Habia una serie hace unos años de esto, con uno de los protagoistas que habia trabajado en Lost, Persona de Interes
«Diez mil ojos que todo lo ven y diez millones de oídos que todo lo escuchan. Eso es La Máquina: algo que está en todas partes y en ninguna» Bueno
Hundreds of law enforcement agencies are using a new facial recognition app that can reveal names and addresses of unknown individuals by comparing them to THREE BILLION images scraped from the internet
More than 600 police departments are said to be using the Clearview AI app
The app reportedly uses facial recognition AI to match uploaded photos to the three billion images it has in its database
The database contains images gathered from all over the internet and can include identifying details, such as names and addresses
Police have said that they were able to solve cases by using Clearview AI
Nada, de otro lado donde no tienen la menor idea de que es un asado, pero dos definiciones utiles
Newspaper and kindling are also accelerants. Especially if you build the combustion reaction into a chimney with lots of fresh air. Just get the temperature up to 2,000 F (or so) and the exothermic reaction of coal will become self sustaining. The minute those volatile gases start cooking out of the coal, you have a winner !
The trick to combustion is turning the combustant into a pseudo vapor. Add in plenty of oxidizer (air) and the gas – gas reaction quickly becomes self- sustaining.
BTW, one of my thermo profs at TAMU had a favorite question, “what are the three T’s of combustion ?”
The answer: Time, Temperature, and Turbulence. The more you can add of any of these (preferably all), the better your combustion process will be.
En estas epocas, que, Dilbert ha sabido ilustrar muy bien, tenemos un personaje, el Manager, PHB en la jerga Dilbertiana, que, ante cualquier proyecto dice, si bajamos los dias a la mitad ahorramos el 50% no? y asi salen las cosas.
De Wiki
The Pointy-haired Boss (or Pointy-headed Boss often abbreviated to just PHB[1] or "The Boss") is Dilbert's boss in the Dilbert comic strip. He is notable for his micromanagement, gross incompetence, obliviousness to his surroundings, and unhelpful buzzword usage; yet somehow retains power in the workplace
Bueno, a veces no es gratis y sale vidas, el 737 es una muestra, y como siempre afanando, esto es de IEEE Spectrum
How the Boeing 737 Max Disaster Looks to a Software Developer
Design shortcuts meant to make a new plane seem like an old, familiar one are to blame
I have been a pilot for 30 years, a software developer for more than 40. I have written extensively about both aviation and software engineering. Now it’s time for me to write about both together.
The Boeing 737 Max has been in the news because of two crashes, practically back to back and involving brand new airplanes. In an industry that relies more than anything on the appearance of total control, total safety, these two crashes pose as close to an existential risk as you can get. Though airliner passenger death rates have fallen over the decades, that achievement is no reason for complacency.
The 737 first appeared in 1967, when I was 3 years old. Back then it was a smallish aircraft with smallish engines and relatively simple systems. Airlines (especially Southwest) loved it because of its simplicity, reliability, and flexibility. Not to mention the fact that it could be flown by a two-person cockpit crew—as opposed to the three or four of previous airliners—which made it a significant cost saver. Over the years, market and technological forces pushed the 737 into ever-larger versions with increasing electronic and mechanical complexity. This is not, by any means, unique to the 737. Airliners constitute enormous capital investments both for the industries that make them and the customers who buy them, and they all go through a similar growth process.
Most of those market and technical forces are on the side of economics, not safety. They work as allies to relentlessly drive down what the industry calls “seat-mile costs”—the cost of flying a seat from one point to another.
Much had to do with the engines themselves. The principle of Carnot efficiency dictates that the larger and hotter you can make any heat engine, the more efficient it becomes. That’s as true for jet engines as it is for chainsaw engines.
It’s as simple as that. The most effective way to make an engine use less fuel per unit of power produced is to make it larger. That’s why the Lycoming O-360 engine in my Cessna has pistons the size of dinner plates. That’s why marine diesel engines stand three stories tall. And that’s why Boeing wanted to put the huge CFM International LEAP engine in its latest version of the 737.
There was just one little problem: The original 737 had (by today’s standards) tiny little engines, which easily cleared the ground beneath the wings. As the 737 grew and was fitted with bigger engines, the clearance between the engines and the ground started to get a little…um, tight.
Illustration: Norebbo.comBy substituting a larger engine, Boeing changed the intrinsic aerodynamic nature of the 737 airliner.
Various hacks (as we would call them in the software industry) were developed. One of the most noticeable to the public was changing the shape of the engine intakes from circular to oval, the better to clear the ground.
With the 737 Max, the situation became critical. The engines on the original 737 had a fan diameter (that of the intake blades on the engine) of just 100 centimeters (40 inches); those planned for the 737 Max have 176 cm. That’s a centerline difference of well over 30 cm (a foot), and you couldn’t “ovalize” the intake enough to hang the new engines beneath the wing without scraping the ground.
The solution was to extend the engine up and well in front of the wing. However, doing so also meant that the centerline of the engine’s thrust changed. Now, when the pilots applied power to the engine, the aircraft would have a significant propensity to “pitch up,” or raise its nose.
The angle of attack is the angle between the wings and the airflow over the wings. Think of sticking your hand out of a car window on the highway. If your hand is level, you have a low angle of attack; if your hand is pitched up, you have a high angle of attack. When the angle of attack is great enough, the wing enters what’s called an aerodynamic stall. You can feel the same thing with your hand out the window: As you rotate your hand, your arm wants to move up like a wing more and more until you stall your hand, at which point your arm wants to flop down on the car door.
This propensity to pitch up with power application thereby increased the risk that the airplane could stall when the pilots “punched it” (as my son likes to say). It’s particularly likely to happen if the airplane is flying slowly.
Worse still, because the engine nacelles were so far in front of the wing and so large, a power increase will cause them to actually produce lift, particularly at high angles of attack. So the nacelles make a bad problem worse.
