9 ms·

All software is buggy. The problem with the MCAS system is that pilots were not informed that it was there, nor were they given a way to override it and take f

All software is buggy. The problem with the MCAS system is that pilots were not informed that it was there, nor were they given a way to override it and take full control of the airplane. Also, while the MCAS system relied on two sensors, if either failed, the MCAS system itself failed, so there was no built in back-up for it. Bugs in software happen because situations where they arise are sometimes hard to predict. You can test your software all you want but it's not until it's in the field that you start discovering new issues because people tend to do things in ways developers didn't consider. Tesla's software has over a billion miles of data on it and it still has issues in some basic functionality. And let's not talk about Iowa which in itself was a major failure in software release management.

linuxftw 7y ago
> the MCAS system itself failed The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. > Bugs in software happen because situations where they arise are sometimes hard to predict. Everything that cause MCAS to drive the plane into the ground was 100% predictable and testable. There are two basic problems. The first, is that the people that thought MCAS was a good idea in the first place are incompetent. The second problem is the people that designed and implemented the MCAS system were even more incompetent. Idiots managing idiots, and if I was the CEO of that company, that system would have never been allowed in the first place.
- muldvarp 7y ago
  > The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. You're technically right, but I'd say that incorrect sensor data is something that should be taken into account. And failing to take that into account is a failure on part of the MCAS.
  - kayfox 7y ago
    It did take it into account, but the incorrect angle reporting was not severe enough to result in the sensor being marked as faulty. From the sound of things it was designed to deal with large bit flips, sensor jamming the the home position or sensor misalignment (which is at fixed angles because of the mounting holes) rather than the sensor jamming in other positions or being horribly miscalibrated. The company that repaired the sensor used in the Lion Air Flight did loose their license to repair any and all certified avionics parts and is probably out of business at this point. Donno about the technician that forged the post-install tests of that sensor.
    - salawat 7y ago
      The architecture of the system was such that no cross-checking could occur. There was a feature to implement an AoA disagree light, but that only came into play if an optional package was purchased. The Lion Air crash data had the computer registering an angle off by a ridiculous degree that should not have even been attainable by flying one of these planes in the manner for which it was designed. The Ethiopian FDR showed even more ludicrous measurements as I recall. It wasn't just a case of "It wasn't bad enough", it was a case of the computer believing the plane was belly flopping into the air stream (75 degrees AoA!). Note the Space Shuttle only hits around 40 degrees on it's reentry in order to keep the wind hitting the thermally insulated bottom, and that only at Mach 10+. There is no excuse for any software engineer/computer scientist to ignore the basic physics of the domain they are coding for to the point they cannot identify when a critical measurement is so far out of whack as to be instantly dismissed. FDR graph: https://visualapproach.io/wp-content/uploads/2019/04/Data_Sheet_1.png https://visualapproach.io/wp-content/uploads/2019/04/Data_Sh...
  - pdonis 7y ago
    > I'd say that incorrect sensor data is something that should be taken into account I think that is the GP's point: MCAS operated exactly as it was designed, and it killed people because it was designed incompetently, not taking into account things that obviously should have been taken into account.
- jahlove 7y ago
  Is the fact that MCAS only relied on data from a single AOA sensor (when two existed) not a defect?
  - salawat 7y ago
