patrickjp93 wrote:PW100 wrote:patrickjp93 wrote:I've read the JT610 report. You're misinterpreting it. It's not the designation that matters. It's the end system that does. They'd have been a fault-tolerant system if allowed, and not because any designation said so, but because common sense said so as all of us prove.
The end system requirements are driven by the designation.
Designation matters a great deal. Unless you want to apply a risk ratio of 10 E-9 (or even 10 E-12) to each and every individual piece of software (and hardware?).
No they are not in a proper bottom-up engineering effort. They may clarify edge cases, but the vast majority of the requirements come from common sense. Having the designation does not matter. Knowing the system has to be fault-tolerant or else you risk killing thousands of people matters when it comes to gathering requirements. You don't need to go through the formal criticality assessment to know point blank that MCAS needed the requirements JTAR (JATR?) experts said it should have had from the beginning. Give me a break engineers are far smarter than bureaucrats' procedures.
That's pretty much what I do by default, and it's usually less costly to do that than spend the time justifying the risk away (and especially so when you do so fraudulently and the ghost of Christmas Past comes back to haunt you).
Yes, the safety classification designation matter in aircraft safety, because that designation is part of the aircraft safety standard internationally set by the regulators. You can't avoid it to carry passengers, really.
No, the requirements do not come from common sense in aircraft safety, because it's a very complex system involving performance, delay, cost, insurance, production, subcontractors, operators, pilots, passengers, maintenance, training, logistic, international laws, years of safety records, massive history of accident analysis, etc...
The safety assessment resulting in the safety classification designation as "major" of the MCAS was exactly what was wrong on the 737-8/9 MAX. This is because the safety classification designation was only "major" that the redundancy requirement did not apply to the MCAS as it should have. This is precisely why the 737-8/9 MAX is grounded and why this is a so big mess for Boeing to clean now.: the change in the safety classification designation imply a lot of redesign and probably a pilots training.