Real talk about software, hardware, and the ideas changing how we build things.
We cover the technical side of technology. Not just the product launches and press releases, but the architecture decisions, the tradeoffs, and the engineering culture that shapes what actually gets built. Our…
Topics we cover: Software · Hardware · Developer Tools · AI & Machine Learning · Open Source · Security
On 19 October 2016, the ExoMars Schiaparelli entry demonstrator deployed its parachute about three minutes after atmospheric entry, experienced unexpected high rotation rates, and saturated its Inertial Measurement Unit for roughly one second. The guidance, navigation and control software merged that corrupted rotation data into its state estimate, produced a large attitude error, and eventually computed an altitude below ground level. The flight computer then released the parachute and backshell, fired the braking thrusters for 3 seconds instead of 30, and activated the on-ground sequence as if the vehicle had landed. It was still at about 3.7 km. Signal was lost at 14:47:22 UTC, roughly 43 seconds before the expected touchdown, and the module hit the surface at an estimated 540 km/h. The ESA inquiry attributes the loss to saturation handling, modelling, and validation gaps — not to a failed IMU. That distinction is the whole article.
The primary document is the ESA Inspector General’s ExoMars 2016 – Schiaparelli Anomaly Inquiry (DG-I/2017/546/TTN, Issue 1 Rev 0, 18 May 2017), with a public summary distributed through ESA’s exploration portal. The causal chain below is drawn from those documents and from ESA’s own summary language; where I am interpreting rather than quoting, I say so.
The inquiry notes the behaviour was reproduced in computer simulations of the control system’s response to the erroneous information. That matters: this was not an unpredictable physical event. It was a logic path that could be exercised on the ground and wasn’t, at least not with a representative sensor.
The tempting read is “bad gyro.” The inquiry does not support that. The IMU did what saturated sensors do: it reported at its limit. The failure lived at the hardware-software boundary, in three places the inquiry names explicitly.
BBC’s reporting on the inquiry lists “the saturation limit for the IMU was set too high” among the root causes. A range chosen against nominal flight envelopes leaves no headroom for the transient that actually occurs — in this case, parachute inflation. Setting the limit high does not prevent saturation; it only moves the threshold past the point where the flight software might have recognised the event as anomalous. The retrieved sources do not give the numeric limit or the measured peak rates, so I will not invent them. Confidence that the limit was a contributing factor: high, per the inquiry summary. Confidence in any specific number: none.
“Inadequate handling of IMU data by the guidance software” is another named root cause. The mechanism is visible in the architecture: attitude comes from integrating gyro rates, and altitude comes from fusing that attitude-propagated state with radar measurements. A one-second corruption at the input propagates through the integrator and contaminates the state long after the sensor has recovered. The inquiry’s own framing — “one mistake in any of the sub-models can ruin everything” — is about simulation, but it applies equally to the estimator.
The inquiry report states that the parachute model used in the end-to-end simulator and the Avionics Test Bench “does not include disturbances at parachute inflation such as lateral movement and area oscillations.” If the simulation never produces the rates that saturate the IMU, no test campaign built on that simulation will ever exercise the saturation path. The validation gap and the modelling gap are the same gap.
This is the line that should stop a review cold. From the inquiry’s description of the Avionics Test Bench limitations: “IMU EM are used only for electrical interface and polarity tests – the IMU cannot be stimulated to be included in the navigation function or in the GNC closed-loop tests.” The navigation function was therefore never tested against a representative IMU under closed-loop conditions. The exact failure mode that occurred — saturated rates feeding the estimator — was outside the test envelope by construction.
An altitude below ground level is physically impossible. It is also, in software terms, trivially detectable. The fact that a negative altitude propagated into irreversible event triggers tells you there was no plausibility gate between the estimator output and the event logic. The estimator was allowed to be wrong, and the event logic was allowed to believe it.
This is where I move from sourced fact to design argument. The inquiry documents the outcome; the following is my reading of what a defensible architecture would have done differently. Treat it as engineering opinion grounded in the documented chain, not as a finding of the board.
Each rule below is written so it can be tested on a bench, not just asserted in a review.
Treat the IMU saturation flag as a first-class fault with an explicit persistence window. If saturation persists beyond a defined threshold — one second is the documented duration here — the estimator should hold, reinitialise, or degrade to a backup attitude source rather than integrating through the event. Bench test: inject a saturation pulse of the measured duration into the IMU interface and verify the estimator’s response is bounded and the flag is latched for the specified window.
Parachute release, backshell separation, thruster enable, and on-ground mode are one-way doors. Each should require agreement between independent sensors — for Schiaparelli, the integrated IMU altitude and the radar Doppler altimeter — within a plausibility band before the command is issued. Bench test: drive the radar and IMU channels to disagree by more than the band and confirm no irreversible command is issued.
Altitude must be non-negative. A negative estimate should raise a fault, not trigger a landing sequence. This is a one-line check with a large blast radius. Bench test: force the estimator to output a negative altitude and confirm the event logic is blocked and a fault is logged.