I’ll say it again: In the 737 Max, the engine nacelles themselves can, at high angles of attack, work as a wing and produce lift. And the lift they produce is well ahead of the wing’s center of lift, meaning the nacelles will cause the 737 Max at a high angle of attack to go to a higher angle of attack. This is aerodynamic malpractice of the worst kind.
Pitch changes with power changes are common in aircraft. Even my little Cessna pitches up a bit when power is applied. Pilots train for this problem and are used to it. Nevertheless, there are limits to what safety regulators will allow and to what pilots will put up with.
Pitch changes with increasing angle of attack, however, are quite another thing. An airplane approaching an aerodynamic stall cannot, under any circumstances, have a tendency to go further into the stall. This is called “dynamic instability,” and the only airplanes that exhibit that characteristic—fighter jets—are also fitted with ejection seats.
Everyone in the aviation community wants an airplane that flies as simply and as naturally as possible. That means that conditions should not change markedly, there should be no significant roll, no significant pitch change, no nothing when the pilot is adding power, lowering the flaps, or extending the landing gear.
The airframe, the hardware, should get it right the first time and not need a lot of added bells and whistles to fly predictably. This has been an aviation canon from the day the Wright brothers first flew at Kitty Hawk.
Apparently the 737 Max pitched up a bit too much for comfort on power application as well as at already-high angles of attack. It violated that most ancient of aviation canons and probably violated the certification criteria of the U.S. Federal Aviation Administration. But instead of going back to the drawing board and getting the airframe hardware right (more on that below), Boeing relied on something called the “Maneuvering Characteristics Augmentation System,” or MCAS.
Boeing’s solution to its hardware problem was software.
I will leave a discussion of the corporatization of the aviation lexicon for another article, but let’s just say another term might be the “Cheap way to prevent a stall when the pilots punch it,” or CWTPASWTPPI, system. Hmm. Perhaps MCAS is better, after all.
MCAS is certainly much less expensive than extensively modifying the airframe to accommodate the larger engines. Such an airframe modification would have meant things like longer landing gear (which might not then fit in the fuselage when retracted), more wing dihedral (upward bend), and so forth. All of those hardware changes would be horribly expensive.
What’s worse, those changes could be extensive enough to require not only that the FAA recertify the 737 but that Boeing build an entirely new aircraft. Now we’re talking real money, both for the manufacturer as well as the manufacturer’s customers.
That’s because the major selling point of the 737 Max is that it is just a 737, and any pilot who has flown other 737s can fly a 737 Max without expensive training, without recertification, without another type of rating. Airlines—Southwest is a prominent example—tend to go for one “standard” airplane. They want to have one airplane that all their pilots can fly because that makes both pilots and airplanes fungible, maximizing flexibility and minimizing costs.
It all comes down to money, and in this case, MCAS was the way for both Boeing and its customers to keep the money flowing in the right direction. The necessity to insist that the 737 Max was no different in flying characteristics, no different in systems, from any other 737 was the key to the 737 Max’s fleet fungibility. That’s probably also the reason why the documentation about the MCAS system was kept on the down-low.
Put in a change with too much visibility, particularly a change to the aircraft’s operating handbook or to pilot training, and someone—probably a pilot—would have piped up and said, “Hey. This doesn’t look like a 737 anymore.” And then the money would flow the wrong way.
As I explained, you can do your own angle-of-attack experiments just by putting your hand out a car door window and rotating it. It turns out that sophisticated aircraft have what is essentially the mechanical equivalent of a hand out the window: the angle-of-attack sensor.
You may have noticed this sensor when boarding a plane. There are usually two of them, one on either side of the plane, and usually just below the pilot’s windows. Don’t confuse them with the pitot tubes (we’ll get to those later). The angle-of-attack sensors look like wind vanes, whereas the pitot tubes look like, well, tubes.
Angle-of-attack sensors look like wind vanes because that’s exactly what they are. They are mechanical hands designed to rotate in response to changes in that angle of attack.
The pitot tubes measure how much the air is “pressing” against the airplane, whereas the angle-of-attack sensors measure what direction that air is coming from. Because they measure air pressure, the pitot tubes are used to determine the aircraft’s speed through the air. The angle-of-attack sensors measure the aircraft’s direction relative to that air.
There are two sets of angle-of-attack sensors and two sets of pitot tubes, one set on either side of the fuselage. Normal usage is to have the set on the pilot’s side feed the instruments on the pilot’s side and the set on the copilot’s side feed the instruments on the copilot’s side. That gives a state of natural redundancy in instrumentation that can be easily cross-checked by either pilot. If the copilot thinks his airspeed indicator is acting up, he can look over to the pilot’s airspeed indicator and see if it agrees. If not, both pilot and copilot engage in a bit of triage to determine which instrument is profane and which is sacred.
Long ago there was a joke that in the future planes would fly themselves, and the only thing in the cockpit would be a pilot and a dog. The pilot’s job was to make the passengers comfortable that someone was up front. The dog’s job was to bite the pilot if he tried to touch anything.
On the 737, Boeing not only included the requisite redundancy in instrumentation and sensors, it also included redundant flight computers—one on the pilot’s side, the other on the copilot’s side. The flight computers do a lot of things, but their main job is to fly the plane when commanded to do so and to make sure the human pilots don’t do anything wrong when they’re flying it. The latter is called “envelope protection.”
Let’s just call it what it is: the bitey dog.
Let’s review what the MCAS does: It pushes the nose of the plane down when the system thinks the plane might exceed its angle-of-attack limits; it does so to avoid an aerodynamic stall. Boeing put MCAS into the 737 Max because the larger engines and their placement make a stall more likely in a 737 Max than in previous 737 models.
When MCAS senses that the angle of attack is too high, it commands the aircraft’s trim system (the system that makes the plane go up or down) to lower the nose. It also does something else: Indirectly, via something Boeing calls the “Elevator Feel Computer,” it pushes the pilot’s control columns (the things the pilots pull or push on to raise or lower the aircraft’s nose) downward.
