8 ms·

Like the Toyota unintended acceleration issue we need third parties to look at the flight control software and engineering decisions taken for the MAX line and

Like the Toyota unintended acceleration issue we need third parties to look at the flight control software and engineering decisions taken for the MAX line and give a an independent report. Certainly not the FAA who delegated their oversight to Boeing. 346 people died because of their ineptitude.

Retric 8y ago
At best, stricter regulations may have resulted in a different design to comply with US regulations. The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. So, it’s tricky to place blame on US regulators for foreign crashes.
- jeltz 8y ago
  That just means FAA wasn't the only inept organization.
  - Retric 8y ago
    Blaming EASA/FAA/Boing etc feels good, but calling them inept becase they are not perfect is overstating things. Looking back it seems like an obviously bad call, but that’s hindsight bias.
    - jeltz 8y ago
      I did not blame FAA, I was just pointing out why your logic was flawed. Just because the plane crashes did not happen in the US does not mean that the FAA may not be at fault. The FAA had approved the plane and it was operated the same way in Africa as in the US so it is just chance that none of the crashes happened in the US.
      - Retric 8y ago
        FAA has many regulations that most of Africa does not. So, no they where not operated in the same fashion. It’s still been grounded in the US for good reasons, but you can’t take individual regulations in isolation.
- throwawaycert 8y ago
  While in a de jure sense this is true, de facto the FAA effectively does have oversight over many (maybe most) commercial aircraft all over the world. Small countries in particular do not have the resources necessary to exercise meaningful oversight over every type of aircraft on the planet, and defer to FAA decisions in virtually every respect for Boeing and other American-made aircraft, and the US FAA and NTSB are involved in the investigation of virtually every incident involving a Boeing aircraft anywhere in the world. Even larger, well-resourced geopolitical entities like the EU rely heavily on the FAA to do its job for Boeing aircraft, much as the FAA relies on the EASA to do its job for Airbus aircraft. It's not pure rubber stamping, but it's close enough that things like this can pretty easily happen if a manufacturer's home agency falls asleep at the switch. An example of the FAA's influence: Airworthiness regulations are so closely coordinated that special numbering is used by Canada, Europe, and Japan to match the numbering of FAA airworthiness regulations for easy cross-referencing. The FAA is also delegated air traffic control responsibility for much of the world's international airspace by the ICAO. It is basically impossible to fly a commercial aircraft on Earth without being under the – possibly very heavy – influence of US civil aviation authorities, and it would take a great many resources and serious, concerted political will by many countries to change that.
- trimbo 8y ago
  > The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. The FAA has bilateral agreements with other countries and the EU for certification[1]. I read recently but can't quickly find in this that the FAA trusts EASA's certs for Airbus flying in the US. The Ethiopian agency also trusts the FAA and EASA for this information[2] So, it's not really tricky here, we can blame the FAA for the crash of a US manufactured plane in a foreign land (if the problem was the FAA's certification process). [1] - https://www.faa.gov/aircraft/air_cert/international/bilateral_agreements/baa_basa_listing/ https://www.faa.gov/aircraft/air_cert/international/bilatera... [2] - https://web.archive.org/web/20180215175924/http://www.ecaa.gov.et/Directorate.aspx https://web.archive.org/web/20180215175924/http://www.ecaa.g...
  - Retric 8y ago
    Edit: The entire point around these regulations is managing trust. Aircraft manufacturers are trying to build safe aircraft, the question is how much oversight is nessisary. EASA largely trusted the FAA and the FAA largely trusted Boing which they need to do. EASA can’t verify every bolt, they need to trust the manufacturer’s process to some degree. So, EASA can’t really abandon blame as easily as they abandon responsibility. If they allow a flawed process to continue then that’s on them. However, in this case these agreements still give EASA veto authority about what aircraft are allowed. Which is why EASA was able to ground these airplanes before the FAA did.
thechao 8y ago
Toyota never had an “unintended acceleration issue”—that was purely human error. A Toyota engine can’t overpower its brakes, unless there was gross negligence in the care of the brakes, i.e., they were totally inoperative. Just to make sure we’re clear on the braking thing: if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car will absolutely come to a complete halt in about the same distance as if you didn’t have your foot on the accelerator. Here’s another thing to back up my claim: how do you think burn outs work?
- noselasd 8y ago
  an "unintended acceleration issue" is quite orthogonal to whether the brakes work perfectly and could overcome the engine.
- seandougall 8y ago
  That sounds like a fun experiment to try on, say, a winding mountain road...
- amartya916 8y ago
  I do not know why you are getting the downvotes, but you are correct. The DoT and independent inspectors backed up this scenario. https://www.caranddriver.com/features/a15125313/its-all-your-fault-the-dot-renders-its-verdict-on-toyotas-unintended-acceleration-scare-feature/ https://www.caranddriver.com/features/a15125313/its-all-your...
  - iforgotpassword 8y ago
    This doesn't mention the horrible spaghetti code NASA found when reviewing the code. 250k lines of C with thousands of global variables. It leaves a pretty bad taste. Then again, I still wouldn't be surprised if most people were just too perplexed if their car suddenly accelerated like crazy and not stay calm and hit the brakes as hard as possible right away. It might take you a second or two to get what's going on, and by then you might already have lost control.
rasz 8y ago
I agree, we need someone like Michael Barr to comb thru supposedly clean safety certified Ada codebase (in reality most likely full of C++ garbage).
- 4thaccount 8y ago
  Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.
  - fmihaila 8y ago
    > Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome. It's not about software verification. In this case, the verifier would have given it a pass (with respect to this particular accident). It's about bad management/bad requirements: - "minimization of pilot training is the overarching requirement" - "it's okay to feed only a single sensor into MCAS, even though there are two of them on the plane" - "it's okay to sell critical safety equipment as options costing extra" - "it's okay to not tell any pilot about any of this, since we practically didn't change anything". This particular one is not about C++.
    - 4thaccount 8y ago
      Agreed that static analysis/proof verification only gets you so far. I was just thinking that the visibility of the incident might lead to some companies asking how they can go even further to make things safer. Of course the first and most important steps consist of what you're saying above, followed by doing whatever they can on the software front if they aren't doing it already.
- mrpippy 8y ago
  The problem here is not a software bug—-the software performed as designed, the design was just bad.
MuffinFlavored 8y ago
> 346 people died because of their ineptitude. This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all rotten because 346 died is kind of dramatic when millions have been kept safe.
- lisper 8y ago
  The problem is not that this is a big number of deaths in an absolute sense. The problem is that this is a big number of deaths to result from a chain of events that can ultimately be traced back to a strategic decision by Boeing to increase profits, and where an explicit component of that strategy was to cut corners on training. The whole point of MCAS was to avoid the overhead of having to obtain a new type certificate for the new engine design, and that lead to 346 deaths. That's the problem.
  - diminoten 8y ago
    All deaths can be traced back to some kind of profit motive, but I don't see you protesting every hospital/doctor on the planet. It's incredibly dangerous to propose changes to the FAA, given how much of an unqualified success they've had over the years at keeping flight safe. Don't let y our populist rage kill probably one of the best/most successful government institutions the US has ever created.
    - lisper 8y ago
      > It's incredibly dangerous to propose changes to the FAA That is an incredibly ironic thing to say, because these deaths are a result of changes to the FAA, specifically, the delegation of the FAA's regulatory authority to the company being regulated. That this would not end well was easily foreseeable because it's such a blatant conflict of interest.
      - 8y ago

