The code that exploded a rocket

In 1996 a very expensive (but fortunately non-fatal!) rocket explosion became a teachable moment in computer science, when the debut launch of the ESA's shiny new Ariane 5 rocket spectacularly failed less than a minute after lift off.
This video was produced for a University of Sydney online course called "NaN: Numbers And Numerics".
Credits:
Ariane 5 launch videos: ESA, Arianespace, CNES
Mission Control flight desk image: NASA
Ariane 4 & Ariane 5 images: ESA, Arianespace, CNES

[@SteevyMathew]

You should really voice an audiobook... Or a podcast... Or just record yourself reading a scientific journal or even a dictionary.

[@TopQuark]

You're very kind. I'll give it a try if I can find a dictionary ...

[@perfectionbox]

Or describing animals during their mating season 🤣

[@416pp]

@@TopQuark why did you stop making videos this was brilliant…. Don’t stop now

[@TopQuark]

@@416pp haven't stopped, just on ... uh ... extended break? Trying to find the time to do more. Watch this space!

[@hoocna]

I feel kinda bad for laughing so hard at how you animated the content. EXCELLENT job hahahah

[@sovietmudkip1]

I'm so glad this channel got randomly mentioned in a Reddit post. The content is excellent

[@ryanhamstra49]

You mentioned the code ran for 40 seconds then shut down, and on the old rocket it was fine but this one was going faster. My favorite part is the issue happened at 38 seconds into flight, so they didn’t even have to fix the software, they would have just had to do the math and know and shut it down at 35 seconds instead and it would have been fine

[@OzoneTheLynx]

Btw. The start procedure also changed for Ariane 5, so that loss of time in case of a hold? Wasn't even a thing anymore in Ariane 5. So it served literaly no purpose XD

[@R2k2]

A very nice video, in ‘easy to understand’ English! Thank you for the video! I have seen a talk from Matt Parker, with him explaining this disaster. And it is a small addition to this story. On the Ariana 4, there were indeed a lot of sensors which the guidance system monitored. (Including the sensor that was still sending data, when it could have been turned off after launch). Some sensors would send 16 bits of data, and some sensors would send 64 bits. For the sensors that could send 64 bits, there was a small checksum that would check the amount of bits. But some sensors never send more than 16 bits. And for these sensors, the checksum never initiated. To save memory and computer power, they would allocated a 16 bit part of the memory in the guidance system for the sensors that wouldn’t exceed a 16 bit data block. (Why reserve a space of 64 bits, when only 16 bits are coming in)? And this worked just fine. For the Ariana 4. But when the Ariana 5 launched, and like this video explaines, this particular sensor suddenly went beyond the 16 bits of data and send 64 bits of data. But because there were only 16 bits allocated for this sensor in the guidance system’s memory bank, the guidance system crashed and send this error message to the flight computer. And like this video brilliantly explained, the flight computer interpreted this message as navigation data.

[@TopQuark]

Yes, Matt dug deeper than I did it seems - he's like that :) I didn't want to go into checksums and so on for this video, so a simplified story made sense. The essence is there. Thanks for the kind words!

[@jamskinner]

Why would an even semi modern cup need to save compute by only doing 16 bit?

[@logarhythmic6859]

"Why test the code? It worked on the other rockets" It's not nearly as costly or as serious, but it kind of reminds me of the Venera probes that landed on Venus. In Venera 9-12, either one or both lens caps failed to release from the camera, and then Venera 14 had the lens cap release, but it landed right under where another instrument was supposed to take measurements of the surface, thus blocking the measurements.

[@gasparinizuzzurro6306]

sviluppo sw da anni e non posso che essere d'accordo con te. non è che è esploso per non curanza dei programmatori (chiunque sbaglia e i test ci sono per questo, per assicurare al meglio l'affidabilità), è esploso per i soliti "ragionieri-manager" dell'economia che hanno TAGLIATO sulla necessità di fare test, tanto funzionava per il razzo vecchio. I have been developing sw for years and I can only agree with you. it is not that it exploded due to the neglect of programmers (whoever makes a mistake and there are tests for this, to ensure the best possible reliability), it exploded for the usual "accountants-managers" of the economy who have CUT on the need to do tests , "because it worked for the old rocket."

