Famous software bugs in history

Most bugs cost an afternoon. A few make history. The cases below are the ones engineers still teach, because each was investigated in public and each has a clear lesson. Wherever possible we've used the official inquiry, regulator or vendor report, and every cost or casualty figure is the one stated in the cited source.

Therac-25 (1985–1987): when software replaced the safety interlocks#

The Therac-25 was a computer-controlled radiation therapy machine. In the definitive account, Nancy Leveson and Clark Turner report that between June 1985 and January 1987, six known accidents involved massive overdoses, with deaths and serious injuries. Eleven machines were installed, five in the US and six in Canada. Unlike its predecessors, the Therac-25 relied on software for safety functions that earlier models had backed up with independent hardware interlocks.

The investigators identified more than one software flaw. At Tyler, Texas, an operator who edited the treatment mode and returned to the command line within about 8 seconds, while the bending magnets were still being set, could leave the machine in an inconsistent state. It showed a cryptic "Malfunction 54" (Leveson & Turner). At Yakima, Washington, a one-byte variable named Class3 was incremented on every pass through a setup routine. When it rolled over to zero at the moment the operator pressed "set", a safety check was skipped. AECL's fix was to set the variable to a fixed non-zero value instead of incrementing it.

Patriot missile at Dhahran (25 February 1991): a tenth of a second that never quite added up#

On 25 February 1991 a Patriot battery in Dhahran, Saudi Arabia, failed to intercept an Iraqi Scud, which struck a US Army barracks and killed 28 soldiers. The GAO's report IMTEC-92-26 was titled Software Problem Led to System Failure.

The system counted time in tenths of a second as an integer and converted it to seconds using a 24-bit register. Because 1/10 has no exact binary representation, every conversion was slightly off, and the error grew the longer the system ran. Mathematician Douglas Arnold works through the arithmetic in his analysis: after about 100 hours of uptime the drift was about 0.34 seconds, enough for a Scud travelling around 1,676 m/s to fall outside the radar's "range gate".

Pentium FDIV (1994): five missing table entries#

Intel's Pentium used an SRT division algorithm driven by a lookup table. According to a summary hosted by Earlham College's computer science department, citing Byte (March 1995), five of the table's 1,066 entries were not loaded into the chip's programmable logic array, so they read as zero instead of +2. Intel characterised the chance of a random divide producing an inaccurate result as about 1 in 9 billion. The well-known test case 4195835 / 3145727 came back wrong in the fifth significant digit. Intel eventually offered no-questions-asked replacements.

Ariane 5 Flight 501 (4 June 1996): reused code, new rocket#

Ariane 5's maiden flight flew normally until about 37 seconds after ignition. The launcher then veered off course and began to disintegrate at about H0 + 39 seconds. The Inquiry Board found that both inertial reference units had shut down. The backup failed first, one 72-millisecond data cycle earlier, "for the same reason" as the active unit.

The cause was "a data conversion from 64-bit floating point to 16-bit signed integer value". The value, the horizontal bias BH, was too large to fit and triggered an Operand Error. Other conversions in the same code were protected. This one wasn't, because analysis based on Ariane 4 said it couldn't overflow. Ariane 5's early trajectory was different, so it did. The Board also noted that the alignment code in which the error occurred "serves no purpose" after liftoff.

Mars Climate Orbiter (23 September 1999): pounds vs newtons#

NASA lost contact with the Mars Climate Orbiter during its orbit-insertion burn on 23 September 1999. The Mishap Investigation Board's Phase I report found that ground software called SM_FORCES reported thruster impulse data in English units of pound-force seconds, while the project's software interface specification required metric newton-seconds. Navigation models therefore underestimated small trajectory effects by a factor of 4.45. The minimum survivable altitude was 80 km. After-the-fact estimates put the actual periapsis at about 57 km.

# What the interface required vs what was delivered
impulse_lbf_s = 1.0
impulse_n_s = impulse_lbf_s * 4.45   # conversion that never happened

Y2K (1999–2000): the bug that mostly didn't happen#

For decades, many programs stored years as two digits, so 00 couldn't be told apart from 1900. Remediation was enormous. The research firm IDC estimated US preparation spending at about $134 billion, and worldwide estimates exceeded $300 billion, as summarised on Wikipedia's Year 2000 problem article. The failures that did occur on 1 January 2000 were mostly minor, such as websites showing the year "19100".

The 2003 Northeast blackout: an alarm that failed silently#

On 14 August 2003 a blackout hit an area with an estimated 50 million people and 61,800 MW of load in the US and Canada (U.S.-Canada Task Force final report). Overgrown trees tripping transmission lines were a primary cause. A software failure turned that into a cascade. Shortly after 14:14 EDT, FirstEnergy's alarm and logging software failed. Operators "did not know that they were operating without alarms", so they kept trusting a view of the grid that had stopped updating.

Knight Capital (1 August 2012): dead code, a repurposed flag, one server#

The SEC's order lays out the sequence in unusual detail. Knight's order router, SMARS, still contained "Power Peg", a feature unused since 2003. New code for NYSE's Retail Liquidity Program reused the flag that used to activate Power Peg. A technician deployed the new code to only seven of the eight SMARS servers, and no second person reviewed the deployment. When the market opened, orders carrying the repurposed flag reached the eighth server and woke up Power Peg.

