Public safety failures, turned into engineering work products.
Every quarter brings another headline that sounds like a technology problem but reads, to anyone who has run a HARA, like a process problem. This blog covers functional safety and cybersecurity across automotive, aerospace, robotics & physical AI, industrial, and medical — translating each story into the artifacts our standards already ask us to produce.
Field notes
When the Safe State Became the Payoff: The Rockwell Logix CIP Fault Advisory (ICSA-26-244-03) Through an IEC 61511 and IEC 62443-3-3 Lens
CISA published ICSA-26-244-03 on September 1, 2026 - CVE-2026-9637, a CWE-119 length-validation defect in CIP message processing that drives ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 into a major nonrecoverable fault clearable only by a physical power cycle. Re-framed as a safety function whose de-energized state is correct, unauthenticated, and reachable from anywhere the control network is routed.
Read the postWhen the Detector and the Isolator Lived in Different Type Certificates: The A220 EEC Bleed-Leak AD (2026-15-14) Through an ARP4761A and 14 CFR 33.28 Lens
FAA AD 2026-15-14 (91 FR 47951, effective September 3, 2026) finally mandates Pratt & Whitney EEC software 2.12.1 on 152 U.S.-registry A220s, two years after a design review found the large-bleed-duct-leak protection logic did not cover a burst at one specific location. Re-framed as an interface whose detection coverage nobody declared, and a crew procedure that spent seventeen months holding a catastrophic failure condition together.
Read the postWhen the Update Discharged the Patients: The GE HealthCare Portrait Mobile Early Alert Through an IEC 62304 and IEC 60601-1-8 Lens
FDA issued an Early Alert on August 21, 2026 for GE HealthCare's Portrait Core Services software - during an update at one facility, patients wearing Portrait Mobile sensors were discharged from the monitoring system and alarm settings fell back to factory defaults. Re-framed as a software change whose risk analysis never modelled the update as an operating state, and an alarm-preset persistence rule IEC 60601-1-8 already spells out.
Read the postWhen the Traffic Cop Kept Its Keys in the Backup: The OTTO Fleet Manager Advisory (ICSA-26-239-03) Through an ANSI/A3 R15.08 and IEC 62443-4-2 Lens
CISA published ICSA-26-239-03 on August 27, 2026 - CVE-2026-75112, a bcrypt work factor set too low in Rockwell Automation's OTTO Fleet Manager, the software that assigns missions and holds the site map for fleets of PL d safety-rated autonomous mobile robots. Re-framed as a configuration artifact that walks out of the security boundary carrying the site's safety assumptions with it.
Read the postWhen the Noise and the Attacker Sent the Same Bytes: The Bendix EC80 Brake ECU Advisory (ICSA-26-237-05) Through an ISO/SAE 21434 and FMVSS 121 Lens
CISA published ICSA-26-237-05 on August 25, 2026 - three CVEs against the Bendix EC80 heavy-truck brake ECU, found by reverse-engineering a 2024 safety recall of ~450,000 units that was publicly framed as a line-noise problem. NMFTA's road tests put a Class 8 combination into a latched CAN blackout clearable only by disconnecting the battery.
Read the postWhen the Ship's Identity Was a Writable Field: The FURUNO FA-50 AIS Advisory (ICSA-26-237-07) Through an IEC 63154 and IACS UR E27 Lens
CISA published ICSA-26-237-07 on August 25, 2026 - CVE-2026-59769 (CVSS 9.1, hard-coded credentials) and CVE-2026-67578 (7.5, missing authentication) let anyone on a vessel's own network rewrite the MMSI a Class B AIS transponder broadcasts. Production ended October 2020, no patch is coming, and the vendor's residual risk control is locking the boat.
Read the postWhen the Inspection Interval Branched on the Repair History: The 737 MAX Bear Strap AD (2026-15-11) Through a 14 CFR 25.571 Damage-Tolerance and Part 26 Repair-Assessment Lens
FAA AD 2026-15-11 (91 FR 50698, effective September 10, 2026) puts 471 U.S.-registry 737-8, -9 and -8200 airplanes into a bear strap crack inspection program with zero cracks found on the MAX to date. Re-framed as a damage-tolerance evaluation whose initial-flaw assumption the production line quietly falsified, and an inspection program that gates on a repair record nobody was required to keep.
