Ariane 5 Flight 501
loreprogramming
The 1996 maiden launch destroyed by an integer overflow in software reused from Ariane 4.
Thirty-seven seconds after liftoff on June 4, 1996, a 64-bit velocity value overflowed a 16-bit conversion inside inertial-alignment code inherited from Ariane 4, where the flight profile made the overflow impossible; on the faster Ariane 5 it was not. The exception took down both redundant units running identical code, the rocket veered and self-destructed, and roughly half a billion dollars of vehicle and payload fell into the Atlantic. The Lions report made it the eternal case study on reusing code outside its validated envelope.
On 4 June 1996 the maiden flight of Ariane 5 veered off course thirty-seven seconds after launch and destroyed itself, losing the rocket and its four scientific satellites. The cause was a conversion of a 64-bit floating point value to a 16-bit signed integer that overflowed, in code inherited from Ariane 4.
Three details make it exemplary rather than merely expensive. The code was doing something only meaningful before launch and had no function at all in flight, so the calculation that killed the rocket was not needed. The value overflowed because Ariane 5 flew a genuinely different trajectory with larger horizontal velocity, which the Ariane 4 assumption had ruled out. And the exception that resulted was handled by shutting down the inertial reference unit, which the backup unit, running identical software, had already done for the identical reason.
The lesson the inquiry drew was about reuse, not arithmetic. Code proven correct in one environment carries its assumptions with it, and inheriting it without revalidating those assumptions is inheriting an unstated specification. Redundancy that runs the same software is redundancy against hardware failure only, which is why design diversity exists and why it is expensive enough that people keep deciding they do not need it.