In about 45 minutes, while processing 212 customer orders, SMARS produced more than 4 million executions in 154 stocks, for over 397 million shares. Knight lost more than $460 million (SEC press release) and later paid a $12 million penalty. Before the open, Knight's systems had sent 97 automated emails flagging "Power Peg disabled". They weren't designed as alerts, and nobody acted on them.

• Delete dead code instead of leaving it callable.
• Never reuse a flag or field for a new meaning.
• Automate deployments and verify every target got the same build.
• Have a kill switch, and make alerts that matter look like alerts.

CrowdStrike Channel File 291 (19 July 2024): 21 fields expected, 20 provided#

At 04:09 UTC on 19 July 2024, CrowdStrike pushed a configuration update to its Falcon sensor for Windows that triggered a logic error and blue-screen crashes. It was reverted at 05:27 UTC. Microsoft estimated that 8.5 million Windows devices were affected, which it described as less than one percent of all Windows machines.

According to CrowdStrike's root cause analysis, a template type introduced with sensor 7.11 defined 21 input fields, but the integration code supplied only 20. Earlier content used a wildcard for the 21st field, so nothing read it. The 19 July content was the first to match on that field, and the Content Interpreter performed an out-of-bounds read. Fixes included runtime bounds checks and staged rollouts for this kind of content.

The Year 2038 problem: the next rollover#

Unix-like systems traditionally store time as a signed 32-bit count of seconds since 1970-01-01. The glibc project's design notes state that this value rolls over past +2,147,483,647 at 2038-01-19 03:14:07 UTC, possibly jumping back to 1901-12-13. 64-bit platforms already use a 64-bit time_t. The risk is in 32-bit embedded devices, file formats and databases that store 32-bit timestamps, and code that computes future dates (a 20-year certificate or mortgage, for example) long before 2038.

>>> 2**31 - 1
2147483647   # seconds after 1970-01-01T00:00:00Z  →  2038-01-19T03:14:07Z

Patterns that keep repeating#

For the everyday versions of these mistakes, see our guides to JavaScript errors and Python errors.

Frequently asked questions

What is the most expensive software bug in history?

There is no reliable single ranking, because costs are counted in very different ways (lost hardware, trading losses, remediation spending, economic disruption). Among well-documented cases, the SEC found that Knight Capital lost more than $460 million in about 45 minutes in 2012, and estimates of worldwide Y2K remediation spending run into the hundreds of billions of dollars.

Was the Mars Climate Orbiter lost because of metric vs imperial units?

Yes. NASA's Mishap Investigation Board found the root cause was ground software (SM_FORCES) that reported thruster impulse in pound-force seconds when the interface specification required newton-seconds, a factor of 4.45. The resulting navigation error put the spacecraft far too close to Mars.

What caused the Ariane 5 explosion?

On 4 June 1996, software in both inertial reference units failed when converting a 64-bit floating-point value (horizontal bias, BH) to a 16-bit signed integer that was too small to hold it. The code had been reused from Ariane 4, whose trajectory never produced values that large, and the function served no purpose after liftoff.

What is the Year 2038 problem?

Systems that store time as a signed 32-bit count of seconds since 1 January 1970 will overflow at 03:14:07 UTC on 19 January 2038, and may wrap back to 1901. Modern 64-bit systems use a 64-bit time value, but embedded devices, old file formats and 32-bit software can still be affected.

Sources

Every factual claim on this page links to one of these. Checked October 2026. See how we source.

1. ARIANE 5 Flight 501 Failure: Report by the Inquiry Board (1996), text mirror at University of Minnesota www-users.cse.umn.edu
2. NASA: Mars Climate Orbiter Mishap Investigation Board Phase I Report (10 November 1999) llis.nasa.gov
3. Leveson & Turner, An Investigation of the Therac-25 Accidents, IEEE Computer, 1993 (course copy, Michigan State University) cse.msu.edu
4. U.S. SEC press release 2013-222: SEC Charges Knight Capital With Violations of Market Access Rule sec.gov
5. U.S. SEC Order, In the Matter of Knight Capital Americas LLC, Release No. 34-70694 sec.gov
6. GAO/IMTEC-92-26: Patriot Missile Defense: Software Problem Led to System Failure at Dhahran, Saudi Arabia gao.gov
7. Douglas N. Arnold (University of Minnesota): The Patriot Missile Failure www-users.cse.umn.edu
8. Earlham College CS: Bugs in the Intel Microprocessors (Pentium FDIV) cs.earlham.edu
9. U.S.-Canada Power System Outage Task Force: Final Report on the August 14, 2003 Blackout energy.gov
10. CrowdStrike: Falcon Update for Windows Hosts, Technical Details crowdstrike.com
11. CrowdStrike: Channel File 291 Incident Root Cause Analysis (6 August 2024) crowdstrike.com
12. Microsoft: Helping our customers through the CrowdStrike outage (20 July 2024) blogs.microsoft.com
13. Wikipedia: Year 2000 problem en.wikipedia.org
14. glibc wiki: Y2038 Proofness Design sourceware.org