In the 737 Max, like most modern airliners and most modern cars, everything is monitored by computer, if not directly controlled by computer. In many cases, there are no actual mechanical connections (cables, push tubes, hydraulic lines) between the pilot’s controls and the things on the wings, rudder, and so forth that actually make the plane move. And, even where there are mechanical connections, it’s up to the computer to determine if the pilots are engaged in good decision making (that’s the bitey dog again).
But it’s also important that the pilots get physical feedback about what is going on. In the old days, when cables connected the pilot’s controls to the flying surfaces, you had to pull up, hard, if the airplane was trimmed to descend. You had to push, hard, if the airplane was trimmed to ascend. With computer oversight there is a loss of natural sense in the controls. In the 737 Max, there is no real “natural feel.”
True, the 737 does employ redundant hydraulic systems, and those systems do link the pilot’s movement of the controls to the action of the ailerons and other parts of the airplane. But those hydraulic systems are powerful, and they do not give the pilot direct feedback from the aerodynamic forces that are acting on the ailerons. There is only an artificial feel, a feeling that the computer wants the pilots to feel. And sometimes, it doesn’t feel so great.
When the flight computer trims the airplane to descend, because the MCAS system thinks it’s about to stall, a set of motors and jacks push the pilot’s control columns forward. It turns out that the Elevator Feel Computer can put a lot of force into that column—indeed, so much force that a human pilot can quickly become exhausted trying to pull the column back, trying to tell the computer that this really, really should not be happening.
Illustration: Norebbo.comThe antistall system depended crucially on sensors that are installed on each side of the airliner—but the system consulted only the sensor on one side.
Indeed, not letting the pilot regain control by pulling back on the column was an explicit design decision. Because if the pilots could pull up the nose when MCAS said it should go down, why have MCAS at all?
MCAS is implemented in the flight management computer, even at times when the autopilot is turned off, when the pilots think they are flying the plane. In a fight between the flight management computer and human pilots over who is in charge, the computer will bite humans until they give up and (literally) die.
Finally, there’s the need to keep the very existence of the MCAS system on the hush-hush lest someone say, “Hey, this isn’t your father’s 737,” and bank accounts start to suffer.
The flight management computer is a computer. What that means is that it’s not full of aluminum bits, cables, fuel lines, or all the other accoutrements of aviation. It’s full of lines of code. And that’s where things get dangerous.
Those lines of code were no doubt created by people at the direction of managers. Neither such coders nor their managers are as in touch with the particular culture and mores of the aviation world as much as the people who are down on the factory floor, riveting wings on, designing control yokes, and fitting landing gears. Those people have decades of institutional memory about what has worked in the past and what has not worked. Software people do not.
In the 737 Max, only one of the flight management computers is active at a time—either the pilot’s computer or the copilot’s computer. And the active computer takes inputs only from the sensors on its own side of the aircraft.
When the two computers disagree, the solution for the humans in the cockpit is to look across the control panel to see what the other instruments are saying and then sort it out. In the Boeing system, the flight management computer does not “look across” at the other instruments. It believes only the instruments on its side. It doesn’t go old-school. It’s modern. It’s software.
This means that if a particular angle-of-attack sensor goes haywire—which happens all the time in a machine that alternates from one extreme environment to another, vibrating and shaking all the way—the flight management computer just believes it.
It gets even worse. There are several other instruments that can be used to determine things like angle of attack, either directly or indirectly, such as the pitot tubes, the artificial horizons, etc. All of these things would be cross-checked by a human pilot to quickly diagnose a faulty angle-of-attack sensor.
In a pinch, a human pilot could just look out the windshield to confirm visually and directly that, no, the aircraft is not pitched up dangerously. That’s the ultimate check and should go directly to the pilot’s ultimate sovereignty. Unfortunately, the current implementation of MCAS denies that sovereignty. It denies the pilots the ability to respond to what’s before their own eyes.
Like someone with narcissistic personality disorder, MCAS gaslights the pilots. And it turns out badly for everyone. “Raise the nose, HAL.” “I’m sorry, Dave, I’m afraid I can’t do that.”
In the MCAS system, the flight management computer is blind to any other evidence that it is wrong, including what the pilot sees with his own eyes and what he does when he desperately tries to pull back on the robotic control columns that are biting him, and his passengers, to death.
In the old days, the FAA had armies of aviation engineers in its employ. Those FAA employees worked side by side with the airplane manufacturers to determine that an airplane was safe and could be certified as airworthy.
As airplanes became more complex and the gulf between what the FAA could pay and what an aircraft manufacturer could pay grew larger, more and more of those engineers migrated from the public to the private sector. Soon the FAA had no in-house ability to determine if a particular airplane’s design and manufacture were safe. So the FAA said to the airplane manufacturers, “Why don’t you just have your people tell us if your designs are safe?”
The airplane manufacturers said, “Sounds good to us.” The FAA said, “And say hi to Joe, we miss him.”
Thus was born the concept of the “Designated Engineering Representative,” or DER. DERs are people in the employ of the airplane manufacturers, the engine manufacturers, and the software developers who certify to the FAA that it’s all good.
Now this is not quite as sinister a conflict of interest as it sounds. It is in nobody’s interest that airplanes crash. The industry absolutely relies on the public trust, and every crash is an existential threat to the industry. No manufacturer is going to employ DERs that just pencil-whip the paperwork. On the other hand, though, after a long day and after the assurance of some software folks, they might just take their word that things will be okay.
It is astounding that no one who wrote the MCAS software for the 737 Max seems even to have raised the possibility of using multiple inputs, including the opposite angle-of-attack sensor, in the computer’s determination of an impending stall. As a lifetime member of the software development fraternity, I don’t know what toxic combination of inexperience, hubris, or lack of cultural understanding led to this mistake.
But I do know that it’s indicative of a much deeper problem. The people who wrote the code for the original MCAS system were obviously terribly far out of their league and did not know it. How can they implement a software fix, much less give us any comfort that the rest of the flight management software is reliable?
