Flight-Proven
The software that destroyed Ariane 5’s maiden flight was flight-proven. Both halves of that sentence are true. That is exactly the problem.
On 4 June 1996, about forty seconds after liftoff, Flight 501 veered off course and broke apart. The inquiry board chaired by Jacques-Louis Lions traced the failure to the inertial reference system: an alignment function carried over from Ariane 4 kept running after liftoff, serving a hold-in-countdown requirement that Ariane 5 did not have. Ariane 5 built up horizontal velocity five times faster than Ariane 4, producing values the Ariane 4-era code could not represent. A variable overflowed, the system shut down, and the launcher was lost. The full system was never tested against Ariane 5 trajectory data. Why would it be? It had flown successfully for years.
Here is the reframe. This was not missing evidence, and it was not faked evidence. Every fact behind “proven in flight” was real. What was missing was the scope record: which envelope the proof covered, and a trigger to reopen the claim when the application left that envelope.
Interchangeability claims age exactly this way. In my latest article, I re-quote the definition: parts capable of fully replacing each other in any application. But claims proven by similarity or simulation are proven against the applications that existed on the day of the claim. Every new variant, new plant, and new operating envelope silently extends the claim into territory the evidence never visited.
Systems engineers already own the vocabulary for the fix: verification by inspection, analysis, demonstration, or test. Each method is legitimate, each with a bounded scope. We record the method for requirements. We rarely record it for interchangeability claims. An honest claim names both: proven how, and proven for what envelope.
That is what closed-loop impact analysis is for. The evidence grade can stand; similarity is legitimate evidence, but the envelope check must be redone when context changes. “New application” is a claim-reopening event, not a footnote.
So, a test: pick one part your organization qualified by similarity or simulation. Could anyone state the envelope that evidence covered? And would anything in your change process notice when a new application steps outside it? Let me know what you think.
Ready to go deeper?
Use code Martijn10 for 10% off training—and don’t forget to tell them Martijn sent you 😉.
Copyrights by the Institute for Process Excellence
This article was originally published on ipxhq.com & mdux.net.