need, more than ever, for the software we write to work reliably in a
wide range of conditions--even, and especially, in unexpected
conditions. This paper, written by Robert Rasmussen from the Jet
Propulsion Laboratory in 2008, documents and explains some fundamental
principles about designing fault tolerant systems as learned through
the hard-won experience of designing Guidance, Navigation, and Control
(GN&C) systems for spacecraft. This paper is rich in principles,
examples, and advice, and has a lot to offer to our industry
generally--even for those of us who don't actively work on software for
spaceships!
