3 ms·

I don't understand how this was a software failure. From everything I've ever read about this issue, including this piece, the failure seems very much like a mo

I don't understand how this was a software failure. From everything I've ever read about this issue, including this piece, the failure seems very much like a model & design failure. It seems like a systems & human factors engineering failure. Not a software failure.

thatswrong0 7y ago
Well, if you ask why only once, then it's a software failure - a system with a serious amount of control authority can fail catastrophically if just one hardware sensor fails. Safety critical software like this must account for hardware failures. But there are many many more whys you need to ask before you get the full picture.
- Haga 7y ago
  I wish some of the engineers that dropped out over this could speak up.
jrockway 7y ago
They should have written a program to determine the angle of attack without an angle of attack sensor. The fact that they couldn't means that there need to be more team-building exercises, websites blocked by the corporate firewall, and outsourcing!
afterburner 7y ago
The software fix was the stopgap solution to a design side effect. The stopgap solution was also not that well designed, and ultimately confused the pilots, who were deliberately untrained in the changes. Why deliberately untrained? Because the whole selling point of the design was that you wouldn't have to retrain your pilots because it would handle just like the old plane.
- im_down_w_otp 7y ago
  Still none of that makes it a software failure. We're also straining the definition of "failure" here as it relates to software. Software doesn't really fail in the way considered in the realm of traditional functional-safety. It doesn't wear out like a cable or a capacitor. But, I digress.
mantap 7y ago
There were absolutely software design failures - to have two sensors but only read the value of one of them and to not even apply sanity checks to check the sensor is working (e.g. is the sensor saying that the aircraft is pointing towards the sky when it's on the ground?). It's simply crazy. The only plausible explanation is that Boeing did not perceive MCAS to be safety critical, even though it had control of the aircraft, and so they didn't bother to apply any redundancy to it. Boeing seemed to wrongly assume that any failure modes would appear as a runaway trim.
- im_down_w_otp 7y ago
  That seems very specifically to be a design failure, not a software failure, no?

thatswrong0 7y ago

Well, if you ask why only once, then it's a software failure - a system with a serious amount of control authority can fail catastrophically if just one hardware sensor fails. Safety critical software like this must account for hardware failures. But there are many many more whys you need to ask before you get the full picture.

Haga 7y ago
I wish some of the engineers that dropped out over this could speak up.

jrockway 7y ago

They should have written a program to determine the angle of attack without an angle of attack sensor. The fact that they couldn't means that there need to be more team-building exercises, websites blocked by the corporate firewall, and outsourcing!

afterburner 7y ago

The software fix was the stopgap solution to a design side effect. The stopgap solution was also not that well designed, and ultimately confused the pilots, who were deliberately untrained in the changes. Why deliberately untrained? Because the whole selling point of the design was that you wouldn't have to retrain your pilots because it would handle just like the old plane.

im_down_w_otp 7y ago
Still none of that makes it a software failure. We're also straining the definition of "failure" here as it relates to software. Software doesn't really fail in the way considered in the realm of traditional functional-safety. It doesn't wear out like a cable or a capacitor. But, I digress.

mantap 7y ago

There were absolutely software design failures - to have two sensors but only read the value of one of them and to not even apply sanity checks to check the sensor is working (e.g. is the sensor saying that the aircraft is pointing towards the sky when it's on the ground?). It's simply crazy. The only plausible explanation is that Boeing did not perceive MCAS to be safety critical, even though it had control of the aircraft, and so they didn't bother to apply any redundancy to it. Boeing seemed to wrongly assume that any failure modes would appear as a runaway trim.

im_down_w_otp 7y ago
That seems very specifically to be a design failure, not a software failure, no?