Choose the IMU range against worst-case measured deployment transients, including parachute inflation, not against nominal flight. If the measured transient exceeds the selected range, that is a finding, not a nuisance. Bench test: replay recorded inflation-rate data through the selected IMU model and confirm the saturation flag asserts where expected and the software handles it.
An IMU that can only be tested for electrical interface and polarity leaves the navigation function untested against sensor faults. The test bench must be able to inject representative rate profiles — including saturation — into the closed-loop GNC. Bench test: run the full descent sequence with injected inflation transients and verify the estimator and event logic behave as specified.
If the parachute model omits inflation disturbances, the Monte Carlo campaign cannot discover the failure. Add lateral movement and area oscillation terms to the inflation model and re-run the dispersion analysis. Bench test: confirm the updated model produces body rates that reach the IMU range and that the software response is characterised.
This is a constructed example, not a record of any specific vehicle. A flight computer accepts an integrated altitude of −50 m and, without cross-checking the radar return, commands parachute release. A plausibility gate requiring altitude ≥ 0 and agreement with radar within a defined tolerance would have blocked the command and raised a fault. The gate is cheap; the release is not reversible. The Schiaparelli chain is the same shape at a larger scale.
Several things would sharpen this analysis and are not in the retrieved material: the numeric IMU saturation limit, the measured peak rotation rates during inflation, the specific altitude plausibility logic (or absence of it) in the GNC software, and which corrective actions were actually implemented for ExoMars 2020. The inquiry notes recommendations and required software upgrades; it does not, in the retrieved excerpts, verify implementation. Claims that the 2020 mission incorporated specific fixes should be treated as unverified until the project’s own documentation says so.
No. The inquiry attributes the loss to saturation handling, modelling, and validation gaps. The IMU reported at its limit, which is what a saturated sensor does.
About one second, per ESA’s update as summarised by The Planetary Society — longer than expected.
Because the flight software believed the vehicle had landed. The negative altitude estimate triggered the on-ground sequence, which cut the burn short. The planned burn was 30 seconds.
The inquiry indicates the module was close to a successful landing at the planned location and that other checks and balances, had they been present, could have prevented the loss. That is the inquiry’s assessment, not a simulation result I can reproduce here.
Treat saturation as a fault with a persistence window. Gate irreversible events on multi-sensor agreement. Reject physically impossible states before they reach event logic. Set thresholds against measured transients. Require a stimulable sensor in closed-loop validation. Put the disturbance that matters into the simulation. A one-second sensor saturation should never be able to command a descent sequence; the architecture should make that impossible, and the bench should prove it.
The native garment preview shows a dark shirt with very small, centered lowercase lettering: meh. No animal illustration. No exclamation point. No secondary graphic. The period is there, and it matters. This is not a slogan in the usual sense. A slogan asks you to agree, to belong, to declare something. This asks for nothing. That is the design argument, and it is worth reading closely.
Most printed t-shirts are legible at conversational distance. The type is large enough to be read across a room, and the message is sized to match its confidence. This one is not. The lettering is small and centered, which means a reader has to be close to see it at all. The shirt does not broadcast. It withholds. Whether that is a deliberate design decision or simply the scale the artwork was set at, the effect is the same: the message is available only to someone already near enough to notice.
That is an unusual thing for a garment to do. Clothing usually carries a message outward, to strangers, as a form of self-description. Here the message is almost private. The lowercase meh. reads less like a statement and more like a status indicator — the kind of terse, lowercase, punctuation-light text that shows up in a terminal or a chat window when something has finished, or failed, or simply stopped mattering. I am not claiming the designer intended a software reference. The visual evidence does not support that claim, and I will not manufacture one. What the evidence does support is a description: small, lowercase, centered, terminated with a period. The rest is interpretation, and I will label it as such.
Interpreted as typography rather than as a joke, the period is the most interesting element. In retail copy the word is often written without punctuation, as a bare interjection. The printed artwork, as observed, includes the period. A period closes a sentence. It signals completion, not continuation. Meh alone is a sound; meh. is a verdict. The difference is small on the page and large in reading. It converts a shrug into a full stop.
There is a useful distinction here for anyone who writes terse messages for a living — commit messages, status lines, incident summaries, the one-line note left on a whiteboard. A slogan is a promise. A status line is a report. The two are often confused. A slogan says what you want to be true; a status line says what is true now. The shirt’s lettering sits on the status-line side of that line. It does not promise enthusiasm, productivity, or even a mood. It reports a state and stops.
That is also why the design resists the usual gift-roundup framing. It is not a novelty that depends on a shared joke about introversion, though the listing title uses that word. The visual observation does not show an introvert, an animal, or a scene. It shows four letters and a period. The humor, such as it is, comes from the mismatch between the effort of wearing a printed shirt and the flatness of what the shirt says. That mismatch is the whole object. Adding an illustration would resolve it. The design does not resolve it.
