THE EVIDENCE TRAIL
Sources & provenance
What was read. What was invented. What remains unknown.
Alternative web search for source discovery, followed by direct source-text verification; original paraphrases only. Research date: 2026-10-04. This page renders the live repository records rather than maintaining a separate source list.
Source catalog
Download source catalog and access log (JSON)S1 / secondary commentary; motivation for study
Ten Years Of Flawless Flights Proved Nothing About The Software That Destroyed Ariane 5
- author
- Channi Greenwall
- publisher
- published
- Unknown / not established
- accessed
- 2026-10-04
- status
- article body read
- notes
- Publication date not established from retrieved body. Attribution follows the user-supplied article. Full text is not redistributed.
S2 / primary inquiry report through an academic mirror
Ariane 5 Flight 501 Failure: Report by the Inquiry Board
- author
- Inquiry Board chaired by J. L. Lions
- publisher
- ESA/CNES inquiry; University of Minnesota mirror
- published
- 1996-07-19
- accessed
- 2026-10-04
- status
- relevant report sections read directly
- sections
- 2.1; 2.2; 2.3; 3.1(e-t); 3.2; 4: R1-R5, R9-R12
- supports
- conversion and BH mechanism; common-mode SRI loss; timing and phases; test omission; feasible detection tests; post-flight reproduction; assumption governance
- limitations
- Separate technical report, raw telemetry, full source tree and compiler details were not obtained.
S3 / primary institutional history
Ariane 1 to 4 launch facilities
- publisher
- CNES / Centre Spatial Guyanais
- accessed
- 2026-10-04
- status
- read directly
- supports
- first Ariane 4 launch on 15 June 1988; 116 Ariane 4 launches in ELA2 history
S4 / language reference, Ada 2012
Ada Reference Manual, 4.6 Type Conversions
- publisher
- Ada Information Clearinghouse
- accessed
- 2026-10-04
- status
- conversion rules read directly
- supports
- nearest-integer ties-away convention for the illustrative model
- limitations
- Not evidence of exact flown Ada compiler, machine instructions or subtype range.
S5 / primary research-program guidance
Combinatorial Methods for Trust and Assurance
- publisher
- NIST CSRC
- accessed
- 2026-10-04
- status
- read directly
- supports
- interaction testing; coverage measurement; sequence testing; limitations of universal extrapolation from empirical interaction findings
S6 / recommended methods reference
SP 800-142: Practical Combinatorial Testing
- author
- D. Richard Kuhn, Raghu N. Kacker, Yu Lei
- publisher
- NIST
- published
- 2010-10
- accessed
- 2026-10-04
- status
- publication metadata verified; full publication not analyzed
- notes
- Technical interpretation in this study also rests on S5 and the independently executable coverage counterexample.
S7 / primary voluntary risk-management guidance
AI RMF 1.0: AI Risks and Trustworthiness
- publisher
- NIST AI Resource Center
- published
- 2023
- accessed
- 2026-10-04
- status
- validity, reliability, robustness and safety sections read directly
- supports
- contextual intended-use validity; realistic representative test sets; robustness and ongoing monitoring
- limitations
- Does not estimate whether AI would discover Ariane 501's fault.
Research access log
- Alternative web search and direct fetch: used. Search summaries used for discovery, not as primary evidence
- Direct source verification: used. Relevant source text was read and compared with the research claims; individual records distinguish direct reading, metadata verification and unavailable evidence
- https://www.esa.int/Newsroom/Press_Releases/Ariane_501_-_Presentation_of_Inquiry_Board_report: HTTP 403. Official announcement not directly readable; primary inquiry read via university mirror
- https://www.esa.int/Enabling_Support/Space_Transportation/Ariane_42: HTTP 403. First-launch chronology independently checked at CNES
Variable provenance
Documented facts, derived mathematics, synthetic inputs, and unavailable quantities are kept distinct. Empty historical values mean unavailable, not zero. BH values are conversion units, not speed or telemetry.
