>>1064528
>blaming the Ariane V clusterfuck on Ada
No, that was just the rocket designers being retarded. tl;dr they reused code designed for an older and slower rocket which made assumptions about its maximum inertia, assumed anything higher was a sign of hardware failure, and disabled security features to increase performance. They skimped on basic tests to save money and, surprise surprise, the performance hacks didn't scale up to a faster rocket and led to both redundant computers shutting down mid-flight.
The software for the Inertial Reference System (IRS) on the Ariane 5 was identical to the
software used successfully on the Ariane 4 rocket. Basically, the developers took an "Off
The Shelf" part (the IRS) that consisted of hardware and software, the design of which was
used successfully on the Ariane 4 project, and bolted it onto the Ariane 5 rocket
completely untested. The Ariane 5 rocket had a substantially different flight profile than the
Ariane 4 was capable of. When the rocket started its flight, it moved at angles that were
substantially larger than the Ariane 4 flight path would generate. The inertial data exceeded
the range limits of the Ariane 4 software.
The system was designed with a dual-redundant computer (two processor boards that are
identical, running identical software.) One part of the software in question was performing
calculations on the inertial data and needed to do so repeatedly in a very small amount of
time. The original designers needed to speed up the software so they performed an
analysis of the incoming data and concluded that within the Ariane 4 flight profile, numbers
outside of a certain range would never occur. If such numbers *did* occur, it would be most
likely that a sensor had failed and was generating wildly out of range data. Hence, it was
safe to remove any error-handling code and instead design in Failure Detection and
Accommodation (FDA) logic.
The logic went something like this: "If a number comes in over a certain size, it will trigger
a hardware overflow condition. The hardware will trap to an Interrupt Service Routine (ISR)
for handling of that condition. The ISR presumes that if it was reached, then there must be
a hardware fault. In the event of a hardware fault, the software will shut down the computer
and transfer to the 'spare' ccomputer - which is why we have a 'spare' in the first place."
All of this makes sense because the flight path of the Ariane 4 would never generate
numbers large enough to cause an overflow - unless the hardware was broke. The whole
analysis and design was in place, tested and flew successfully for the Ariane 4 rocket.
Now comes the bad part: The design team for the Ariane 5 looked at the IRS for the Ariane
4 and figured that they had a reliable piece of hardware that would work fine for the Ariane 5
and they could save money by reusing an existing design. That's what they did. Only they
started to make unwarranted assumptions - that the unit would work on the Ariane 5 flight
trajectory and that it didn't need to be tested in any way against the flight path expected.
(Thus saving more money.) Had they run even the most rudimentary tests of the unit
against the expected flight path of the Ariane 5, they would have triggered the condition
and detected that they had a problem. They never did.
When the rocket flew for the first time, both dual-redundant computers detected the
overflow condition. Both presumed that the cause was a hardware failure. Both shut down in
an attempt to leave the other side in control. They did *exactly* what they were designed to
do and in that sense behaved flawlessly.
The fact that the computers in question were programmed in Ada had absolutely nothing to
do with the reasons for the crash. It had no more to do with the crash than the fact that both
computers were using a Mil-Std-1750a microprocessor - a computer that has been used
reliably in numerous space applications. The original software designers were not to blame
either. They designed their software logic for the problem at hand and had to work within the
CPU time limitations they were given. Their FDA logic was *perfect* for the Arriane 4 rocket.
The fault lay with the designers of the Ariane 5 and their failure to test their assumptions. It
would be analogous to taking a tire that was designed to work on a Corvette and "reusing"
it in the design of a Freightliner truck. It works *fine* when the only weight it has to support is
a Corvette sports car. What would it likely do trying to support the weight of a Freightliner
truck?