---
title: "Famous software bugs in history"
url: https://erroneo.us/developers/famous-software-bugs/
description: "Ariane 5, Mars Climate Orbiter, Therac-25, Knight Capital, the Patriot clock, Y2K and CrowdStrike: what went wrong, per official reports, and the lessons."
type: guide
section: "Developers"
date_modified: 2026-10-20
publisher: erroneo.us
license: All rights reserved. Quote with attribution and a link.
---

# Famous software bugs in history

> The bugs that crashed rockets, lost a Mars probe, overdosed patients and burned through hundreds of millions of dollars, told from the official investigation reports, with the lesson each one teaches.

Most bugs cost an afternoon. A few make history. The cases below are the ones engineers still teach, because each was investigated in public and each has a clear lesson. Wherever possible we've used the official inquiry, regulator or vendor report, and every cost or casualty figure is the one stated in the cited source.

| Incident | Year | Bug class | Impact (per source) |
|---|---|---|---|
| Therac-25 | 1985–87 | Race conditions, counter overflow | Six massive radiation overdoses, with deaths and serious injuries |
| Patriot missile, Dhahran | 1991 | Fixed-point rounding drift | Scud not intercepted, 28 soldiers killed |
| Pentium FDIV | 1994 | Missing lookup-table entries | Rare wrong division results, chip replacement program |
| Ariane 5 Flight 501 | 1996 | Integer overflow on conversion | Launcher destroyed about 39 s after liftoff |
| Mars Climate Orbiter | 1999 | Unit mismatch (lbf·s vs N·s) | Spacecraft lost on arrival at Mars |
| Y2K | 1999–2000 | Two-digit years | Mostly minor failures after very large remediation spending |
| Northeast blackout | 2003 | Silent alarm-software failure | About 50 million people affected |
| Knight Capital | 2012 | Dead code and a partial deploy | More than $460 million lost in about 45 minutes |
| CrowdStrike Channel File 291 | 2024 | Out-of-bounds read | About 8.5 million Windows devices crashed |
| Year 2038 | 2038 | 32-bit time overflow | Still ahead |

## Therac-25 (1985–1987): when software replaced the safety interlocks

The Therac-25 was a computer-controlled radiation therapy machine. In the definitive account, Nancy Leveson and Clark Turner report that [between June 1985 and January 1987, six known accidents involved massive overdoses](https://web.archive.org/web/20240909111858/http://www.cse.msu.edu/~cse470/Public/Handouts/Therac/Therac_1.html), with deaths and serious injuries. Eleven machines were installed, five in the US and six in Canada. Unlike its predecessors, the Therac-25 relied on software for safety functions that earlier models had backed up with independent hardware interlocks.

The investigators identified more than one software flaw. At Tyler, Texas, an operator who edited the treatment mode and returned to the command line within about 8 seconds, while the bending magnets were still being set, could leave the machine in an inconsistent state. It showed a cryptic "Malfunction 54" ([Leveson & Turner](https://web.archive.org/web/20250719153956/https://cse.msu.edu/~cse470/Public/Handouts/Therac/Therac_3.html)). At Yakima, Washington, a one-byte variable named `Class3` was incremented on every pass through a setup routine. When it rolled over to zero at the moment the operator pressed "set", a safety check was skipped. AECL's fix was to set the variable to a fixed non-zero value instead of incrementing it.

>

**Lesson:** don't remove hardware safety nets because "the software handles it", and treat operator-reported quirks as bug reports. Leveson and Turner also warn that [reusing software doesn't guarantee safety](https://web.archive.org/web/20260530170443/https://cse.msu.edu/~cse470/Public/Handouts/Therac/Therac_5.html).

## Patriot missile at Dhahran (25 February 1991): a tenth of a second that never quite added up

On 25 February 1991 a Patriot battery in Dhahran, Saudi Arabia, failed to intercept an Iraqi Scud, which struck a US Army barracks and [killed 28 soldiers](https://www-users.cse.umn.edu/~arnold/disasters/patriot.html). The [GAO's report IMTEC-92-26](https://www.gao.gov/products/imtec-92-26) was titled *Software Problem Led to System Failure*.

