Re: Ariane5 FAQ

[aek@vib.usr.pu.ru (Alexander Kopilovitch)]

Robert I. Eachus wrote:

> > How can
> > one exclude anything from the simulator's contract if nobody can see differences
> > between the Ariane 4 and Ariane 5?
>
>No knowledge of the difference between the Ariane 4 and Ariane 5 was
>involved.  The perfectly reasonable assumption was made that there was
>no need to simulate the alignment functions which ran before takeoff,
>because there was nothing to be learned there.  (This is a case where
>the Araine 4 and 5 really were identical.  Sitting on the pad, the
>accelerometers and gyros were identical and the launch site was
>identical.)  Again what slipped through was that there was a requirement
>in the Ariane 4 to continue running the alignment software after MEI
>(main engine ignition), even though those results were "thrown away" if
>MEI resulted in a launch.

Ok, I agree, I recognize that kind of logic (I think I have seen it several
times, when I contacted with high-position managers). And I think that too
high concentration of this kind of logic within a project is a smoking gun
by itself. Well, I downgrade the seriouseness of the allegation (in some
non-technical sense -;), but I'm still not sure enough that not giving the
part of the source code to the simulator's developers is true fact and not
just good guess.

Anyway, assuming that that is a true fact,  I'm going to include into the next
draft of FAQ the following Q-A pair:

----------------------------------------------------------------------------
Q. So, if the limitations were clearly reflected in comments within the source
code then most probably they would be seen by the simulator's developers and
the disaster would be averted?

A. Probably NO. Because that part of the source code (aligment function),
where the limitations were violated in the flight, was not given to the
simulator's developers. That happened because simulation of that function
of real device was excluded from the contract for the simulator development.

The reason for that omission was that for Ariane 5 that function is not needed
after takeoff, and that before takeoff that function was really identical for
the Ariane 4 and Ariane 5. What was overlooked is that for the Ariane 4 that
function WAS executed after takeoff (about 40 seconds), so the unchanged real
device will execute that function for the Ariane 5 despite the absence of any
need for it there.
----------------------------------------------------------------------------

>This is one of those very hard to understand things until you have that
>Aha! moment.

Just because of that I'm going to include that Q-A pair into the FAQ even
being not sure enough that it is really true, but have only good probability
of that.



Alexander Kopilovitch                      aek@vib.usr.pu.ru
Saint-Petersburg
Russia