Download full variable register (CSV)| name | evidence class | value | units | source | model use | limitation |
|---|---|---|---|---|---|---|
| conversion source width | documented | 64 | bits | S2 section 2.1 | Python float proxy | Not original machine implementation |
| conversion target width | documented | 16 signed | bits | S2 section 2.1 | Signed range check | Original subtype context unavailable |
| integer limits | derived | -32768 to 32767 | conversion units | Signed 16-bit mathematics | Boundary tests | Not a physical speed limit |
| rounding | model convention | nearest ties away | conversion units | S4 | Ada-style demonstrator | Not verified against flown compiler |
| backup failure time | documented | 36.7 | seconds after H0 | S2 finding 3.1(e) | Historical narrative only | Approximately 30 seconds after lift-off |
| active failure delay | documented | approximately 0.05 | seconds | S2 finding 3.1(f) | Historical narrative only | Do not equate with data-cycle period |
| data cycle | documented | 0.072 | seconds | S2 section 2.1 | Optional trace step | Not complete internal SRI schedule |
| flight mode start | documented | -3 | seconds relative H0 | S2 section 2.1 | Historical narrative only | H0 is ignition command |
| alignment duration from mode start | documented | 50 | seconds | S2 section 2.1 | Historical narrative only | Not time after lift-off |
| alignment end after liftoff | approximate documented | 40 | seconds after lift-off | S2 sections 2.1 and 3.1(m) | Fixed modeled cutoff | Approximation not exact schedule |
| horizontal velocity buildup ratio | documented | 5 | relative rate | S2 finding 3.1(p) | Context only | Not a BH multiplier or transfer function |
| replicas | documented | 2 | units | S2 section 2.1 | Identical deterministic failure | No modeled inter-unit timing delay |
| processor workload target | documented | 80 | percent | S2 section 2.2 | Context only | No timing or resource model |
| bh legacy support | synthetic | 0 to 30000 | conversion units | Study design | Uniform sampling | Not Ariane 4 data |
| bh expanded support | synthetic | 0 to 65535 | conversion units | Study design | Uniform sampling | Not Ariane 5 data |
| time support | synthetic | 0 to 80 | seconds after lift-off | Study design | Uniform independent sampling | Not a flight operational profile |
| rare tail weight | synthetic | 0.001 | probability | Study design | Mixture sampling | Not an empirical tail estimate |
| rare tail bh support | synthetic | 32768 to 65535 | conversion units | Study design | Uniform overflow tail | Deliberately constructed stress condition |
| synthetic trace peak | synthetic | 50000 | conversion units | Study design | Linear BH ramp over 50 seconds | Not calibrated to flight |
| bh scale and filter | unavailable | Unavailable | Unavailable | Not obtained in reviewed sources | No imputation | Needed for physical trajectory mapping |
| raw flight telemetry | unavailable | Unavailable | Unavailable | Not obtained in reviewed sources | No imputation | Needed for independent historical replay |
| original source or executable | unavailable | Unavailable | Unavailable | Not obtained in reviewed sources | No emulation claim | Needed for implementation-in-loop replication |
| diagnostic word encoding | unavailable | Unavailable | Unavailable | Not obtained in reviewed sources | Boolean message-kind abstraction | No bit-pattern or flight-law reconstruction |
| sensor noise distribution | unavailable | Unavailable | Unavailable | Not obtained in reviewed sources | No noise fitted | Needed for quantitative physical uncertainty |
| readiness switches | synthetic | 7 | Boolean factors | Study design | 128-row joint prerequisite grid | Designed configurations not a population sample |
| readiness target | synthetic | 0.95 | probability | Study design | Declared random-discovery target | Not a guarantee or empirical AI discovery rate |
| readiness short budget | synthetic | 10 | iid opportunities | Study design | Undersized random-campaign control | Injected witness is separate from random draws |
| readiness target budget | derived | 5990 | iid opportunities | Binomial formula at p=0.0005 | Minimal budget meeting declared target | Conditional on synthetic distribution and iid sampling |
| replay retention | synthetic | true or false | policy switch | Study design | Retain input design oracle and expected detection | Not independent human validation |
| response enforcement | synthetic | true or false | policy switch | Study design | Block under Boolean response rule | Not a measurement of organizational action |
Executable assumption register
Teaching model; map these obligations to real implementation evidence before deployment. Owners below are responsibility roles, not claims of assigned people.