The system counted time in tenths of a second as an integer and converted it to seconds using a 24-bit register. Because 1/10 has no exact binary representation, every conversion was slightly off, and the error grew the longer the system ran. Mathematician Douglas Arnold works through the arithmetic in [his analysis](https://www-users.cse.umn.edu/~arnold/disasters/patriot.html): after about 100 hours of uptime the drift was about 0.34 seconds, enough for a Scud travelling around 1,676 m/s to fall outside the radar's "range gate".

>

**Lesson:** floating- and fixed-point errors accumulate, and "it works in testing" isn't "it works after 100 hours of uptime". Test long-running behaviour, and make time calculations exact.

## Pentium FDIV (1994): five missing table entries

Intel's Pentium used an SRT division algorithm driven by a lookup table. According to a summary hosted by [Earlham College's computer science department](https://www.cs.earlham.edu/~dusko/cs63/fdiv.html), citing *Byte* (March 1995), five of the table's 1,066 entries were not loaded into the chip's programmable logic array, so they read as zero instead of +2. Intel characterised the chance of a random divide producing an inaccurate result as about 1 in 9 billion. The well-known test case `4195835 / 3145727` came back wrong in the fifth significant digit. Intel eventually offered no-questions-asked replacements.

>

**Lesson:** "rare" isn't the same as "harmless" when millions of units run billions of operations. Users' trust also depends on how openly you disclose a flaw.

## Ariane 5 Flight 501 (4 June 1996): reused code, new rocket

Ariane 5's maiden flight flew normally until about 37 seconds after ignition. The launcher then veered off course and began to disintegrate at about H0 + 39 seconds. The [Inquiry Board](https://www-users.cse.umn.edu/~arnold/disasters/ariane5rep.html) found that both inertial reference units had shut down. The backup failed first, one 72-millisecond data cycle earlier, "for the same reason" as the active unit.

The cause was "a data conversion from 64-bit floating point to 16-bit signed integer value". The value, the horizontal bias `BH`, was too large to fit and triggered an Operand Error. Other conversions in the same code were protected. This one wasn't, because analysis based on Ariane 4 said it couldn't overflow. Ariane 5's early trajectory was different, so it did. The Board also noted that the alignment code in which the error occurred "serves no purpose" after liftoff.

Wrong: ~~It flew fine on Ariane 4, so it's safe to reuse unchanged.~~

Right: Reused code inherits assumptions. Re-validate them against the new system's actual operating range.

## Mars Climate Orbiter (23 September 1999): pounds vs newtons

NASA lost contact with the Mars Climate Orbiter during its orbit-insertion burn on 23 September 1999. The [Mishap Investigation Board's Phase I report](https://llis.nasa.gov/llis_lib/pdf/1009464main1_0641-mr.pdf) found that ground software called `SM_FORCES` reported thruster impulse data in English units of pound-force seconds, while the project's software interface specification required metric newton-seconds. Navigation models therefore underestimated small trajectory effects by a factor of 4.45. The minimum survivable altitude was 80 km. After-the-fact estimates put the actual periapsis at about 57 km.

```
# What the interface required vs what was delivered
impulse_lbf_s = 1.0
impulse_n_s = impulse_lbf_s * 4.45   # conversion that never happened
```

>

**Lesson:** put units in types, field names or schemas, verify interfaces end to end, and treat navigation anomalies that people noticed as blockers. The Board's contributing causes also included a verification and validation process that didn't adequately cover ground software, and inadequate communications between project elements.

## Y2K (1999–2000): the bug that mostly didn't happen

For decades, many programs stored years as two digits, so `00` couldn't be told apart from 1900. Remediation was enormous. The research firm IDC estimated US preparation spending at about $134 billion, and worldwide estimates exceeded $300 billion, as summarised on [Wikipedia's Year 2000 problem article](https://en.wikipedia.org/wiki/Year_2000_problem). The failures that did occur on 1 January 2000 were mostly minor, such as websites showing the year "19100".

>

**Myth check:** "Y2K was a hoax" gets the cause backwards. The rollover was quiet *because* the remediation work was done. That kind of hindsight error is covered on our [cognitive biases](https://erroneo.us/thinking/cognitive-biases/) page.

