You're previewing the Bennett demo family. Numbers, schedule, and kids are sample data.Start your own
Loading page…
In 1999 a spacecraft flew nine months to Mars and burned up on arrival. Nothing was broken. Two teams of excellent engineers had each written correct software, and the two programs disagreed about one thing neither of them ever said out loud.
Most people hear bug and think: somebody made a silly mistake. Somebody was careless. Somebody is not very good at this.
That is almost never what happened. Here is the honest definition, and it is worth reading twice.
A bug is the gap between what you said and what you meant. The machine did what you said. Nothing malfunctioned.
That is why bugs are so slippery. When a hammer breaks you can see the break. When a program has a bug, every part is working exactly as built — the fault is invisible because it is not in any part. It is in the space between two parts, or between the code and the intention behind it.
And if that sounds like something only beginners suffer from, here is the most expensive counter-example there is.
Two teams. NASA's Jet Propulsion Laboratory flew the spacecraft; Lockheed Martin built it and wrote some of the ground software. Between them sat a written document specifying exactly what each side would send the other. Follow what happened.
Where was the Mars Climate Orbiter's fault actually located?
Three years earlier, on 4 June 1996, Europe's new Ariane 5 rocket lifted off for the first time and destroyed itself 37 seconds after main engine ignition, about 30 seconds into the flight.
The cause was a piece of software converting a number from a large, precise format into a much smaller one — a box that could hold values only up to a certain size. The number was the rocket's horizontal speed. On Ariane 5 that speed was far larger than on the older Ariane 4, and it no longer fitted in the box. The system stopped. The backup system, running the identical software, had already stopped for the identical reason a moment earlier.
Now the part that makes this a lesson rather than a horror story. That code had flown on Ariane 4 for years without a single failure, and on Ariane 4 the calculation could not overflow — the rocket simply never went that fast in that direction. The code was not sloppy. It was correct, proven, and trusted, and every one of those things was true right up until it was carried onto a rocket that flew differently.
Worse: the calculation was part of a routine that only had a job to do before liftoff. It was still running purely because it had been left running on the older rocket. It destroyed the flight while computing something nobody needed.
The inquiry board did not blame a programmer. It named specification and design errors, and reviews and tests that never exercised this part of the system with Ariane 5's real flight numbers.
The Ariane software had run perfectly for years. What changed?
Bugs are older than computers, and the story most people tell about the word is not quite right. Tap these into the order they happened.
Tap whichever you think happened next
Notice what those four have in common. Not one of them is somebody not knowing how to code. Edison's bugs were the ordinary friction of building anything new; the moth was a physical object in a machine; and the two spacecraft were lost by teams that reviewed, tested and documented their work to a standard almost no software ever receives.
Both official investigations reached the same shape of answer, and it is not the shape people expect.
Neither blamed an individual. The Mars board pointed at how the two organisations checked each other's work — the navigation team had noticed something looked odd during the cruise and there was no strong process for turning that unease into an alarm. The Ariane board pointed at specifications and at tests that never fed the system the numbers it would actually meet.
The reasoning is practical rather than kind. If the answer is a person was careless, your fix is to ask people to be more careful, and people have been trying that for the whole of history. If the answer is nothing on this path checked the units, you can build the check — and then the mistake becomes impossible for everyone, forever, including on days when they are tired.
This is why the good habits look the way they do. A test is not there because you are expected to be bad at this; it is a check that keeps working after you have stopped paying attention. Being told your units, saying what a number means, having a second person read it — every one of those is somebody's old accident, turned into a rule.
So when your own program does something absurd, the useful question is never how did I miss that? It is: what did I actually say? Read your instructions like a stranger who has never heard of your intentions — because that is precisely who ran them.
Your game gives the player 10 points for a coin worth 1. You stare at the line and it looks fine. What is the most useful next move?
You’re previewing as a parent — nothing here is recorded.
Mars Climate Orbiter: launched 11 December 1998, contact lost 23 September 1999 during orbit insertion. NASA's Mishap Investigation Board found the root cause was ground software (SM_FORCES) supplying thruster impulse in pound-force-seconds where the software interface specification required newton-seconds; 1 lbf-s = 4.448 N-s, a factor of about 4.45. The spacecraft's planned closest approach was about 226 km; it entered the atmosphere at roughly 57 km, below the estimated survivable minimum of about 80 km. Total mission cost was about 327.6 million dollars (spacecraft development, launch and operations combined). The board also identified contributing process failures rather than individual fault, including inadequate verification of the navigation data and no effective route for the navigation team's in-flight concerns to trigger formal action. Ariane 501: maiden flight 4 June 1996. The ESA/CNES Inquiry Board found the launcher was lost through complete loss of guidance and attitude information 37 seconds after the start of the main engine ignition sequence (about 30 seconds after lift-off), caused by an unprotected data conversion of a 64-bit floating-point horizontal-velocity value into a 16-bit signed integer in the inertial reference system software; both the active and backup units failed identically because they ran the same software. The alignment function involved served a purpose only before lift-off but remained operative afterwards, a carry-over from Ariane 4. The Board attributed the failure to specification and design errors and to reviews and tests that did not adequately exercise the inertial reference system with Ariane 5 trajectory data. Word origin: Thomas Edison used 'bugs' for engineering faults in an 1878 letter, and the term appears in his notebooks from 1876; he did not coin it. On 9 September 1947 a moth was taped into the Harvard Mark II logbook beside the note 'First actual case of bug being found' — the logbook is in the Smithsonian's National Museum of American History; Grace Hopper worked on the Mark II and popularised the story, but the entry was probably not written by her.