Re: Ariane Failure

[Steve O'Neill <oneils@gbr.msd.ray.com>]

Marin David Condic wrote:
> The software module in question was originally analyzed on Ariane 4 with a
> veiw toward improving speed. They had a shortage of CPU cycles and had
> identified this one module as a major consumer of resources. They changed
> the code to eliminate all the range checking and other "safety features"
> (not at all uncommon in this business) in order to speed it up. This was not
> without analysis that examined the possible valid ranges for various numbers
> and mathematically reasoning about it & coming to the conclusion that any
> values that would possibly generate a hardware overflow error could not be
> in the valid flight path of the Ariane 4 - hence it was likely to be a
> sensor failure and the proper accommodation would be to transfer control to
> the other channel. 

And here was another of the fatal system design flaws that should never
have been made... it seems that this 'other channel' was an *identical*
system which, of course, reacted in the same manner.  Leaving the poor
flight control computer with no valid data.  Ooops!