<story><title>Software Won’t Fix Boeing’s ‘Faulty’ Airframe</title><url>https://www.eetimes.com/document.asp?doc_id=1334482</url></story><parent_chain><item><author>GuB-42</author><text>&amp;gt; One possibility is incompetence. But Boeing engineers are smart people, so I&amp;#x27;m not convinced by this.&lt;p&gt;That&amp;#x27;s still a possibility. Stupid decisions can emerge out of smart people.&lt;p&gt;Boeing is huge, and what they develop is incredibly complex. There are a lot of people with differing level of competence, ethics, and goals.&lt;p&gt;For example (I am not saying that happened), the engineers designing MCAS didn&amp;#x27;t expect incorrect AoA data, thinking the checks were done elsewhere. At the same time, the &amp;quot;sensors&amp;quot; team thought that raw, unchecked data was expected. The integration guy didn&amp;#x27;t read the specs correctly (sometimes, it comes down to a single word), didn&amp;#x27;t catch that, and checked the OK box. His manager, focused on a more pressing issue took that as granted and it went to production.&lt;p&gt;It is possible that the engineers did an excellent work, but didn&amp;#x27;t question the specs they had. The integration guy is normally super reliable but he just had a bad day. And his manager handled the other problem beautifully and overlooked the MCAS&amp;#x2F;AoA because, normally, the integration guy is reliable. A series of small mistakes that ended up in a catastrophe.&lt;p&gt;There are a lot of safeguards but the complexity is so high that sometimes, something goes through. Especially if the company is under pressure.</text></item><item><author>mhandley</author><text>Boeing&amp;#x27;s software fix, announced today, is to compare readings from both angle-of-attack sensors and disable MCAS if they disagree significantly.  The obvious question is why they didn&amp;#x27;t do this in the first place?&lt;p&gt;One possibility is incompetence.  But Boeing engineers are smart people, so I&amp;#x27;m not convinced by this.  The elephant in the room is the requirement to maintain a common type rating with older 737 models.&lt;p&gt;Suppose they did originally do what the fixed software does now, and disable MCAS if the AoA sensors disagree.  The problem Boeing face is that with MCAS disabled when this occurs, the plane no longer flies like an older 737.  They&amp;#x27;d need to announce to the pilots an AoA disagree, and announce that MCAS was disabled.  Now what?  A pilot certified and trained on the older 737 would not know how the Max now differs from what they trained on.  If they&amp;#x27;d done this, they&amp;#x27;d have needed to provide additional training, and this must have concerned Boeing management that it might jeopardize the common type rating.  Hence it seems likely they didn&amp;#x27;t add the AoA sensor comparison for this reason, reasoning that it was unlikely to be a problem anyway.  We now know that reasoning was flawed.&lt;p&gt;What does this mean going forwards?  Will EASA and other CAAs refuse to certify the modified 737 Max under the same type rating as the older 737?  This certainly seems possible.  If they did require a separate type rating, this would likely kill 737 sales, regardless of whether the plane is now safe.</text></item></parent_chain><comment><author>vonmoltke</author><text>&amp;gt; For example (I am not saying that happened), the engineers designing MCAS didn&amp;#x27;t expect incorrect AoA data, thinking the checks were done elsewhere. At the same time, the &amp;quot;sensors&amp;quot; team thought that raw, unchecked data was expected. The integration guy didn&amp;#x27;t read the specs correctly (sometimes, it comes down to a single word), didn&amp;#x27;t catch that, and checked the OK box. His manager, focused on a more pressing issue took that as granted and it went to production.&lt;p&gt;&amp;gt; It is possible that the engineers did an excellent work, but didn&amp;#x27;t question the specs they had. The integration guy is normally super reliable but he just had a bad day. And his manager handled the other problem beautifully and overlooked the MCAS&amp;#x2F;AoA because, normally, the integration guy is reliable. A series of small mistakes that ended up in a catastrophe.&lt;p&gt;What you describe here would be a major failure of systems engineering on the project.&lt;p&gt;The systems engineers are responsible for flowing top level requirements down to the individual systems.  They are responsible for ensuring the specs the engineering teams receive for their systems are correct, and for handling requests to change said specs.  If the spec of the output of the AoA sensors does not match the spec flowed down to other teams on the input from those sensors the systems engineers responsible did not do their jobs.&lt;p&gt;Systems engineers exist to manage complexity like this, to ensure that the various engineering teams across the various disciplines are technically coordinated by providing clear, consistent specs and interfaces for them to work to.  If that didn&amp;#x27;t happen, then I would not say those engineers are competent, let alone smart.  It would be especially disappointing to me (as a former systems engineer) if this were the case, as systems engineering is the &lt;i&gt;last&lt;/i&gt; place I would expect such incompetence from a company like Boeing.  It&amp;#x27;s at the core of everything they do.&lt;p&gt;I want to address one specific point in a different context.&lt;p&gt;&amp;gt; the engineers designing MCAS didn&amp;#x27;t expect incorrect AoA data, thinking the checks were done elsewhere&lt;p&gt;You &lt;i&gt;always&lt;/i&gt; expect out-of-spec conditions to be a possibility and have something in place to handle those conditions appropriately.  To not do so is incompetence bordering on negligence.</text></comment>
