For cost reasons, the Ariane 501 was fitted with two Ariane 4 inertial-reference systems (IRS), and no tests were performed with the real IRS to verify that they would behave correctly during the Ariane 5 flight, although simulations were performed. At 6s after main engine start (HO), the Ariane 5 lifted off and, at HO+36.7s, or T+ (lift-off) 30s, the flight terminated.
The back-up IRS monitored the horizontal acceleration of the Ariane 5 and, because this was different from the Ariane 4 flight profile - 60m/s at HO+30s, five times the horizontal velocity - it suffered a memory overflow and informed the flight-control system that it was not functioning. The primary guidance system suffered similarly, 20 milliseconds later, and shut down, so the computer was flying blind.
As a result, the computer misinterpreted diagnostic data for actual flight data, and commanded the nozzles of the solid-rocket boosters and Vulcain engine to gimbal to their extreme, pitching the vehicle forward abruptly, at a 20¹ angle of attack, at 4km altitude. The payload fairing disintegrated under the aerodynamic loads, followed by the separation of the boosters, complete structural failure and a simultaneous auto destruct.
"It is very fortunate that the software error was discovered during the first launch rather than further down the line, as that would have caused more disruption, particularly if the vehicle was in commercial operation," says Andre Van Gaver, head of the Ariane 5 programme office at ESA's headquarters in Paris.
"On the 501, we made a mistake," he says. "Software is critical, but is also the hardest to check. In 1990-1, it was decided to use as many Ariane 4 components as possible, to save costs. In the guidance system, this led to disaster."
The mistake was retaining what, in retrospect, was an unneccessary role for an Ariane 5 and then not reprogramming the system. If the launch had proceeded beyond 44s (the Ariane 5 remains on the pad for 6s after main-engine ignition, before solid-rocket-booster ignition) without incident, the anomaly might never have been discovered, Van Gaver adds.
When the Ariane 4 was being designed, the original IRS was programmed to reconfigure its alignment on the launch pad. This meant that, in the event of the threat of a delay in the countdown for the short launch windows required for flights into Sun-synchronous orbit, planned for the Spot remote-sensing programme, the countdown could be continued during a period of 5s between T-9s, when the final sequence begins and passes a point-of-no-return at T-4s. The IRS is freed for 5s so that it can re-align itself as required.
Without the programme, the IRS would need 40min to re-align itself and therefore the launch would be impossible. Also, to achieve this, the guidance platform was allowed to continue to function after lift-off to T+50s, calculating the vehicle's performance as a sub-routine.
The Ariane 5 countdown is different, as the point of no return occurs at T-4s and the final sequence at T-2s, so there is no critical period and neither the rapid recycling capability or the inherent sub-routine which caused the accident were required.
This sub-routine was retained and not checked against the Ariane 5's trajectory profile. "The Ariane 5 goes up far more quickly. We did not realise that the lateral acceleration would overload the memory," says Van Gaver. "If the vehicle had continued for an extra 8s, the flight probably would have succeeded and we would have been none the wiser", he adds.
"We must have a system where, if there is a software fault, you go on," he continues. "The computer in the platform had a memory overlap because it was checking against incorrect programme data. It therefore interpreted that as imperfect angular acceleration. We should have changed the rules not to allow sub-routines to be introduced. We should have checked that Sextant Avionique had the real trajectories for the Ariane 5. We should also have checked against the alignment programme. We do not need this sub-routine for alignment. We have to make sure that no error can wipe out the whole system. So, there will be no sub-routines in flight," he concludes.
Source: Flight International
