> Saying this should have been handled as a known error is totally reasonable but that's broadly the same as saying they should have just written bug free code.

> Saying this should have been handled as a known error is totally reasonable but that's broadly the same as saying they should have just written bug free code. I think there's a world of difference between writing bug free code, and writing code such that a bug in one system doesn't propagate to others. Obviously it's unreasonable to foresee every possible issue with a flight plan and handle each, but it's much more reasonable to foresee that there might be some issue with some flight plan at some point, and structure the code such that it doesn't assume an error-free flight plan, and the damage is contained. You can't make systems completely immune to failure, but you can make it so an arbitrarily large number of things have to all go wrong at the same time to get a catastrophic failure.