<story><title>Software Won’t Fix Boeing’s ‘Faulty’ Airframe</title><url>https://www.eetimes.com/document.asp?doc_id=1334482</url></story><parent_chain><item><author>GuB-42</author><text>&amp;gt; One possibility is incompetence. But Boeing engineers are smart people, so I&amp;#x27;m not convinced by this.&lt;p&gt;That&amp;#x27;s still a possibility. Stupid decisions can emerge out of smart people.&lt;p&gt;Boeing is huge, and what they develop is incredibly complex. There are a lot of people with differing level of competence, ethics, and goals.&lt;p&gt;For example (I am not saying that happened), the engineers designing MCAS didn&amp;#x27;t expect incorrect AoA data, thinking the checks were done elsewhere. At the same time, the &amp;quot;sensors&amp;quot; team thought that raw, unchecked data was expected. The integration guy didn&amp;#x27;t read the specs correctly (sometimes, it comes down to a single word), didn&amp;#x27;t catch that, and checked the OK box. His manager, focused on a more pressing issue took that as granted and it went to production.&lt;p&gt;It is possible that the engineers did an excellent work, but didn&amp;#x27;t question the specs they had. The integration guy is normally super reliable but he just had a bad day. And his manager handled the other problem beautifully and overlooked the MCAS&amp;#x2F;AoA because, normally, the integration guy is reliable. A series of small mistakes that ended up in a catastrophe.&lt;p&gt;There are a lot of safeguards but the complexity is so high that sometimes, something goes through. Especially if the company is under pressure.</text></item><item><author>mhandley</author><text>Boeing&amp;#x27;s software fix, announced today, is to compare readings from both angle-of-attack sensors and disable MCAS if they disagree significantly.  The obvious question is why they didn&amp;#x27;t do this in the first place?&lt;p&gt;One possibility is incompetence.  But Boeing engineers are smart people, so I&amp;#x27;m not convinced by this.  The elephant in the room is the requirement to maintain a common type rating with older 737 models.&lt;p&gt;Suppose they did originally do what the fixed software does now, and disable MCAS if the AoA sensors disagree.  The problem Boeing face is that with MCAS disabled when this occurs, the plane no longer flies like an older 737.  They&amp;#x27;d need to announce to the pilots an AoA disagree, and announce that MCAS was disabled.  Now what?  A pilot certified and trained on the older 737 would not know how the Max now differs from what they trained on.  If they&amp;#x27;d done this, they&amp;#x27;d have needed to provide additional training, and this must have concerned Boeing management that it might jeopardize the common type rating.  Hence it seems likely they didn&amp;#x27;t add the AoA sensor comparison for this reason, reasoning that it was unlikely to be a problem anyway.  We now know that reasoning was flawed.&lt;p&gt;What does this mean going forwards?  Will EASA and other CAAs refuse to certify the modified 737 Max under the same type rating as the older 737?  This certainly seems possible.  If they did require a separate type rating, this would likely kill 737 sales, regardless of whether the plane is now safe.</text></item></parent_chain><comment><author>village-idiot</author><text>Some investigative journalism indicates that this is not what happened.&lt;p&gt;The FAA has different levels of redundancy and uptime requirements based on the outcome of system failure. A system categorized as “catastrophic” failing would lose the plane and all passengers, while “hazardous” might hurt some and kill a few, and so on. The FAA requires that catastrophic systems must have a backup, while hazardous can go without one if it’s reliable enough.&lt;p&gt;Boeing classified the MCAS as “hazardous” only under certain flight characteristics, and they categorized it as a lower level than hazardous during level flight. This means that the crews designing the specification made the decision to depend upon only a single input, and it appears to have been built to spec[0].&lt;p&gt;It also appears that the FAA was experiencing internal pressure to delegate more certification authority to Boeing, with disastrous results.&lt;p&gt;0: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.seattletimes.com&amp;#x2F;business&amp;#x2F;boeing-aerospace&amp;#x2F;failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.seattletimes.com&amp;#x2F;business&amp;#x2F;boeing-aerospace&amp;#x2F;faile...&lt;/a&gt;</text></comment>