US flights grounded because engineer accidentally 'replaced one file with another'

[lapfog_1]

6. so... not a hardware failure...

an architecture failure...

Someone should have constructed the software to make replacing a critical file nearly impossible... we typically do that in Unix / Linux systems by making such files "immutable" so that to change the contents one has to first issue a command to remove the restriction and then copy the new file over the old file. This prevents accidental replacement. In addition, if the file is truly critical, the architect should have designed the software to check the contents to ensure that the new file contents are "acceptable" format before resolving to use the new contents. This can be done many ways... but at the very least the new data should not cause the software to fail completely.

In the Object Storage world there is even the ability to require two different user accounts to change the contents of the object... i.e. the person with the authority to change the object t with a different object is NOT the same person / account needed to make the object even changeable. This is sort of like a nuclear launch sequence. Two people each with their own keys are required to make a change to a critical data file / object.

Not to say that even then accidents can't happen. Of course they can... but such systems make it much harder to do. Obviously, nuclear launch keys demand more attention from the operators than a pilot notification system.