So Boeing produced a dynamically unstable airframe, the 737 Max. That is big strike No. 1. Boeing then tried to mask the 737’s dynamic instability with a software system. Big strike No. 2. Finally, the software relied on systems known for their propensity to fail (angle-of-attack indicators) and did not appear to include even rudimentary provisions to cross-check the outputs of the angle-of-attack sensor against other sensors, or even the other angle-of-attack sensor. Big strike No. 3.
None of the above should have passed muster. None of the above should have passed the “OK” pencil of the most junior engineering staff, much less a DER.
That’s not a big strike. That’s a political, social, economic, and technical sin.
It just so happens that, during the timeframe between the first 737 Max crash and the most recent 737 crash, I’d had the occasion to upgrade and install a brand-new digital autopilot in my own aircraft. I own a 1979 Cessna 172, the most common aircraft in history, at least by production numbers. Its original certification also predates that of the 737’s by about a decade (1955 versus 1967).
My new autopilot consists of several very modern components, including redundant flight computers (dual Garmin G5s) and a sophisticated communication “bus” (a Controller Area Network bus) that lets all the various components talk to one another, irrespective of where they are located in my plane. A CAN bus derives from automotive “drive by wire” technology but is otherwise very similar in purpose and form to the various ARINC buses that connect the components in the 737 Max.
My autopilot also includes electric pitch trim. That means it can make the same types of configuration changes to my 172 that the flight computers and MCAS system make to the 737 Max. During the installation, after the first 737 Max crash, I remember remarking to a friend that it was not lost on me that I was potentially adding a hazard similar to the one that brought down the Lion Air crash.
Finally, my new autopilot also implements “envelope protection,” the envelope being the graph of the performance limitations of an aircraft. If my Cessna is not being flown by the autopilot, the system nonetheless constantly monitors the airplane to make sure that I am not about to stall it, roll it inverted, or a whole host of other things. Yes, it has its own “bitey dog” mode.
As you can see, the similarities between my US $20,000 autopilot and the multimillion-dollar autopilot in every 737 are direct, tangible, and relevant. What, then, are the differences?
For starters, the installation of my autopilot required paperwork in the form of a “Supplemental Type Certificate,” or STC. It means that the autopilot manufacturer and the FAA both agreed that my 1979 Cessna 172 with its (Garmin) autopilot was so significantly different from what the airplane was when it rolled off the assembly line that it was no longer the same Cessna 172. It was a different aircraft altogether.
In addition to now carrying a new (supplemental) aircraft-type certificate (and certification), my 172 required a very large amount of new paperwork to be carried in the plane, in the form of revisions and addenda to the aircraft operating manual. As you can guess, most of those addenda revolved around the autopilot system.
Of particular note in that documentation, which must be studied and understood by anyone who flies the plane, are various explanations of the autopilot system, including its command of the trim control system and its envelope protections.
There are instructions on how to detect when the system malfunctions and how to disable the system, immediately. Disabling the system means pulling the autopilot circuit breaker; instructions on how to do that are strewn throughout the documentation, repeatedly. Every pilot who flies my plane becomes intimately aware that it is not the same as any other 172.
This is a big difference between what pilots who want to fly my plane are told and what pilots stepping into a 737 Max are (or were) told.
Another difference is between the autopilots in my system and that in the 737 Max. All of the CAN bus–interconnected components constantly do the kind of instrument cross-check that human pilots do and that, apparently, the MCAS system in the 737 Max does not. For example, the autopilot itself has a self-contained attitude platform that checks the attitude information coming from the G5 flight computers. If there is a disagreement, the system simply goes off-line and alerts the pilot that she is now flying manually. It doesn’t point the airplane’s nose at the ground, thinking it’s about to stall.
Perhaps the biggest difference is in the amount of physical force it takes for the pilot to override the computers in the two planes. In my 172, there are still cables linking the controls to the flying surfaces. The computer has to press on the same things that I have to press on—and its strength is nowhere near as great as mine. So even if, say, the computer thought that my plane was about to stall when it wasn’t, I can easily overcome the computer.
In my Cessna, humans still win a battle of the wills every time. That used to be a design philosophy of every Boeing aircraft, as well, and one they used against their archrival Airbus, which had a different philosophy. But it seems that with the 737 Max, Boeing has changed philosophies about human/machine interaction as quietly as they’ve changed their aircraft operating manuals.
The 737 Max saga teaches us not only about the limits of technology and the risks of complexity, it teaches us about our real priorities. Today, safety doesn’t come first—money comes first, and safety’s only utility in that regard is in helping to keep the money coming. The problem is getting worse because our devices are increasingly dominated by something that’s all too easy to manipulate: software.
Hardware defects, whether they are engines placed in the wrong place on a plane or O-rings that turn brittle when cold, are notoriously hard to fix. And by hard, I mean expensive. Software defects, on the other hand, are easy and cheap to fix. All you need to do is post an update and push out a patch. What’s more, we’ve trained consumers to consider this normal, whether it’s an update to my desktop operating systems or the patches that get posted automatically to my Tesla while I sleep.
Back in the 1990s, I wrote an article comparing the relative complexity of the Pentium processors of that era, expressed as the number of transistors on the chip, to the complexity of the Windows operating system, expressed as the number of lines of code. I found that the complexity of the Pentium processors and the contemporaneous Windows operating system was roughly equal.
That was the time when early Pentiums were affected by what was known as the FDIV bug. It affected only a tiny fraction of Pentium users. Windows was also affected by similar defects, also affecting only fractions of its users.
But the effects on the companies were quite different. Where Windows addressed its small defects with periodic software updates, in 1994 Intel recalled the (slightly) defective processors. It cost the company $475 million—more than $800 million in today’s money.
I believe the relative ease—not to mention the lack of tangible cost—of software updates has created a cultural laziness within the software engineering community. Moreover, because more and more of the hardware that we create is monitored and controlled by software, that cultural laziness is now creeping into hardware engineering—like building airliners. Less thought is now given to getting a design correct and simple up front because it’s so easy to fix what you didn’t get right later.
Every time a software update gets pushed to my Tesla, to the Garmin flight computers in my Cessna, to my Nest thermostat, and to the TVs in my house, I’m reminded that none of those things were complete when they left the factory—because their builders realized they didn’t have to be complete. The job could be done at any time in the future with a software update.