For technical readers, the more interesting question is what kind of message survives being this small. In interface design, small type is usually a failure of hierarchy — something that should have been larger was set too small. Here the smallness is the hierarchy. The message is deliberately demoted below the threshold of casual reading. It is a signal for the person who leans in, not for the room. Whether that is good design depends on what you want a shirt to do. If you want it to start conversations, it is a poor choice. If you want it to be readable only by people already close enough to be having one, it is coherent.
The shirt is listed as a standard t-shirt under the Quirky Cotton Collective brand, and the exact listing is here. The observation above is of the native garment preview, not of a worn garment. I have not worn it, washed it, or tested how the print holds up, and I am not going to pretend otherwise. What can be said from the preview is narrow and specific: the lettering is small, lowercase, centered, and punctuated. Everything else in this column is an argument about what that combination does, not a claim about the shirt’s quality.
The argument, stated plainly: understatement is a design decision with consequences. A small lowercase word with a period is not the same object as a large capitalized word with an exclamation point, even if both are printed on cotton. The first asks to be noticed; the second asks to be agreed with. The meh. shirt belongs to the first category, and that is a more interesting category than it first appears. It treats the garment as a surface for a quiet signal rather than a billboard for a personality. You may find that appealing or pointless. Either reading is available from the same four letters.
Editorial note: This publication and Quirky Cotton Collective share an owner. This is not an independent review.
The shirt shows a single line of white capitals, I HAD POTENTIAL, above a white curved ramp. At the upper left, on a short ledge, sits a dashed empty circle. At the lower right, on a flat ledge, rests a solid white ball. The ramp between them is curved, not a straight diagonal. That is the whole design. No arrows, no equations, no labels beyond the sentence. The drawing is doing the work, and the sentence is the caption.
Most slogan shirts ask you to agree with a sentence. This one asks you to read a diagram. The difference matters, because the diagram is not decorative. It encodes a specific physical idea, and the joke only lands if you notice which object moved and which one did not.
I want to be careful about what the drawing can and cannot establish. It is a cartoon, not a free-body diagram. It has no scale, no axes, no stated masses, no friction coefficient. What it does have is a legible before-and-after: a dashed outline where a ball used to be, and a solid ball where a ball now is. The dashed circle is the conventional visual shorthand for something absent or displaced. The solid ball is the thing that is present. The curved ramp connects the two positions.
Read literally, the image says: a ball was at the top of a curved descent, and now a ball is at the bottom. The dashed circle marks the starting position. The solid ball marks the ending position. The sentence above says the ball had potential. In physics, potential energy is energy stored by virtue of position in a field. An object held above a lower surface has gravitational potential energy relative to that surface. Release it, and the potential converts to kinetic energy as it descends. The curved ramp is the path of that conversion.
So the joke is not that the ball was lazy. The joke is that the ball did exactly what a ball at the top of a ramp does. It had potential, and the potential was spent. The dashed circle is the ghost of the configuration that stored the energy. The solid ball is the configuration after the energy has been released. The shirt is a two-frame animation compressed into one still.
That reading depends on one visual choice: the ramp is curved, not straight. A straight diagonal would read as a simple inclined plane, and the joke would still work, but the curve adds something. A curved descent implies acceleration that changes along the path. It looks more like a track than a wedge. It also makes the drawing feel less like a textbook illustration and more like a small machine. The ball does not slide down a triangle; it follows a shaped route from one ledge to another. The curve is the only element that suggests motion rather than mere arrangement.
The other choice that matters is the empty circle. A solid ball at the bottom alone would be ambiguous. It could be a ball that never moved, or a ball that was always there. The dashed circle at the top is what turns the image into a sequence. It says: this position used to be occupied. Without it, the sentence I HAD POTENTIAL would have nothing to attach to. The dashed outline is the visual tense of the shirt. It is the past tense of the ball.
There is a second reading available, and I think it is the one most wearers are responding to. In ordinary speech, having potential means having capacity that has not yet been used. A person with potential is a person expected to do something later. The shirt takes that phrase and pairs it with a diagram in which the potential has already been converted. The ball is at the bottom. The dashed circle is empty. The sentence is in the past tense. The joke is the gap between the two: the phrase we use to describe unrealized capacity, printed above an image of capacity that has been fully realized as a descent.
That is a different kind of joke from a sarcastic caption. It is a visual pun that requires the reader to supply the mechanism. The shirt does not say the ball wasted its potential or fulfilled it. It just shows the before and after and lets the sentence carry the regret. The regret is not in the drawing. The drawing is neutral physics. The regret is in the tense.
This is why the design works better as a diagram than as a slogan alone. A plain shirt reading I HAD POTENTIAL would be a statement of self-assessment, and the reader would have to guess whether it was rueful or defiant. The ramp and ball give the sentence a referent. They make the abstraction concrete. They also make the joke testable in a way that a slogan is not: you can look at the image and ask whether the ball actually had potential, and the answer is yes, and the answer is also that the potential is gone. The drawing does not argue with the sentence. It illustrates it too literally.
