flight. The problem was traced to a software failure which persisted in spite of

Source: Lions, J.L. et al. (1996). "Report by the Inquiry Board on the Ariane 5 Flight 501 Failure."



The Ariane 5 launcher was the fifth (I think) in a series of rocket launcher designs produced by the ESA (European Space Agency). About 40 seconds into its initial flight, it failed. In particular, it followed a normal flight path until about 37 seconds after launch. It then suddently veered off of its flight path, broke up, and exploded.

What went wrong? According to the general description in the report,

Initial Considerations

Suppose that you were requested to develop a key system for a rocket.


The Ariane 5 keeps track of its attitude and movements through an Inertial Reference System. To protect for failure, the launcher has two identical inertial reference systems, both of which are working, but only one of which is active.

The software for the inertial reference systems is written in Ada, a language that permits more robust code through the use of exception handlers (or variants thereof). Much of the code for the inertial reference systems had appropriate error checking. The parts that didn't had gone through an analysis as to their posible values.

The inertial reference system software for the Ariane 5 was "practically the same" as that used successfully on the Ariane 4.

A design decision was made that when an inertial reference system failed, a number of steps should be taken:

The Failure

What went wrong? A routine in the inertial reference system used only during take off continued to run for another forty or so seconds, and then failed. The failure stopped the two inertial reference systems, as per the design above. (Yes, it was part of the design of the system that it continued to run. Why? For the Ariane 4, this permitted interrupts in the count-down without significant realignment time.)

How did it fail? It attempted to convert a 64 bit floating point number to a 16 bit signed integer. Unfortunately, the floating point number was too big. (Yes, this had been identified as a potential trouble spot, but hand analysis in the initial design of the software showed that it would never happen, at least in the Ariane 4.)

Given that most components of space systems undergo thorough testing, why was this failure allowed? While the hardware for the inertial reference system was tested, and the software was shown to meet specifications, the full inertial reference system was never tested. (It was deemed both inappropriate and too expensive to test the inertial reference system. The specifications for the software had originally been for the Ariane 4, and did not take the acceleration of the Ariane 5 into account.)


These are the verbatim recommendations of the inquiry board

[News] [Basics] [Syllabus] [Outlines] [Assignments] [Studies] [Examples] [Readings] [Projects] [API]

Disclaimer Often, these pages were created "on the fly" with little, if any, proofreading. Any or all of the information on the pages may be incorrect. Please contact me if you notice errors.

Source text written by Samuel A. Rebelsky.

Source text last modified Fri Sep 5 12:31:49 1997.

This page generated on Fri Oct 17 09:04:48 1997 by SamR's Site Suite.

Contact our webmaster at