Boeing is in the process of rolling out a set of software updates to the 737 Max flight control system, including MCAS. I don’t know, but I suspect that those updates will center on two things:
Having the software “cross-check” system indicators, just as a human pilot would. Meaning, if one angle-of-attack indicator says the plane’s about to stall, but the other one says it’s not so, at least hold off judgment about pushing the nose down into the dirt and maybe let a pilot or two know you’re getting conflicting signals.
Backing off on the “shoot first, ask questions later” design philosophy—meaning, looking at multiple inputs.
For the life of me, I do not know why those two basic aviation design considerations, bedrocks of a mind-set that has served the industry so well until now, were not part of the original MCAS design. And, when they were not, I do not know or understand what part of the DER process failed to catch the fundamental design defect.
But I suspect that it all has to do with the same thing that brought us from Boeing’s initial desire to put larger engines on the 737 and to avoid having to internalize the cost of those larger engines—in other words, to do what every child is taught is impossible: get a free lunch.
The emphasis on simplicity comes from the work of Charles Perrow, a sociologist at Yale University whose 1984 book, Normal Accidents: Living With High-Risk Technologies, tells it all in the very title. Perrow argues that system failure is a normal outcome in any system that is very complex and whose components are “tightly bound”—meaning that the behavior of one component immediately controls the behavior of another. Though such failures may seem to stem from one or another faulty part or practice, they must be seen as inherent in the system itself. They are “normal” failures.
Nowhere is this problem more acutely felt than in systems designed to augment or improve safety. Every increment, every increase in complexity, ultimately leads to decreasing rates of return and, finally, to negative returns. Trying to patch and then repatch such a system in an attempt to make it safer can end up making it less safe.
This is the root of the old engineering axiom “Keep it simple, stupid” (KISS) and its aviation-specific counterpart: “Simplify, then add lightness.”
The original FAA Eisenhower-era certification requirement was a testament to simplicity: Planes should not exhibit significant pitch changes with changes in engine power. That requirement was written when there was a direct connection between the controls in the pilot’s hands and the flying surfaces on the airplane. Because of that, the requirement—when written—rightly imposed a discipline of simplicity on the design of the airframe itself. Now software stands between man and machine, and no one seems to know exactly what is going on. Things have become too complex to understand.
I cannot get the parallels between the 737 Max and the space shuttle Challenger out of my head. The Challenger accident, another textbook case study in normal failure, came about not because people didn’t follow the rules but because they did. In the Challenger case, the rules said that they had to have prelaunch conferences to ascertain flight readiness. It didn’t say that a significant input to those conferences couldn’t be the political considerations of delaying a launch. The inputs were weighed, the process was followed, and a majority consensus was to launch. And seven people died.
In the 737 Max case, the rules were also followed. The rules said you couldn’t have a large pitch-up on power change and that an employee of the manufacturer, a DER, could sign off on whatever you came up with to prevent a pitch change on power change. The rules didn’t say that the DER couldn’t take the business considerations into the decision-making process. And 346 people are dead.
It is likely that MCAS, originally added in the spirit of increasing safety, has now killed more people than it could have ever saved. It doesn’t need to be “fixed” with more complexity, more software. It needs to be removed altogether.
Pero, como en general en Medio Oriente, donde se vienen pegando documentadamente eso si al menos desde hace mucho (ver post anterior), uno de los problemas de Arabia Saudita es que hacer despues del petroleo, si el petroleo alcanza ahora, que hacer con la poblacion, y asi, de ahi, la IPO
What does the Aramco IPO tell us about Saudi reforms?
Having struggled to win foreign backing for the $25.6bn listing, the crown prince’s plans face further scrutiny
The excitement was palpable as bankers, one group at a time, stepped on to buses that shuttled them from Riyadh’s Ritz-Carlton hotel to a meeting with Saudi officials.
Saudi Arabia, the most conservative of nations, had promised to do what no other Gulf state had dared: open the books of its state oil company Saudi Aramco, let the world peer inside and ultimately take a stake in the kingdom’s crown jewel.
When the bankers arrived, they were greeted by Prince Mohammed bin Salman, then the deputy crown prince, and his “A-team” sitting around the “biggest table I’ve ever seen”, says one executive who attended the December 2016 meeting. The bankers were pitching for business from what was touted as the world’s largest initial public offering, with Riyadh seeking a valuation of $2tn and considering a global listing of 5 per cent of shares to raise $100bn.
“It was euphoric,” says the executive. “Some people were sceptical, but I would say, ‘What? Focus on the positives’. They were finally prepared to do it and bring socio-economic change [to the country].”
Three turbulent years later, Riyadh can lay claim to the world’s largest IPO. But it is on a far smaller scale than it had originally suggested. Saudi Aramco is to list 1.5 per cent of its shares on the local stock exchange on Wednesday, raising at least $25.6bn with minimal participation from foreign institutions that balked at even the scaled back valuation of $1.7tn.
“They aren’t doing what they were aiming to do, which is bring in foreign capital,” says a senior banker, who like most of those interviewed, asked not to be identified. “It’s not a real deal, it’s political.”
The story of the listing is a metaphor for the rollercoaster journey Saudi Arabia has been on as Prince Mohammed consolidated power and shook up the kingdom on a scale not witnessed since his grandfather, Abdulaziz, founded the modern state 87 years ago. It is a tale that began with audacious announcements and lofty ambitions that generated huge expectation but also scepticism. Now as the first phase of Prince Mohammed’s “Vision 2030” reform plan edges towards its close, it has become one of missed economic targets and shifting goalposts set against the paradox of unprecedented social reforms and increasing autocracy.
Why foreign investors questioned Saudi Aramco's IPO valuation
It is a combination that has fuelled contrasting narratives between optimists, resolutely supportive of the crown prince, and pessimists who fear his brash and aggressive leadership is doing more harm than good.
