On the morning of 4 June 1996, the first Ariane 5 lifted off from Kourou in French Guiana. On board were the four Cluster science satellites, first proposed in November 1982.
For about half a minute the flight was normal. Then, 36.7 seconds after the command to ignite the main engine, the backup inertial reference system, the unit that measures the rocket’s attitude and movements, stopped working. About 0.05 seconds later the active unit stopped too, for the same reason. It sent the main computer a diagnostic bit pattern, which the computer read as flight data. The computer swung the nozzles of the boosters and the main engine to full deflection to fix an attitude error that hadn’t happened. At about 39 seconds the rocket began to break up, and its self-destruct system fired at an altitude of about 4 kilometers.
An independent inquiry board, chaired by Jacques-Louis Lions of the French Academy of Sciences, reported about six weeks later. The design of the unit, it found, was “practically the same” as the one flying on Ariane 4, “particularly as regards the software.”
The failure was in a piece of software that aligns the platform before launch. On Ariane 5 it served no purpose after lift-off. It kept running for about 40 seconds anyway, because Ariane 4 had needed that for a rare countdown hold, and the requirement had been kept “for commonality reasons.” Ariane 5 picks up horizontal speed five times faster than Ariane 4 in its first 40 seconds. A value tied to that speed grew too large to convert from a 64-bit floating-point number into a 16-bit integer. The conversion was unprotected, the unit’s specification said any such exception should stop the processor, and both units ran the same software.
Nobody had shown the unit the new flight. The board found it had been “jointly agreed” not to include Ariane 5’s trajectory data in the unit’s requirements and specification. “The supplier of the SRI was only following the specification given to it,” the report says. No test checked the unit against Ariane 5’s countdown, flight sequence and trajectory. Such a ground test, the board wrote, would have exposed the failure.
There had been a second chance. In 1992 the programme decided not to put the real units into its closed-loop flight simulations. One stated reason: the units “should be considered to be fully qualified at equipment level.” The board judged the reasons technically valid, but saw “a definite risk” in assuming critical equipment was validated by its own qualification, or by previous use on Ariane 4.
The board made 14 recommendations. Most were about software and testing: switch the alignment off at lift-off, put real equipment in the loop, include trajectory data in specifications. The last was about the partners themselves: “Close engineering cooperation, with clear cut authority and responsibility, is needed to achieve system coherence, with simple and clear interfaces between partners.”
The Cluster mission flew again four years later, launched in two pairs on 16 July and 9 August 2000.