The Inquiry Board's Recommendations
R1 Switch off the alignment function of the inertial reference
system immediately after lift-off. More generally, no software
function should run during flight unless it is needed.
R2 Prepare a test facility including as much real equipment
as technically feasible, inject realistic input data, and perform
complete, closed-loop, system testing. Complete simulations must
take place before any mission. A high test coverage has to be
R3 Do not allow any sensor, such as the inertial reference
system, to stop sending best-effort data.
R4 Organise, for each item of equipment incorporating
software, a specific software qualification review. The
Industrial Architect shall take part in these reviews and report
on complete system testing performed with the equipment. All
restrictions on use of the equipment shall be made explicit for
the Review Board. Make all critical software a Configuration
R5 Review all flight software (including embedded software),
and in particular:
- Identify all implicit assumptions made by the code and
its justification documents on the values of quantities provided
by the equipment. Check these assumptions against the
restrictions on use of the equipment.
- Verify the range of values taken by any internal or
communication variables in the software.
- Solutions to potential problems in the onboard computer
software, paying particular attention to onboard computer
switchover, shall be proposed by the Project Team and reviewed
by a group of external experts, who shall report to the onboard-
computer Qualification Board.
R6 Wherever technically feasible, consider confining
exceptions to tasks and devise backup capabilities.
R7 Provide more data to the telemetry upon failure of any
component, so that recovering equipment will be less essential.
R8 Reconsider the definition of critical components, taking
failures of software origin into account (particularly single-
R9 Include external (to the project) participants when
reviewing specifications, code and justification documents. Make
sure that these reviews consider the substance of arguments,
rather than check that verifications have been made.
R10 Include trajectory data in specifications and test
R11 Review the test coverage of existing equipment and extend
it where deemed necessary.
R12 Give the justification documents the same attention as
code. Improve the technique for keeping code and its
R13 Set up a team that will prepare the procedure for
qualifying software, propose stringent rules for confirming such
qualification, and ascertain that specification, verification and
testing of software are of a consistently high quality in the
Ariane-5 Programme. Inclusion of external RAMS (Reliability,
Availability, Maintainability, Safety) experts is to be
R14 A more transparent organisation of the cooperation among
the partners in the Ariane-5 Programme must be considered. Close
engineering cooperation, with clear-cut authority and
responsibility, is needed to achieve system coherence, with
simple and clear interfaces between partners.