I would not claim the shirt teaches physics or improves anyone’s understanding of energy. It is a cartoon. But it is a cartoon with a correct internal logic, and that is more than most diagram jokes manage. The dashed circle is on the upper ledge. The solid ball is on the lower ledge. The ramp connects them. The sentence is in the past tense. Every element is consistent with the others. There is no extra decoration to dilute the reading.
The minimalist execution helps. White ink on a dark garment, or the inverse, with no secondary text and no border. The capitals are plain. The ramp is a single stroke. The two ledges are short horizontal lines. The whole thing reads at a glance, which is what a diagram has to do if it is going to be worn. A more elaborate illustration would invite scrutiny it could not survive. This one invites exactly the amount of scrutiny it can survive: enough to get the joke, not enough to demand a free-body diagram.
If you are the kind of reader who spends your day looking at schematics and timing diagrams, the shirt is a small pleasure because it respects the same habit. It presents a before and an after and expects you to infer the transition. It does not label the transition. It does not explain the physics. It assumes you will see the dashed circle and the solid ball and understand that one is the past state of the other. That is a diagram convention, not a slogan convention, and it is the reason the shirt reads as dry rather than sentimental.
The phrase itself is common enough that the shirt is not relying on novelty of wording. What it adds is the drawing. That is the part worth looking at. The dashed circle is the argument. The solid ball is the punchline. The curved ramp is the mechanism that connects them. The sentence is the caption that tells you which tense to read the image in.
You can find the shirt at the Quirky Cotton Collective listing. The design is described there as a physics pun, and the visual observation above is the basis for this reading. I am not claiming the shirt demonstrates a physics result or that wearing it will make anyone better at physics. I am claiming that the drawing is legible, that its parts are consistent, and that the joke depends on a visual convention rather than a verbal one. That is a modest claim, and it is the one the artwork supports.
Editorial note: this publication and Quirky Cotton Collective share an owner.
Most retellings of Ariane 5 Flight 501 stop at the arithmetic: a 64-bit floating-point value was converted to a 16-bit signed integer, the value did not fit, and the launcher was lost. That summary is accurate as far as it goes, and it is also the least useful version of the story for anyone who designs embedded systems.
The Inquiry Board’s report is unusually specific about what happened, because the evidence was unusually good. Both Inertial Reference Systems (SRIs) were recovered from the debris field. The Board read out their memory, reproduced the internal events by simulation, and examined the software code, which it found consistent with the failure scenario. The report states the chain is established beyond reasonable doubt. This is a documented post-mortem with hardware in hand, not an inference from telemetry alone.
What the Board describes is a chain of three separable decisions. The overflow is the first link. The exception-handling policy is the second. The reuse of Ariane 4 alignment behavior is the third. Each link was individually defensible inside its own context. Only the chain was fatal, and the chain is what a bench test can actually exercise.
The sequence the Board establishes runs from the destruction backward. The launcher began to disintegrate at about H0 + 39 seconds under aerodynamic loads from an angle of attack greater than 20 degrees, which separated the boosters and triggered self-destruction. The nozzle deflections that produced that angle were commanded by the On-Board Computer (OBC) using data from the active SRI. Part of that data was not flight data at all but a diagnostic bit pattern from the SRI computer, which the OBC interpreted as attitude information.
The active SRI had stopped sending correct data because it had declared a failure due to a software exception. The OBC could not switch to the backup because the backup had already ceased functioning during the previous data cycle, a 72-millisecond period, for the same reason.
The exception itself came from a data conversion. The Board’s wording is precise: the internal SRI software exception was caused during execution of a data conversion from 64-bit floating point to 16-bit signed integer value, and the floating-point number being converted had a value greater than what a 16-bit signed integer could represent. That produced an Operand Error. The conversion instructions, written in Ada, were not protected against causing an Operand Error, although other conversions of comparable variables in the same place in the code were protected.
The variable in question was an internal alignment result called BH, Horizontal Bias, related to the horizontal velocity sensed by the platform and calculated as an indicator of alignment precision over time. BH was much higher than expected because the early trajectory of Ariane 5 differs from that of Ariane 4 and produces considerably higher horizontal velocity values. The Board does not publish the numeric value of BH in the retrieved report text, and this article does not supply one.
The conversion that failed sat in software that only performs alignment of the strap-down inertial platform. That module computes meaningful results only before lift-off. After lift-off it serves no purpose.
It was still running because of a timing requirement inherited from the previous vehicle. The alignment function is operative for 50 seconds after the SRI enters Flight Mode, which occurs at H0 minus 3 seconds on Ariane 5. When lift-off occurs, the function therefore continues for approximately 40 seconds of flight. The Board states plainly that this time sequence is based on an Ariane 4 requirement and is not required for Ariane 5.
This is the reuse link, and it is the one most often skipped in summaries. The code was not wrong for Ariane 4. The 50-second window was not wrong for Ariane 4. The assumption embedded in both — that the alignment function’s inputs stay within a bounded range during the window it remains active — was an Ariane 4 assumption. Carrying the module forward carried the assumption forward without a corresponding check against the new vehicle’s early trajectory.