[@wysoft]

Probably 1-2 days max to set up a simulated environment to test the software using known performance characteristics of the new rocket. Nah, too expensive to bring those lazy ass coders in.

[@deletedgamer111]

"Let's just ship it and then push the fix to production."

[@AfricanFlightStar]

You an ex-Boeing employee? Asking for a friend. 😁

[@jpppe]

@@AfricanFlightStar💀

[@RAJATHRAJRK]

You can host history lessons or science classes with such a cool sound

[@TopQuark]

Thank you! I'd love to do more, just need a few more days in the week ...

[@rty1955]

Sounds like Microsoft coders work. Thier motto: "get it off your desk, let the users make you aware of a bug." Typical kiddie coders.

[@agirlindenial8752]

lol

[@Daresco]

Very nice content, very well explained. Thumbs up!

[@MichaelPohoreski]

@2:10 Standard *2's complement* means negative values have the sign bit *set* so -1 is 1111 1111 1111 1111, and -32768 is 1000 0000 0000 0000.

[@simonnielsen1525]

A very good description of the accident. My CS 101 professor gave a very similar presentation of the problem back in 1996, when the post mortem report first came out.

[@gawayne1374]

I love the reaction of the flight director.

[@WrathofArminius]

Let’s just pray 🙏 that this doesn’t happen in November when they use this rocket for the James Webb 🔭

[@jarvis7472]

Its one of the most reliable rockets in service with about 80 succesfull launches is a row. But I'm still scared as hell for the launch.

[@WrathofArminius]

@@jarvis7472 no, I know. I’m just saying. I’m half empty kinda guy I guess. Lol. I would literally cry if something goes wrong. Seriously excited about this. For years. Anyways, it’ll be perfect. Of course it won’t happen.

[@d4nielDayZContent]

The last 40 secs of this video left me speechless.

[@jonathanwalther]

Immediate subscription!

[@madkea4807]

Great comedy! Great EXPENSIVE comedy. I can keep laughing as no lives were lost, right

[@stighenningjohansen]

its a flaw in their system. No quality control going on? or guidelines, reviews, testing to failiure? This a sign of weakness in the ESA organisation. An embarrassing one

[@AW-xj4un]

Excellent description of something that was born of laziness and incompetence.

[@PRCA-zw4xo]

Outstanding video. Thank you so much. Will be showing to my class.

[@Blaze_0101]

Does the computer inside rocket has permission to self destruct itself when it is in danger? If is it so then the precious satellites or any other important thing that that the rocket was carrying can be forcefully ejected like pilots in fighter jet do to save time and money right?

[@waqarmehdi4394]

Inadvertently I am watching this on a 4th of June 24 years later.

[@jamskinner]

Why convert from float to int anyway? And why only a 16 bit int? How old is this hardware?

[@charlesbyrne5594]

The most expensive firework in history!

[@NJTDover]

4:26 the cat rang Elon Musk for some tips but unfortunately his mobile was engaged. Poor puss lost all hope and bought the farm.

[@JacquelineCaldwell-u8j]

Very informative! Thanks 👍🏼

[@leandro842]

Stupid error.

[@greggb557]

Pointy end.. wait, boom!!

[@aseemsameer7281]

There are some things terribly wrong mentioned in this video. The system did not shut down after calculating the integer overflow. It simply gave an error message. Why would a system shut down if it's software produces an exception? It's against software design fundamentals. Also, we don't need a handling mechanism for the guidance system to handle errors, we either need the main computer to simply support 64 bit integers and not correct itself when guidance system goes down. Lastly, there is no 'freaking out' in software. It's either 1 or 0.

[@TopQuark]

Thanks for your comments, though I think you're overstating a bit these "terribly wrong" issues. First, the official report on the accident states that the errors encountered caused once of the guidance computers to shut down - this was a programming decision built into the system, and while you say it's against programming fundamentals, it was clearly part of the coding culture at the time. Your second point: it's easy to say what would have made this problem go away in retrospect. That these things weren't done at the time IS THE WHOLE POINT. Finally, "Freaking out" is my shorthand for those 1s and 0s not working out properly and things going badly wrong. So anyway, thanks for watching, and for being interested enough to throw some comments in.

