Figure 1. The Ariane-501 launcher on the new pad at the Guiana Space Centre (CSG), Europe's spaceport in Kourou, French Guiana (Photo. CSG for ESA/CNES)
In the early morning of 4 June 1996, at the Guiana Space Centre, Europe's spaceport, the countdown for the maiden flight of Ariane-5 proceeded smoothly until 7 minutes before main engine start (H0 7 min; Fig. 1). At this point the launch was put on hold because the strict visibility criteria for a launch were not met at the opening of the launch window (08 h 35 min local time).
Figure 1. The Ariane-501 launcher on the new pad at the Guiana
Space Centre (CSG), Europe's spaceport in Kourou, French Guiana
(Photo. CSG for ESA/CNES)
As had been forecast by the local meteorological station, visibility conditions quickly improved and the ignition sequence was initiated at H0 = 09h 33min 59s local time (= 12 h 33 min 59s UT). Ignition of the Vulcain engine and the two solid boosters was nominal, as was the ensuing lift-off (Fig. 2). The vehicle performed a nominal flight trajectory until approximately H0+37 s, but shortly thereafter suddenly veered off course, broke up, and exploded.
Figure 2. Lift-off of Ariane flight 501; the hot jet from one of
the booster flame trenches is visible in this view (Photo. CSG
for ESA/CNES)
Preliminary investigation of the flight data showed:
The origin of the failure was rapidly narrowed down to the Flight Control System, and more particularly, to the Inertial Reference Systems, which obviously ceased to function almost simultaneously at around H0+36.7 s.
The self-destruction of the launcher occurred near the launch pad, at an altitude of approximately 4000 m. All of the launcher and satellite debris therefore fell back to ground east of the launch pad, scattering over an area of approximately 12 km².
Recovery of material proved difficult, since this area is nearly all mangrove swamp or savannah. Nevertheless, it was possible to retrieve the two Inertial Reference Systems. Of particular interest was the one which had worked in active mode and stopped functioning last, and for which, therefore, certain information was not available in the telemetry data (provision for transmission to ground of this information was confined to whichever of the two units might fail first). The results of the examination of this unit were very helpful in the analysis of the failure sequence.
An independent Inquiry Board was set up in the days following the incident, and in its conclusions one can read:
The failure of Ariane-501 was caused by the complete loss of guidance and attitude information 37 s after start of the main engine ignition sequence (30 s after lift-off). This loss of information was due to specification and design errors in the software of the Inertial Reference System.
The fourteen Recommendations of the Inquiry Board are listed in the accompanying panel.
A comprehensive, so-called 'level-1' assessment of the detailed telemetry data acquired during the forty seconds of flight has been carried out. Few anomalies other than that which proved fatal have been observed and they do not call for important changes to the launcher's design. Two main points are being studied - aerodynamic coupling and the blow-back of jet streams on ignition - and both are discussed in detail in the following survey of each system.
Booster stage
The two booster stages
operated normally for 37 s. The observed pressure laws in the two
boosters were, in particular, highly symmetrical. The following
anomalies could, however, be noted:
Main cryogenic stage
The main stage and
Vulcain engine functioned satisfactorily until 38 s into the
flight. The ignition sequence was nominal and pressurisation of
the liquid-oxygen (LOX) and liquid-hydrogen (LH²) tanks was
in line with predictions. The only significant anomaly was
increasing pressure fluctuations inside the servo-actuators from
H0+20 s onwards. The likely cause is 'buffeting', a coupling
between the aerodynamic forces and the aft structure of the
launcher, which affected the Vulcain engine's servo-actuators.
With the explosion of the launcher, it did not, however, prove
possible to obtain a complete picture of this coupling, which is
by nature transient. Subsequent tests have confirmed this
physical phenomenon and show that there would be no divergence
even in extreme cases.
Vehicle Equipment Bay (VEB)
The VEB
functioned normally, apart from the failure of the two Inertial
Reference Systems and inversion of the membrane between the VEB
and SPELTRA (multiple-payload-carrying structure) when the VEB
compartment depressurised too quickly. A simple corrective
measure has since been implemented in the ventings of the upper
part of the launcher.
Upper stage - fairing - SPELTRA - payload
adapters
There is no anomaly to report here, the
flight being of such short duration that these elements were not
put to a representative in-flight test.
Electrical system
The electrical system
functioned satisfactorily overall, with only small anomalies
being detected in the launcher-to-ground telemetry links at lift-
off.
