4 ms·

A statistically unlikely pair of crashes or the same model of plane, same phase of flight, same consequences, and similar altitude variations would seem to be e

A statistically unlikely pair of crashes or the same model of plane, same phase of flight, same consequences, and similar altitude variations would seem to be enough justification for a prudent grounding. If a company releases a new version of their software and it crashes twice in similar ways (much more frequently than the previous version), that is also enough reason to rollback the release and investigate, especially if the software has any critical use cases.

snowwrestler 8y ago
If you release a software update and only 2 out of thousands of nodes are experiencing problems, would you honestly take the whole application offline over that? Most software companies would not, in my experience. They would take a close look at those two nodes first. Obviously commercial aviation has much higher standards than software vendors generally do. Airline tickets don’t generally come with 5,000 word EULAs with all-caps provisions like “THIS SOFTWARE IS NOT FIT FOR PURPOSE AND SHOULD NOT BE USED FOR ANY REASON AND YOU ASSUME ALL RESPONSIBILITY FOR ANY NEGATIVE OUTCOMES OF ANY KIND” etc. Two crashes in close succession seems like an obvious abnormality. But because standards are so high, to commercial aviation providers and regulators, every single crash is treated as a significant abnormality. So the question is, why don’t they ground all models of a certain plane after a single crash? Once you understand that, the same logic applies to two crashes.
- tayo42 8y ago
  This doesn't really work, those 2 nodes of thousands have to kill a little over 300 people too when they go bad, when other software releases haven't killed people.
- dmichulke 8y ago
  The first fallacy in this is that (as I understand it) you only think about probabilities, while in fact it's about probability (of something bad happening) times the cost of that bad thing. Clearly, a chance for a bug losing you 300$ is much less of a problem than a chance for a bug killing 300 people. The second thing is that a software update may render previous knowledge useless. Just because the old software ran successfully on 100k nodes, it might still be the case that 2 out of 1000 new versions fail, so then you have 0.2% failure rate. That doesn't mean you should take out all 100k nodes but it means you might want to stop the 1k nodes in accordance with the principles laid out above. Finally, I am not even sure why this is a yes/no question. How about: You're allowed to use the plane but you cannot rely on a defense of "the FAA said it was ok" if something happens, so talk to your insurance before.
- FartyMcFarter 8y ago
  You're missing the point. It's not just about the fact that two crashes happened. It's that the crashes look suspiciously similar. So this is both statistically suspicious, and points at a possible common cause for the crash, making it even more worrying that there's something seriously broken in this design.

snowwrestler 8y ago

If you release a software update and only 2 out of thousands of nodes are experiencing problems, would you honestly take the whole application offline over that? Most software companies would not, in my experience. They would take a close look at those two nodes first. Obviously commercial aviation has much higher standards than software vendors generally do. Airline tickets don’t generally come with 5,000 word EULAs with all-caps provisions like “THIS SOFTWARE IS NOT FIT FOR PURPOSE AND SHOULD NOT BE USED FOR ANY REASON AND YOU ASSUME ALL RESPONSIBILITY FOR ANY NEGATIVE OUTCOMES OF ANY KIND” etc. Two crashes in close succession seems like an obvious abnormality. But because standards are so high, to commercial aviation providers and regulators, every single crash is treated as a significant abnormality. So the question is, why don’t they ground all models of a certain plane after a single crash? Once you understand that, the same logic applies to two crashes.

tayo42 8y ago
This doesn't really work, those 2 nodes of thousands have to kill a little over 300 people too when they go bad, when other software releases haven't killed people.
dmichulke 8y ago
The first fallacy in this is that (as I understand it) you only think about probabilities, while in fact it's about probability (of something bad happening) times the cost of that bad thing. Clearly, a chance for a bug losing you 300$ is much less of a problem than a chance for a bug killing 300 people. The second thing is that a software update may render previous knowledge useless. Just because the old software ran successfully on 100k nodes, it might still be the case that 2 out of 1000 new versions fail, so then you have 0.2% failure rate. That doesn't mean you should take out all 100k nodes but it means you might want to stop the 1k nodes in accordance with the principles laid out above. Finally, I am not even sure why this is a yes/no question. How about: You're allowed to use the plane but you cannot rely on a defense of "the FAA said it was ok" if something happens, so talk to your insurance before.
FartyMcFarter 8y ago
You're missing the point. It's not just about the fact that two crashes happened. It's that the crashes look suspiciously similar. So this is both statistically suspicious, and points at a possible common cause for the crash, making it even more worrying that there's something seriously broken in this design.