Re: Ariane5 FAQ

["Robert I. Eachus" <rieachus@attbi.com>]

Berend de Boer wrote:

> Except requirements it seems. And I think you should have a look at
> Design By Contract and in particular Eiffel.

No.  And that is what all the sound and fury has been about.  The 
mapping from requirements to actual code was perfectly done.  The 
problem was that the requirements which were perfectly filled were for 
the Ariane 4, not the Ariane 5.

The nature of the political/management problem at Arianespace was such 
that no one ever saw both the Ariane 5 requirements and the SRI 
documentation until after the disaster.  The red herring dragged about 
of documenting requirements in the source code is just that, a red 
herring.  The programmers simulating the SRI for the flight guidance 
simulator did not see the alignment function code--because simulating it 
was not part of their contract.

Of course, if anyone involved in letting that contract had known that 
the alignment function on the Ariane 4 was required to run for 40 
seconds after engine start, simulation of it might have been included in 
the simulator.  Or something else might have happened that resulted in 
an engineer learing of this requirements mismatch.

But as we know, no one was ever in a position to do a diff between the 
Ariane 4 and Ariane 5 requirements, and then apply that to reused 
subsystems.  Did everyone miss the point of the SECOND Ariane 5 failure 
investigation?  Diffferent launch, different subsystem, very different 
failure mode. But the thing both failures had in common was systems 
reused from Ariane 4 without checking that they met the new requirements.

If you missed it, here it is again.  The failure didn't get nearly the 
press that the first one did, but the result was the same, a launch 
failure: http://spaceflightnow.com/ariane/v142/010713followup.html and
http://www.arianespace.com/site/news/03_06_19_release_index.html

There was also a FOURTH Ariane 5 failure (out of 14 tries) on flight 
157: http://www.esa.int/export/esaCP/ESA7198708D_index_0.html  This was 
due to failure of the cooling of the Vulcain 2 engine, new to the Ariane 
5 ECA.  Although this failue had nothing to do with Ariane 4 reuse, or 
Ada, what do we find under contributing factors?  "non-exhaustive 
definition of the loads to which the Vulcain 2 engine is subjected 
during flight"

Translation, ANOTHER requirements definition failure.  The first three 
launch failures were all due to the failure of change mananagement and 
requirements tracking during the original Ariane 5 development.  But 
this latest failure involves a design subsequent to the first two Ariane 
5 failures.  You have to wonder...

In any case, focusing on the particular details of the first failure and 
not the overall programmatic issues is a mistake.  In Arianespace's 
case, so far a multi-billion Euro mistake.

-- 
"As far as I'm concerned, war always means failure." -- Jacques Chirac, 
President of France
"As far as France is concerned, you're right." -- Rush Limbaugh