Famous Software Bugs and Failures Every Engineer Should Know

NASA's first attempt at Venus was destroyed by the range safety officer about five minutes after launch on 22 July 1962. Newspapers blamed a missing hyphen; most later accounts describe a missing overbar in the handwritten guidance equations, so the software used unsmoothed velocity data and overreacted once a hardware fault came into play. Accounts of the exact character still differ. The lesson holds either way. Every transcription step between a specification and code is a place where meaning can silently vanish, and a defect that only bites when another component fails will slip straight past ordinary testing. Arthur C. Clarke called it the most expensive hyphen in history.

A radiation therapy machine involved in at least six massive overdoses between 1985 and 1987; three of the patients later died. It dropped the hardware interlocks of earlier models and relied on software reused from them, where those interlocks had masked the same defects. One fault was a race condition triggered when experienced operators edited settings quickly. Another came from a flag set by incrementing a one-byte counter, which occasionally overflowed to zero and skipped a safety check. The cryptic 'Malfunction 54' message gave operators nothing to act on, and early reports were dismissed. Nancy Leveson and Clark Turner's investigation is still the clearest account of why safety belongs to the whole system.

For about nine hours on 15 January 1990, much of AT&T's long-distance network refused calls. A software update installed in December had a misplaced "break" in C code, which jumped out of a "switch" statement early in the routine that handled recovery messages. When one switch reset and announced "I'm back, I'm OK", its neighbours could crash while processing that message, then reset and announce themselves in turn. It is the classic cascading failure: the code meant to restore the network spread the fault across it, because every switch ran the same software. AT&T recovered by reverting to the earlier version, a reminder that a fast, tested rollback is part of any deployment.

On 25 February 1991 a Patriot battery at Dhahran failed to engage an Iraqi Scud, which hit a barracks and killed 28 soldiers of the US Army's 14th Quartermaster Detachment. The system counted time in tenths of a second, and truncation in a 24-bit fixed-point register meant the error grew the longer it ran. After about 100 hours the clock had drifted by a third of a second, enough to shift the tracking window nearly 700 metres. The fault was known: Israeli data showing it reached the Army on 11 February, and a later warning said only that very long run times could affect targeting, without saying how long. It shows why long-running systems must be tested for how long they will actually run.

The first Ariane 5 broke up 37 seconds after launch on 4 June 1996, taking the four Cluster science spacecraft with it. Inertial reference code reused from Ariane 4 converted a 64-bit floating-point value, the horizontal bias, into a 16-bit signed integer. Ariane 5's faster trajectory produced a number too large to fit, the unhandled exception halted both inertial reference units, and the rocket steered itself to destruction. The cruel detail is that this alignment function served no purpose after lift-off. Redundancy did not help because both units ran identical software. The inquiry's recommendations, on handling exceptions and testing reused code against the new vehicle's real trajectory data, are still taught today.

A success story with a scare in the middle. Days after landing on Mars on 4 July 1997, Pathfinder's computer began resetting itself: four resets, on 5, 10, 11 and 14 July. The cause was priority inversion in its VxWorks software, where a low-priority task held a shared resource that a high-priority task needed, while medium-priority work kept the low-priority task from finishing. Engineers reproduced the fault on a duplicate system on Earth and, on 21 July, uploaded a change enabling priority inheritance. The glitch had appeared in preflight testing but was given low priority. Pathfinder is the standard example for teaching concurrency, and for the value of being able to diagnose and patch a system you cannot touch.

The units mix-up everyone has heard of, and the part most people miss. Lockheed Martin's ground software reported thruster impulse in pound-force seconds, while NASA's navigation software expected newton-seconds, a factor of 4.45. Small errors added up over the cruise, and on 23 September 1999 the orbiter reached Mars far lower than the planned 226 km and was lost. The arithmetic was not the real failure. Navigators had noticed the trajectory looked wrong, and an extra correction burn was discussed but never carried out. NASA's Ed Weiler put it down to systems engineering and the checks and balances. Interface specifications, end-to-end verification and a culture that acts on doubts are the lessons here.

The most human entry here. Fujitsu's Horizon accounting system, rolled out across Post Office branches from 1999, showed shortfalls that subpostmasters could not explain, and more than 900 of them were prosecuted between 1999 and 2015 on the strength of its figures. In Bates v Post Office in 2019 the High Court found Horizon had contained bugs, errors and defects, and it emerged that Fujitsu staff could alter branch accounts remotely. It is the starkest lesson on this list about treating computer output as proof. In May 2024 a new law quashed the convictions in England, Wales and Northern Ireland. Anyone building systems whose records can be used against people should know this case.

The failure that mostly did not happen, which is exactly why it belongs here. Decades of software stored years as two digits to save memory, so 2000 would read as 1900 and break date arithmetic. Worldwide remediation cost an estimated $308 billion, and the problems that did appear on 1 January 2000 were generally regarded as minor. People still argue whether that proves the money was wasted or well spent, and that argument is the lesson: successful prevention looks like nothing at all. Y2K also showed how long a shortcut can outlive its reasons. The next one is already scheduled, in 2038, when signed 32-bit Unix time runs out.

