Tagged incident-analysis
7 pieces
- · 7 min read
Therac-25: When the Untested Assumption Is a Safety Architecture
The Therac-25 removed the hardware interlocks its reused code assumed and gave the job to software. A race condition reachable by fast operator edits, plus a one byte counter overflowing to zero, bypassed a safety check. Six overdoses, three deaths, and a cause the investigators located in the system rather than in a line.
- · 6 min read
Boeing 737 MAX and MCAS: The Single Sensor Nobody Fault Injected
MCAS depended on one angle of attack sensor for a function Boeing's own assessment classified as hazardous, a classification that normally precludes single sensor dependence. The safety analysis also understated the system's authority by more than four times. This is a system safety failure, not a missing unit test.
- · 6 min read
Heartbleed Was One Missing Negative Test
OpenSSL's heartbeat handler copied as many bytes as the client declared without checking that against what the client actually sent, returning up to 64 KB of adjacent memory. The tests only ever sent well formed heartbeats, so the failure path was never driven once, and the fix was as trivial as the bug.
- · 6 min read
Mars Climate Orbiter: Assert Your Units at Every Boundary
A ground software module computed thruster impulse in pound force seconds while the interface specification required newton seconds. Navigation consumed it as newton seconds, underestimating the effect by a factor of 4.45, and no test or interface check at the contractor boundary ever reconciled the two.
- · 6 min read
Knight Capital: A 460 Million Dollar Deploy With No Consistency Check
A technician copied new code to eight servers by hand and one did not receive it. A repurposed feature flag then reactivated dormant routing logic on that one server. Roughly 4 million executions in 45 minutes, and no control existed that would have gone red on the divergence.
- · 7 min read
Ariane 5: The Code Worked in Every Demo and Destroyed the Rocket
The inertial reference module was reused unchanged from Ariane 4 and had a flawless demonstration record. Ariane 5 produced horizontal velocity values roughly five times larger, a conversion to a 16 bit signed integer exceeded 32,767, and the launcher was destroyed 37 seconds after liftoff.
- · 7 min read
The CrowdStrike Outage Was a Validator That Did Not Test the Thing
The template defined twenty one input fields and the interpreter supplied twenty. Earlier instances wildcarded the twenty first, so the mismatch could not manifest and four months of deployments succeeded. The validator passed the file that broke it because it checked an assumption rather than the field count.