Ariane 5 Flight 501: The $370 Million Rocket Killed by One Number

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On June 4, 1996, the European Space Agency's new Ariane 5 lifted off from Kourou carrying the four Cluster satellites, each about 1,200 kilograms, bound to study Earth's magnetosphere. For thirty seconds the flight was flawless. At 37 seconds the rocket swiveled its nozzles hard to one side, tore itself apart under aerodynamic stress, and self-destructed. Nothing physical had broken. The cause was a few lines of software inherited from the Ariane 4.

This episode traces the chain reaction step by step. The inertial reference system tried to convert a 64-bit floating-point value called horizontal bias into a 16-bit signed integer that tops out at 32,767. The faster Ariane 5 blew past that ceiling, the processor halted as its rules required, and the backup unit, running identical code, had already shut down milliseconds earlier. The inquiry led by Jacques-Louis Lions then exposed the assumptions and skipped tests that made the failure inevitable.

• The fatal calculation belonged to an alignment function the Ariane 4 needed for about 40 seconds after liftoff. On the Ariane 5 it served no purpose at all once the rocket left the pad.
• To keep processor workload under an 80 percent cap, engineers protected only four of seven variables against overflow, trusting old Ariane 4 flight data for the other three.
• With both navigation units shut down, the main computer read diagnostic data as flight commands and forced the vehicle past a 20 degree angle of attack, ripping the boosters from the main stage.
• The team simulated the reference system's outputs in software instead of testing the real hardware. After the explosion, investigators fed the actual units the flight data and reproduced the failure exactly.
• Four replacement satellites, Cluster 2, launched in the summer of 2000 on Russian Soyuz rockets, and the disaster spurred industrial use of static code analysis built on abstract interpretation.