Ground-to-launcher interface - lift-off -
trajectory
The various umbilical connectors
performed nominally and were released correctly. Launcher wobble
(about the vertical trajectory at lift-off) was very slight; the
wind was also very light, at approximately 1.5 m/s. There was an
acceleration deficit as the launcher left the platform - 4.4 m/s
rather than the expected 5.3 m/s - which persisted until about
H0+26 s. Thus, after 30 s of flight, the launcher's altitude was
100 m below the nominal figure and its velocity was Mach 0.53
rather than the predicted 0.56. These figures were, however,
still within specification.
On engine ignition, overfilling with water of the booster flame trenches caused a blowback of the jet streams from the solid boosters, creating some minor damage to hardware (water is injected into the flame trenches shortly before lift-off to reduce the acoustic noise level to which the launcher is subjected). A simple modification has been devised, which is to delay the moment of water injection thereby reducing the volume at the bottom of the flame trenches, which on flight 501 partially blocked the flow of booster gases.
Flight control
Until failure of the
Inertial Reference Systems at about 36.7 s, flight control
performed nominally. As soon as a specified velocity was reached
at 25.7 s, the guidance function was activated and flight control
reacted nominally taking into account the slight under-
performance of the launcher.
Aerothermodynamics - depressurisation - air
cleanliness
Contamination inside the fairing was
about 3 mg/m² at about 37 s (specification is 2 mg/m²);
it can be assumed, based on Ariane-1 measurements, that this
contamination would be eliminated once a vacuum had been created
in the fairing.
Dynamic environment
The recorded blast
wave over-pressure slightly exceeded specification for the
fairing and the booster pallets. External acoustic noise values
were slightly higher than expected at lift-off (when they are at
their maximum), but were lower than expected when at an altitude
of 50 m. Values at the Main Stage tail structure were as
expected.
Internal acoustic noise values were lower than expected and below the interface specification for the SPELTRA structure and Vehicle Equipment Bay. For the fairing, certain internal measurements in the 31 and 63 Hz octaves were slightly above specification.
No signs of POGO effect (resonance caused by propellant flow through the feed lines) were measured at the Main Stage. As the Upper Stage had not started its propulsive phase, absence of the POGO phenomenon there could not be confirmed.
Vibration levels on the stages were low, the only exception being the Vulcain engine gimbal where the specification was exceeded but was still acceptable at system level. The payload interface complied with the specification but the vibration levels recorded were 70 to 100 Hz higher than expected. The mathematical models will therefore have to be re-adjusted.
One item that was fully qualified after the very unfortunate explosion of the launcher was the safety system, as well as its forecasts and computing models (debris impact zone, cloud dispersion model, absence of air toxicity beyond the safety limits). Explosion of the launcher at 4000 m altitude is one of the most hazardous scenarios imaginable as far as ground impact and hazardous cloud pattern are concerned.
In accordance with the French and international regulations applicable to industrial installations, a very detailed risk and impact analysis had been performed during the design, construction and testing phases of the Ariane-5 facilities at the Guiana Space Centre. An environmental measurement plan had already been implemented at each of the seven full-size booster test firings performed between 1993 and 1995. With the results of these measurements, the real impact on the natural environment (atmosphere, fauna, flora and water courses) could be determined, and the mathematical models of combustion-cloud dispersion and chemical fallout could be adjusted. The combustion gases from the solid boosters during Ariane-5's atmospheric flight include 21%(by mass) hydrochloric acid, 34% aluminium oxide, and 28% carbon monoxide and carbon dioxide. The Vulcain engine of the cryogenic main stage practically ejects only water vapour.
During the measurements of the natural state of the environment close to the Kourou facilities prior to each test, it was confirmed that, as elsewhere in the Amazonian ecosystem, the aluminium-oxide content in the ground and natural waters (between 4% and 35%), and the water acidity (PH values between 4 and 6), are particularly high.
For Ariane flight 501, more than 100 sensors were installed around the launch pad and as far afield as the towns of Kourou (15 km to the southeast) and Sinnamary (25 km to the northwest). They analysed both the air (mainly for hydrochloric acid) and the water (inside the pad's flame trenches and in the rivers). The results show that the hydrochloric-acid and aluminium-oxide fallout occurred within a 500 m radius of the launch pad. No gaseous pollution at ground level was detected by any of the measuring instruments outside the launch area. The cloud produced by the explosion and the plume of exhaust gases immediately moved parallel to the coast, and were monitored by helicopters until three hours after the accident, by which time they were several kilometres off the coast and dissipating gradually.
On the ground, several types of gases were monitored: the lift-off cloud, some still-burning solid-propellant fragments from the boosters, and the vaporisation of launcher and spacecraft propellants. These gases rose and headed towards the sea, at an altitude of more than 1000 m (Fig. 3).
