How did a number too big for its box blow up a rocket?

Every number in a computer lives in a box of a fixed size, and a type system is the set of rules about what goes in which box. It associates a data type, such as integer, floating point or string, with each value in a program, and its main purpose is to reduce bugs caused by mismatches in how values are interpreted in different parts of a program. On 4 June 1996 the first flight of Europe's Ariane 5 rocket showed what happens when a number does not fit its box. About 30 seconds after lift-off, the rocket lost its guidance information completely and was destroyed.

You already know the problem from an odometer. A car's counter with six digits shows 999999, and one more kilometer makes the result invalid, because there is nowhere to put the seventh digit. Programmers call this an integer overflow: an arithmetic operation tries to create a value outside the range that fits in the space allocated for it.

On Ariane 5, the guidance software converted a 64-bit floating point number into a 16-bit signed integer. The number was greater than a 16-bit signed integer can represent, and the conversion failed. The software had been reused from Ariane 4, but Ariane 5 builds up horizontal velocity five times more rapidly, so values appeared that Ariane 4 never produced. Worse, the specification said that any exception should shut down the guidance computer, and that shutdown proved fatal: the same software ran in both units, so both stopped. The failure became known as one of the most infamous and expensive software bugs in history, with a loss of more than US$370 million.

The lesson is that a type tells you the shape of the box, not whether tomorrow's values will fit. The inquiry's analysis said the ranges of variables should have been spelled out, but a 16-bit range was simply assumed.