“Right aspirations, wrong approach,” says an executive familiar with the royal court. “When you are trying to do too much, you end up doing nothing much. There’s a hundred things that have to go up to his highness; it creates an environment of overwork and gridlock.”
The lack of economic progress helps explain why Prince Mohammed was so keen to complete the Saudi Aramco listing this year — the need for a win.
“Before the IPO, there was some disillusionment that none of the big projects have yielded anything and the economy is doing badly. People were asking, ‘What has happened to Vision 2030?’” says a foreign executive with Saudi clients. “With the IPO, they can say they have done something they said they were going to do.”
There has been some progress. Prince Mohammed has ushered in social reforms few believed they would see. A ban on women driving has been lifted; cinemas have opened; rules that prevented women travelling abroad without the consent of male guardians have been eased; and the once-feared religious police have been muzzled.
New laws on bankruptcy, foreign ownership and mortgages have been signed off.
But, for many, the positives have been drowned out by negatives, including the shocking murder of Jamal Khashoggi, whose dismembered body has not been recovered a year after his killing. Many Saudi businesses were already reeling from an anti-corruption operation conducted 11 months before the journalist’s murder in Istanbul in October 2018. That purge saw more than 300 princes and tycoons locked up in the Ritz-Carlton — the same hotel the excited bankers had stayed in 11 months earlier — shattering the fragile confidence of a business community already buckling under the weight of austerity measures and the state’s failure to pay bills.
Separate crackdowns targeting bloggers, female activists, journalists, clerics and academics have reinforced the belief that Riyadh has become more repressive under Prince Mohammed. His actions have quashed debate, whether it is about the merits of the IPO or the pace of reform and highlighted the risks of investing in the kingdom.
Crucially, the flood of foreign direct investment Prince Mohammed was betting on to support his plans has yet to materialise. Instead it fell to $1.4bn in 2017. And even though it picked up to $3.2bn last year, according to UN data, that is less than half the FDI secured in 2016. Meanwhile, outward investment trebled between 2017 and 2018 to $21.2bn, a reflection of spending by state entities, notably the Public Investment Fund, the sovereign wealth fund, as well as private investors shifting money offshore.
“He could have used the energy of hope instead of the energy of fear . . .
and not just been surrounded by yes men. The Saudi private sector could mobilise $200bn to $300bn — the shortage is not capital, it’s trust,” says the executive familiar with the royal court.
Repeating Saudi businessmen’s concerns, he adds: “‘We saw our friends go to the Ritz, we saw our bills not being paid [by the government] and now they say we should come and invest?’”
“There’s no question we’ve had a tough time getting to where we are and it’s been more difficult than we would have hoped,” says a senior Saudi official. But he adds, “You can’t underplay what we’ve managed to achieve. We are going through an evolution and everyone is judging us while it’s happening.”
It was, however, Prince Mohammed who set such high goals just at the moment when the oil-rich region was grappling with a prolonged fall in crude prices that turned abundant surpluses into yawning deficits. The crown prince was clear about his prime objectives: reining in the domineering role of the state and creating private sector jobs for the youthful population.
A National Transformation Plan, unveiled in 2016, was to cut unemployment from 11.6 per cent to 9 per cent, create more than 450,000 private sector jobs and increase non-oil revenues, while also lowering public sector wages from 45 per cent to 40 per cent of total government spending — all by 2020. But it became clear that many goals were unrealistic and the next year Riyadh revised the NTP, with targets removed or pushed out by five to 10 years.
It was an early sign of the magnitude of the task. Today, many of the metrics paint a very different picture and the state’s role is as dominant as ever. Unemployment sits at 12.2 per cent, after surging to a record high of 12.9 per cent last year. The public sector wage bill has increased to 50 per cent of expenditure, while the budget deficit is expected to widen to $50bn next year — almost twice the proceeds of the Saudi Aramco IPO. The government has boosted non-oil revenue by introducing value added tax and tariffs on foreign workers, who dominate the private sector.
But the latter move has been debilitating for businesses dependent on cheaper foreign labour. The cuts to energy subsidies were welcomed by economists but have added to companies’ costs and damped demand. The IMF has downgraded its forecast for growth in gross domestic product this year to 0.2 per cent because of lower oil prices and cuts to production, even as there is a pick-up in non-oil activity.
“We rushed into quite a lot early on,” says the Saudi official. “We had energy, we had success, we had confidence, and everything was going really well. But then you start saying, ‘Let’s shift here, let’s do this here’. [And then] there is a bandwidth issue. Do we have enough people to manage this process? No, but we’re still going to give it a shot.”
Other factors created “blind spots”, says the executive familiar with the royal court. “Prince Mohammed’s mistake was that every time someone like Larry Fink [BlackRock’s chairman and chief executive] visited, he believed the Kool-Aid and that they were ready to pour hundreds of billions of dollars in, when in reality they just wanted a piece of the action,” he says.
The obsequious behaviour continued through the IPO process, which was revived after Saudi Aramco’s $12bn bond issue attracted significant foreign interest in April. Bankers and advisers jumped through hoops to lay out a plan to achieve the $2tn valuation. When Khalid al-Falih, the energy minister, was deemed resistant to the IPO, he was replaced.
At London pitches to the company in September, bank executives proposed aggressive marketing strategies, some saying a valuation of more than $2tn was eminently possible. But arguments flared, say people close to the process.
Prince Mohammed’s circle tried to push back against the inclusion of sensitive political topics in the risks section of the IPO prospectus. Officials were also furious when banks reported that international demand was dependent on valuations below $1.5tn.
Still, the fact that for all the doubts it is finally happening has proved to some that nothing is off-limits in the Mohammed bin Salman era.
“Saudi Arabia does not have to sell a single Saudi Aramco share, but the idea itself reflects a different approach to state administration,” wrote Abdulrahman al-Rashed, a Saudi columnist. “That is something that any visitor who knows Saudi Arabia will verify — the country is changing in all aspects of life.”
The jury is still out on the tangible impact of the downsized listing.