Figure 3. The cloud produced by the explosion and the plume of
exhaust gases immediately moved away, parallel to the coast, and
were monitored by helicopters until three hours after the
accident. By this time, they were several kilometres offshore and
dissipating gradually. (Source: CNES/CSG)
The so-called 'Internal Operations Plan' (a legally-imposed and periodically rehearsed safety plan) was initiated immediately after the launcher's explosion. Among other procedures, it triggered a computer-aided estimation of the exact debris fallout zone by the Flight Safety Team, taking into account the launcher's position and velocity at the time of the explosion, as well as the wind pattern, which varies with altitude.
Some hours after the explosion, fragment-locating operations started. The whole of the affected area was systematically photographed and mapped. The positions of all items were fixed using the GPS system and were found to be well within the pre- computed impact zone. The heaviest fragments had landed in the savannah and marshland between 1 and 2 km east of the launch pad. Lighter pieces had 'flown' for some minutes and landed further away, influenced by the mainly northwesterly wind, but did not represent a hazard (Fig. 4). Some of the solid-propellant fragments continued to burn on the ground, causing very localised savannah fires. The vegetation affected is recovering rapidly and no impact on the indigenous fauna has been detected, confirming similar observations made after the static firings of the boosters.
Figure 4. The fragment fallout zone shown on this drawing was
well within the Flight Safety Team's estimated area. The dotted
lines represent the trajectories followed by the heaviest
fragments (Source: CNES/CSG)
Fragment-recovery operations were started immediately thereafter and involved almost one hundred people (safety engineers and technicians, firemen, security guards, and legionnaires) over a period of several weeks. Helicopters and special amphibious vehicles were deployed. Priority was given to recovering first those parts relevant to the failure investigation, including the two inertial reference units and the onboard computers. Carefully respecting the safety rules (avoiding explosion, fire or release of hazardous materials), the majority of the more accessible items, including the solid- propellant fragments, were also recovered as quickly as possible. Most elements of the four Cluster satellites were also recovered (Fig. 5) and returned to ESTEC in Noordwijk (NL) for inspection, but unfortunately none were still flightworthy.
Figure 5. Recovery work in progress at the impact site of one of
the Cluster spacecraft (Photo: CSG)
The main findings of the Inquiry Board show that the 501 flight failure was due to design faults in the software embedded in the Inertial Reference System (SRI):
These anomalies had not been brought to light by all of the various programme tests and reviews, which had otherwise proved effective. The ground/flight mode interface had been inadequately identified. Furthermore, testing at equipment and system levels had been insufficiently representative. However, the overall Ariane-5 architecture is not called into question.
All of the Inquiry Board's recommendations have been transformed into a plan of action comprising over 40 detailed items, classified according to the various firms and hardware items concerned. The plan's main thrust's are:
Detailed actions prompted by the Inquiry Board's findings are summarised in the accompanying panel.
Additional actions to those prompted by the Inquiry Board's findings are also being taken:
All these actions must be completed before flight 502 in order to guarantee a successful outcome with maximum confidence.
SRI
System qualification environment (functional simulation facility)
Programme
Improvement of overall coordination relating to software
Improved assessment of flight data
The Inquiry Board advocated (Recommendation No. 14) a more transparent organisation, closer engineering cooperation, and clear-cut authority and responsibility among the partners in the Ariane-5 Programme.
In the past, hardware equipment was considered as a whole and treated as single Configuration Controlled Item. Thus, the embedded software was not studied in the same detail and showed up only in the functional specifications which the hardware equipment was required to meet. The detailed design and functional impact on other pieces of software elsewhere in the vehicle was insufficiently known. It was therefore decided to formally establish the role of 'Software Architect', a responsibility that has since been discharged by the Industrial Architect, given the need to understand properly how the software functions both in the electrical/computing-system environment and in the launcher-system environment. A revised Management Specification (A5-SM-0-10, industrial organisation) has been issued to strengthen the Industrial Architect's role regarding embedded software. The Industrial Architect is now involved in the reviews held at various points in the development of each software-containing component, and approves, as does CNES, its definition and qualification plan.
The software programmes embedded in the hardware equipment will also be considered as Configuration Controlled Items and, as such, the Industrial Architect is required to:
The project reviews - Preliminary Design Review, Critical Design Review and Qualification Board - also draw on outside software experts.
For the already developed Ariane-5 onboard software, the post- 501 plan of action has foreseen exhaustive verification in the form of qualification reviews (after registering all software flight-domain limitations, failure modes and information likely to flow through the communication bus between the equipment and the onboard computers) in order to gain a better understanding of all possible system functioning modes.