Retric 8y ago

At best, stricter regulations may have resulted in a different design to comply with US regulations. The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. So, it’s tricky to place blame on US regulators for foreign crashes.

jeltz 8y ago
That just means FAA wasn't the only inept organization.
- Retric 8y ago
  Blaming EASA/FAA/Boing etc feels good, but calling them inept becase they are not perfect is overstating things. Looking back it seems like an obviously bad call, but that’s hindsight bias.
  - jeltz 8y ago
    I did not blame FAA, I was just pointing out why your logic was flawed. Just because the plane crashes did not happen in the US does not mean that the FAA may not be at fault. The FAA had approved the plane and it was operated the same way in Africa as in the US so it is just chance that none of the crashes happened in the US.
    - Retric 8y ago
      FAA has many regulations that most of Africa does not. So, no they where not operated in the same fashion. It’s still been grounded in the US for good reasons, but you can’t take individual regulations in isolation.
throwawaycert 8y ago
While in a de jure sense this is true, de facto the FAA effectively does have oversight over many (maybe most) commercial aircraft all over the world. Small countries in particular do not have the resources necessary to exercise meaningful oversight over every type of aircraft on the planet, and defer to FAA decisions in virtually every respect for Boeing and other American-made aircraft, and the US FAA and NTSB are involved in the investigation of virtually every incident involving a Boeing aircraft anywhere in the world. Even larger, well-resourced geopolitical entities like the EU rely heavily on the FAA to do its job for Boeing aircraft, much as the FAA relies on the EASA to do its job for Airbus aircraft. It's not pure rubber stamping, but it's close enough that things like this can pretty easily happen if a manufacturer's home agency falls asleep at the switch. An example of the FAA's influence: Airworthiness regulations are so closely coordinated that special numbering is used by Canada, Europe, and Japan to match the numbering of FAA airworthiness regulations for easy cross-referencing. The FAA is also delegated air traffic control responsibility for much of the world's international airspace by the ICAO. It is basically impossible to fly a commercial aircraft on Earth without being under the – possibly very heavy – influence of US civil aviation authorities, and it would take a great many resources and serious, concerted political will by many countries to change that.
trimbo 8y ago
> The FAA is not a global organization, they don’t have oversight over any of the crashed aircraft. The FAA has bilateral agreements with other countries and the EU for certification[1]. I read recently but can't quickly find in this that the FAA trusts EASA's certs for Airbus flying in the US. The Ethiopian agency also trusts the FAA and EASA for this information[2] So, it's not really tricky here, we can blame the FAA for the crash of a US manufactured plane in a foreign land (if the problem was the FAA's certification process). [1] - https://www.faa.gov/aircraft/air_cert/international/bilateral_agreements/baa_basa_listing/ https://www.faa.gov/aircraft/air_cert/international/bilatera... [2] - https://web.archive.org/web/20180215175924/http://www.ecaa.gov.et/Directorate.aspx https://web.archive.org/web/20180215175924/http://www.ecaa.g...
- Retric 8y ago
  Edit: The entire point around these regulations is managing trust. Aircraft manufacturers are trying to build safe aircraft, the question is how much oversight is nessisary. EASA largely trusted the FAA and the FAA largely trusted Boing which they need to do. EASA can’t verify every bolt, they need to trust the manufacturer’s process to some degree. So, EASA can’t really abandon blame as easily as they abandon responsibility. If they allow a flawed process to continue then that’s on them. However, in this case these agreements still give EASA veto authority about what aircraft are allowed. Which is why EASA was able to ground these airplanes before the FAA did.

