6 ms·

> They do the tests to validate that this rocket won't turn into a cruise missile, headed for the nearest residential area. In that case the rocket has a fligh

by ygra 10y ago

> They do the tests to validate that this rocket won't turn into a cruise missile, headed for the nearest residential area. In that case the rocket has a flight-termination system, though, which should activate as soon as it veers too far outside the planned/expected parameters of the flight.

Gracana 10y ago
This discussion reminds me of the failure of the first Ariane 5 launch. The flight-termination system was activate erroneously, and the payload was not insured. Ouch. http://www.esa.int/esapub/bulletin/bullet87/cavall87.htm http://www.esa.int/esapub/bulletin/bullet87/cavall87.htm https://around.com/ariane.html https://around.com/ariane.html https://en.wikipedia.org/wiki/Cluster_%28spacecraft%29 https://en.wikipedia.org/wiki/Cluster_%28spacecraft%29
- twic 10y ago
  That's not what happened - the rocket went out of control due to a software bug allowed by over-reliance on unit testing, and was quite properly deliberately destroyed. But yes, Cluster was run on the cheap, hence the use of the Ariane 5 test flight, and didn't have insurance.
  - dalke 10y ago
    "Over-reliance on unit testing"? I have a somewhat different read from the inquiry board report, which says it was a "systematic software design error." Yes, inadequate testing, and a belief the working code for Ariane 4 meant it was validated for Ariane 5 were certainly contributory, but I think it's unfair to single out an over-reliance on unit testing. The board argues that there was a bias towards believing the software does not have an error. Thus, any out-of-range value is interpreted as a hardware error, which means the CPU should shut down. There was a decision to not include Ariane 5 trajectory data in the SRI requirements and specification. Thus, while tests were rigorous at the equipment ("unit") level, and there were system tests, they didn't test that case. This is test design failure. In addition, the board says "the review process was a contributory factor in the failure." I can see how those can be aspects of "over-reliance on unit testing", but it doesn't explain, for example, how some of the variables from Ariane 4 were protected from overflow exceptions but others were not.
    - twic 10y ago
      You have quite fairly picked me up on a cheeky exaggeration. Lots of things had to go wrong to cause the Ariane 5 failure - including bad handling of overflow, as you mention. But to my mind, the universal last line of defence against any kind of mistake is an integration test: put all of the parts of the system together, feed them real input, and verify that you get correct output. Arianespace did not do that. Well, until they actually launched it. It was a test flight, right? It proved to be an essential and very effective test.
      - dalke 10y ago
        That means there was an under-reliance on system testing, which I agree with. It doesn't imply there was an over-reliance on unit testing any more than it implies there was an over-reliance on analysis or over-reliance on the expectation of developing bug-free software.
      - david-given 10y ago
        If anyone's at all interested in risk analysis or robust software, it's totally worth finding a decent writeup on the Ariane 5 failure --- it's a fascinating postmortem in just how many unexpected little things together added up to a big boom. Everything is incredibly obvious in hindsight, of course, but making things obvious is largely what hindsight is for. And once you've finished reading that, go look up the Therac-25...
  - Gracana 10y ago
    Oops, yeah I recalled that the subsystem that caused the problem didn't need to run after launch, so I was thinking it fed incorrect data to the auto-destruct system, not that it actually went off course.
Phlarp 10y ago
For more context, all (edit: American!) rockets for decades have had onboard self destruct systems and a "Range Safety Officer" on the ground whose entire job is to determine if and when to deploy this self destruct system. The cruise missile scenario is highly unlikely as the rocket itself would be destroyed soon after leaving its intended trajectory.
- cstross 10y ago
  Not all rockets: https://en.wikipedia.org/wiki/Intelsat_708 https://en.wikipedia.org/wiki/Intelsat_708 (China, CZ-3B, Intelsat 708 payload, the launcher flew off-course and crashed on a village in 1996: by some estimates 200-500 civilians were killed.)
  - ygra 10y ago
    All rockets launched in the US have to have one, though :-)
  - dalke 10y ago
    That links to http://www.thespacereview.com/article/2323/1 http://www.thespacereview.com/article/2323/1 where one of the comments is: > Like Russian vehicles, there is no flight termination system that receives ground commands onboard Chinese launch vehicles. Only US and ESA launch sites have such a system. Correction, Falcon 1 did not have such a system for launching on Kwaj.
    - dogma1138 10y ago
      That's because usually the US and ESA/France launch from densely populated areas. The launch pad at the Kennedy Space Center/CC is effectively about 50 mile from downtown Orlando, Baikonur is in the middle of nowhere.
      - T0T0R0 10y ago
        Okay, rockets that can go very high, can still crash very far away. An unpredictable, malfunctioning rocket could still million-to-one itself onto a school bus filled with children, halfway across a continent.
deleted 10y ago
[deleted]
TrevorJ 10y ago
That doesn't mitigate the danger really.
mabbo 10y ago
It too should work. Just like rockets shouldn't explode while loading fuel before a test firing. But of all systems I never want to have to test in production, the flight-termination system is at the top of my list.