The Industrial Architect also has overall responsibility for the Electrical and Software System (SEL), and in particular:
An exhaustive verification, involving all of the launcher's constituent hardware, of the applicability and actual application of the general system specifications has been undertaken, in order to check that no system aspect has been overlooked in developing this hardware.
The Qualification Board was given the mandate to set up specialised audit groups to study any aspect it considered critical. Each audit group is headed by a member of the Qualification Board, and draws on outside experts in the area concerned. This approach has the dual advantage of drawing together the necessary expertise and judging, in depth, the suitability of the work done and the validity of programme documentation issued.
As far as the aforementioned action plan is concerned, significant progress has already been made in four primary domains:
More or less independent of the flight-501 failure, further qualification is required for a number of improvements which, for schedule or other development-constraint reasons, could not be built into the 501 vehicle and are thus being introduced for the first time on flight 502. The main improvements involve:
The flight-502 Vulcain engine, with the improved hydrogen turbopump, was delivered in November 1996, and integration of the Main Stage was well underway at the time of writing (mid- December).
Mid-March 1997 will be the key date for delivery to the Guiana Space Centre (CSG) of the remaining flight-502 hardware, including:
The Flight-Readiness Review will take place on 18 and 19 March, with the launch campaign planned to begin at CSG on 7 April. The Launcher Countdown Rehearsal will take place on 21 May, to be followed by the Launch-Readiness Review on 4 and 5 July 1997.
The Ariane-502 launch date is closely linked to the calendar of the flight programme modifications, their development and, most importantly, their validation tests. Analysis of this workload is still in progress and the launch date will only be confirmed on satisfactory completion of the validation testing, but the objectives set in mid-December 1996 included a target launch date of 8 July.
Since flight 501 did not validate the GTO mission, it has been decided to use flight 502 to qualify the launcher's nominal mission, namely a dual launch into GTO. This means that flight of the Atmospheric Re-entry Demonstrator (ARD), which cannot be launched with a standard GTO mission since it requires a specific 'en-route jettison manoeuvre' at the end of the main-stage burn, has to be postponed until flight 503. The 502 passengers will therefore be the AMSAT- P3D radio-amateur satellite and two technology-demonstration mockups.
The APEX (Ariane Payload EXperiments) configuration inside the upper part of the vehicle is shown in Figure 6. The upper mockup weighs 2000 kg and includes a 350 kg payload known as 'TEAMSAT,' which is composed of five experiments proposed by various European Universities and coordinated by ESTEC:
Figure 6. The planned Ariane-502 payload configuration
In the lower position inside the SPELTRA, the 550 kg AMSAT-P3D satellite (Fig. 7) will be mated to the lower mockup, weighing 1800 kg. The satellite and a Special Bearing Structure (SBS) have both been developed by the international AMSAT organisation. The SBS has been designed to carry a larger payload on its top, thereby creating a generic launcher-to-spacecraft interface adapter and separation system for payloads in the 500 to 1000 kg class as secondary passengers, but it will not be used for this purpose on Ariane-502.
Figure 7. The AMSAT-P3D international radio-amateur satellite
undergoing final preparations in Orlando, Florida (Photo: L.
Mulvehill/CQ VHF Magazine)
AMSAT-P3D's main mission objectives are to:
In order to achieve the above objectives, AMSAT-P3D's final orbit will have a perigee of 4000 km, an apogee of approximately 50 000 km, and an inclination of 60 deg.
Since two successful test flights are necessary to demonstrate full qualification of Ariane-5, flight 503 will also form part of the qualification process. The planned payloads are the Atmospheric Re-entry Demonstrator (ARD) mentioned above, a technology-demonstration capsule for a future European manned space transport vehicle, and a commercial payload. The 503 launch is expected to take place approximately five months after flight 502, to allow sufficient time for a full evaluation of the 502 flight data, for the launcher's shipment to French Guiana, and for the launch campaign itself.
AMSAT is a worldwide group of radio-amateurs who share an active interest in building, launching, and then communicating with each other using non-commercial radio-amateur satellites. Since its initial founding in the USA more than 25 years ago, AMSAT has predominantly used volunteer labour and donated resources to design, construct and, with the assistance of government and commercial space agencies, successfully launch over two dozen radio-amateur communications satellites into Earth orbit. The AMSAT-P3D programme is managed by AMSAT-DL (Germany), whilst the integration and testing work is being performed by AMSAT-NA (USA). Groups in these two countries are providing the spacecraft and mission design, platform structure, and much of the spacecraft's equipment. Other hardware items (mainly transmitters and receivers) are being provided by radio-amateur groups in over a dozen countries on five continents, forming a unique international team of volunteers who make a remarkable contribution to the advancement of space communications, space education and the space sciences.
ESA Bulletin Nr. 89.