[db48x]

The problem was in the software too. It made an assumption that the height above ground could not change by several miles all at once, but flying over a very tall cliff caused the terrain height to do just that. Because we have reasonably accurate 3D models of the moon’s terrain, they could have done an exhaustive search to find the largest change that could ever be seen in practice and made their threshold higher than that.

(Or they could have searched google for “tallest cliff on the moon” and just gone with that result.)

As usual, it is only when multiple problems line up just right that an accident happens. They had to have both a flaw in their software _and_ a flaw in their mission planning process, and those flaws had to line up with each other. https://en.wikipedia.org/wiki/Swiss_cheese_model

[roundandround]

If they had every intention of staying on plan but some team had delays and costs for fixing bugs with handling a larger differential than the lander would encounter, I assume a manager would be let go.

[db48x]

That’s a useless thing to speculate about.

My point is that they could have used a more appropriate threshold from the very beginning. It wouldn’t have cost them any development time.

[roundandround]

I think NASAs switch to Probabilistic Risk Assessment has everything to do with unhappiness with doing a study of the entire moon and expanding requirements that shouldn't cost any more development time.

Exactly what planning failure would occur wouldn't have been known, so how many other general capabilities would this lander have needed to maintain across different scenarios where they might interact with each other? How much less testing of the actual plan would they have made to stay on schedule and in budget?