“They are juggling [Saudi] money from one place to another, and my concern is that it will be used for investments outside, like [Japan’s] SoftBank, when it’s supposed to be used to create sectors domestically,” says a Gulf-based executive.
Much is likely to hinge on the PIF, which will receive the proceeds of the IPO and has undergone a radical transformation to in effect become the personal tool of Prince Mohammed to drive the reform process.
Headed by Yasir al-Rumayyan, one of Prince Mohammed’s closest aides who replaced Mr Falih as chair of Saudi Aramco, the sovereign wealth fund is tasked with establishing new industries at home as well as leading projects such as Neom, a $500bn futuristic city. It made its mark on the global stage with high-profile investments, including pumping $45bn into SoftBank’s Vision Fund.
But its role is controversial. Proponents argue it is needed to spearhead projects the private sector would not, and use its financial and political muscle to develop new sectors. Critics complain it is crowding out the private sector, reinforcing the state’s dominance and making risky bets. Some are concerned that its omnipresence will now stretch to control of Saudi Aramco, with the risk that it uses the oil firm as a cash cow.
“The PIF is sucking all the air out,” says a Saudi businessman.
There is one issue that unites sceptics and optimists: with the IPO completed, the ultimate test of Prince Mohammed’s abilities will be delivering the next phase of building a strong economy.
“Urban, young Saudis are extremely happy and feel they owe the leadership a lot of credit,” says Steffen Hertog, a Gulf expert at the London School of Economics. But he warns that “social reforms are low-hanging fruit”. Creating sufficient jobs to tackle 30 per cent youth unemployment is a bigger task.
“What can the next big thing be? The mega projects will take a lot of time and some locals think the PIF might be creating white elephants.”
REALITY
Saudi Aramco raised $25.6bn from selling a 1.5% stake and could exercise an option to meet demand by selling an extra portion, collecting $29.4bn in total. The IPO relied on Saudi and regional investors.
EMPLOYMENT
TARGET
The 2016 National Transformation Plan aimed to cut unemployment from 11.6% to 9% by 2020. Youth unemployment, at around 30%, would also be tackled.
REALITY
Riyadh quietly revised the NTP with targets removed or pushed out by five to 10 years. Unemployment is at 12.2%, after hitting a record 12.9% in 2018.
PRIVATISATION
TARGET
The plan aimed to create more than 450,000 private sector jobs and increase non-oil revenues. Public sector wages were also to be cut from 45% to 40% of total government spending by 2020.
REALITY
The state’s role, especially with the expansion of the Public Investment Fund, is as dominant as ever, with the public sector wage bill rising to 50 per cent of expenditure.
La batalla de Megido (siglo XV a. C.) se libró entre las fuerzas egipcias bajo el mando del faraónTutmosis III contra una coalición cananea comandada por el rey de Kadesh, para dirimir la soberanía sobre Retenu. La fecha más comúnmente aceptada de su desarrollo es el 16 de abril de 1457 a. C (conforme a la Cronología del Antiguo Oriente Próximo), aunque algunos autores la sitúan en el 1482 a. C. o en el 1479 a. C. Terminó con una victoria egipcia, que obligó a los cananeos a retirarse a la ciudad de Megido, donde posteriormente fueron asediados y vencidos. Con el restablecimiento de la dominación egipcia en Canaán, Tutmosis III comenzó un reinado en el que el imperio egipcio alcanzó su época de mayor expansión.
Es la primera batalla de la historia de la que existe una relación histórica detallada. En ella se registra por vez primera la utilización del arco compuesto y se da el primer recuento de bajas.10 Todos los detalles de la batalla proceden de fuentes egipcias, principalmente de las escrituras jeroglíficas del templo de Amón en Karnak, Tebas (actual Luxor) hechas por el escriba militar Tjaneni; también en la estela de Gebel Barkal, en una estela del templo de Ptah de Karnak y en una estela de Armant
Y, seguimos afanando notas, esto es de Julio, mucho no ha cambiado, pero vean los cash flows y la necesidad de guita
The Vaca Muerta Play: Gaining competitive economics through operational efficiencies
Argentina's Vaca Muerta formation is viewed as Latin America's most promising area for the development of unconventional oil and gas resources. An analog often quoted for the Vaca Muerta is the prolific Eagle Ford formation in the United States of America (USA). The Vaca Muerta formation has seen clear benefits from the lessons learned up north in the USA. Active operators are enhancing the productivity of the wells by implementing longer laterals and tighter frac stages, thus optimizing efficiencies and cost structures. Current challenges include an undeveloped transport infrastructure and a dearth of service companies. The development of the Vaca Muerta formation has seen activity ramp up in recent years, however cost reductions and operational refinements will continue to play a critical role in its overall success.
The Vaca Muerta Formation
The Vaca Muerta formation is characterised by large volumes of reserves and unique geological heterogeneity. Historically, the Neuquén Basin has been Argentina's most prolific basin, with first production coming online in the late 1920's. Conventional production from the Neuquén Basin peaked around the 2000's and since then it has seen a gradual decline. The Vaca Muerta formation, one of the most prolific unconventional formations being targeted by operators, has close to 310 billion barrels of oil equivalent of recoverable reserves and is expected to revive production from the basin.
The Vaca Muerta formation is stretched over four provinces: Neuquén, Mendoza, La Pampa and Rio Negro. The Vaca Muerta formation's thickness increases in the center of the Neuquén Basin. Operators, while drilling vertical wells in the early stages, concluded that to increase reservoir contact, they would start drilling horizontally into this formation. The Vaca Muerta formation's porosity reaches up to 12% which has helped to optimise the production and flow of hydrocarbons.
The thermal maturity, TOC % and the pressure gradient for the Vaca Muerta formation are all within favorable ranges. A big portion of the formation has a thermal maturity in the range of 0.5 to 2.5 (% Ro). The TOC % for the Vaca Muerta formation has a wide range, with a minimum of 2% reaching up to 12% in certain regions. The pressure gradient for the Vaca Muerta formation is between 0.6 to 1.5 (psi/ft).
