4 ms·

>“Only one computer was used in the past, because Boeing was able to prove statistically that its system was reliable, the person said.” Yeah, I have a real pr

>“Only one computer was used in the past, because Boeing was able to prove statistically that its system was reliable, the person said.” Yeah, I have a real problem with that. A priori of a computer failure, you may have statistical reliability. But once it actually fails, the failure rate is 100% and a backup computer is needed. Also, external AoA sensors fail all the time (like when a bird hits them), so the failure probability is very high. So we're not just talking about solid-state computer reliability here. What also concerns me is that airliners fly at transsonic speeds. How would the AoA calculations be affected when the airplane is in a slip for some reason, and the AoA sensors are reading different values? What happens when MCAS goes berserk at high speeds (ie. near Mach 1.) If MCAS wasn't even tested on takeoff, it sure as hell wasn't tested at Mach 0.8. If the stakes are not clear ... besides the loss of life, an airliner crash often results in the bankruptcy of the entire carrier. Source: commercially-rated airplane pilot who's studied high-speed aerodynamics.

crocal 7y ago
Statistics are used all the time in safety critical designs. But, this is key, they are then balanced with the outcome expected due to each statistical failure. The more serious the outcome, the less the tolerated statistical failure. In the case of MCAS, from what we have read so far, it seems this analysis was biased toward a non-catastrophic outcome (e.g. manageable through pilot action). This may explain why the statistical failure of a single computer was deemed sufficient. Now, assessors have upped the stakes, and the stats do not work anymore. This indeed reveals a very serious problem in the RAMS process at Boeing, and exceed the scope of a « simple » software fix.
varjag 7y ago
As an embedded systems developer, I have developed mistrust to statistical reliability figures. These days you quite often come across components and subassemblies with MTBF stating (sometimes tens of) millions of hours. When you try to clarify with the vendor how they arrive at these figures there is nothing but general handwaving about using industry tools and statistical models. But sorry, just can't seriously take it on faith that your product is going to last 11 centuries at 20C.
- Quequau 7y ago
  Yeah there's a few degrees of separation between the people who wrote the claims (and have to defend/support them) and the people that did the testing... and then substantially more between those that did the testing and those who did the original work showing that the statistical proofs on accelerated ageing were reasonable things to depend on. By the time it gets to the marketplace nobody knows anything and we're all acting like the monkeys in the story with banana and the ice-water spray.
- jacquesm 7y ago
  Any MTBF longer than that particular industry has existed should be suspect or invalidated absent an existence proof (which will take some time...).
- Hunisgung 7y ago
  A couple of years ago, I was working on the verification team for a (non-critical) avionics system for a large commercial aircraft. I noticed one of the components seemed to have more failures than expected. I reported the issue and the systems architect waved it off arguing that his analysis of the supplier data had proven that the MTBF for this component was over 500 thousand hours. Few months later, a task force was established by the project management to look for an alternate supplier for this component after it became obvious that its failure rate was significantly higher than advertised.
  - jhayward 7y ago
    Much, perhaps most, of the effect we have as individuals in large organizations is indirect and hard to see or quantify. It's not always as simple as we think and changing course of a group almost always takes time, education, repetition, and some redundant effort. It's still worthwhile and effective. It is entirely possible that this is a success story of a lower-level engineer raising an issue that the higher levels then addressed. Just because no one immediately jumps and say "by golly, we have to get rid of component X right now!" doesn't mean that the issue didn't begin percolating vertically and horizontally, ultimately resulting in a large-scale corrective effort.
rwc 7y ago
MCAS only active at critical phases of flight like takeoff. At cruise, MCAS would not be active.
- _ph_ 7y ago
  You have it the wrong way around. MCAS is not active while flaps are extended, so not during starts and landings. It is also not enabled while the autopilot is active, as MCAS isn't balancing the airplane but about giving the right rudder feedback to the pilot when manually piloting the airplane. The accidents happened in normal operations after the flaps were retracted.
heisenbit 7y ago
You were only mentioning the problems with MCAS when it comes to sensors and decision making. As bad as that is the fact that the MCAS decisions are de-facto locked in by spinning the trim wheel. Undoing those revolutions manually - after locking MCAS out - takes a while. A while that is not available in the flight states MCAS is most likely to act.

crocal 7y ago

Statistics are used all the time in safety critical designs. But, this is key, they are then balanced with the outcome expected due to each statistical failure. The more serious the outcome, the less the tolerated statistical failure. In the case of MCAS, from what we have read so far, it seems this analysis was biased toward a non-catastrophic outcome (e.g. manageable through pilot action). This may explain why the statistical failure of a single computer was deemed sufficient. Now, assessors have upped the stakes, and the stats do not work anymore. This indeed reveals a very serious problem in the RAMS process at Boeing, and exceed the scope of a « simple » software fix.

varjag 7y ago

As an embedded systems developer, I have developed mistrust to statistical reliability figures. These days you quite often come across components and subassemblies with MTBF stating (sometimes tens of) millions of hours. When you try to clarify with the vendor how they arrive at these figures there is nothing but general handwaving about using industry tools and statistical models. But sorry, just can't seriously take it on faith that your product is going to last 11 centuries at 20C.

Quequau 7y ago
Yeah there's a few degrees of separation between the people who wrote the claims (and have to defend/support them) and the people that did the testing... and then substantially more between those that did the testing and those who did the original work showing that the statistical proofs on accelerated ageing were reasonable things to depend on. By the time it gets to the marketplace nobody knows anything and we're all acting like the monkeys in the story with banana and the ice-water spray.
jacquesm 7y ago
Any MTBF longer than that particular industry has existed should be suspect or invalidated absent an existence proof (which will take some time...).
Hunisgung 7y ago
A couple of years ago, I was working on the verification team for a (non-critical) avionics system for a large commercial aircraft. I noticed one of the components seemed to have more failures than expected. I reported the issue and the systems architect waved it off arguing that his analysis of the supplier data had proven that the MTBF for this component was over 500 thousand hours. Few months later, a task force was established by the project management to look for an alternate supplier for this component after it became obvious that its failure rate was significantly higher than advertised.
- jhayward 7y ago
  Much, perhaps most, of the effect we have as individuals in large organizations is indirect and hard to see or quantify. It's not always as simple as we think and changing course of a group almost always takes time, education, repetition, and some redundant effort. It's still worthwhile and effective. It is entirely possible that this is a success story of a lower-level engineer raising an issue that the higher levels then addressed. Just because no one immediately jumps and say "by golly, we have to get rid of component X right now!" doesn't mean that the issue didn't begin percolating vertically and horizontally, ultimately resulting in a large-scale corrective effort.

rwc 7y ago

MCAS only active at critical phases of flight like takeoff. At cruise, MCAS would not be active.

_ph_ 7y ago
You have it the wrong way around. MCAS is not active while flaps are extended, so not during starts and landings. It is also not enabled while the autopilot is active, as MCAS isn't balancing the airplane but about giving the right rudder feedback to the pilot when manually piloting the airplane. The accidents happened in normal operations after the flaps were retracted.

heisenbit 7y ago

You were only mentioning the problems with MCAS when it comes to sensors and decision making. As bad as that is the fact that the MCAS decisions are de-facto locked in by spinning the trim wheel. Undoing those revolutions manually - after locking MCAS out - takes a while. A while that is not available in the flight states MCAS is most likely to act.