Re: Multiple reasons for failure of Ariane 5 (was: Re: Ariane 5 - not an exception?)

[eachus@spectre.mitre.org (Robert I. Eachus)]

In article <kdk9vs9cln.fsf@henning.camb> johndoe@zaphod.nosc.mil (Kirk Beitz) writes:

  > after reading the failure analysis, it seems a little
  > irresponsible to even hint about the failure of the rocket being
  > based solely on the lack of proper exception handling.

   One way of looking at the failure is that:

   1.  The software detected an out-of-range condition on horizontal
       velocity. 

   2.  The exception handler for this condition regarded it as a
       non-survivable hardware failure, and proceed to save failure
       data to help in the crash analysis.

   3.  The diagnostic data was regarded as valid navigational input...

   (Sounds preposterous, but read the report!)

   The first two are not obviously broken in isolation--in the Ariane
   4 the software was designed for, that high a horizontal velocity
   early in the fligh would be either a bogus reading or a severe
   hardware failure.  Point three, of course, is only acceptable if it
   can only occur AFTER catastrophic failure.

   But if your read the report, several levels of management reviewed
and agreed to 1 and 2.  So the software functioned correctly, if you
regard correctly as adherence to specifications.  If you want more for
your money, the reason that several levels of management looked at
points one and two was that, in Ada, it was obvious that there were
potential problems here.  Management literally decided that item 1
could never happen, and that the diagnostic information was "that
important."

    So the exception was handled exactly as management wanted, even
after being asked, "Are you sure?"

    To be fair, the managers asked about the out of range horizontal
velocity check answered correctly in the context the question was
asked.  And the software designers never knew to reraise the issue,
since they never saw the Ariane 5 flight profile data.  The managers
who goofed were the ones who decided to use the same software on
Ariane 4 and 5 without doing any checks against the new requirements.
That is NO checks as in no specification reviews, no code review and
no testing.

--

					Robert I. Eachus

with Standard_Disclaimer;
use  Standard_Disclaimer;
function Message (Text: in Clever_Ideas) return Better_Ideas is...