Ariane 5 Flight 501: reused software, unrevised requirements
Software reused from Ariane 4 had never been tested against Ariane 5 conditions.
- Programme
- Ariane 5 Flight 501
- Year
- 1996
- Sector
- Space
- Outcome
- Vehicle broke up 37 seconds after lift-off
What happened
Ariane 5 Flight 501 broke up 37 seconds after lift-off.
Software reused from Ariane 4 suffered an integer overflow when it encountered Ariane 5's higher velocity.
What was found
The ESA/CNES Inquiry Board found that Ariane 5 trajectory data had not been included in the requirements for the reused software.
The Inquiry Board also found that the software had never been tested against Ariane 5 conditions.
Engineering lesson
Reuse carries assumptions with it. Software that is proven in one context is only proven for the conditions of that context, and those conditions live in its requirements.
When the operating environment changes, the requirements of every reused element need to be revisited, and verification needs to be repeated against the new conditions.
The practice this points to
Treat reuse as a change: re-examine the requirements of each reused component against the new system's operating envelope.
Require verification of reused elements under the new conditions, and record explicitly where earlier evidence is being relied upon.
Where Kelvora fits
Kelvora is a requirements and assurance platform that links reused components to the requirements and evidence they depend on. When the operating context changes, it can help engineers see which requirements and which verification evidence need to be reviewed again.
Sources
- ESA/CNES, Ariane 5 Flight 501 Inquiry Board Report, July 1996.