Ariane 5, Flight 501: How One Overflow Blew Up a Rocket in 40 Seconds

On 4 June 1996, the Ariane 5 rocket broke apart and self-destructed 37 seconds after launch on its very first flight. On board: four scientific satellites worth around half a billion dollars, atop a rocket that cost billions to develop. The cause wasn’t physics or engines. The cause was one number conversion in software that nobody really tested. It’s one of the most instructive cases in the history of testing — let’s break down what happened and what QA takes away.

What happened

The Ariane 5 carried an Inertial Reference System (SRI) that computes the rocket’s attitude and velocity. Its software was taken almost unchanged from the previous rocket, Ariane 4. Inside was a piece of code that converted horizontal velocity from a 64-bit floating-point number to a 16-bit integer.

Ariane 5 launched with more power and on a steeper trajectory than Ariane 4. The horizontal velocity was higher than assumed — and during the conversion the number didn’t fit into 16 bits: an overflow occurred. The code wasn’t protected against it: an unhandled exception was raised. Instead of handling it gracefully, the SRI output a diagnostic error code — and the control system interpreted those bits as real flight data. The rocket veered sharply, began to break up under aerodynamic loads, and the automatic self-destruct fired. 37 seconds.

Why redundancy didn’t help

There were two SRIs on board — primary and backup, for reliability. But they ran the same software. The backup failed on the same line from the same overflow a fraction of a second before the primary. Redundant copies of identical units don’t protect against a bug in the code itself — both instances contain the same bug.

The kicker: that calculation wasn’t even needed

The most galling part: the code that failed handled platform alignment before launch. After liftoff it wasn’t needed at all — but, inherited from Ariane 4, it kept running for a few seconds after launch “just in case.” So the rocket was destroyed by functionality that did no useful work in flight.

QA lessons

Reused code isn’t validated code. It was validated for Ariane 4’s flight envelope, not Ariane 5’s. When you reuse a component in a new context, re-test it against the NEW inputs and conditions — don’t assume “it worked before, so it works.”
Test boundaries and overflows. The float→int conversion was deliberately left unprotected — based on the old rocket’s assumptions. Any type narrowing (64→16 bits) is a boundary to hit with maximum/impossible values.
Dead and unnecessary functionality is a risk. A calculation not needed after launch kept running and killed the rocket. Code that “just runs in case” should either have a reason or be turned off.
Redundancy with identical software ≠ fault tolerance. Identical copies fail identically. Real redundancy requires diversity (a different algorithm/implementation) — or at least the awareness that “another identical one” doesn’t save you from software bugs.
Error handling and fail-safe. The exception produced garbage that was read as data. A system should degrade safely, not “fall over into diagnostics” that someone interprets as a working signal.
Test in the real configuration and on real data. The SRI was never run with Ariane 5’s actual trajectory — only Ariane 4’s assumptions. That’s the classic system/integration testing gap: the component “works” in isolation, but not in the real environment with real inputs.

In short — what to take with you

A $370M rocket was brought down by one unprotected number conversion — software, not hardware.
Reused code must be re-tested in the new context; “it worked before” isn’t an argument.
Type narrowing is a boundary: hit it with maximums, overflow, impossible values.
Dead functionality running “just in case” is a source of risk.
Redundancy with identical software doesn’t protect against a bug in that software.
Test in the real configuration and on real data, not on assumptions.

Further reading: Ariane flight V88 (Wikipedia) · Inquiry Board report · Ariane 5 report — mirror