1
Ariane 5 1
Ariane 5 Flight 501 1
2
History 2
3
• Why Ariane 5? 3
• Why Ariane 5? • Program initiated in 1987 3
• Why Ariane 5? • Program initiated in 1987 • Evolutive 3
• Why Ariane 5? • Program initiated in 1987 • Evolutive • Now number one world luncher 3
4
4
5
Costs 5
Costs • 130 000 000 € / 10 000 kg 5
Costs • 130 000 000 € / 10 000 kg • US$370 million 5
6
What happened? 6
7
7
8
Architecture 8
Architecture Inertial Platform 8
Architecture Inertial Platform IGC 2 8
Architecture Inertial Platform IGC 2 IGC 1 8
Architecture Inertial Platform IGC 2 IGC 1 Data Bus OBC 2 8
Architecture Inertial Platform IGC 2 IGC 1 Data Bus OBC 2 OBC 1 8
9
Chronology 9
Chronology • H0 + 37 : Trajectory angle > 20° 9
Chronology • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation 9
10
10
• H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation 11
• H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 11
12
• H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 12
• Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 12
13
Ariane 5 - Vulcain 2 13
14
• Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 14
• OBC gives Nozzle Inclination Order based on IGC2’s informations which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 14
15
• OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 15
• IGC 2 sends a sequence of bits which meant IGC failure • OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • Solid Rocket Booster Separation • Self destruction! 15
16
• IGC 2 sends a sequence of bits which meant IGC failure • OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • .... • Self destruction! 16
• IGC 2 shuts down thanks to a software exception. It tries to switch on IGC 1. • IGC 2 sends a sequence of bits which meant IGC failure • OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • .... • Self destruction! 16
17
• SRI 2 shuts down thanks to a software exception. It tries to switch on SRI 1. • SRI 2 sends a sequence of bits which meant SRI failure • OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • .... 17
• SRI 1 already down thanks to the same software exception. • SRI 2 shuts down thanks to a software exception. It tries to switch on SRI 1. • SRI 2 sends a sequence of bits which meant SRI failure • OBC gives Nozzle Inclination Order based on IGC2’s informations, which were misinterpreted. • Brutal Nozzle Inclination • H0 + 37 : Trajectory angle > 20° • .... 17
18
The software failure 18
The software failure declare vertical_veloc_sensor: float; horizontal_veloc_sensor: float; vertical_veloc_bias: integer; horizontal_veloc_bias: integer; ... begin declare pragma suppress(numeric_error, horizontal_veloc_bias); begin sensor_get(vertical_veloc_sensor); sensor_get(horizontal_veloc_sensor); vertical_veloc_bias := integer(vertical_veloc_sensor); horizontal_veloc_bias := integer(horizontal_veloc_sensor); ... exception when numeric_error => calculate_vertical_veloc(); when others => use_irs1(); end; end irs2; 18
19
The unprotected variable 19
The unprotected variable • 80% maximum charge for the IGC 19
The unprotected variable • 80% maximum charge for the IGC • Need to find out which variables to protect 19
The unprotected variable • 80% maximum charge for the IGC • Need to find out which variables to protect • The HVB variable was not considered dangerous... 19
The unprotected variable • 80% maximum charge for the IGC • Need to find out which variables to protect • The HVB variable was not considered dangerous... • ...but the Ariane 5 trajectory data was not in the IGC’s spec file! 19
20
Ariane’s reaction to exceptions 20
Ariane’s reaction to exceptions • Send a sequence of bits on the bus defining the error 20
Ariane’s reaction to exceptions • Send a sequence of bits on the bus defining the error • Save the context in an EEPROM 20
Ariane’s reaction to exceptions • Send a sequence of bits on the bus defining the error • Save the context in an EEPROM • /!\ Shut down the IGC /!\ 20
21
• Untreated exceptions are obviously raised because of a hardware failure... 21
• Untreated exceptions are obviously raised because of a hardware failure... • ...but not this time! 21
22
The Mistakes 22
23
Ariane 4 code Re-use 23
Ariane 4 code Re-use • IGC code was re-used code from Ariane 4 23
Ariane 4 code Re-use • IGC code was re-used code from Ariane 4 • Software exception caused by a useless program! 23
24
...and one missing test 24
...and one missing test • ...which was not considered useful, because the ariane 5 trajectory not mentioned in the IGC’s spec file! 24
25
Recommend
More recommend
