Heavy entry. The world grounded the Boeing 737 MAX this week — every airline, every country, the FAA last among major regulators — after Ethiopian Airlines 302 crashed with the same signature as October’s Lion Air 610. 346 people across the two flights. The emerging picture, assembled from reporting and the Lion Air preliminary findings, centers on MCAS: flight-control software that automatically pushes the nose down based on angle-of-attack data — added to make a re-engined 60-year-old airframe handle like its predecessor, so airlines could skip simulator retraining. Per reporting: it took input from a SINGLE sensor (no voting, no cross-check), could re-engage repeatedly against pilot trim inputs, and wasn’t described in the flight manual because the certification strategy depended on the differences not counting as differences.
Every thread this archive follows converges here, at maximum stakes: single-sensor trust (#096’s fusion sermon inverted), automation fighting its operators (#106’s liveness-probe herd, air-frame edition), certification-by-inheritance (the “it’s the same system” claim as load-bearing paperwork), and incentive-shaped engineering (#130’s time-shifted accountability — retraining costs were THIS quarter’s; the risk was some future crew’s). Software didn’t just have a bug; the ORG CHART had a bug and the software shipped it (Conway, #064, at altitude).
I have no glib close. 346 people. Aviation’s postmortem culture — the most rigorous in civilization, the one our industry cribs from — will now be tested on its own hardest case: a failure where the root causes include the certification process itself. Read the eventual reports. All of them. That’s the job’s debt to the dead: we’re the industry that gets to rehearse (#135); theirs doesn’t.
TIL: sensor voting architectures — dual-redundant vs triplex, disagree-and-disengage vs disagree-and-vote. The AoA disagree WARNING LIGHT was, per reporting, a paid option. Sit with that sentence. Audit what your own products make optional.