6 ms·

Talking about Ariane 5, it's been interesting reading parts of its history. Particularly: "Ariane 5's first test flight (Ariane 5 Flight 501) on 4 June 1996 fa

Talking about Ariane 5, it's been interesting reading parts of its history. Particularly: "Ariane 5's first test flight (Ariane 5 Flight 501) on 4 June 1996 failed, with the rocket self-destructing 37 seconds after launch because of a malfunction in the control software. A data conversion from 64-bit floating point value to 16-bit signed integer value to be stored in a variable representing horizontal bias caused a processor trap (operand error)because the floating point value was too large to be represented by a 16-bit signed integer. The software was originally written for the Ariane 4 where efficiency considerations (the computer running the software had an 80% maximum workload requirement) led to four variables being protected with a handler while three others, including the horizontal bias variable, were left unprotected because it was thought that they were "physically limited or that there was a large margin of safety". The software, written in Ada, was included in the Ariane 5 through the reuse of an entire Ariane 4 subsystem despite the fact that the particular software containing the bug, which was just a part of the subsystem, was not required by the Ariane 5 because it has a different preparation sequence than the Ariane 4" I wouldn't want any part on something as mission critical as getting a rocket to deliver something into orbit.

deleted 5y ago
[deleted]
pkaye 5y ago
Looks like 95.5% success rate. I don't know if there is anything better with that much payload capacity and as long a track record. https://en.wikipedia.org/wiki/Ariane_5 https://en.wikipedia.org/wiki/Ariane_5
- ceejayoz 5y ago
  https://en.wikipedia.org/wiki/Delta_IV https://en.wikipedia.org/wiki/Delta_IV and https://en.wikipedia.org/wiki/Atlas_V https://en.wikipedia.org/wiki/Atlas_V have essentially perfect records. The IV had a lower-than-expected orbit on a non-payload test flight, and the V had a lower-than-expected orbit that the payload was able to fix.
  - colechristensen 5y ago
    You have to take statistics like this with a grain of salt. Sometimes less than perfect reliability is by design, sometimes development details (like how different the "new" rocket that earned that name is from previous designs) hide failures in earlier rockets with different names.
    - ceejayoz 5y ago
      Sure, but if anything, Ariane 5 is a good example of that; it blew up because of reused software from the Ariane 4.
  - wumpus 5y ago
    NROL-30 on Atlas 5 apparently had a shorter lifetime after the "fix", and that is normally considered a "partial failure".
- richardwhiuk 5y ago
  Success rate isn't very interesting. If a random 1/20 rockets fail, then that's very bad. If your first 10 rockets failed, and then you next 190 succeed, that's likely to be a much better rocket.
- wumpus 5y ago
  SpaceX F9 has 106 successful launches after their last failure. Ariane 5 has 106 launches since their last full failure. (1 partial failure in there.) Of course, F9 is a little smaller, everything other than Delta IV Heavy is a little smaller, so your statement including "with that much payload capacity" is true by construction.
  - shakezula 5y ago
    Wow, that's a much better continuous success rate than I would've guessed on either account.
    - wumpus 5y ago
      Yes, it's amazing how the numbers pile up over time -- Ariane 5 was a great market fit for a long time until recently, and SpaceX has a crazy high F9 launch cadence.
  - xoa 5y ago
    A few small expansions, not to take away from your overall point: >SpaceX F9 has 106 successful launches after their last failure. Ariane 5 has 106 launches since their last full failure. Worth noting given these rockets' history (and also your mention of cargo), both have had a number of major variants (as well as minor evolutions). The only operational F9 is the current Block 5 (first launched in 2018) and for the Ariane 5 the ECA (first flown in 2005). F9 Block 5 has flown 75 times and all have been successful. Ariane 5 ECA has flown 77 times with 1 failure. They're reliable rockets, though the F9 has obviously had a higher cadence as well as the distinction of human flight. >Of course, F9 is a little smaller, everything other than Delta IV Heavy is a little smaller It's a little more complicated in terms of cargo. F9 expended (which I think is fair given the Ariane 5 is expended) actually does slightly more mass to LEO (22.8t vs 22t). But the A5 is more optimized given its staging around mass to GTO, where it beats out F9 (8.3t vs 10.9t). F9 of course loses quite a bit when reused (LEO: 15.6t, GTO: 5.5t), but at massively less cost so not quite the same thing. Also when you say "everything other" you've completely forgotten about Falcon 9 Heavy :). That does 63.8t to LEO and 26.7t to GTO, and of course vastly outmasses either the F9 or A5.
colechristensen 5y ago
Eh, aerospace involves a lot more testing and specification and generally being careful in engineering practices and still failure for new products is expected. You launch your first few rockets expecting them to explode because even with all of the care, it's just not reasonable to expect that you got everything right in simulation, test, and design. This is why the public response to "failures" from SpaceX, NASA, etc. etc. are so frustrating, people don't understand the nature of product testing. You don't get to see a washing machine or microchip or car or whatever else do its equivalent of exploding on the pad, but they all do and much worse. The first flight of a rocket not exploding is like spending days writing code, compiling it once without errors and running it in production with no issues. It's basically unimaginable and when it does happen you sit and wonder what's actually going wrong that you don't know about yet. Once you do get a working configuration, you don't change it or make only very safe changes. You rely on what's worked before because things are actually exactly the same, not constantly changing like so much software today. This leads to a lot of conservatism that people don't understand (why is military hardware using X, it's so outdated!)