## The 2003 Northeast blackout: an alarm that failed silently

On 14 August 2003 a blackout hit an area with an estimated 50 million people and 61,800 MW of load in the US and Canada ([U.S.-Canada Task Force final report](https://www.energy.gov/sites/default/files/oeprod/DocumentsandMedia/BlackoutFinal-Web.pdf)). Overgrown trees tripping transmission lines were a primary cause. A software failure turned that into a cascade. Shortly after 14:14 EDT, FirstEnergy's alarm and logging software failed. Operators "did not know that they were operating without alarms", so they kept trusting a view of the grid that had stopped updating.

>

**Lesson:** monitoring needs its own monitoring. A dashboard showing no alerts should never look the same as a dashboard that has stopped working. Heartbeats and "last updated" timestamps prevent that.

## Knight Capital (1 August 2012): dead code, a repurposed flag, one server

The [SEC's order](https://www.sec.gov/files/litigation/admin/2013/34-70694.pdf) lays out the sequence in unusual detail. Knight's order router, SMARS, still contained "Power Peg", a feature unused since 2003. New code for NYSE's Retail Liquidity Program reused the flag that used to activate Power Peg. A technician deployed the new code to only seven of the eight SMARS servers, and no second person reviewed the deployment. When the market opened, orders carrying the repurposed flag reached the eighth server and woke up Power Peg.

In about 45 minutes, while processing 212 customer orders, SMARS produced more than 4 million executions in 154 stocks, for over 397 million shares. Knight lost more than $460 million ([SEC press release](https://www.sec.gov/newsroom/press-releases/2013-222)) and later paid a $12 million penalty. Before the open, Knight's systems had sent 97 automated emails flagging "Power Peg disabled". They weren't designed as alerts, and nobody acted on them.

- Delete dead code instead of leaving it callable.
- Never reuse a flag or field for a new meaning.
- Automate deployments and verify every target got the same build.
- Have a kill switch, and make alerts that matter look like alerts.

## CrowdStrike Channel File 291 (19 July 2024): 21 fields expected, 20 provided

At 04:09 UTC on 19 July 2024, CrowdStrike pushed a configuration update to its Falcon sensor for Windows that [triggered a logic error and blue-screen crashes](https://www.crowdstrike.com/en-us/blog/falcon-update-for-windows-hosts-technical-details/). It was reverted at 05:27 UTC. Microsoft estimated that [8.5 million Windows devices](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/) were affected, which it described as less than one percent of all Windows machines.

According to CrowdStrike's [root cause analysis](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf), a template type introduced with sensor 7.11 defined 21 input fields, but the integration code supplied only 20. Earlier content used a wildcard for the 21st field, so nothing read it. The 19 July content was the first to match on that field, and the Content Interpreter performed an out-of-bounds read. Fixes included runtime bounds checks and staged rollouts for this kind of content.

>

**Lesson:** configuration is code. Anything that can crash a kernel-level component deserves the same validation, bounds checks and gradual rollout as a binary release.

## The Year 2038 problem: the next rollover

Unix-like systems traditionally store time as a signed 32-bit count of seconds since 1970-01-01. The [glibc project's design notes](https://sourceware.org/glibc/wiki/Y2038ProofnessDesign) state that this value rolls over past +2,147,483,647 at **2038-01-19 03:14:07 UTC**, possibly jumping back to 1901-12-13. 64-bit platforms already use a 64-bit `time_t`. The risk is in 32-bit embedded devices, file formats and databases that store 32-bit timestamps, and code that computes future dates (a 20-year certificate or mortgage, for example) long before 2038.

```
>>> 2**31 - 1
2147483647   # seconds after 1970-01-01T00:00:00Z  →  2038-01-19T03:14:07Z
```

## Patterns that keep repeating

| Pattern | Seen in | Defence |
|---|---|---|
| Assumptions from an old context | Ariane 5, Therac-25 | Re-validate reused code against new operating ranges |
| Numeric representation limits | Ariane 5, Patriot, Y2K, 2038 | Checked conversions, wide types, explicit overflow handling |
| Interface mismatches | Mars Climate Orbiter, CrowdStrike | Typed schemas, units in names, contract tests |
| Silent failure | 2003 blackout, Knight Capital | Heartbeats, real alerts, monitoring the monitors |
| Risky rollout | Knight Capital, CrowdStrike | Automated, staged, verifiable deploys with a kill switch |

For the everyday versions of these mistakes, see our guides to [JavaScript errors](https://erroneo.us/developers/javascript-errors/) and [Python errors](https://erroneo.us/developers/python-errors/).