The Board is explicit that the overflow alone did not fail the mission. The specification of the exception-handling mechanism contributed to the failure. On any kind of exception, the system specification required three things: indicate the failure on the databus, store the failure context in EEPROM, and shut down the SRI processor. The EEPROM was recovered and read out. The Board identifies the decision to cease processor operation as what finally proved fatal.
The rationale behind that policy is documented and, in its own terms, coherent. The Board describes a culture within the Ariane programme of addressing random hardware failures. From that viewpoint, an exception-handling mechanism is designed for a random hardware failure, which a backup unit can reasonably cover. A systematic software fault is a different failure class, and the policy did not distinguish between them.
Restart was not a recovery path. The Board notes that attitude is too difficult to recalculate after a processor shutdown, so the unit becomes useless. The Board also observes that the computers within the SRIs could have continued to provide their best estimates of the required attitude information, and that there is reason for concern when a software exception is allowed, or even required, to halt a processor handling mission-critical equipment.
The Ariane 5 flight control system carried two SRIs with identical hardware and software, one active and one in hot standby. If the OBC detected that the active unit had failed, it would switch immediately, provided the other unit was functioning properly. On Flight 501 the other unit was not functioning properly, because it had hit the same exception one 72-millisecond cycle earlier.
The Board’s language on this point is worth keeping intact: the loss of a proper software function is hazardous because the same software runs in both SRI units, and in this case it resulted in the switch-off of two still healthy critical units of equipment. The units were healthy in the hardware sense. They were not independent in the failure-mode sense.
This is the redundancy lesson in its least glamorous form. Counting units overstates reliability when the units share a systematic fault path. A hot standby protects against random hardware failure. It offers nothing against a deterministic software exception triggered by the same input on both units within the same cycle.
The Board records why not all conversions were protected. A maximum workload target of 80% had been set for the SRI computer. To bound the exposure of unprotected code, an analysis was performed on every operation that could raise an exception, including Operand Error. The conversion of floating-point values to integers was analyzed, and operations involving seven variables were found at risk. Protection was added to four of them, visible in the Ada code. Three were left unprotected.
The reasoning for the three, as reported to the Board, was that they were either physically limited or had a large margin of safety. For BH, that reasoning turned out to be faulty. The Board found no reference in the source code directly justifying the decision, and observed that the assumption, while agreed, was essentially obscured from external review by the volume of documentation around any industrial application.
Two further findings matter for anyone who audits reuse. The decision to protect some variables and not others was taken jointly by project partners at several contractual levels. And there is no evidence that trajectory data were used to analyze the behavior of the unprotected variables; it was jointly agreed not to include Ariane 5 trajectory data in the SRI requirements and specification.
The interpretation I would draw, and it is an interpretation rather than a Board finding: a resource budget became a safety argument. The 80% workload target is a constraint to negotiate. It is not evidence that a hazard is bounded. When a protection is removed to meet a budget, the justification for removal needs to be as traceable as the protection itself, and it needs to be re-derived whenever the operating envelope changes.
The ESA presentation of the Board’s report states the conclusion directly: the loss of guidance and attitude information was due to specification and design errors in the SRI software, and the extensive reviews and tests carried out during the Ariane 5 development programme did not include adequate analysis and testing of the SRI or of the complete flight control system, which could have detected the potential failure.
The same release stresses that the alignment function, which served a purpose only before lift-off but remained operative afterward, was not taken into account in the simulations, and that the equipment and system tests were not sufficiently representative. The Board’s corrective list follows from that gap: switch off or inhibit the alignment function after lift-off, modify fault processing so the processor does not shut down, and test to check coverage of the SRI flight domain. At system level it calls for representativeness improvements, systematic use of real equipment where possible, and simulation of real trajectories on SRI electronics.
Note what the corrective list targets. It does not begin with “use a wider integer.” It begins with removing the post-lift-off function, changing the exception policy, and proving the flight domain is covered. The arithmetic fix is necessary and insufficient.
These are recommendations, not findings of the Board. Each one maps to a link in the documented chain and can be checked on a bench without flight hardware.
1. Fault-inject the exception handler, not just the arithmetic. For every conversion from floating point to a narrower integer type, drive the input to the representable boundary and past it, then observe what the handler does. The pass criterion is graceful degradation with a defined output, not a logged fault followed by a processor halt. On Flight 501 the handler was specified to shut down the processor, and that specification, not the overflow, is what removed guidance.
2. Treat every protection exemption as a claim requiring evidence. If a conversion is left unprotected because the variable is “physically limited” or has “large margin,” record the bound, the source of the bound, and the operating envelope it assumes. Re-derive it when the envelope changes. The Board found no evidence that trajectory data were used to analyze the unprotected variables, and BH’s margin was the one that failed.