- bumby 5y ago
  I think this is a fair take when you're talking about failures of nascent designs because of unknown failure modes. But it's frustrating when there are failures from known failure modes that just had process escapes. A couple examples: - CST-100 was sent into orbit with software mapped to valves incorrectly. There is no credible reason this shouldn't have been tested thoroughly on the ground first. - Falcon 9 had a failure due to a tank support strut that had strength characteristics a fraction of its design spec. Good supplier quality control should have vetted the material prior to its use. (SpaceX has since added material tests). Finding unknown causes of failures help us learn more about the science of the industry. But not catching known failure modes due to lack of process control is a different animal.
  - hn_throwaway_99 5y ago
    > But not catching known failure modes due to lack of process control is a different animal. I agree, but for any complicated product like a rocket launch there are probably many many tens of thousands/hundreds of thousands/millions of things like this where one small uncaught error can cause mission failure. At some point it's just statistics, you'd expect to see some catastrophic failures across some percentage of products early in their lifecycle, regardless of how good your process control is.
jollybean 5y ago
Amazing. I wonder if given the large advances in computing power, that we might develop something like Ada+Rust for such systems where we can eliminate all sorts of error classes.
- acomjean 5y ago
  I worked on radars. We used Ada. The knock on it is that its slow, and didn't have a huge ecosystem. but 20 years later at least slow is not really much of a problem. You kinda got used to the fact if the software compiled it probably would run. It had some neat features (like constraining values, eg this variable will be between 0 and 10. Of course you'd have to deal with things when you ended up outside that range.. ). Really quite reliable. https://learn.adacore.com/courses/intro-to-ada/chapters/strongly_typed_language.html https://learn.adacore.com/courses/intro-to-ada/chapters/stro... They tested a lot (some of the testing was delivered with the software even, to run anytime...).
  - jollybean 5y ago
    I interned in IT on Space Systems and looking back I'm basically amazed we ever put 'software' in space. There were some organizational attempts to control for such issues, but there were no real solutions other than a bunch of guidelines. Some of the code written for the space station was done in long, sleepless 'power-coding' binges. I thought that was 'cool' now I think it's 'insane'. I do remember learning a bit about Ada, but it's been so long, and it's probably out of the range for most things today. Even Rust is a bridge to far for most projects, I really wish there were ways to 'back off' from Rusts ultra-hard principled approach because I think what most projects need is '65% Rust', not '100%' which is the only current option.
    - acomjean 5y ago
      Rust is very low level. When I looked at Go (I haven't really learned it beside some simple things), it seemed the most Ada like of languages I've looked at. I'm not sure how safe it is, but considering some of these govt. projects were moving to c++ from Ada, it might be reliable enough. > the space station was done in long, sleepless 'power-coding' binges Yikes. I grew to appreciate Ada. We would disable the interupts on some cpus and the software had to be reliable as if the code crashed or got stuck, you were rebooting the machine.
MayeulC 5y ago
> were left unprotected because it was thought that they were "physically limited or that there was a large margin of safety You didn't mention it, but IIRC what made the overflow possible was the increased performance of Ariane 5. Such values couldn't physically be reached with Ariane 4. Now, the real irony is that indeed that computation and whole subsystem wasn't needed. It tells you something about removing unneeded parts. On the other hand, the aerospace sector is traditionally very conservative and reluctant to change things. Have a look at the superstition surrounding launch processes: http://stevenjohnfuchs.com/soyuzblue/yes-they-pee-on-the-tires/ http://stevenjohnfuchs.com/soyuzblue/yes-they-pee-on-the-tir... I can picture code being included whole for fear of breaking something by mistake.
Eikon 5y ago
Video of the incident: https://www.youtube.com/watch?v=gp_D8r-2hwk https://www.youtube.com/watch?v=gp_D8r-2hwk
barkingcat 5y ago
That part about the saying "well, it's not rocket science" In this case, it is rocket science.
jlengrand 5y ago
I still remember that one, I was at school 80 kms away when it blew up. Quite the boom given the distance, but nobody scared, just heard a large bang. Most launches were at night, and we could watch the trail of flames pass by but 501 was launched during the day. Impressive to watch how wrong it went, how fast. There's even still the dude saying "all parameters and trajectory normal" literally as the thing explodes. Good times and nice memories.
Stevvo 5y ago
I find it interesting that bug is so normal, like it's exactly the type of bug we encounter all the time in terrestrial software. Yet the stakes are so much higher.
dylan604 5y ago
>I wouldn't want any part on something as mission critical as getting a rocket to deliver something into orbit. I hear there's a need for 3rd party libraries to log data.