[@lucassousa9201]

What a great video! Thank you very much for this. You've got an amazing voice, by the way hahaha

[@TopQuark]

Thank you. I'm trying to get back into a semi-regular uploading schedule again, as opposed to a year between videos (which even CGP Grey would raise an eyebrow at).

[@shahidzia4365]

mashallah.

[@waldoppen]

How does something this important get so far down the launch process without being noticed...?

[@TopQuark]

Hindsight makes it obvious. When you have a large team working on something, it's *really* hard to make sure Group A knows to ask all of the questions about the bit of the code that Group B worked on. It simply never occurred to Group A that there might even be a problem ... until there was.

[@errrzarrr]

@@TopQuark couldn't explain it better myself.

[@RockinRob2258]

@@TopQuark This is also where good system design is key. Something like Leveson's System Theoretic Process Analysis (STPA) method. Notice, the individual software components or systems containing software didn't fail, but the interaction between two systems was bogus and caused the failure.

[@YagamiAckerman]

A type-conversion bug.

[@andersmusikka]

Were negative integers coded that way in the Ariane computer? Seems very unusual - most computers use two's complement representation.

[@Hammer_Games]

yep, floats are not saved that way... there is one bit which decides if the number is positive or negative. and value is then a simple binary to decimal conversion... this would make the rocket fall either :D

[@andersmusikka]

@@Hammer_Games I'm thinking about the table shown at 2 minutes. It seems to be showing integers, encoded in a very interesting and unusual way!

[@Hammer_Games]

@@andersmusikka Me too. I believe it was encoded in the usual way, just the author of the video made it wrong. Because there are a 15-bit value and 1 bit of sign. You decode it very easily, it might vary if the sign is the first or last bit... but overall surely 0x16 is not int16.MinValue :) Because what makes any number are bits in binary order and so 16x0 is 0... It could also be a big-endian or small endian. Means that bits could be written from start rather the end... I am not sure how "OS" for this was written, but still, this would make no sense.

[@TopQuark]

Well spotted both. I didn't want to go TOO deep on the different ways to do integers, so I just did a simple thing ... knowing that people who know about such things might go 🤔

[@thomasgreiner1646]

Arianespace used the Ariane 4 on board computer with hardly any modifications. This meant they had not calculated for the extreme vibrations with hugely more powerful rocket system the on board computer shut down because of vibration overload. Mission control decided reluctantly to destroy L501 before any other catastrophe (the launch path is eastwards over the mid Atlantic and Gabon, Africa). Sadly a ten year project from ESTEC the 4 Cluster satellites were on board (for measuring the Magnetosphere) The Ariane 5 was designed with much more powerful boosters and Vulcan thruster for human (heavier) space equipment launching but of course there was no one interested after the disaster. Shit happens...

[@sequalsr2550]

Thats what REAL BAD LUCK IS LIKE BOIS

[@nurulamaliaramadhani9591]

Was there a ethics that was violated in that case?

[@muhammadrehan6241]

Dekhli video kar li tyaari quiz ki??? #uog

[@heroiheroi1812]

Kya Samjh Ai Aapko? Aor Sir Kya Sawaal Pooch Sakte?

[@-learningastronautics-astr3753]

Soy el único que me que le pasó que al encontrar el título en ESPAÑOL, esperaba oír un video EN ESPAÑOL???

[@AfricanFlightStar]

Great summary, thank you!

[@johanrosenfeld3153]

Bonsoir à tous, Johan, ne t'inquiète pas, il y aura un nouvel agenda des lancements d'Arianespace 1996-1997 qui seront les suivantes: 10/09/96 Vol 91 Ariane 42 P Lanceur L462 ECHOSTAR 2 13/11/96 Vol 92 Ariane 44 L Lanceur L463 ARABSAT 2B & MEASAT 2 30/01/97 Vol 93 Ariane 44 L Lanceur L465 GE-2 & NAHUEL 1A 28/02/97 Vol 94 Ariane 44 P Lanceur L464 INTELSAT 801 16/04/97 Vol 95 Ariane 44 LP Lanceur L467 BSAT-1A & THAICOM 3 03/06/97 Vol 97 Ariane 44 L Lanceur L468 INMARSAT- 3F4 & INSAT -2D 25/06/97 Vol 96 Ariane 44 P Lanceur L466 INTELSAT 802 08/08/97 Vol 98 Ariane 44 P Lanceur L469 PAS 6 Merci cordialement, Johan.

