Re: Ariane5 FAQ

["Robert I. Eachus" <rieachus@attbi.com>]

Hyman Rosen wrote:

> They didn't just move the software, they moved the hardware too.
> I don't "want" anything. The investigatory report says that the
> Ariane 4 SRI software and documentation failed to make obviously
> clear its dependence on the details of the Ariane 4 flight path,
> which helped lead to the assumption by the Ariane 5 people that
> it would "just work". The failure to check for overflow in the
> Ariane 4 code was not an essential part of its operation, but a
> shortcut taken in order to reduce CPU usage. Software which has
> such sensitive dependency on input is brittle and fragile, and
> should accordingly come plastered with warning stickers.

Why, why, do you keep spouting this nonsense?  The documentation for the 
SRI software not only showed a dependence on the Ariane 4 flight path, 
but it explicitly stated that it had not been checked against the Ariane 
5 requirements.

The massive failure was the direct result of the political and 
management decisions which prevented the (Ariane 4 project) SRI 
engineers from seeing the Ariane 5 requirements, and prevented all the 
engineers, software, hardware, and test employed on the Ariane 5 
development from ever seeing the Ariane 4 SRI documentation.

Now I could go on long and loud about a contract situation where the 
Ariane 4 SRI upgrade was performened under those circumstances.  But I 
wouldn't expect it to have these consequences.  It was the combination 
of several separate management decisions, each of which can be 
criticised in hindsight, but all with the same engineering consequence, 
the Ariane 5 REQUIREMENTS were never compared to the Ariane 4 SRI 
SPECIFICATION.  If that had happened several major problems INCLUDING 
this one would have been discovered.

In fact, the actual failure was caused by another of these mismatches. 
The software for the engine controllers was set to take the data from 
the SRI, compare it to the (current) stack limits then pass either the 
maximum permitted deflection or the requested deflection to the servos.

So what happened when the engine controllers got junk data?  The engines 
were deflected to the structural limit for the Ariane 4 stack at this 
point in its flight profile.  Of course, the Ariane 5 stack was bigger, 
the aerodynamic stresses greater, and it disintegrated.  Then the range 
safety officer triggered the self-destruct.  The same thing could have 
happened if Ariane 501 had hit wind shear.

Also the SRI software used the Ariane 4 moments of inertia in its 
control laws.  The report seems to indicate that there was a 10 Hz 
ocillation building up due to this.  If it had gone on would that have 
been sufficient to destroy Ariane 501?  Probably.

-- 

                                                        Robert I. Eachus

�In an ally, considerations of house, clan, planet, race are 
insignificant beside two prime questions, which are: 1. Can he shoot? 2. 
Will he aim at your enemy?� -- from the Laiden novels by Sharon Lee and 
Steve Miller.