deleted 5y ago

[deleted]

pkaye 5y ago

Looks like 95.5% success rate. I don't know if there is anything better with that much payload capacity and as long a track record. https://en.wikipedia.org/wiki/Ariane_5 https://en.wikipedia.org/wiki/Ariane_5

ceejayoz 5y ago
https://en.wikipedia.org/wiki/Delta_IV https://en.wikipedia.org/wiki/Delta_IV and https://en.wikipedia.org/wiki/Atlas_V https://en.wikipedia.org/wiki/Atlas_V have essentially perfect records. The IV had a lower-than-expected orbit on a non-payload test flight, and the V had a lower-than-expected orbit that the payload was able to fix.
- colechristensen 5y ago
  You have to take statistics like this with a grain of salt. Sometimes less than perfect reliability is by design, sometimes development details (like how different the "new" rocket that earned that name is from previous designs) hide failures in earlier rockets with different names.
  - ceejayoz 5y ago
    Sure, but if anything, Ariane 5 is a good example of that; it blew up because of reused software from the Ariane 4.
- wumpus 5y ago
  NROL-30 on Atlas 5 apparently had a shorter lifetime after the "fix", and that is normally considered a "partial failure".
richardwhiuk 5y ago
Success rate isn't very interesting. If a random 1/20 rockets fail, then that's very bad. If your first 10 rockets failed, and then you next 190 succeed, that's likely to be a much better rocket.
wumpus 5y ago
SpaceX F9 has 106 successful launches after their last failure. Ariane 5 has 106 launches since their last full failure. (1 partial failure in there.) Of course, F9 is a little smaller, everything other than Delta IV Heavy is a little smaller, so your statement including "with that much payload capacity" is true by construction.
- shakezula 5y ago
  Wow, that's a much better continuous success rate than I would've guessed on either account.
  - wumpus 5y ago
    Yes, it's amazing how the numbers pile up over time -- Ariane 5 was a great market fit for a long time until recently, and SpaceX has a crazy high F9 launch cadence.
- xoa 5y ago
  A few small expansions, not to take away from your overall point: >SpaceX F9 has 106 successful launches after their last failure. Ariane 5 has 106 launches since their last full failure. Worth noting given these rockets' history (and also your mention of cargo), both have had a number of major variants (as well as minor evolutions). The only operational F9 is the current Block 5 (first launched in 2018) and for the Ariane 5 the ECA (first flown in 2005). F9 Block 5 has flown 75 times and all have been successful. Ariane 5 ECA has flown 77 times with 1 failure. They're reliable rockets, though the F9 has obviously had a higher cadence as well as the distinction of human flight. >Of course, F9 is a little smaller, everything other than Delta IV Heavy is a little smaller It's a little more complicated in terms of cargo. F9 expended (which I think is fair given the Ariane 5 is expended) actually does slightly more mass to LEO (22.8t vs 22t). But the A5 is more optimized given its staging around mass to GTO, where it beats out F9 (8.3t vs 10.9t). F9 of course loses quite a bit when reused (LEO: 15.6t, GTO: 5.5t), but at massively less cost so not quite the same thing. Also when you say "everything other" you've completely forgotten about Falcon 9 Heavy :). That does 63.8t to LEO and 26.7t to GTO, and of course vastly outmasses either the F9 or A5.

colechristensen 5y ago

Eh, aerospace involves a lot more testing and specification and generally being careful in engineering practices and still failure for new products is expected. You launch your first few rockets expecting them to explode because even with all of the care, it's just not reasonable to expect that you got everything right in simulation, test, and design. This is why the public response to "failures" from SpaceX, NASA, etc. etc. are so frustrating, people don't understand the nature of product testing. You don't get to see a washing machine or microchip or car or whatever else do its equivalent of exploding on the pad, but they all do and much worse. The first flight of a rocket not exploding is like spending days writing code, compiling it once without errors and running it in production with no issues. It's basically unimaginable and when it does happen you sit and wonder what's actually going wrong that you don't know about yet. Once you do get a working configuration, you don't change it or make only very safe changes. You rely on what's worked before because things are actually exactly the same, not constantly changing like so much software today. This leads to a lot of conservatism that people don't understand (why is military hardware using X, it's so outdated!)