[@kcageek7140]

Des français ?je suis tout seul

[@SomeRandomGuy_id]

Thank GOD James Webb telescope survived the launch.

[@kyokogodai-ir6hy]

What does anyone involved care? They got paid. SMH

[@Naufal-Bagas]

keren mas

[@zandvoort8616]

Wasn’t the guidance system designed and built by the U.K.?

[@crispybacon9917]

So, it was only 1 second off not blowing up? Tragic

[@Ramdomdude-mt4sw]

im studying for my software engineering exam, very funny and interesting video thanks

[@apolloskyfacer5842]

So it was management cutting costs who were really to blame for this disaster. Did they get the guillotine outa storage ?

[@waqarmehdi4394]

We see an example where 1 sec could cost you billions and years of accumulated hard work and intellectuality.

[@alexfigueroa9993]

I don't know why this was recommended from YT but, wow!

[@hilwaamanamankiyar-pp5bf]

uark

[@mervynsands3501]

A monumental oversight that should have been foreseen. How foolish is that.

[@orlovskyconsultinggbr2849]

Yeap, i will use it in my client presentation of not doing requirements engineering

[@randomdude4411]

Rocket science is more easier than programming

[@eduardosalvadornoriega4387]

All because they forgot a semi colon

[@letmetlo]

This video is very funny and sad at the same time

[@alexandruandru455]

So eventually the error was not the integer overflow but the fact that the code designed for launchpad alignment (where the velocity would obviously not cause overflow) ran longner than supposed.

[@jamskinner]

The overflow is a problem if there is no way to handle it. Exceptions typically cause execution to end unless handled by some error handling code.

[@stag3t-muspsa910]

IM SITTING HERE SCRATHING MY HEAD.......🤔🤔

[@ignatiusjk]

Yea that's what I was thinking.

[@arcticspacefox864]

Thank you very good explaination

[@lokesh303101]

1996.

[@alextan8924]

Payload is lost

[@maximilianhohl412]

Oh man this is so terrible and sad I'll never complain about debugging again

[@TopQuark]

I know, right? Nothing exploded when I got some FORTRAN code wrong during my physics research in the olden times. OK, other than my head, maybe.

[@jimdailey1018]

You lost me but I'll bet that was a very bad day for a bunch of people.

[@TopQuark]

When the pointy end isn’t going upwards, it’s a bad day

[@551taylor]

Oops!

[@Joangelis]

great video

[@shahidzia4365]

very nice explanation

[@karlmahlmann]

Very well explained. So sad.

[@miquelcalafellestarellas1226]

F

[@alanomuyaku7445]

Wow!!

[@sourabhjagtap4950]

And that's why exception handling is necessary

[@jamskinner]

Probably built before exception handling was built into the language.

[@ianchan2624]

cool video dude!

[@cryptomonkey6142]

Oops

[@vinijill1622]

Loved the explanation !

[@nilakshguleria2449]

This happens when everyone is positive thinker.

[@jgmccabe]

I'm sure this has been addressed, but the bit about "the original programmers decided to keep that bit of code running for 40 seconds after the scheduled lift-off" is a bit of a red herring. The code that was reused was written that way for Ariane 4, but it was management that decided to cut costs by not testing the whole Ariane 5 system in a safe, simulated environment (because, as mentioned, the code had worked perfectly well before) where the "continues running after lift-off but 1. shouldn't, 2. doesn't need to, 3. causes problems" issue would've been found.

[@apolloskyfacer5842]

So it was management cutting costs who were really to blame for this disaster. Did they get the guillotine outa storage ?

[@casey2979]

"datter"

[@jesusramirez000]

For some reason I feel like esa is almost always having this type of issues

[@ronliebermann]

The explosion of this rocket was a shame, I remember when it happened. But this failure was caused by human error, not by a line of code. If you watch the video, you’ll note that they don’t give the names of the men who were involved. They carefully attribute everything to “machines”. According to communist ideology, governments are supposed to omnipotent, so they can never admit to a mistake. Therefore government employees must never be blamed for incompetence, or wrongdoing. This video was a snow job to direct attention away from the real cause of the accident: Idiots who didn’t know what they were doing.

[@rolletroll2338]

"According to communist ideology" what the hell are you talking about?