7 ms·

From the article: >“Only one computer was used in the past, because Boeing was able to prove statistically that its system was reliable, the person said.” Yea

by nemild 7y ago

From the article: >“Only one computer was used in the past, because Boeing was able to prove statistically that its system was reliable, the person said.” Years back, my father co-wrote a paper on the Space Shuttle Challenger showing issues with the statistical thinking at NASA: http://www.math.montana.edu/shancock/courses/stat401/Dalal_etal_1989-Challenger.pdf http://www.math.montana.edu/shancock/courses/stat401/Dalal_e... I wonder what statistical techniques Boeing used, and how defensible those techniques were.

voldacar 7y ago
"Prove statistically" is such an odd phrase. I wonder if they used fuzzing or something like that? Because even so that is quite far from a formal software proof
- jwilliams 7y ago
  It's relatively common in embedded programming (in my experience). A lot of real-time programming is around scheduling. You certainly can use formal proofs there too, but statistical methods would be common at significant scale.
- na85 7y ago
  It's quite common in aerospace certification to cite systems having proven records of an acceptably-low number of failures per flight hour or similar metric. I suspect they're using that sense of the word "proven", as opposed to a formal software proof.
- pdpi 7y ago
  Don’t know what’s going on with their certification process here but probabilistic reasoning is very common, and very reasonable, eg in cryptography.
danjayh 7y ago
For those who are outside of the industry, the article is probably not completely accurate. I don't know specifically about the 737 MAX, but for many of their other newer airframes (787, upcoming 777x), Boeing relies on a concept called 'high integrity at the source'. Essentially, two complete copies of the flight computer hardware are put on a single card and they cross-compare their results. If you're looking for a bit of dense reading material on the subject, you might find a related patent application interesting: https://patents.google.com/patent/US9170907 https://patents.google.com/patent/US9170907
- makomk 7y ago
  As described, that provides zero protection against software bugs. Both of the redundant lanes are carrying out identical computations on identical data using identical code and will make identical errors if there's any bug. On paper it's more powerful than the non-synchronized system Airbus uses in that it can stop erroneous computations from being used at all, rather than detecting them after the fact, but it wouldn't be able to detect problems like the Qantas Flight 72 accident in which erroneous data with a particular timing happens to trip a latent bug.
  - CriticalCathed 7y ago
    What's the upside of two identical computers computing the same input? I can understand a backup if the first fails, but why two identical systems contemporaneously computing?
    - makomk 7y ago
      Protects against certain kinds of transient hardware faults that are common enough to worry about in safety-critical systems, I think.
      - Aardwolf 7y ago
        How does it know which of the two is correct?
        ethbro 7y ago
        See above comment. With 2, you don't. With 3, you do. But if there's a human in the loop and a manual alternate control pathway, detecting a disagreement allows you to cue the manual operator and transfer control to them. Or fall back to a much simpler system of computer aid. With 1, hardware failures are extremely hard to detect at all, as even your computational checks for internal consistency are subject to mutation.
kuzehanka 7y ago
Statistics is borderline pseudoscience. Various techniques and methodologies are rigorous, but when applying them to complex real world problems, there is a necessary element of human interpretation. With that interpretation it's trivial to twist most scenarios towards either outcome. I spent several years doing stats/BI in the medical manufacturing industry and have on many occasions done analyses that showed what my employer wanted and would stand up to scrutiny, but if my employer wanted the opposite outcome of that analysis, that would also be possible and also stand up to scrutiny. The best way to address this is to remove any financial/business incentives form the analysis, but that's not really feasible most of the time and also requires larger/more expensive teams that are capable of internally challenging their own work. https://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statistics https://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statist...
- ethbro 7y ago
  I came across this on Friday: https://medium.com/ssense-tech/building-the-data-science-dream-s-81892a56848f https://medium.com/ssense-tech/building-the-data-science-dre... Despite the title, it's mostly an essay on why visualization and presentation are critical to any statistical treatment. I think it's one of those difficult skill combinations. You want someone extremely well-versed in statistics, plus someone capable of giving a damn about accurate presentation, plus someone with the UX intuition to make the correct choices to make something readable without sacrificing accuracy and important nuances. And if that "someone" is actually two people, you run the risk of telephone misunderstandings as work passes between them. Which is a tall order. Made taller by the (as you note) different kinds of audiences: simply ignorant, aggressively biased, rushed, etc.