bumby 5y ago
I think this is a fair take when you're talking about failures of nascent designs because of unknown failure modes. But it's frustrating when there are failures from known failure modes that just had process escapes. A couple examples: - CST-100 was sent into orbit with software mapped to valves incorrectly. There is no credible reason this shouldn't have been tested thoroughly on the ground first. - Falcon 9 had a failure due to a tank support strut that had strength characteristics a fraction of its design spec. Good supplier quality control should have vetted the material prior to its use. (SpaceX has since added material tests). Finding unknown causes of failures help us learn more about the science of the industry. But not catching known failure modes due to lack of process control is a different animal.
- hn_throwaway_99 5y ago
  > But not catching known failure modes due to lack of process control is a different animal. I agree, but for any complicated product like a rocket launch there are probably many many tens of thousands/hundreds of thousands/millions of things like this where one small uncaught error can cause mission failure. At some point it's just statistics, you'd expect to see some catastrophic failures across some percentage of products early in their lifecycle, regardless of how good your process control is.

jollybean 5y ago

Amazing. I wonder if given the large advances in computing power, that we might develop something like Ada+Rust for such systems where we can eliminate all sorts of error classes.

acomjean 5y ago
I worked on radars. We used Ada. The knock on it is that its slow, and didn't have a huge ecosystem. but 20 years later at least slow is not really much of a problem. You kinda got used to the fact if the software compiled it probably would run. It had some neat features (like constraining values, eg this variable will be between 0 and 10. Of course you'd have to deal with things when you ended up outside that range.. ). Really quite reliable. https://learn.adacore.com/courses/intro-to-ada/chapters/strongly_typed_language.html https://learn.adacore.com/courses/intro-to-ada/chapters/stro... They tested a lot (some of the testing was delivered with the software even, to run anytime...).
- jollybean 5y ago
  I interned in IT on Space Systems and looking back I'm basically amazed we ever put 'software' in space. There were some organizational attempts to control for such issues, but there were no real solutions other than a bunch of guidelines. Some of the code written for the space station was done in long, sleepless 'power-coding' binges. I thought that was 'cool' now I think it's 'insane'. I do remember learning a bit about Ada, but it's been so long, and it's probably out of the range for most things today. Even Rust is a bridge to far for most projects, I really wish there were ways to 'back off' from Rusts ultra-hard principled approach because I think what most projects need is '65% Rust', not '100%' which is the only current option.
  - acomjean 5y ago
    Rust is very low level. When I looked at Go (I haven't really learned it beside some simple things), it seemed the most Ada like of languages I've looked at. I'm not sure how safe it is, but considering some of these govt. projects were moving to c++ from Ada, it might be reliable enough. > the space station was done in long, sleepless 'power-coding' binges Yikes. I grew to appreciate Ada. We would disable the interupts on some cpus and the software had to be reliable as if the code crashed or got stuck, you were rebooting the machine.

MayeulC 5y ago

> were left unprotected because it was thought that they were "physically limited or that there was a large margin of safety You didn't mention it, but IIRC what made the overflow possible was the increased performance of Ariane 5. Such values couldn't physically be reached with Ariane 4. Now, the real irony is that indeed that computation and whole subsystem wasn't needed. It tells you something about removing unneeded parts. On the other hand, the aerospace sector is traditionally very conservative and reluctant to change things. Have a look at the superstition surrounding launch processes: http://stevenjohnfuchs.com/soyuzblue/yes-they-pee-on-the-tires/ http://stevenjohnfuchs.com/soyuzblue/yes-they-pee-on-the-tir... I can picture code being included whole for fear of breaking something by mistake.

Eikon 5y ago

Video of the incident: https://www.youtube.com/watch?v=gp_D8r-2hwk https://www.youtube.com/watch?v=gp_D8r-2hwk

barkingcat 5y ago

That part about the saying "well, it's not rocket science" In this case, it is rocket science.

jlengrand 5y ago

I still remember that one, I was at school 80 kms away when it blew up. Quite the boom given the distance, but nobody scared, just heard a large bang. Most launches were at night, and we could watch the trail of flames pass by but 501 was launched during the day. Impressive to watch how wrong it went, how fast. There's even still the dude saying "all parameters and trajectory normal" literally as the thing explodes. Good times and nice memories.

Stevvo 5y ago

I find it interesting that bug is so normal, like it's exactly the type of bug we encounter all the time in terrestrial software. Yet the stakes are so much higher.

dylan604 5y ago

>I wouldn't want any part on something as mission critical as getting a rocket to deliver something into orbit. I hear there's a need for 3rd party libraries to log data.