Power lines sagging into overgrown trees in Ohio started it, but software turned a local problem into a blackout affecting an estimated 55 million people across the north-eastern United States and Ontario on 14 August 2003. A race condition in the alarm system of FirstEnergy's GE XA/21 energy management software stalled it silently, so control room operators were unaware the alarms had failed for over an hour while lines tripped one after another. The lesson is about failing loudly. A monitoring system that stops without saying so is worse than none, because people keep trusting a quiet screen. Watch the watchers, and make the absence of updates an alarm in itself.

On 1 August 2012, Knight Capital deployed new trading code to its SMARS servers, but the update was not copied to one of the eight. The new code reused an old flag, and on that server the flag woke dormant "Power Peg" logic that had not been used for years. In approximately 45 minutes it flooded the market with unintended orders, leaving a pre-tax loss of $440 million, and within months the firm had agreed to be acquired by Getco. Every engineer who ships to a fleet should know this one. Dead code is not harmless, repurposing a flag is a trap, and a deployment process that relies on someone copying files to each machine by hand will one day miss one.

A missing bounds check in OpenSSL's heartbeat extension let anyone ask a server to echo back far more data than they had sent, up to 64 kibibytes of its memory at a time, which could include private keys and passwords. The code went in on 31 December 2011, shipped in version 1.0.1 in March 2012, and was not disclosed and fixed until 7 April 2014, when about 17% of the web's trusted secure servers were thought to be vulnerable. The deeper lesson is about who maintains shared infrastructure. OpenSSL was receiving about $2,000 a year in donations, and within weeks the industry announced the Core Infrastructure Initiative to fund critical open-source projects. Never trust a length field a client sends you.

The European lander that crashed on Mars in October 2016, because the software believed one bad second of data. When its parachute opened, the inertial measurement unit saturated for about one second. Fed that reading, the navigation system calculated a negative altitude, concluded it had already landed, released the parachute early and fired its thrusters for only a few seconds instead of the expected 30, while still about 3.7 km up. The inquiry reported in May 2017. The lesson is plausibility checking: a sensor at its limit is not telling the truth, and software should ask whether an estimate makes physical sense before acting on it, especially when the action cannot be undone.

Boeing's Maneuvering Characteristics Augmentation System on the 737 MAX pushed the nose down based on a single angle-of-attack sensor at a time, and could activate repeatedly. When one sensor failed, MCAS kept trimming the aircraft nose down. The Lion Air and Ethiopian Airlines crashes killed 346 people, and MCAS was not described in the flight manual or in training materials. This is less a coding bug than a design and certification failure, which is why it is essential reading. A joint review found the FAA failed to properly review MCAS. The 2020 fix makes it compare both sensors and activate only once per event: redundancy and limits on authority that arguably should have been there from the start.

Boeing's uncrewed Starliner launched on 20 December 2019 and promptly read the wrong time: its mission elapsed timer was offset by 11 hours, because it took the time from the rocket at the wrong moment. Believing it was in a different phase of flight, the capsule burned fuel it needed and could not reach the International Space Station. The second bug is the more sobering one. Engineers found during the flight that the service module could strike the capsule after separation, and fixed it before re-entry. Both slipped past because end-to-end testing had been broken into pieces. The review's corrective actions grew to 80, and a second uncrewed test flew in May 2022.

On 4 October 2021 Facebook, Instagram and WhatsApp vanished from the internet for hours. During routine maintenance, a command meant to assess the availability of global backbone capacity disconnected all of Facebook's data centres instead, and a bug in the audit tool meant to catch such commands failed to stop it. Its DNS servers, unable to reach the data centres, then withdrew their BGP advertisements, so the rest of the internet could not even find Facebook. The recovery is half the lesson: with internal tools down too, engineers had to be sent to the data centres in person. Safety checks are code and can have bugs, and the tools you need to fix an outage must not depend on the system that is out.

At 04:09 UTC on 19 July 2024, CrowdStrike pushed a content update for its Falcon sensor. Channel File 291 triggered an out-of-bounds memory read in software running inside the Windows kernel, and machines crashed on boot. The update was reverted at 05:27 UTC, 78 minutes later, but by Microsoft's estimate 8.5 million Windows devices were already affected, grounding flights and disrupting hospitals and banks, and many needed hands-on repair. It is the clearest modern case for staged rollouts. Customers could not delay these content updates, which went everywhere at once. CrowdStrike now releases them in rings and gives customers control over timing, practices every team pushing configuration at scale should copy.

A reminder of how much of the internet runs through one region. On 19 and 20 October 2025, a latent race condition in DynamoDB's DNS management automation in AWS's US-EAST-1 region let two DNS Enactor processes work against each other, and the regional DynamoDB endpoint was left with an empty DNS record. Services that depended on DynamoDB began to fail, including the system that manages EC2 hosts, which then fell into congestive collapse under its own backlog of retries. From first errors to full recovery took about 14 and a half hours. AWS disabled the automation worldwide while it fixed it. The lessons: automation that cleans up can delete what is live, and recovery paths need protection from retry storms.

From 11:20 UTC on 18 November 2025, a large share of the web started returning Cloudflare error pages. A permissions change to a database made a query return duplicate rows, so the feature file for Cloudflare's bot detection doubled in size. The proxy code had a limit set to 200 features, and when the oversized file arrived, a Rust unwrap on the error panicked instead of handling it. Engineers initially wrongly suspected a DDoS attack, partly because the bad file was regenerated every few minutes and the failure kept coming and going. Core traffic recovered around 14:30. Cloudflare's own conclusion is the takeaway: treat internally generated configuration with the same suspicion as user input, and keep a kill switch.