by nemild 7y ago

voldacar 7y ago

"Prove statistically" is such an odd phrase. I wonder if they used fuzzing or something like that? Because even so that is quite far from a formal software proof

jwilliams 7y ago
It's relatively common in embedded programming (in my experience). A lot of real-time programming is around scheduling. You certainly can use formal proofs there too, but statistical methods would be common at significant scale.
na85 7y ago
It's quite common in aerospace certification to cite systems having proven records of an acceptably-low number of failures per flight hour or similar metric. I suspect they're using that sense of the word "proven", as opposed to a formal software proof.
pdpi 7y ago
Don’t know what’s going on with their certification process here but probabilistic reasoning is very common, and very reasonable, eg in cryptography.

danjayh 7y ago

For those who are outside of the industry, the article is probably not completely accurate. I don't know specifically about the 737 MAX, but for many of their other newer airframes (787, upcoming 777x), Boeing relies on a concept called 'high integrity at the source'. Essentially, two complete copies of the flight computer hardware are put on a single card and they cross-compare their results. If you're looking for a bit of dense reading material on the subject, you might find a related patent application interesting: https://patents.google.com/patent/US9170907 https://patents.google.com/patent/US9170907

makomk 7y ago
As described, that provides zero protection against software bugs. Both of the redundant lanes are carrying out identical computations on identical data using identical code and will make identical errors if there's any bug. On paper it's more powerful than the non-synchronized system Airbus uses in that it can stop erroneous computations from being used at all, rather than detecting them after the fact, but it wouldn't be able to detect problems like the Qantas Flight 72 accident in which erroneous data with a particular timing happens to trip a latent bug.
- CriticalCathed 7y ago
  What's the upside of two identical computers computing the same input? I can understand a backup if the first fails, but why two identical systems contemporaneously computing?
  - makomk 7y ago
    Protects against certain kinds of transient hardware faults that are common enough to worry about in safety-critical systems, I think.
    - Aardwolf 7y ago
      How does it know which of the two is correct?
      - ethbro 7y ago
        See above comment. With 2, you don't. With 3, you do. But if there's a human in the loop and a manual alternate control pathway, detecting a disagreement allows you to cue the manual operator and transfer control to them. Or fall back to a much simpler system of computer aid. With 1, hardware failures are extremely hard to detect at all, as even your computational checks for internal consistency are subject to mutation.

kuzehanka 7y ago

Statistics is borderline pseudoscience. Various techniques and methodologies are rigorous, but when applying them to complex real world problems, there is a necessary element of human interpretation. With that interpretation it's trivial to twist most scenarios towards either outcome. I spent several years doing stats/BI in the medical manufacturing industry and have on many occasions done analyses that showed what my employer wanted and would stand up to scrutiny, but if my employer wanted the opposite outcome of that analysis, that would also be possible and also stand up to scrutiny. The best way to address this is to remove any financial/business incentives form the analysis, but that's not really feasible most of the time and also requires larger/more expensive teams that are capable of internally challenging their own work. https://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statistics https://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statist...

ethbro 7y ago
I came across this on Friday: https://medium.com/ssense-tech/building-the-data-science-dream-s-81892a56848f https://medium.com/ssense-tech/building-the-data-science-dre... Despite the title, it's mostly an essay on why visualization and presentation are critical to any statistical treatment. I think it's one of those difficult skill combinations. You want someone extremely well-versed in statistics, plus someone capable of giving a damn about accurate presentation, plus someone with the UX intuition to make the correct choices to make something readable without sacrificing accuracy and important nuances. And if that "someone" is actually two people, you run the risk of telephone misunderstandings as work passes between them. Which is a tall order. Made taller by the (as you note) different kinds of audiences: simply ignorant, aggressively biased, rushed, etc.