3. Audit reuse at the level of the assumption, not the module. For each inherited module, enumerate every constant, time window, and range check that came from the donor vehicle, and re-derive each against the host vehicle’s actual trajectory and timing. The 50-second alignment window was an Ariane 4 requirement. On Ariane 5 it kept a pre-liftoff function running for roughly 40 seconds of flight.
4. Count independent failure modes, not units. Identical hardware and software in a hot standby pair is a common-cause path for any systematic fault. If the redundancy credit appears in a reliability calculation, the calculation needs a diversity argument or an explicit derating for common-cause failure. Two SRIs failed within one 72-millisecond cycle for the same reason.
5. Make the resource budget a visible constraint, not a silent safety argument. When a workload or timing target drives a decision to remove a check, that decision belongs in the hazard analysis with a named owner and a review path, not only in the code review record. The Board’s account of the four-of-seven decision is a case study in how a defensible local tradeoff becomes invisible to external review.
6. Test the flight domain, not the nominal trajectory. The Board’s corrective measures call for testing that checks coverage of the SRI flight domain and for simulating real trajectories on SRI electronics. A bench harness that replays the host vehicle’s early trajectory through the reused module, including the segment after the function should have been irrelevant, would have exercised the exact input that overflowed.
The overflow was the trigger. The Board states that although the source of the Operand Error was identified, this in itself did not cause the mission to fail. The specification of the exception-handling mechanism, which shut down the processor, contributed to the failure, and the Board identifies that shutdown as what finally proved fatal.
They ran identical hardware and software. The backup ceased functioning during the previous 72-millisecond data cycle for the same reason as the active unit, so the OBC had nothing to switch to.
The function remained operative for 50 seconds after the SRI entered Flight Mode, which occurs at H0 minus 3 seconds. That timing was an Ariane 4 requirement and was not required for Ariane 5, so the function continued for approximately 40 seconds of flight.
No. The report describes the decision to protect some variables and not others as taken jointly by project partners at several contractual levels, and it frames the failure in terms of specification, design, testing, and organizational factors.
Both SRIs were recovered. The failure context was determined from memory readouts, the internal events were reproduced by simulation, and the software code was examined and found consistent with the failure scenario. The Board states the chain is established beyond reasonable doubt.
The Board references a restricted-circulation Technical Report with greater technical detail. That document would carry the precise BH value and the memory readout specifics. The public report supports the qualitative chain without publishing the numeric magnitude, and this article does not estimate it.
Primary sources: the Inquiry Board report as archived at the University of Minnesota, and ESA’s presentation of the Board’s report. Both are cited inline above.
The first thing the eye finds on this shirt is not the words. It is the yellow triangle. A caution triangle is the most over-trained symbol in the visual vocabulary: we have all been conditioned, from road signs and equipment labels and safety briefings, to read it as a warning about a hazard in the environment. Then the eye drops to the crossed-out hand, and the grammar flips. The hazard is not a wet floor or a high voltage. The hazard is contact. The triangle is doing the work of a personal boundary, and the crossed-out hand is the enforcement clause.
That inversion is the whole design, and it is worth reading closely because it is more careful than the average slogan shirt. The lettering reads NOT FRIENDLY DO NOT TOUCH in the flat, imperative register of industrial signage. The yellow caution triangle sits above or beside it, and inside or alongside the triangle is a hand with a slash through it. The palette is the standard caution yellow against a dark ground, which is the same contrast logic that makes hazard labels legible at a glance. Nothing here is decorative. Every element is borrowed from the language of compliance, and the joke — if it is a joke — comes from applying that language to a person rather than a machine.
Read the three clauses separately. Not friendly is a disposition claim. Do not touch is a behavioral instruction. The crossed-out hand is the pictogram that makes the instruction survive translation and inattention. In real signage, that redundancy is deliberate: text for the reader who reads, pictogram for the reader who does not. The shirt reproduces that redundancy faithfully, which is why it reads as a sign and not as a sentence someone put on a shirt.
The interesting word is friendly. A hazard label does not usually describe the temperament of the hazard. It describes the condition — slippery, corrosive, hot. Not friendly is a category error on purpose. It takes a word we use for people and plugs it into a slot built for physical states, and the result is a small, dry joke about how we talk about strangers. The sign is not warning you that the wearer will bite. It is warning you that the wearer has declined the usual social contract of being approachable, and it has filed that refusal in the format of an OSHA placard.
Strip the pictogram and the shirt becomes a grumpy sentence. Strip the words and it becomes an ambiguous symbol — a hand with a slash could mean no hands, wash your hands, or do not reach into the machine. The design only works because the two channels agree. That is the same principle behind a good error message: the code and the human-readable text have to point at the same fault, or the reader has to guess which one to trust. Here, the text and the pictogram are redundant in the useful way, and the redundancy is what makes the boundary legible from across a room.
I would push the reading one step further. A crossed-out hand is a prohibition on a specific action, not a statement about the person performing it. The sign does not say you are unwelcome. It says this contact is not permitted. That is a narrower and more defensible claim than the words alone suggest, and it is the reason the design holds up as something other than misanthropy. It is a boundary with a scope.