## Frequently asked questions

**What is the most expensive software bug in history?**

There is no reliable single ranking, because costs are counted in very different ways (lost hardware, trading losses, remediation spending, economic disruption). Among well-documented cases, the SEC found that Knight Capital lost more than $460 million in about 45 minutes in 2012, and estimates of worldwide Y2K remediation spending run into the hundreds of billions of dollars.

**Was the Mars Climate Orbiter lost because of metric vs imperial units?**

Yes. NASA's Mishap Investigation Board found the root cause was ground software (SM_FORCES) that reported thruster impulse in pound-force seconds when the interface specification required newton-seconds, a factor of 4.45. The resulting navigation error put the spacecraft far too close to Mars.

**What caused the Ariane 5 explosion?**

On 4 June 1996, software in both inertial reference units failed when converting a 64-bit floating-point value (horizontal bias, BH) to a 16-bit signed integer that was too small to hold it. The code had been reused from Ariane 4, whose trajectory never produced values that large, and the function served no purpose after liftoff.

**What is the Year 2038 problem?**

Systems that store time as a signed 32-bit count of seconds since 1 January 1970 will overflow at 03:14:07 UTC on 19 January 2038, and may wrap back to 1901. Modern 64-bit systems use a 64-bit time value, but embedded devices, old file formats and 32-bit software can still be affected.

## Sources

1. [ARIANE 5 Flight 501 Failure: Report by the Inquiry Board (1996), text mirror at University of Minnesota](https://www-users.cse.umn.edu/~arnold/disasters/ariane5rep.html)
2. [NASA: Mars Climate Orbiter Mishap Investigation Board Phase I Report (10 November 1999)](https://llis.nasa.gov/llis_lib/pdf/1009464main1_0641-mr.pdf)
3. [Leveson & Turner, An Investigation of the Therac-25 Accidents, IEEE Computer, 1993 (Michigan State University course copy, archived)](https://web.archive.org/web/20240909111858/http://www.cse.msu.edu/~cse470/Public/Handouts/Therac/Therac_1.html)
4. [U.S. SEC press release 2013-222: SEC Charges Knight Capital With Violations of Market Access Rule](https://www.sec.gov/newsroom/press-releases/2013-222)
5. [U.S. SEC Order, In the Matter of Knight Capital Americas LLC, Release No. 34-70694](https://www.sec.gov/files/litigation/admin/2013/34-70694.pdf)
6. [GAO/IMTEC-92-26: Patriot Missile Defense: Software Problem Led to System Failure at Dhahran, Saudi Arabia](https://www.gao.gov/products/imtec-92-26)
7. [Douglas N. Arnold (University of Minnesota): The Patriot Missile Failure](https://www-users.cse.umn.edu/~arnold/disasters/patriot.html)
8. [Earlham College CS: Bugs in the Intel Microprocessors (Pentium FDIV)](https://www.cs.earlham.edu/~dusko/cs63/fdiv.html)
9. [U.S.-Canada Power System Outage Task Force: Final Report on the August 14, 2003 Blackout](https://www.energy.gov/sites/default/files/oeprod/DocumentsandMedia/BlackoutFinal-Web.pdf)
10. [CrowdStrike: Falcon Update for Windows Hosts, Technical Details](https://www.crowdstrike.com/en-us/blog/falcon-update-for-windows-hosts-technical-details/)
11. [CrowdStrike: Channel File 291 Incident Root Cause Analysis (6 August 2024)](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf)
12. [Microsoft: Helping our customers through the CrowdStrike outage (20 July 2024)](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/)
13. [Wikipedia: Year 2000 problem](https://en.wikipedia.org/wiki/Year_2000_problem)
14. [glibc wiki: Y2038 Proofness Design](https://sourceware.org/glibc/wiki/Y2038ProofnessDesign)

---
Source page: https://erroneo.us/developers/famous-software-bugs/ · More: https://erroneo.us/llms.txt