The Thirty-Seven-Second Overflow

Inherited Inertial Code and the Destruction of Ariane 5 Flight 501

Thirty-six seconds after liftoff from the Guiana Space Centre in Kourou, French Guiana, on June 4, 1996, the maiden flight of the European Space Agency's Ariane 5 heavy-lift launcher was climbing smoothly through 3,700 meters of altitude at Mach 0.7. Built over ten years at a development cost of $7 billion, Ariane 5 Flight 501 carried four Cluster magnetospheric research satellites worth $370 million. At $T + 36.7$ seconds, both of the rocket's redundant Inertial Reference Systems (SRI-2 and SRI-1) simultaneously shut themselves down. Less than two seconds later, the main Vulcain cryogenic engine and the two solid rocket boosters swiveled violently to their mechanical limits. That deflection pitched the booster twenty degrees sideways into the supersonic airstream. Dynamic aerodynamic shear ripped the launcher apart, triggering the range safety charges at $T + 39$ seconds.

The inquiry board chaired by mathematician Jacques-Louis Lions traced the disaster to seven lines of Ada software inside the Inertial Reference System. That module had been copied unchanged from the smaller Ariane 4 rocket. On Ariane 4, the SRI computer ran a pre-launch alignment routine that monitored platform motion for forty seconds after liftoff in case a hold required a rapid countdown restart. Inside that routine, a background task periodically calculated a variable named BH (Horizontal Bias), which measured accumulated horizontal velocity sensing.

To store BH in a fixed-point hardware register, the Ada code converted the 64-bit IEEE floating-point number directly into a 16-bit signed integer. In two's-complement binary arithmetic, a 16-bit signed integer can represent values only within a strict numerical window:

During Ariane 4 software design in the 1980s, engineers had analyzed the seven variables converted in that module to ensure the microprocessor never exceeded 80 percent of its computational capacity. To save clock cycles, programmers placed explicit overflow exception handlers on four of the seven variables. They left BH and two other variables unprotected because Ariane 4's physical trajectory could never generate a horizontal velocity large enough to exceed 32,767 during the first forty seconds of flight.

Ariane 5, however, was a completely different physical machine. Powered by twin solid rocket boosters delivering 13,000 kilonewtons of thrust—nearly five times the liftoff thrust of Ariane 4—Ariane 5 accelerated far more rapidly along a steeper initial horizontal pitch program. Furthermore, the forty-second post-liftoff alignment countdown had zero functional purpose on Ariane 5, which used a different ground launch sequence. Even so, engineers left the legacy routine active to preserve software commonality.

At $T + 36.7$ seconds, Ariane 5's horizontal velocity bias crossed 32,768.0. When the processor executed the 64-bit-to-16-bit conversion without an exception handler, the hardware raised an Ada Numeric_Error operand exception. Following a standard fault-tolerance assumption that any unhandled exception indicated a random hardware fault in the sensor unit, the active SRI-2 computer halted its processor so the backup SRI-1 could take over.

However, the backup SRI-1 was running the exact same Ada software fed by the exact same acceleration physics. It had crashed on the identical integer overflow 72 milliseconds earlier. As its final act before shutting down, SRI-2 dumped a 16-bit diagnostic error bit-pattern onto the data bus connected to the rocket's main On-Board Computer (OBC). Because the OBC had not been programmed to recognize a dual-SRI shutdown, it interpreted the raw diagnostic error bits as valid flight telemetry indicating an extreme attitude deviation, and commanded the booster nozzles to hard-over deflection.