There is a real difference between a slogan and a usable promise, and the sign format is what moves this design from the first category toward the second. A slogan asserts an identity: I am an introvert. A sign specifies a condition and an action: this state exists; do this. The second is testable in a way the first is not. You can walk up to someone wearing this and know, without asking, what the expected behavior is. That is what a good interface does — it removes the need for a conversation about the rules.
This is also where the shirt is honest about its limits. A sign on a shirt is not an access-control system. It cannot enforce anything. It is a request, printed in the visual dialect of commands, and the gap between the imperative grammar and the actual social situation is where the humor lives. The wearer is not a locked door. The wearer is a person who has chosen a very efficient way to say please read the room before you read me.
The listing title includes the word introvert, and the design is easy to read as an introvert joke. I think that reading is fair but incomplete. Introversion is a temperament description, and the shirt is not making a claim about temperament in any technical sense. It is borrowing the authority of a hazard label to make a social preference look like a safety rule. The joke is not introverts are unfriendly. The joke is that the language of workplace safety is a surprisingly good fit for the language of personal space.
That is a visual and rhetorical observation, not a psychological one. I am not claiming the shirt identifies introverts, diagnoses anyone, or improves any social outcome. I am claiming that the design works because it treats a boundary as a piece of signage, and signage is the one genre where bluntness is a feature rather than a failure.
Three things are worth checking against the actual garment rather than the mockup. First, the contrast between the caution yellow and the ground color: hazard signage depends on that contrast surviving print, and a yellow that goes muddy against a dark shirt will weaken the whole read. Second, the legibility of the crossed-out hand at small scale — a pictogram that works on a poster can turn into a smudge on a chest. Third, the hierarchy: the triangle should register before the text, and the text before the pictogram, because that is the order in which a real warning sign is scanned. If the print collapses that order, the design loses its sign-ness and becomes a graphic tee with a lot of words on it.
The shirt is available as a standard t-shirt through the listing linked here: Not Friendly Do Not Touch Funny Warning Sign Introvert. The design is the argument. The garment is the medium.
If you are evaluating this kind of design — for yourself, for a team gift, or just because the visual grammar interests you — the questions are the same ones a signage reviewer would ask. Does the pictogram agree with the text, or does it introduce a second, conflicting instruction? Is the imperative scoped to an action rather than a person? Does the hierarchy survive at the size it will actually be seen? And does the design know that it is a request wearing the costume of a command? This shirt passes those checks. The crossed-out hand is not decoration. It is the clause that makes the sentence enforceable in the only way a shirt can be: by being read before the conversation starts.
Editorial note: this publication and Quirky Cotton Collective share an owner; this column is an owner-authorized reading of the design, not an independent review.
Editorial note: This publication and Quirky Cotton Collective share an owner.
The shirt reads I WEAR THIS SHIRT PERIODICALLY in plain caps, and beneath that line sit four tiles in the visual grammar of the periodic table: 53 I, 74 W, 22 Ti, 16 S. The tile symbols are I, W, Ti, S. Read them in sequence and you get I W Ti S — which is not the sentence above it, not a word, and not quite a rebus. That gap between what the tiles say and what the caption claims is the whole design, and it is worth taking seriously as a piece of visual argument rather than a joke that happens to be printed on cotton.
The first thing to notice is that the tiles are not decorative. Each one carries an atomic number and a symbol in the standard arrangement: number upper-left, symbol centered. 53 is iodine. 74 is tungsten. 22 is titanium. 16 is sulfur. Those are correct assignments, and the symbols are the ones a chemistry-literate reader would expect. The design is not sloppy about its references. It is precise about them, which makes the mismatch with the caption deliberate rather than accidental.
The second thing to notice is what the tiles do not do. They do not spell periodically. They do not spell shirt. They do not even spell I wear this in any literal sense, because W is tungsten and Ti is titanium and S is sulfur, and the sequence I-W-Ti-S is a string of element symbols that happens to be pronounceable as a fragment of the sentence but is not a transcription of it. The caption says one thing; the diagram says another; the joke lives in the reader’s willingness to accept the diagram as a stand-in for the caption even though it plainly is not one.
That is a more interesting move than a simple pun. A pun would replace one word with a homophone and let the sentence survive intact. This design replaces a phrase with a diagram of a phrase — a set of tiles that gesture toward the words without reproducing them. The reader is asked to perform a small act of translation: see the tiles, recognize the symbols, sound out the fragment, and then accept that the fragment is meant to evoke the full sentence above it. The shirt is not saying I wear this shirt periodically in element symbols. It is citing the sentence and then offering a partial, symbolic echo of it. The caption does the semantic work; the tiles do the visual work; the gap between them is the joke.
I think that gap is also the reason the design holds up better than a literal element-spelling would. If the tiles spelled the sentence exactly — if every word were rendered in valid element symbols — the shirt would be a puzzle with a single correct solution, and once you solved it there would be nothing left to look at. Instead, the tiles are a near-miss by design. They are close enough to be read as an attempt and wrong enough to be recognized as a joke about attempts. The reader who knows the periodic table sees the symbols and immediately notices that W is not we and Ti is not this and S is not shirt. The reader who does not know the table sees four tiles that look scientific and a caption that looks like a punchline, and the shirt still works, just at a different level. That double readability is not an accident; it is what the design is for.
