ordinary engineering rigor ? you would need extraordinary superfical rigor. otherwise you get examples like below on a bigger scale:
The Boeing 737 MAX MCAS Crashes (2018–2019)
Impact: 346 lives lost, $20B+ in direct losses, grounding of the global fleet.
The Failure: Boeing designed the Maneuvering Characteristics Augmentation System (MCAS) to automatically pitch the plane's nose down if the angle of attack (AoA) was too high. To simplify the system and avoid retraining pilots on expensive simulators, Boeing engineered MCAS to rely on input from a single AoA sensor.
Why "Ordinary Rigor" Failed: Standard redundancy principles were bypassed because safety hazard analyses incorrectly categorized MCAS failure as a "major" rather than "hazardous" or "catastrophic" event. Engineers assumed pilots could easily override the system using standard runaway stabilizer procedures. In practice, MCAS repeatedly re-engaged, overriding pilot inputs based on a single faulty sensor reading.
2. The Ariane 5 Flight 501 Explosion (1996)
Impact: Loss of $370 million spacecraft payload, decades of development destroyed in 37 seconds.
The Failure: A 64-bit floating-point number representing horizontal bias was converted to a 16-bit signed integer. The value exceeded 32,767 (the maximum 16-bit integer), triggering an unhandled integer overflow exception. The primary and backup inertial reference computers both crashed, causing the rocket to veer off course and self-destruct.
Why "Ordinary Rigor" Failed: The software module was reused directly from the Ariane 4 rocket without re-testing under Ariane 5's flight profiles. Ariane 4's lower acceleration meant the overflow condition was physically impossible. Engineers purposefully disabled software protection for that specific variable to keep CPU load under 80%, assuming standard flight parameters would never trigger an overflow.
3. The Therac-25 Radiation Overdoses (1985–1987)
Impact: At least 6 patients severely injured or killed by massive radiation overdoses.
The Failure: The Therac-25 was a computer-controlled medical linear accelerator. A race condition in the software allowed an operator to rapidly change settings in under 8 seconds, causing the machine to enter high-energy "X-ray" mode without deploying the physical target converter needed to diffuse the beam.
Why "Ordinary Rigor" Failed: Engineers removed the physical, electro-mechanical safety interlocks used in previous models (Therac-6 and Therac-20), relying entirely on software safety checks. The software was written by a single programmer and was never independently audited. The development team assumed that since the software code was adapted from older models, it was inherently safe.
4. The Mars Climate Orbiter Loss (1999)
Impact: $327 million spacecraft destroyed upon arrival at Mars.
The Failure: The ground-based navigation software developed by Lockheed Martin calculated thruster impulses using Imperial units (pound-force seconds), while NASA’s flight system expected metric units (Newton-seconds). The trajectory calculations were off by a factor of 4.45.
Why "Ordinary Rigor" Failed: Rigorous verification and testing protocols existed at both NASA and Lockheed, but interface control documents failed to explicitly enforce unit specifications across sub-teams. Navigators noticed minor trajectory anomalies during the 9-month transit, but standard escalation procedures failed to resolve the discrepancies before orbital insertion.
5. The Knight Capital Automated Trading Collapse (2012)
Impact: $440 million lost in 45 minutes, leading to the company's near-bankruptcy.
The Failure: Knight Capital deployed new high-frequency trading code to eight servers. However, an engineer forgot to copy the new software to the eighth server. The eighth server retained old, dead code (Power Peg) that re-purposed an internal flag. When activated, it continuously bought high and sold low millions of times in minutes.
Why "Ordinary Rigor" Failed: Standard deployment procedures lacked automated configuration drift auditing, central deployment verification, or automated circuit breakers. The system operated without an automated rate-limiting kill switch capable of halting anomalous order volumes at the exchange layer.
6. The Patriot Missile Software Time Drift (1991)
Impact: 28 soldiers killed, 100+ injured when an Iraqi Scud missile hit barracks in Dhahran, Saudi Arabia.
The Failure: The system's internal clock measured time in tenths of a second using a 24-bit fixed-point register. Over time, floating-point truncation errors accumulated. After 100 hours of continuous operation, the clock drifted by 0.34 seconds. At Scud speeds, this shifted the tracking target window by over 600 meters.
Why "Ordinary Rigor" Failed: The Patriot system was originally designed as a mobile air defense system meant to run for a few hours at a time, not continuous days. Engineers patched a clock drift issue in parts of the codebase but missed a specific subroutine used in radar target calculation, relying on system restarts rather than fixing the underlying floating-point precision constraint.