In grad school I took a class from Robert Boyer and J Strother Moore (famous for Boyer-Moore string searching and the 2005 ACM Software System Award for the Boy

In grad school I took a class from Robert Boyer and J Strother Moore (famous for Boyer-Moore string searching and the 2005 ACM Software System Award for the Boyer-Moore Theorem Prover). It was a long time ago, but I remember an anecdote that Boyer explained happened while working at NASA on the Apollo project. It is a good example of the simple things that can go wrong in space. (I hope I can explain it clearly and correctly, I took that class decades ago.) At one point, to return to earth the command module must separate from the landing module (after it has been on the surface of the moon and back) and fire the thrusters that will return the astronauts and some moon rocks to earth. The astronauts flip some switches to start this sequence. Shortly before the whole Apollo moon mission, programmers discovered a bug. The thruster doesn't know where the center of gravity of the orbiter is located, but it must adjust its gimbals so that the thrust is in line with the craft's center of gravity to prevent tumbling the spaceship. This is automatically done, rapidly at the startup of the thrusters, by firing and then wiggling the nozzle a bit to figure out the correct direction vector in line with the center of gravity by readings from gyros. It seems like this should work. The bug is that there would be a delay between flipping the switch to fire the thrusters and the actual firing because, in zero-gravity, the fuel is just a big floating ball of liquid in the fuel tanks and consequently there is a delay of a few seconds while little maneuvering gas jets start accelerating the craft causing the fuel to move to the back of the tank (where the fuel lines are) and finally making its way into the nozzle of the trusters where it ignites automatically. Unfortunately, the software assumed that the thruster would ignite right away, and would wiggle the nozzle and get a completely wrong answer for the calculated center of gravity because the engine wasn't ignited yet. Then, with the nozzle pointed in the totally wrong direction, ignition would cause the craft to be pitched into a dangerous tumble while trying to leave lunar orbit. This bug wouldn't be obvious during testing on earth because the fuel would be at the bottom of the tank and ready to fire without the delay. It was too late to patch the software so some instructions were taped next to the switches instructing the astronauts to put in the necessary delay manually.