Comment by redis_mlc | Hacker News Reader

Comment by redis_mlc | Hacker News Reader

>“Only one computer was used in the past, because Boeing was able to prove statistically that its system was reliable, the person said.”

Yeah, I have a real problem with that.

A priori of a computer failure, you may have statistical reliability. But once it actually fails, the failure rate is 100% and a backup computer is needed.

Also, external AoA sensors fail all the time (like when a bird hits them), so the failure probability is very high. So we're not just talking about solid-state computer reliability here.

What also concerns me is that airliners fly at transsonic speeds. How would the AoA calculations be affected when the airplane is in a slip for some reason, and the AoA sensors are reading different values? What happens when MCAS goes berserk at high speeds (ie. near Mach 1.)

If MCAS wasn't even tested on takeoff, it sure as hell wasn't tested at Mach 0.8.

If the stakes are not clear ... besides the loss of life, an airliner crash often results in the bankruptcy of the entire carrier.

Source: commercially-rated airplane pilot who's studied high-speed aerodynamics.

As an embedded systems developer, I have developed mistrust to statistical reliability figures. These days you quite often come across components and subassemblies with MTBF stating (sometimes tens of) millions of hours. When you try to clarify with the vendor how they arrive at these figures there is nothing but general handwaving about using industry tools and statistical models.

But sorry, just can't seriously take it on faith that your product is going to last 11 centuries at 20C.

Yeah there's a few degrees of separation between the people who wrote the claims (and have to defend/support them) and the people that did the testing... and then substantially more between those that did the testing and those who did the original work showing that the statistical proofs on accelerated ageing were reasonable things to depend on.

By the time it gets to the marketplace nobody knows anything and we're all acting like the monkeys in the story with banana and the ice-water spray.

Any MTBF longer than that particular industry has existed should be suspect or invalidated absent an existence proof (which will take some time...).

A couple of years ago, I was working on the verification team for a (non-critical) avionics system for a large commercial aircraft. I noticed one of the components seemed to have more failures than expected.

I reported the issue and the systems architect waved it off arguing that his analysis of the supplier data had proven that the MTBF for this component was over 500 thousand hours.

Few months later, a task force was established by the project management to look for an alternate supplier for this component after it became obvious that its failure rate was significantly higher than advertised.

Much, perhaps most, of the effect we have as individuals in large organizations is indirect and hard to see or quantify. It's not always as simple as we think and changing course of a group almost always takes time, education, repetition, and some redundant effort. It's still worthwhile and effective.

It is entirely possible that this is a success story of a lower-level engineer raising an issue that the higher levels then addressed.

Just because no one immediately jumps and say "by golly, we have to get rid of component X right now!" doesn't mean that the issue didn't begin percolating vertically and horizontally, ultimately resulting in a large-scale corrective effort.

in my experience this is by far the less likely scenario, but I would like to hear from OP whether his initial work contributed to the ultimate decision

For more context, I was 99% sure they there was an issue with the component and that a hardware rework would have to be made sooner or later. The systems architect had some seniority over me but I could have pushed the issue hard enough for it to be addressed.

Then I did not take the high road. The guy was very obnoxious and I had other issues to address. So I let it slide to maintain my "this is important" quota for other matters.

And a couple of months later, when some units failed on the test aircrafts (I insist on the fact that this was not a critical system), I had an issue report showing that the issue was observed during supplier-side tests and then ignored.

I really wouldn't be surprised if some components don't last that long...

Take a regular ceramic resistor. I'd bet that if you kept it in a temperature controlled sealed box, it would last 2000 years.

I would possibly even reckon it might last 200,000 years.

Ceramics are so so so inert, and as are metals as long as they're away from oxygen.

The 11 century MTBF example was a complete SoM.

Statistics are used all the time in safety critical designs. But, this is key, they are then balanced with the outcome expected due to each statistical failure. The more serious the outcome, the less the tolerated statistical failure.

In the case of MCAS, from what we have read so far, it seems this analysis was biased toward a non-catastrophic outcome (e.g. manageable through pilot action). This may explain why the statistical failure of a single computer was deemed sufficient. Now, assessors have upped the stakes, and the stats do not work anymore.

This indeed reveals a very serious problem in the RAMS process at Boeing, and exceed the scope of a « simple » software fix.

You were only mentioning the problems with MCAS when it comes to sensors and decision making. As bad as that is the fact that the MCAS decisions are de-facto locked in by spinning the trim wheel. Undoing those revolutions manually - after locking MCAS out - takes a while. A while that is not available in the flight states MCAS is most likely to act.

MCAS only active at critical phases of flight like takeoff. At cruise, MCAS would not be active.

You have it the wrong way around. MCAS is not active while flaps are extended, so not during starts and landings. It is also not enabled while the autopilot is active, as MCAS isn't balancing the airplane but about giving the right rudder feedback to the pilot when manually piloting the airplane. The accidents happened in normal operations after the flaps were retracted.

Reply on news.ycombinator.com