The phrase I wear this shirt periodically is itself a small piece of boundary humor. Periodically means from time to time in ordinary speech and at regular intervals in technical speech, and the shirt leans on both. The caption is a confession of infrequent use dressed up as a scientific statement. The tiles reinforce the technical reading — periodic table, periodic function, periodic sampling — while the caption keeps the ordinary reading alive. The joke is not that the shirt is worn often or rarely; it is that the word periodically can mean either, and the design refuses to settle the question. That refusal is the point. A shirt that said I wear this shirt sometimes would be a shrug. A shirt that says periodically and then backs it with element tiles is making a small argument about how technical language can be used to avoid committing to a plain answer.
There is a temptation, with a design like this, to treat the tiles as a claim about chemistry or about the periodic table as a system. I do not think that is what is happening. The tiles are not arranged to demonstrate a trend, a group, or a period. They are arranged to be read left to right as a sequence of symbols, and the sequence is chosen for its phonetic resemblance to the caption, not for any chemical relationship among iodine, tungsten, titanium, and sulfur. Those four elements do not share a group, a period, or a common industrial use that would make their juxtaposition meaningful in a chemical sense. The design is using the visual format of the periodic table — the tile, the number, the symbol — as a recognizable signifier of science, and then filling that format with a sequence that serves the pun. That is a legitimate graphic move, but it is a move about visual language, not about chemistry. The shirt is not teaching anything about iodine or tungsten. It is borrowing their typography.
That borrowing is worth naming precisely, because it is the same move a lot of technical communication makes. A diagram, a table, a formatted block of text carries authority because of its shape before anyone reads its contents. The periodic-table tile is one of the most recognizable information formats in the culture: number, symbol, maybe a name, arranged in a grid. When you put a tile on a shirt, you are borrowing that authority and redirecting it toward a joke. The joke works because the format is trustworthy and the content is not. If the tiles were hand-drawn or irregular, the design would read as whimsical. Because they are clean and correctly numbered, the design reads as a straight-faced misuse of a serious format, which is a drier and more durable kind of humor.
The caption’s typography reinforces that dryness. I WEAR THIS SHIRT PERIODICALLY is set in plain caps, no exclamation point, no decorative flourish. The tiles sit below it in a row, evenly spaced, each one a small rectangle with the number and symbol in the expected positions. There is no visual cue that this is a joke — no winking font, no cartoon element, no speech bubble. The design trusts the reader to notice the mismatch. That trust is what makes it work for the audience it is aimed at: people who read diagrams for a living and who are accustomed to noticing when a label does not match its contents.
For a technical reader, that mismatch is familiar. We spend a lot of time checking whether a diagram says what its caption claims. A block diagram labeled power supply that contains no regulation stage; a timing diagram whose axis labels do not match the text; a table of part numbers where one row is a different package. The shirt is a small, low-stakes version of that experience: a caption and a diagram that are close enough to seem consistent and different enough to reward a second look. The joke is not that the diagram is wrong. The joke is that the diagram is almost right, and the almost is doing all the work.
If you want the object itself, the shirt is listed as I Wear This Shirt Periodically Funny Chemistry Science Pun from Quirky Cotton Collective. The design is the one described above: the caption in caps, four tiles below it, symbols I, W, Ti, S. I am not going to tell you how it wears or how it washes, because I have not worn or washed it. What I can tell you is what the artwork does, which is the part that matters for the argument here.
The argument, stated plainly: this is a design about the difference between a label and a diagram, and it makes its point by refusing to let the diagram spell the label. The tiles are not a transcription. They are a citation, a near-miss, a straight-faced misuse of a trusted format. The caption carries the sentence; the tiles carry the joke; the gap between them is the thing you are supposed to notice. That is a more specific and more interesting move than a generic science pun, and it is why the shirt is worth reading closely rather than just glancing at.
What I would watch for, if you are evaluating this kind of design for yourself or for a gift: does the diagram actually correspond to the caption, or does it only appear to? In this case, the answer is that it only appears to, and that is the intended effect. The design is not trying to be a correct element-spelling of the sentence. It is trying to be a recognizable, slightly wrong echo of it, and it succeeds at that. The reader who expects a literal transcription will be disappointed; the reader who expects a visual joke about transcription will not be. That is the distinction the shirt is built on, and it is the distinction I would use to decide whether it is for you.
The shirt does not need to resolve the ambiguity between periodically as sometimes and periodically as at regular intervals. The ambiguity is the joke. The tiles do not need to spell the sentence. The near-miss is the joke. The design is coherent precisely because it refuses to close the gap it opens. That is a harder thing to do than it looks, and it is the reason the shirt reads as a designed object rather than a slogan with a graphic attached.