Read the postWhen the Turn Signals Lived Inside the Screen: The Toyota 26V511 Combination Meter Recall Through an ISO 26262-9 Freedom-from-Interference and Initialization Lens
Toyota filed NHTSA recall 26V511 on August 6, 2026 - 508,354 Camry Hybrids whose 7-inch combination meter can lose a race during its own boot sequence and come up blank, taking the turn signals, hazard lamps, seat belt reminder and key-left chime with it. Four FMVSS standards broken by one initialization window, seventy-one days after a different supplier's meter failed the same way.
Read the postWhen the Interlock Had a Key That Made It Lie: The Stellantis Dundee Gantry Fatality Through an ISO 14119 and ISO 14118 Lens
A wrongful-death suit in Wayne County alleges the safety interlock on the washer cell at Stellantis Dundee was defeated with a special key when an overhead gantry activated and crushed machine repairman Ronald Adams Sr. on April 7, 2025 - with 'cheater keys' circulating plant-wide and an unexplained motion event reported two days earlier. Re-framed as an ISO 14119 Clause 7 defeat analysis nobody ran and an unexpected-start-up procedure that did not survive a relocation.
Read the postWhen the Intended Use Statement Described Two Moments and the Device Stayed In for Four Days: The Abiomed 14Fr Low Profile Introducer Recall Through an ISO 14971 and ISO 10993 Lens
FDA classified Abiomed's removal of the 14Fr Low Profile Introducer Kit as Class I on July 17, 2026 - thrombus forming in the annular gap between sheath and catheter during prolonged Impella CP support, three serious injuries, and an exclusive compatibility constraint that dragged a whole pump generation off the market with it. Re-framed as a use specification that described insertion and removal for a device that sits in a femoral artery for four days.
Read the postWhen the Audit Log Had an Off Switch: The ANDRITZ HIPASE-250 Advisory (ICSA-26-225-05) Through an IEC 62443-4-2 and CRA Annex I Lens
CISA's August 13, 2026 batch included ICSA-26-225-05 against ANDRITZ HIPASE-250 and 250 SCALA, the SCADA layer of a hydropower automation platform - reversible password storage, an unauthenticated data endpoint, a fleet-wide x11vnc password written by a provisioning script, and an undocumented endpoint that turns audit logging down without asking who you are. Re-framed as a detection control with a single point of defeat and a commissioning artifact nobody put inside the security scope.
Read the postWhen the Clock Counted Hours and the Damage Counted Starts: The PW210 Turbine Exhaust Frame AD (2026-16-13) Through a 14 CFR 33.70 and Part 21 Lens
FAA AD 2026-16-13 (91 FR 52487, effective August 31, 2026) supersedes a seven-week-old AD on Pratt & Whitney Canada PW210 turboshafts because a turbine exhaust frame material introduced by service bulletin PW210-72-57123 cracks sooner than the Waspaloy it replaced. Re-framed as a missing 14 CFR 33.70 life limit, a Part 21 change-classification failure, and an inspection interval written in the wrong unit.
Read the postWhen the Menu Sat on Top of the Test Object: The Ford 26V489 Rearview-Camera Recall Through an FMVSS 111 Default-View and ISO 26262-9 Lens
Ford filed NHTSA recall 26V489 on July 28, 2026 - 47,587 F-150 and F-250 trucks whose SYNC 4 camera Views menu will not dismiss when the driver shifts into Reverse, covering a mandated FMVSS 111 test object. It is the fifth distinct mechanism to break the same rear-visibility requirement, three of them filed while Ford sits inside a $165M NHTSA consent order about rear-visibility recalls.
