3 ms·

> "large enough machines to not OOM before markets closed for the day" Reminded of that missile defense system that was designed to be software-reset once a da

> "large enough machines to not OOM before markets closed for the day" Reminded of that missile defense system that was designed to be software-reset once a day, except the design assumptions changed (a war started) and it was ordered to be left running nonstop, as an emergency measure; after being left on for a week, failed, causing a large number of deaths. That one had some kind of integrator that accumulated floating-point roundoff over time.

scottlamb 1y ago
> Reminded of that missile defense system that was designed to be software-reset once a day, except the design assumptions changed (a war started) and it was ordered to be left running nonstop, as an emergency measure I'm sure you've simplified the story, but it seems like a bit of process failure for a missile defense system to assume peacetime. There's writing software that implements the requirements, and then there's making sure the requirements are right both up front and when you really rely on them in a critical way.
mohaba 1y ago
Patriot missile range gate. I remember covering that in a numerical analysis class.
peterfirefly 1y ago
https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dhahran https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dha...
- scottlamb 1y ago
  I interpret that write-up to mean the daily reboot was a temporary user-suggested workaround for a bug discovered in the field, rather than something in the product specs from the beginning. And it makes more sense to me that no one realized the errors would accumulate or thought to test long operation in general than it would for them to have explicitly said it wasn't important.
  - wrs 1y ago
    Kind of like nobody thought to see what happened if Windows 95 managed to stay up for over 49.7 days [0], only deadlier. [0] https://www.cnet.com/culture/windows-may-crash-after-49-7-days/ https://www.cnet.com/culture/windows-may-crash-after-49-7-da...
0xffany 1y ago
Also on the topic of missiles, it reminded me of Raymond Chen's classic Null Garbage Collector https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98...

scottlamb 1y ago

> Reminded of that missile defense system that was designed to be software-reset once a day, except the design assumptions changed (a war started) and it was ordered to be left running nonstop, as an emergency measure I'm sure you've simplified the story, but it seems like a bit of process failure for a missile defense system to assume peacetime. There's writing software that implements the requirements, and then there's making sure the requirements are right both up front and when you really rely on them in a critical way.

mohaba 1y ago

Patriot missile range gate. I remember covering that in a numerical analysis class.

peterfirefly 1y ago

https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dhahran https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dha...

scottlamb 1y ago
I interpret that write-up to mean the daily reboot was a temporary user-suggested workaround for a bug discovered in the field, rather than something in the product specs from the beginning. And it makes more sense to me that no one realized the errors would accumulate or thought to test long operation in general than it would for them to have explicitly said it wasn't important.
- wrs 1y ago
  Kind of like nobody thought to see what happened if Windows 95 managed to stay up for over 49.7 days [0], only deadlier. [0] https://www.cnet.com/culture/windows-may-crash-after-49-7-days/ https://www.cnet.com/culture/windows-may-crash-after-49-7-da...

0xffany 1y ago

Also on the topic of missiles, it reminded me of Raymond Chen's classic Null Garbage Collector https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98...