    Multi-sensor inputs are not required for systems whose failure impact isn't rated as catastrophic, which Boeing specifically avoided in their safety analysis, ostensibly due to the fact they knew the FAA would require sim training for a multi-sensor system. So if you accept Boeing's original classification it is not a defect. Given that upon further testing after these disasters, the results required them to reclassify MCAS and the Flight computer it runs on as a single, potentially catastrophic point of failure, it is now a defect. Just wanted to point out that regulationwise, that situation evolved over time due to withholding or material omission of critical information with regards to the nature of the system to regulators. Whether or not a jury will agree is yet to be seen.
    - jahlove 7y ago
      > So if you accept Boeing's original classification it is not a defect. Then it's a design defect. The FAA even seems to think so. It seems like hair splitting.
- rbetts 7y ago
  > The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. "It worked on my airplane"
- sopooneo 7y ago
  I think saying the system didn't fail relies an overly tight notion of the MCAS system boundary.
pfundstein 7y ago
> All software is buggy. Assuming that's not hyperbole and just to be pedantic: mov ax,cs mov ds,ax mov ah,9 mov dx, offset Hello int 21h xor ax,ax int 21h Hello: db "Hello World!",13,10,"$"
- tantalor 7y ago
  Bug report for you... Expected: "Hello, World!" Actual: "Hello World!" (missing comma) See spec: https://en.wikipedia.org/wiki/%22Hello,_World!%22_program https://en.wikipedia.org/wiki/%22Hello,_World!%22_program
  - pelliphant 7y ago
    Don't know why I thought this was so funny, but I did. =)
- kalium_xyz 7y ago
  Sad thing we have little insight on microcode and the exact way machine code gets interpreted, for all we know there might still be a resulting bug from any step asm to execution.
Stierlitz 7y ago
@MDWolinski “.. while the MCAS system relied on two sensors ..” MCAS used only the one sensor, this decision made so as to avoid recertification. http://www.b737.org.uk/mcas.htm http://www.b737.org.uk/mcas.htm “Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs?” https://www.aviationtoday.com/2019/11/02/boeing-ceo-outlines-mcas-updates-congressional-hearings/ https://www.aviationtoday.com/2019/11/02/boeing-ceo-outlines...
mnm1 7y ago
Not all software is buggy to the point of killing almost four hundred people. Comparing some shit app some interns built for Iowa with avionics software is frankly insulting to the people who work hard to make avionics software. The same goes for Tesla. The avionics industry, including Boeing, used to have a great record in this area. Even if the mcas bugs were unavoidable, the fact still is that the design was fatally flawed due to either sensor being a single point of failure. And of course, the main problem that the whole, entire airplane is unstable in the air. How can you still make excuses for Boeing at this point in time? The only reason this bug should be irrelevant is because this plane should never carry another commercial passenger. But I'm sure profits will prevail over lives once again starting this summer or whenever the FAA gives their go ahead.
- catalogia 7y ago
  > And of course, the main problem that the whole, entire airplane is unstable in the air. That's not really true. The airframe is fine, except it doesn't handle like a 737. MCAS was meant to make the MAX handle like a 737. Mentour Pilot, a 737 instructor with a youtube channel, has covered this fairly extensively: https://youtu.be/TlinocVHpzk?t=951 https://youtu.be/TlinocVHpzk?t=951
  - mnm1 7y ago
    Great video. But he says the exact same thing I did. The MCAS is necessary because of the different engine placement. So the airplane cannot recover from a stall without it. That, to me, makes the entire airplane unstable and improper for commercial flights as this is an expected condition at times that the plane should be able to recover from. The airplane cannot function without a deeply flawed software system no one understands and no one knows how to operate. Changing the software doesn't change any of these things.
    - dschuler 7y ago
      It is possible to recover from a stall without MCAS, but the handling characteristics have changed. The requirement is that the force on the yoke increases with the angle of attack, but in the case of the MAX, the stick force becomes lighter at a certain point. As I understand it, Boeing was mainly trying to avoid training pilots for any changes.

