Re: Fortran or Ada?

["Larry Elmore" <ljelmore@montana.campus.mci.net>]

jbs@yktvmv.watson.ibm.com wrote in message
<19981002.222045.439@yktvmv.watson.ibm.com>...
>In article <36156677.7566@lanl.gov>,
> on Fri, 02 Oct 1998 17:49:11 -0600,
> William Clodius <wclodius@lanl.gov> writes:
>>jbs@yktvmv.watson.ibm.com wrote:
>>> <snip>
>>>          The report I have says nothing like this.  What report are
>>> you referring to?
>>>                         James B. Shearer
>>
>>Robert Eachus's comments are "mostly" inferable from the report. He is
>>correct that the report says (in equivalent words) that "the stack was
>>destroyed when the engine deflection exceeded the physical stress limits
>>of the stack (booster and payload)." He is also correct that this
>>implies that the software did not properly check that such an engine
>>deflection was safe at that thrust. I suspect that he infers from
>>presummed best practices that the software would make such a check, and
>>that it failed because the physical parameters were wrong, and that the
>>most likely reason that they were wrong was because the Ariane 4
>>parameters were used. However, the number of steps used in that
>>inference are long and while the individual steps are plausible
>>collectively they are less plausible. Further, whether any other system
>>malfunction could have caused the software to command that that
>>deflection is unknown.
>
>         Actually what the report says is:
>
>!    f) Approx. 0.05 seconds later the active inertial reference system,
>!    identical to the back-up system in hardware and software, failed for
the
>!    same reason. Since the back-up inertial system was already
inoperative,
>!    correct guidance and attitude information could no longer be obtained
and
>!    loss of the mission was inevitable.
>!
>!    g) As a result of its failure, the active inertial reference system
>!    transmitted essentially diagnostic information to the launcher's main
>!    computer, where it was interpreted as flight data and used for flight
>!    control calculations.
>!
>!    h) On the basis of those calculations the main computer commanded the
>!    booster nozzles, and somewhat later the main engine nozzle also, to
make a
>!    large correction for an attitude deviation that had not occurred.
>!
>!    i) A rapid change of attitude occurred which caused the launcher to
>!    disintegrate at 39 seconds after H0 due to aerodynamic forces.
>!
>!    j) Destruction was automatically initiated upon disintegration, as
>!    designed, at an altitude of 4 km and a distance of 1 km from the
launch
>!    pad.
>
>         I don't see anything in there about the engine deflection
>being unsafe in itself, it just pointed the rocket in the wrong
>direction.  Presumedly a less extreme deflection (error) would just
>have delayed the accident a few seconds.

Well, _of course_ you didn't see anything in there about the engine
deflection being unsafe in itself! That's because no one has suggested
anything so foolish. Mr. Eachus wrote:

"Note later in the report
where it says that the stack was destroyed when the engine deflection
exceeded the physical stress limits of the stack (booster and
payload). "

The failure was due to a management decision to use unchanged the Ariane 4
sub-system without any testing, or even adequate review.

LArry