Curriculum·Senior·R411
Building, Validating, and Operating Your Own Automation
Ariane 5 Flight 501, 4 June 1996. The launcher lost all guidance and attitude information 37 seconds after the start of the main engine ignition sequence, began to disintegrate at about 39 seconds, and about 40 seconds after the flight sequence began, at an altitude of about 3,700 meters, veered off its flight path, broke up and exploded.
Lesson 1 opens on
The Mars Climate Orbiter, 23 September 1999
The Mars Climate Orbiter launched on 11 December 1998 and fired its main engine for about sixteen minutes on 23 September 1999 to enter Martian orbit, after which contact was lost. The mishap investigation board found that one team supplied thruster impulse values in pound-force seconds while the navigation software expected newton-seconds.44822 newtons, the navigation computations read every impulse as substantially smaller than it was, and the accumulated trajectory error placed the spacecraft on a path entering the atmosphere at roughly 57 kilometres of altitude rather than the intended figure near 226.
The lessons
- R411-01From rules to codeSeparate the rule from its encoding, and name where the loss actually occursabout 32 min · opens on The Mars Climate Orbiter, 23 September 1999
- R411-02Backtesting automation honestlyName the four places look-ahead enters through a data pipeline rather than through logicabout 32 min · opens on The Ariane 5 conversion, read as a validation boundary
- R411-03Paper and staged deploymentName the four deployment stages and what each one is allowed to concludeabout 32 min · opens on Knight Capital's deployment, 27 July to 1 August 2012
- R411-04Operating the systemSpecify what the system must do when the venue is unavailableabout 32 min · opens on The New York Stock Exchange halt, 8 July 2015
- R411-05Risk controls in the machineList the five machine-level limits and where each one must liveabout 32 min · opens on Everbright Securities, 16 August 2013
- R411-06Reviewing automated performanceReview at component level rather than on the total, and say why the total hides a failureabout 33 min · opens on AXA Rosenberg's model error, 2007 to 2011
Labs
R411-L
Take one strategy from hypothesis through specification, backtest with walk-forward validation, paper deployment with realistic fills, and a written go/no-go decision with pre-committed deployment criteria, risk limits, monitoring plan, and shutdown conditions. A rigorous rejection is a passing outcome.