On 4 June 1996, the maiden flight of Arianespace’s Ariane 5 rocket, vehicle 501, veered off course 37 seconds after launch and was destroyed by its automated flight-termination system. The rocket carried four European Space Agency Cluster research satellites; the failure caused losses exceeding US$370 million. An inquiry board chaired by mathematician Jacques-Louis Lions found that Ariane 5 reused inertial-reference software from Ariane 4 even though the rockets had materially different early-flight trajectories.
A dormant alignment routine, needed for roughly 40 seconds on Ariane 4 but unnecessary after Ariane 5 liftoff, converted an unexpectedly large 64-bit floating-point value into a 16-bit signed integer. The resulting overflow halted both redundant inertial-reference units, which then transmitted diagnostic data that the flight computer interpreted as navigation commands. Those commands produced extreme nozzle deflections, an angle of attack above 20 degrees, structural breakup, and self-destruction. The report identified inadequate protection of three critical variables, insufficiently representative testing, and a design assumption that a detected software exception should stop the processor. Four replacement Cluster II satellites were launched in 2000, and the incident accelerated formal verification and large-scale static analysis of safety-critical software.
