Re: Ariane5 FAQ

["Robert I. Eachus" <rieachus@attbi.com>]

Vinzent Hoefler wrote:

> Ok, so change the entire brake controller. ;-) What reason makes you
> think, it will work?

A better example would be to take a brake system from a car and put it 
into a truck.  But the box for the brake system was labeled "for MVW up 
to 5,000 pounds," and it is a 2 1/2 ton truck.

This is what you have to keep the focus on.  The problem was not that 
the engineers for the Ariane 4 inertial guidance system didn't do their 
job perfectly, or that the engineers for the Ariane 5 didn't do their 
jobs correctly.  Management put a box on the org chart and the 
engineering test plan which said that these people will make sure that 
the Ariane 4 inertial guidance software will work on the Ariane 5.  Then 
they literally erased the box without staffing it, with the intent of 
saving money.

So as things worked out no engineer was ever in a position to give an 
opinion on whether the inertial guidance software was suitable for the 
Ariane 5.  It really happened that (if you read Dilbert) a pointy haired 
boss took the software out of the box and handed it to the Arine 5 
construction team saying it had been throughly tested for this job.

But no engineer ever saw both the Ariane 5 requirements and the Ariane 4 
inertial guidance software documentation until after the crash.  And the 
elimination of the "full-up" engineering tests of the inertial guidance 
software with the engine controls was cancelled for lack of funds and 
lack of time after all the engine system design engineers had gone on to 
other projects.

It would be nice if there was a particular culprit who knew that the 
reason the full-up guidance system tests were behind schedule because 
the guidance software didn't work.  But in reality, the testing was so 
far behind schedule when it was cancelled that they never got as far as 
running with the computers the software ran on integrated into the test 
stand.  (And the test platform was being done as "black box" testing, so 
the test developers had access to the Ariane 5 requirements--but not the 
actual software documentation, just the interfaces.)

I would love to be able to say that "it could never happen here."  But I 
can't, it takes constant vigilance on a project to ensure that there are 
no loose ends, missed requirements or requirements that have changed 
since the original analysis.  So in the end it comes down to the fact 
that we are all only human.

-- 

                                                Robert I. Eachus

�In an ally, considerations of house, clan, planet, race are 
insignificant beside two prime questions, which are: 1. Can he shoot? 2. 
Will he aim at your enemy?� -- from the Laiden novels by Sharon Lee and 
Steve Miller.