Exactly. You can only test for these scenarios to a certain extent and even when everything works as expected during tests, things still tend to break during production when shit hits the fan.
I have worked in manufacturing plants. One thing I've observed is that a unit will be tested after assembly. If it passes, it gets shipped. If it fails, it's tested again, perhaps with some token adjustment or swapping of components with other units.
Any chance you could point me to a reference? I'm doing research in this space and currently working on a paper which does exactly this for diagnostics of testing processes.
Another possible conclusion: fix this several years from now, the first time it causes a test failure and still probably before it causes any production problems.
Yeah absolutely but if you are running a simulation/test would you deliberately inject some random sensor failure if you are doing your tests for something else?
It is not clear what they were testing - perhaps they were indeed testing the MCAS system with sensor failures, but if so I probably wouldn't have expected such a surprised resction from them. It seemed like it was totally unexpected and unexplained, which is not a reaction I would expect if they were testing this.
I wonder how deep the pipeline is between inputs and failing tests on the output? I'd guess they'd have quite a bit of inventory in flight before they realized there was a problem with the output, but hell, I don't know.
Wouldnt the test just need to apply to all modes? If its a matter of automatically tuning through a series of conditions then its reasonable that those could be documented and tested by the facility / standards body.
Was the software designed only to detect tests? Or is detecting tests (and other cases where limiting performance has no adverse consequences) a side-effect of the system's intended behavior.
For instance, suppose the vehicle was programmed to shut off its engine when stopped at a stoplight. Suppose the test scenario measures emissions while stopped at a stoplight...
My understanding was if the function is interrupted on discharge, you fail the test. At least that's how our equipment was tested by an independent lab.
reply