Development
Beginning around 2012 - 2013, development activity in the Vaca Muerta formation has started seeing a gradual ramp up over the past few years. Of the total wells drilled in Argentina, the Vaca Muerta formation comprises of approximately 10% in 2018. However, this is expected to change and go higher as most of the future development capex is being directed towards the unconventional Vaca Muerta formation. Within unconventional development activity in Argentina, the Vaca Muerta formation's share is at approximately 45%. Over time, many new entrants have become active in the development of this formation. YPF, Chevron, ExxonMobil, Wintershall and Pluspetrol are some of the active operators in the Vaca Muerta.
Along with the Vaca Muerta formation, other unconventional tight gas formations such as Mulichinco and Lajas are also being developed in the Neuquén basin. Activity has trended higher within these tight gas formations as well. This activity jump is expected to create healthy competition to source and utilize the limited resources and service companies available in the region. However, the Vaca Muerta formation is expected to attract a lot of these resources as it provides an opportunity to concentrate resources geographically and lead development thus bringing operational efficiencies with it.
Operational considerations
Many natural drive unconventional wells have come online within the Vaca Muerta formation. However, there is also an uptick in the number of artificial lift installations in the development of this formation. The operational learning curve could mimic or be extremely similar to the unconventional formation development in the USA. A large number of wells being drilled currently are all horizontal or directional in nature. The main driver of cost for a Vaca Muerta well is the drilling and completion activities. As a result of this, one of the main areas of focus to bring down the cost of a well drilled in the Vaca Muerta is optimization of the drilling and completion activities. Companies like YPF have deployed walking rigs to reduce costs and gain efficiencies.
YPF is working towards maximizing returns through its technical optimization efforts. The wells being drilled by the company in the Vaca Muerta formation are being drilled faster, with long laterals and more concentrated frac stages. The number of frac stages per well has also gone up in the past few years. While drilling costs form a big portion of the total cost of a well drilled, operators developing this unconventional formation are trying to manage this by establishing long term contracts with the drilling contractors. The use of walking rigs has helped lower drilling times.
The other operational challenges include limited infrastructure to deliver the production to the demand points, sourcing of water for fracturing the unconventional wells, managing the produced water and sourcing material such as sand for fracking. Completion costs, which are heavily weighted by frac services and proppants, are being managed by operators by engaging in and establishing vertical integration where they own such services as well. The number of wells per pad has gone up gradually from approximately 3 wells in 2011 to close to 8 wells in 2018.
Valuations
The cost of drilling an unconventional well in the Vaca Muerta is approximately $8 million. The cost of drilling has come down considerably over the past few years. Year on year the cost to drill a well has come down $1.5 million on average. Operators such as YPF have managed to bring the well cost down from $16 million in 2014 to the current $8 million, a 50% reduction in costs. The observed trend for the unconventional formations in the United States has been a continuous reduction in costs and improvement in efficiencies. If the same trend is followed in the Vaca Muerta formation, average well costs could be reduced further over the long term, making it a very economical and competitive unconventional resource.
This is extremely favorable for the operators as it helps bring the average breakeven price range for the development of the Vaca Muerta formation down to around $40/bbl for oil. As a comparison, the unconventional breakeven price for a well drilled in the Eagle Ford is close to $38/bbl. This makes the cost of drilling a well in the Vaca Muerta formation very competitive with drilling in the Eagle Ford. The average breakeven price range for gas projects in the Vaca Muerta formation is approximately $5.5/mcf. In comparison, the unconventional breakeven price for a well drilled in gas plays in the United States such as the Marcellus is close to $2/mcf.
Well EUR's have also increased in the Vaca Muerta formation over the years. The oil EUR in 2013 was approximately 80 Mbbl in 2013, while it is currently close to 468 Mbls. The gas EUR in 2013 was approximately 198 Mmcf in 2013, but is now currently close to 432 Mmcf. The Internal Rate of Return for projects in the Vaca Muerta formation averages close to 14%. The net present value for a single well drilled in the Vaca Muerta formation is $3.34 million. The payback period for these wells remains competitive when compared to some of the offshore development projects across the world.
Investments
The Neuquén Basin within Argentina is expected to continue to attract investments and deliver long term production growth. The other producing basins in Argentina are being impacted by a decline or depletion in the overall reserves along with a lack of significant discoveries in recent years. The Neuquén Basin's productive formations are expected to offset the declines from the conventional sources while the Vaca Muerta formation will add to the long-term production growth.
The investment into the Vaca Muerta formation has seen a steady increase in recent years. Total capex to be invested for the development of the Vaca Muerta formation is expected to see an increase of approximately 10-15% year-on-year over the next decade. The total development capex is expected to reach approximately $5.5 billion by 2025, increasing to approximately $8 billion by the end of the decade. After tax cash flow is expected to peak in the year 2036, reaching an estimated $5 billion in that year.
Figure 1: Vaca Muerta Capital Investment Forecast.
Fiscal insight
In Argentina, provinces have jurisdiction over the hydrocarbon resources which are located within their territories. The contract model is concession based. The Neuquén province received quarterly bids for certain areas. The other three provinces have held licensing rounds on a regular basis. The current income tax for the country is 30% and this will come down to 25% from 2020. Provinces are also responsible for environmental regulations. For the development of the unconventional Vaca Muerta formation, the government has put in place an incentive program, which provided a well head price of $7.5/mmbtu. These subsidies could be systematically reduced in the coming years.
Conclusion
The USA is expected to continue to lead the world in the development of unconventional resources. The country has shown a remarkable ability to adapt, improvise and introduce efficiencies which have made developments competitive and economical. Many of the insights gained from the development of the unconventional formations here are being transferred to the development of the Vaca Muerta Formation. Argentina has supported the development of the unconventional formations and those operators which are active in the Vaca Muerta formation have been successful in managing the costs and improving the productivity of the wells. The Neuquén Basin provides opportunities beyond the Vaca Muerta formation, with several other formations providing upside potential. Continuing the positive trend in the development of the Vaca Muerta formation will enable it to maintain its position as one of the most prospective unconventional plays outside of the USA.