linuxftw 7y ago

> the MCAS system itself failed The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. > Bugs in software happen because situations where they arise are sometimes hard to predict. Everything that cause MCAS to drive the plane into the ground was 100% predictable and testable. There are two basic problems. The first, is that the people that thought MCAS was a good idea in the first place are incompetent. The second problem is the people that designed and implemented the MCAS system were even more incompetent. Idiots managing idiots, and if I was the CEO of that company, that system would have never been allowed in the first place.

muldvarp 7y ago
> The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. You're technically right, but I'd say that incorrect sensor data is something that should be taken into account. And failing to take that into account is a failure on part of the MCAS.
- kayfox 7y ago
  It did take it into account, but the incorrect angle reporting was not severe enough to result in the sensor being marked as faulty. From the sound of things it was designed to deal with large bit flips, sensor jamming the the home position or sensor misalignment (which is at fixed angles because of the mounting holes) rather than the sensor jamming in other positions or being horribly miscalibrated. The company that repaired the sensor used in the Lion Air Flight did loose their license to repair any and all certified avionics parts and is probably out of business at this point. Donno about the technician that forged the post-install tests of that sensor.
  - salawat 7y ago
    The architecture of the system was such that no cross-checking could occur. There was a feature to implement an AoA disagree light, but that only came into play if an optional package was purchased. The Lion Air crash data had the computer registering an angle off by a ridiculous degree that should not have even been attainable by flying one of these planes in the manner for which it was designed. The Ethiopian FDR showed even more ludicrous measurements as I recall. It wasn't just a case of "It wasn't bad enough", it was a case of the computer believing the plane was belly flopping into the air stream (75 degrees AoA!). Note the Space Shuttle only hits around 40 degrees on it's reentry in order to keep the wind hitting the thermally insulated bottom, and that only at Mach 10+. There is no excuse for any software engineer/computer scientist to ignore the basic physics of the domain they are coding for to the point they cannot identify when a critical measurement is so far out of whack as to be instantly dismissed. FDR graph: https://visualapproach.io/wp-content/uploads/2019/04/Data_Sheet_1.png https://visualapproach.io/wp-content/uploads/2019/04/Data_Sh...
- pdonis 7y ago
  > I'd say that incorrect sensor data is something that should be taken into account I think that is the GP's point: MCAS operated exactly as it was designed, and it killed people because it was designed incompetently, not taking into account things that obviously should have been taken into account.
jahlove 7y ago
Is the fact that MCAS only relied on data from a single AOA sensor (when two existed) not a defect?
- salawat 7y ago
  Multi-sensor inputs are not required for systems whose failure impact isn't rated as catastrophic, which Boeing specifically avoided in their safety analysis, ostensibly due to the fact they knew the FAA would require sim training for a multi-sensor system. So if you accept Boeing's original classification it is not a defect. Given that upon further testing after these disasters, the results required them to reclassify MCAS and the Flight computer it runs on as a single, potentially catastrophic point of failure, it is now a defect. Just wanted to point out that regulationwise, that situation evolved over time due to withholding or material omission of critical information with regards to the nature of the system to regulators. Whether or not a jury will agree is yet to be seen.
  - jahlove 7y ago
    > So if you accept Boeing's original classification it is not a defect. Then it's a design defect. The FAA even seems to think so. It seems like hair splitting.
rbetts 7y ago
> The MCAS system didn't fail. It operated exactly as it was designed, it received faulty sensor data which in turn flew the plane into the ground. "It worked on my airplane"
sopooneo 7y ago
I think saying the system didn't fail relies an overly tight notion of the MCAS system boundary.

pfundstein 7y ago

> All software is buggy. Assuming that's not hyperbole and just to be pedantic: mov ax,cs mov ds,ax mov ah,9 mov dx, offset Hello int 21h xor ax,ax int 21h Hello: db "Hello World!",13,10,"$"

tantalor 7y ago
Bug report for you... Expected: "Hello, World!" Actual: "Hello World!" (missing comma) See spec: https://en.wikipedia.org/wiki/%22Hello,_World!%22_program https://en.wikipedia.org/wiki/%22Hello,_World!%22_program
- pelliphant 7y ago
  Don't know why I thought this was so funny, but I did. =)
kalium_xyz 7y ago
Sad thing we have little insight on microcode and the exact way machine code gets interpreted, for all we know there might still be a resulting bug from any step asm to execution.

Stierlitz 7y ago

@MDWolinski “.. while the MCAS system relied on two sensors ..” MCAS used only the one sensor, this decision made so as to avoid recertification. http://www.b737.org.uk/mcas.htm http://www.b737.org.uk/mcas.htm “Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs?” https://www.aviationtoday.com/2019/11/02/boeing-ceo-outlines-mcas-updates-congressional-hearings/ https://www.aviationtoday.com/2019/11/02/boeing-ceo-outlines...

mnm1 7y ago

Not all software is buggy to the point of killing almost four hundred people. Comparing some shit app some interns built for Iowa with avionics software is frankly insulting to the people who work hard to make avionics software. The same goes for Tesla. The avionics industry, including Boeing, used to have a great record in this area. Even if the mcas bugs were unavoidable, the fact still is that the design was fatally flawed due to either sensor being a single point of failure. And of course, the main problem that the whole, entire airplane is unstable in the air. How can you still make excuses for Boeing at this point in time? The only reason this bug should be irrelevant is because this plane should never carry another commercial passenger. But I'm sure profits will prevail over lives once again starting this summer or whenever the FAA gives their go ahead.

catalogia 7y ago
> And of course, the main problem that the whole, entire airplane is unstable in the air. That's not really true. The airframe is fine, except it doesn't handle like a 737. MCAS was meant to make the MAX handle like a 737. Mentour Pilot, a 737 instructor with a youtube channel, has covered this fairly extensively: https://youtu.be/TlinocVHpzk?t=951 https://youtu.be/TlinocVHpzk?t=951
- mnm1 7y ago
  Great video. But he says the exact same thing I did. The MCAS is necessary because of the different engine placement. So the airplane cannot recover from a stall without it. That, to me, makes the entire airplane unstable and improper for commercial flights as this is an expected condition at times that the plane should be able to recover from. The airplane cannot function without a deeply flawed software system no one understands and no one knows how to operate. Changing the software doesn't change any of these things.
  - dschuler 7y ago
    It is possible to recover from a stall without MCAS, but the handling characteristics have changed. The requirement is that the force on the yoke increases with the angle of attack, but in the case of the MAX, the stick force becomes lighter at a certain point. As I understand it, Boeing was mainly trying to avoid training pilots for any changes.