2-up - ETH Zürich

An Overflow Occurred...
Fri, 2 Aug 1996 – The causes of the Ariane 5 rocket crash (summary):
• An overflow occurred in the Inertial Reference System (SRI) computer
when converting a 64-bit floating point to 16-bit signed integer value.
• There was no error handler for that specific overflow. The default
handler shut down the SRI unit.
• The standby SRI unit had previously shut itself down for the same
reason. The hot SRI and the standby were running the same software.
• The shutdown caused the SRI to output a memory dump on the bus.
The main computer interpreted the memory dump as flight data, causing
such a violent trajectory correction that the rocket disintegrated.
• The program that failed was a pre-flight program, and should not have
been running during the flight.
50
An Overflow Occurred...
• “The investigation team concluded that the designers of
the computer system put in protections against hardware
faults but did not take into account software faults.”
• Das gesamte Ariane-Programm wurde dadurch
eineinhalb Jahre verzögert; dies kostete (die
Steuerzahler...) schätzungsweise 10 Milliarden Euro
Vgl. dazu: J. Jezequel, B. Meyer: “Design by Contract:
The Lessons of Ariane”, Computer, Jan. 1997, 129-130.
51
19