The Ariane 5 Rocket That Exploded Over a Type Conversion

On June 4, 1996, Ariane 5 Flight 501 lifted off from Kourou, French Guiana, carrying four Cluster science satellites worth around $370 million. Thirty-seven seconds later, it veered off course and the range safety officer detonated it.

The cause was a single unhandled exception in the Inertial Reference System. A software module was computing horizontal velocity and storing the result as a 64-bit floating-point number. Then it cast that value into a 16-bit signed integer to pass it to another subsystem. Ariane 5 climbed faster than Ariane 4 ever had — fast enough that the velocity value exceeded 32,767, the maximum a 16-bit signed integer can hold. The conversion raised an operand overflow exception.

The software wasn't written to catch that exception. Instead it halted and dumped a diagnostic error code into the data bus. The flight computer, which was still trying to fly the rocket, read the diagnostic value as navigation data — and concluded the rocket was wildly off course. It wasn't. The flight computer then slewed the nozzles to compensate for a trajectory error that existed only in corrupted memory, which tore the rocket apart aerodynamically.

The module that failed had been copied verbatim from Ariane 4, where the same conversion was provably safe because Ariane 4 could never reach a velocity that would overflow the integer. Nobody had revalidated it for the new vehicle's performance envelope. The post-accident board, led by Jacques-Louis Lions, noted that the module wasn't even needed during the flight phase when it crashed — it was still running alignment calculations from the ground phase.

The Lions report became a landmark in software engineering: it argued that exception handling must be mandatory, not optional, and that reused code must be re-certified in every new operational context.