Case Study: Ariane Flight V88
CSCI 3921w Social, Legal, and Ethical Issues in Computing
Adriana Picoral
Q&A (10 minutes)
Q&A about ethics, computing, and logistics of the course.
No question is too silly, naive, controversial, basic, or advanced.
Warm-up
Before we start, answer in your journal:
Think of a time you used existing code (a function, a library, a Stack Overflow snippet, AI-generated code) without fully checking it.
- What assumptions did that code make?
- How did you know they held in your context?
What happened
- 1996 flight of the European Space Agency’s (ESA) new Ariane 5 rocket
- About 37 seconds after lift-off, the rocket veered off course, began to break apart, and self-destructed
- Payload: the four Cluster satellites, a scientific mission to study Earth’s magnetosphere
- Cost: roughly US$370 million in rocket and payload (commonly cited figure), on top of a decade of development
- No one was killed
What happened
- The bug itself was small and well understood
- The failure was not really about one line of code; it was about assumptions, reuse, testing, and organizational decisions
- It raises a question we will keep returning to: who is responsible when a complex system fails?
The technical cause
- The rocket’s Inertial Reference System (SRI) tells the flight computer where the rocket is and how it’s moving
- Code from a previous successful Ariane version was reused
- One calculation converted a 64-bit floating-point number (related to horizontal velocity) into a 16-bit signed integer
- Ariane 5 was faster than Ariane 4
- The value was too big to fit which caused an operand error (overflow) with the exception not handled
The technical cause
The calculation that failed served no purpose after lift-off.
- It was part of an alignment function only needed before launch
- On Ariane 4, it kept running for ~40 seconds after lift-off, a feature that allowed a quick restart if the countdown was held
- Ariane 5 did not need this feature, but it was kept because “it worked” and changing it was seen as a risk
Why wasn’t it caught?
From the Inquiry Board report (Lions et al., 1996):
- The specifications did not include Ariane 5 trajectory data
- No full system test was run
Key quote
“The exception which occurred was not due to random failure but a design error. The exception was detected, but inappropriately handled because the view had been taken that software should be considered correct until it is shown to be at fault. […] The Board is in favour of the opposite view, that software should be assumed to be faulty until applying the currently accepted best practice methods can demonstrate that it is correct.”
– Ariane 501 Inquiry Board Report, 1996
Aftermath
- The Inquiry Board issued 14 recommendations (e.g., turn off functions not needed in flight, test with real equipment, have sensors send best-effort data instead of stopping)
- The Cluster mission was rebuilt (Cluster II) and launched in 2000 on Russian Soyuz rockets
- Ariane 5 went on to become one of the most reliable launchers, including launching the James Webb Space Telescope (2021)
- Scientists lost years of work
- European taxpayers paid for the loss
The problem of many hands
Helen Nissenbaum (1996), written the same year as Flight 501, identifies barriers to accountability in computing:
- the problem of many hands: so many people contribute that no one feels responsible
- the problem of bugs: treating software errors as inevitable, “just how software is”
- blaming the computer: “the computer did it”
- software ownership without liability: vendors disclaim responsibility
Which of these do you see in Ariane 5?
Connection to professional codes
ACM Code of Ethics:
- 2.1 Strive to achieve high quality in both the processes and products of professional work
- 2.5 Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks
- 2.6 Perform work only in areas of competence
Group Discussion
- Who is responsible for the failure of Flight 501?
- What is the difference between “no single person is to blame” versus “no one is responsible”?
- The code was reused because it was proven reliable. When does reuse make systems safer, and when does it make them more dangerous?
- “It worked on Ariane 4” was treated as evidence of correctness. What is the difference between a system that has not failed and a system that is correct?
- The full system was never tested with real equipment, partly because of cost. Who should decide how much testing is “enough,” and on what basis?
Group Discussion: Ethics frameworks
Each group takes one framework:
- Consequentialism: Who bore the costs of the failure? Would the outcome judgment change if the payoff had been astronauts instead of satellites?
- Deontology: What duties did engineers and managers have, regardless of the outcome? Which ACM principles were violated?
- Contractualism: Could the decision to skip full system testing be justified to everyone affected?
Bringing it forward
Ariane 5 is not an isolated case. Compare:
What patterns do you see across these cases?
References and Further Readings
- Lions, J. L. et al. (1996). Ariane 5 Flight 501 Failure: Report by the Inquiry Board
- Jézéquel, J.-M., & Meyer, B. (1997). Design by contract: The lessons of Ariane. IEEE Computer, 30(1), 129–130.
- Nuseibeh, B. (1997). Ariane 5: Who dunnit? IEEE Software, 14(3), 15–16.
- Nissenbaum, H. (1996). Accountability in a computerized society. Science and Engineering Ethics, 2(1), 25–42.
- Arnold, D. N. Some disasters attributable to bad numerical computing (UMN)
- ACM Code of Ethics and Professional Conduct
Journal Writing
Reflect on what you liked and disliked about this lecture, what you learned, and what you wished you’d learned.
- What you learned from the lecture and discussion – this can be something that surprised you, something you had not considered before, a new way of thinking about something
- What you wish you’d learned from the discussion – this can be questions you still have and questions you would like to explore further
- Anything you liked of disliked