Download all assumptions (JSON)
A1: BH remains representable whenever alignment executes
- status
- refuted for historical Ariane 501 by S2; conditional in model
- owner
- navigation requirements owner
- evidence
- S2, S4
- scope
- Every reachable phase and new trajectory
- falsifier
- BH 40000 at 20 seconds after lift-off
- test
- test_model.ConversionTests.test_out_of_range
- invalidation trigger
- New vehicle trajectory, scaling, representation or phase schedule
- consequence
- Navigation loss through uncontained conversion failure
A2: An unnecessary alignment function cannot affect flight-critical service
- status
- refuted without isolation
- owner
- system safety owner
- evidence
- S2
- scope
- Shared processor and exception policy
- falsifier
- Overflow in alignment halts both navigation units
- test
- test_model.SystemTests.test_containment_and_removal
- invalidation trigger
- Changed task lifetime or exception handling
- consequence
- Apparently noncritical code becomes transitively critical
A3: Adding identical replicas prevents a deterministic software failure
- status
- refuted under shared implementation and trigger
- owner
- resilience architect
- evidence
- S2
- scope
- Common-mode software rather than iid hardware faults
- falsifier
- One, two and three identical units all halt
- test
- test_model.SystemTests.test_same_bug_defeats_redundancy
- invalidation trigger
- Shared code, input, configuration or recovery dependency
- consequence
- Redundancy provides no protection against this cause
A4: A present bus frame is valid navigation output
- status
- refuted
- owner
- interface and evaluation owner
- evidence
- S2
- scope
- Normal and diagnostic modes
- falsifier
- Diagnostic frame passes packet-presence oracle
- test
- test_model.SystemTests.test_diagnostics_guard_not_a_navigation_repair
- invalidation trigger
- Message schema or error semantics change
- consequence
- Failure is scored as success or drives unsafe control
A5: A nominal-output SRI simulator preserves the implementation failure modes
- status
- refuted in this model
- owner
- simulation qualification owner
- evidence
- S2
- scope
- Implementation-specific conversion and exception behavior
- falsifier
- Identical hazardous inputs fail with real logic but pass with stub
- test
- test_model.SystemTests.test_simulator_can_erase_bug
- invalidation trigger
- Changed mock, simulator, instrumentation or hardware interface
- consequence
- False assurance from missing failure paths
A6: Many passing samples establish safety outside their input support
- status
- refuted mathematically and constructively
- owner
- evaluation statistics owner
- evidence
- S2, S7
- scope
- Distribution shift and omitted conditions
- falsifier
- A million legacy-like passes coexist with expanded-profile failures
- test
- test_experiments.ExperimentTests.test_narrow_support
- invalidation trigger
- Changed operating distribution or newly identified variable
- consequence
- Inapplicable confidence bounds are transferred to deployment
A7: Detecting a violation automatically produces replayable evidence and an enforced response
- status
- refuted by independent replay-retention and response switches
- owner
- evaluation and release decision owner
- evidence
- scope
- Synthetic response policy; not empirical human behavior
- falsifier
- Disable replay retention or response while preserving detection
- test
- test_readiness.ReadinessTests.test_replay_and_response_are_downstream_of_detection
- invalidation trigger
- Changed logging, evidence retention, gate wiring or decision ownership
- consequence
- A detected defect does not become a reproducible release blocker
A8: Any nonzero detection probability makes a short random budget adequate
- status
- refuted relative to a declared discovery target
- owner
- evaluation statistics owner
- evidence
- scope
- Specified iid rare-tail distribution and 95% target
- falsifier
- 10 tests miss the target at p=0.0005 while 5990 is the minimal adequate budget
- test
- test_readiness.ReadinessTests.test_minimal_rare_event_budget_is_computed_not_assumed
- invalidation trigger
- Changed tail probability, dependence, stopping rule or probability target
- consequence
- A possible detection is misrepresented as a high-probability discovery guarantee