by ygra 10y ago

Gracana 10y ago

This discussion reminds me of the failure of the first Ariane 5 launch. The flight-termination system was activate erroneously, and the payload was not insured. Ouch. http://www.esa.int/esapub/bulletin/bullet87/cavall87.htm http://www.esa.int/esapub/bulletin/bullet87/cavall87.htm https://around.com/ariane.html https://around.com/ariane.html https://en.wikipedia.org/wiki/Cluster_%28spacecraft%29 https://en.wikipedia.org/wiki/Cluster_%28spacecraft%29

twic 10y ago
That's not what happened - the rocket went out of control due to a software bug allowed by over-reliance on unit testing, and was quite properly deliberately destroyed. But yes, Cluster was run on the cheap, hence the use of the Ariane 5 test flight, and didn't have insurance.
- dalke 10y ago
  "Over-reliance on unit testing"? I have a somewhat different read from the inquiry board report, which says it was a "systematic software design error." Yes, inadequate testing, and a belief the working code for Ariane 4 meant it was validated for Ariane 5 were certainly contributory, but I think it's unfair to single out an over-reliance on unit testing. The board argues that there was a bias towards believing the software does not have an error. Thus, any out-of-range value is interpreted as a hardware error, which means the CPU should shut down. There was a decision to not include Ariane 5 trajectory data in the SRI requirements and specification. Thus, while tests were rigorous at the equipment ("unit") level, and there were system tests, they didn't test that case. This is test design failure. In addition, the board says "the review process was a contributory factor in the failure." I can see how those can be aspects of "over-reliance on unit testing", but it doesn't explain, for example, how some of the variables from Ariane 4 were protected from overflow exceptions but others were not.
  - twic 10y ago
    You have quite fairly picked me up on a cheeky exaggeration. Lots of things had to go wrong to cause the Ariane 5 failure - including bad handling of overflow, as you mention. But to my mind, the universal last line of defence against any kind of mistake is an integration test: put all of the parts of the system together, feed them real input, and verify that you get correct output. Arianespace did not do that. Well, until they actually launched it. It was a test flight, right? It proved to be an essential and very effective test.
    - dalke 10y ago
      That means there was an under-reliance on system testing, which I agree with. It doesn't imply there was an over-reliance on unit testing any more than it implies there was an over-reliance on analysis or over-reliance on the expectation of developing bug-free software.
    - david-given 10y ago
      If anyone's at all interested in risk analysis or robust software, it's totally worth finding a decent writeup on the Ariane 5 failure --- it's a fascinating postmortem in just how many unexpected little things together added up to a big boom. Everything is incredibly obvious in hindsight, of course, but making things obvious is largely what hindsight is for. And once you've finished reading that, go look up the Therac-25...
- Gracana 10y ago
  Oops, yeah I recalled that the subsystem that caused the problem didn't need to run after launch, so I was thinking it fed incorrect data to the auto-destruct system, not that it actually went off course.

Phlarp 10y ago

For more context, all (edit: American!) rockets for decades have had onboard self destruct systems and a "Range Safety Officer" on the ground whose entire job is to determine if and when to deploy this self destruct system. The cruise missile scenario is highly unlikely as the rocket itself would be destroyed soon after leaving its intended trajectory.

cstross 10y ago
Not all rockets: https://en.wikipedia.org/wiki/Intelsat_708 https://en.wikipedia.org/wiki/Intelsat_708 (China, CZ-3B, Intelsat 708 payload, the launcher flew off-course and crashed on a village in 1996: by some estimates 200-500 civilians were killed.)
- ygra 10y ago
  All rockets launched in the US have to have one, though :-)
- dalke 10y ago
  That links to http://www.thespacereview.com/article/2323/1 http://www.thespacereview.com/article/2323/1 where one of the comments is: > Like Russian vehicles, there is no flight termination system that receives ground commands onboard Chinese launch vehicles. Only US and ESA launch sites have such a system. Correction, Falcon 1 did not have such a system for launching on Kwaj.
  - dogma1138 10y ago
    That's because usually the US and ESA/France launch from densely populated areas. The launch pad at the Kennedy Space Center/CC is effectively about 50 mile from downtown Orlando, Baikonur is in the middle of nowhere.
    - T0T0R0 10y ago
      Okay, rockets that can go very high, can still crash very far away. An unpredictable, malfunctioning rocket could still million-to-one itself onto a school bus filled with children, halfway across a continent.

deleted 10y ago

[deleted]

TrevorJ 10y ago

That doesn't mitigate the danger really.

mabbo 10y ago

It too should work. Just like rockets shouldn't explode while loading fuel before a test firing. But of all systems I never want to have to test in production, the flight-termination system is at the top of my list.