PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFamous technology failures teach developers that a defect rarely acts alone: assumptions, system boundaries, safeguards, tests, and incident response shape whether a fault becomes a catastrophe. Ariane 5 Flight 501 shows how inherited software assumptions and shared failure modes can defeat redundant systems; the Therac-25 analysis shows why safety cannot rest on software correctness alone. For teams building ordinary production systems, the same lesson is practical: design for faults, observe what happens, contain immediate harm, and learn from evidence.
Why do technology failures become system failures?
A software error is one event in a larger chain. The operating environment supplies inputs and conditions; hardware and other software interpret the result; safeguards may contain it or fail to; and operators need enough visibility to respond. Studying a failure means examining those connections rather than stopping at the first bug or assigning blame to one person.
As an Amazon Associate I earn from qualifying purchases.
Two historical cases make the distinction clear. Ariane 5 Flight 501 involved a software exception in an inertial reference system followed by loss of guidance data. The Therac-25 investigation instead emphasizes the broader safety system around software, including design, hardware protections, testing, reporting, and oversight. Their human consequences are not comparable scorecards; their value here is in the different engineering questions they expose.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why did Ariane 5 Flight 501 fail?
On 4 June 1996, Ariane 5’s maiden flight failed after its inertial reference system software raised an exception. The inquiry board reported that guidance and attitude information were completely lost 37 seconds after the main-engine ignition sequence began—30 seconds after lift-off. The European Space Agency’s inquiry summary attributed the loss to specification and design errors, along with inadequate analysis and testing of the inertial reference system and the complete flight control system.
#1 Best Overall
How an inherited assumption became a flight failure
The Inquiry Board report describes software carried over from Ariane 4. An alignment function that was useful before launch continued running after liftoff. Ariane 5’s trajectory produced an internal alignment value that, when converted to a 16-bit signed integer, exceeded the type’s representable range and triggered an Operand Error.
Both the active and backup inertial reference systems contained identical software and encountered the same exception. Guidance software then treated diagnostic data from the failed system as flight data. The important point is not that code reuse is inherently unsafe; it is that the function’s assumptions and relevance were not revalidated for the new operating context, and nominal redundancy did not protect against a shared design failure.
Rank #2
- Supplies and preparations
- Energy, heat and power
- Low-tech medicine and healing
- Water quality and treatment
- Food, shelter and first aid
What developers can learn from Ariane 5
- Revalidate context when reusing code. Recheck input ranges, operating conditions, units, timing, and whether inherited functions are still needed. A component that worked in one system may behave differently when its environment changes.
- Test the consequential scenario, not just the component. A component can pass its own tests while the full system fails under a realistic trajectory or sequence. ESA’s inquiry summary says the existing reviews and tests did not adequately analyze and test the system to expose this failure.
- Look for common-mode failures in redundancy. Two identical components can fail together when they share software, assumptions, or inputs. Redundancy is only as independent as its failure modes.
- Define safe behavior for exceptions and invalid data. A failure signal or diagnostic value should not silently become trusted operational input. Specify what downstream components do when a source is unavailable, stale, or invalid.
- Disable functions that are no longer needed. The inquiry board recommended switching off unneeded functions after liftoff, reviewing critical software and double-failure handling, and improving telemetry collection.
The board’s report states: “The Board is in favour of the opposite view, that software should be assumed to be faulty until applying the currently accepted best practice methods can demonstrate that it is correct.” In practice, that means building assurance through analysis and testing—not treating successful operation in a previous system as proof of safety in a new one.
Free tools Windows power users keep installed
One-click scans. No signup required.
What did the Therac-25 investigation teach about safety?
Nancy Leveson and Clark S. Turner’s analysis of the Therac-25 accidents treats them as a systems-safety problem, not a matter of code quality in isolation. The authors note that software previously exercised or reused in another machine is not thereby proven safe in a new system. They also point to the earlier Therac-20’s hardware interlocks, which mitigated the consequence of the same software error implicated in the Tyler deaths.
Leveson and Turner summarize the principle this way: “Safety is a quality of the system in which the software is used; it is not a quality of the software itself.” The implication for developers is that software safeguards need independent system-level protections where the consequences warrant them. A software check can fail; a separate interlock, limit, or controlled procedure may still prevent the hazardous outcome.
Make safety and evidence part of the design
The authors recommend simple designs, documentation, software quality assurance, extensive testing and formal analysis at both module and software levels, and audit trails designed in from the beginning. They also stress user and government oversight and procedures for reporting problems. These measures serve different purposes: testing looks for failures before release, system protections limit consequences, and audit trails and reporting help people detect and investigate problems that do occur.
Rank #4
- Author: Kranz, Gene.
- Publisher: Simon & Schuster
- Pages: 416
- Publication Date: 2009
- Binding: Paperback
For teams outside safety-critical industries, the same structure applies at a proportionate scale. Decide which failures could harm users or data, define what must remain safe if a software component misbehaves, and ensure that the system records enough information to reconstruct important events. An incident report alone does not prevent recurrence; it must lead to reviewed changes in design, operation, or both.
How should developers respond when production fails?
Jonathan Sillito and Esdras Kutomi’s 2020 qualitative study examined 30 software incidents: 15 drawn from in-depth interviews with engineers and 15 sampled from published incident reports. It is a collection of cases, not a statistically representative estimate of how often failures happen. The study looks at how incidents occurred, were detected, investigated, and mitigated, and notes that failures can cascade through systems and expose scaling limits teams had not previously understood.
A practical incident-response sequence
- Mitigate immediate impact. Stabilize the service or protect affected users first. A rollback may be appropriate when a deployment is implicated, but it is one possible mitigation—not a universal fix.
- Keep observing after mitigation. Watch system behavior to see whether the impact has stopped, shifted, or revealed another problem. A return to normal symptoms does not establish the cause.
- Preserve evidence. Retain relevant logs, metrics, alerts, deployment details, and timelines before routine cleanup or retention limits erase them. Record what responders observed and changed.
- Investigate contributing conditions. Trace how the fault propagated, what assumptions were involved, which safeguards worked or failed, and why detection or response took the time it did. Avoid stopping at the nearest code change if upstream conditions contributed.
- Turn findings into reviewed changes. Assign corrective work to the appropriate controls—code, tests, architecture, alerting, documentation, or operational procedure—and verify that the changes address the identified failure path.
How do the cases translate into a developer’s checklist?
| Question | What to examine |
|---|---|
| What assumptions does this component make? | Inputs, ranges, timing, operating conditions, and whether code or design was carried over from a different context. |
| What happens when it fails? | Exception handling, invalid or stale data, downstream behavior, and whether a separate safeguard contains the consequence. |
| Are tests representative? | Component behavior plus realistic system-level scenarios, including unusual sequences and relevant operating conditions. |
| Can we see and reconstruct events? | Telemetry, logs, audit trails, reporting paths, and whether evidence survives long enough for investigation. |
| What happens after an incident? | Impact mitigation, continued observation, evidence-based investigation, and corrective changes with clear ownership and review. |
These questions connect prevention with coping. Realistic tests and independent safeguards reduce the chance that a fault reaches users; observability and a disciplined response help limit damage and make the next failure less likely to repeat the same path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