thechao 8y ago

Toyota never had an “unintended acceleration issue”—that was purely human error. A Toyota engine can’t overpower its brakes, unless there was gross negligence in the care of the brakes, i.e., they were totally inoperative. Just to make sure we’re clear on the braking thing: if you were to accelerate a Toyota sedan (any of them) to 70mph, then stomp on the brakes while holding the accelerator to the floor, the car will absolutely come to a complete halt in about the same distance as if you didn’t have your foot on the accelerator. Here’s another thing to back up my claim: how do you think burn outs work?

noselasd 8y ago
an "unintended acceleration issue" is quite orthogonal to whether the brakes work perfectly and could overcome the engine.
seandougall 8y ago
That sounds like a fun experiment to try on, say, a winding mountain road...
amartya916 8y ago
I do not know why you are getting the downvotes, but you are correct. The DoT and independent inspectors backed up this scenario. https://www.caranddriver.com/features/a15125313/its-all-your-fault-the-dot-renders-its-verdict-on-toyotas-unintended-acceleration-scare-feature/ https://www.caranddriver.com/features/a15125313/its-all-your...
- iforgotpassword 8y ago
  This doesn't mention the horrible spaghetti code NASA found when reviewing the code. 250k lines of C with thousands of global variables. It leaves a pretty bad taste. Then again, I still wouldn't be surprised if most people were just too perplexed if their car suddenly accelerated like crazy and not stay calm and hit the brakes as hard as possible right away. It might take you a second or two to get what's going on, and by then you might already have lost control.

rasz 8y ago

I agree, we need someone like Michael Barr to comb thru supposedly clean safety certified Ada codebase (in reality most likely full of C++ garbage).

4thaccount 8y ago
Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome.
- fmihaila 8y ago
  > Is there a percentage pie chart for what was used on the MAX? Like 80% Ada, 15% C++, and 5% C? I wonder if we'll see a move to things like Spark where proof verification becomes more standard? I don't know much about avionics software, so any educated comments are welcome. It's not about software verification. In this case, the verifier would have given it a pass (with respect to this particular accident). It's about bad management/bad requirements: - "minimization of pilot training is the overarching requirement" - "it's okay to feed only a single sensor into MCAS, even though there are two of them on the plane" - "it's okay to sell critical safety equipment as options costing extra" - "it's okay to not tell any pilot about any of this, since we practically didn't change anything". This particular one is not about C++.
  - 4thaccount 8y ago
    Agreed that static analysis/proof verification only gets you so far. I was just thinking that the visibility of the incident might lead to some companies asking how they can go even further to make things safer. Of course the first and most important steps consist of what you're saying above, followed by doing whatever they can on the software front if they aren't doing it already.
mrpippy 8y ago
The problem here is not a software bug—-the software performed as designed, the design was just bad.

MuffinFlavored 8y ago

> 346 people died because of their ineptitude. This might be too hot of a take for HackerNews, but... look at how many people the FAA has kept safe over the past 30 years. I'm pretty sure the number of people who travel without dying is very, very high. I don't disagree that their might have been some ineptitude (I'm sure you could find that anywhere for anything since it's opinion driven), but to say the FAA is all rotten because 346 died is kind of dramatic when millions have been kept safe.

lisper 8y ago
The problem is not that this is a big number of deaths in an absolute sense. The problem is that this is a big number of deaths to result from a chain of events that can ultimately be traced back to a strategic decision by Boeing to increase profits, and where an explicit component of that strategy was to cut corners on training. The whole point of MCAS was to avoid the overhead of having to obtain a new type certificate for the new engine design, and that lead to 346 deaths. That's the problem.
- diminoten 8y ago
  All deaths can be traced back to some kind of profit motive, but I don't see you protesting every hospital/doctor on the planet. It's incredibly dangerous to propose changes to the FAA, given how much of an unqualified success they've had over the years at keeping flight safe. Don't let y our populist rage kill probably one of the best/most successful government institutions the US has ever created.
  - lisper 8y ago
    > It's incredibly dangerous to propose changes to the FAA That is an incredibly ironic thing to say, because these deaths are a result of changes to the FAA, specifically, the delegation of the FAA's regulatory authority to the company being regulated. That this would not end well was easily foreseeable because it's such a blatant conflict of interest.
    - 8y ago