Read the postWhen the Safety Limit Was Just a Command Handler: The Pulsetto Vagus Nerve Stimulator Advisory (ICSMA-26-223-02) Through an IEC 60601-2-10 and ISO 14971 Lens
CISA published ICSMA-26-223-02 on August 11, 2026 - CVE-2026-18844, CWE-912 Hidden Functionality, CVSS v4.0 7.2 - because a consumer vagus nerve stimulator's firmware accepts undocumented, unauthenticated BLE commands that can disable its electrical safety mechanisms, and the vendor has not responded to CISA. Re-framed as an output ceiling allocated to the wrong architectural layer, with a serious-injury MAUDE report already on file from nominal use.
Read the postWhen the Clearance Had No Signature: The CPDLC over ATN-B1 Advisory (ICSA-26-219-01) Through a DO-326A and ED-120 Lens
CISA published ICSA-26-219-01 on August 7, 2026 - five CVEs against CPDLC over ATN-B1, all versions affected, no mitigation available, because the datalink carrying controller clearances to the flight deck has no authentication at all. Re-framed as a DO-326A Security Risk Assessment never run against the link layer, and an ED-120 availability allocation that assumed random failures instead of a chosen moment.
Read the postWhen the Cabin Lights Shared a Box With the Floats: The AS350/EC130 LACU AD (2026-14-02) Through an ARP4761A CCA and DO-160G Lens
FAA AD 2026-14-02 (91 FR 42644, effective August 14, 2026) hits 576 U.S.-registry AS350/EC120/EC130 helicopters because dust inside a lighting and ancillaries control unit can short it out and take the emergency flotation system with it. Re-framed as a Zonal Safety Analysis gap on a mixed-criticality enclosure, a DO-160G Section 12 category chosen against the wrong operational profile, and a segregation requirement nobody wrote until EASA wrote it for them.
Read the postWhen the Evidence Had No Signature: The Applied Biosystems .fsa/.hid Advisory (ICSMA-26-216-01) Through an IEC 81001-5-1 and ISO/IEC 17025 Lens
CISA published ICSMA-26-216-01 on August 4, 2026 - CVE-2026-17583, CWE-353, CVSS v3.1 8.4 - because Thermo Fisher Applied Biosystems .fsa and .hid DNA data files carry no integrity check at all, and three end-of-life instrument lines get no fix. Re-framed as a missing property on the artifact rather than a missing control on the network, with the detection credit assigned to technical review now falsified.
Read the postWhen the Hazard Had No ECU: The Tesla Lower-Lateral-Link Probe (PE26-006) Through an ISO 26262-3 Item Definition and DFMEA Lens
NHTSA opened PE26-006 on July 29, 2026 into 1,198,300 Tesla Model 3 and Model Y vehicles after 156 complaints that the front lower lateral link detaches, potentially causing loss of directional control - most with no advance warning at all. Re-framed as an item-definition boundary gap, a detection control credited in 2021 that the field has since disproved, and a chassis-integrity monitor nobody wrote a requirement for.
Read the postWhen the Safety Monitor Was the Attack Surface: The NASA cFS Health and Safety Incomplete Fix Through a NASA-STD-8739.8 and IEC 62443-4-1 Lens
CISA advisory ICSA-26-211-06 (July 30, 2026) covers CVE-2026-18064 — an incomplete fix for CVE-2026-15352 leaves a second NULL pointer dereference reachable in NASA's cFS Health and Safety application through v7.0.1, and crashing the app produces a processor reset. Re-framed as a monitor-independence failure, an IEC 62443-4-1 DM-4 defect-class gap, and a commandable reset path nobody wrote a requirement against.
Read the postWhen the Knob Lied: The 787 Mode Control Panel AD (2026-12-07) Through a DO-254 and ARP4761A Lens
FAA AD 2026-12-07 (91 FR 35873, effective July 20, 2026) makes 163 U.S.-registry 787s replace the Honeywell mode control panel outright — up to $405,000 a unit, up to $66M fleet-wide — because the selected altitude can change without a pilot touching it. Re-framed as a DO-254 simple-hardware classification gap, a missing validity gate at the HW-SW interface, and a crew-detection credit taken on the very display the failure corrupts.
Read the postWhen the Same Bug Came Back Four Times: The libIEC61850 and lib60870 Parser Advisories Through an IEC 62443-4-1 and IEC 61850-5 Lens
CISA published ICSA-26-204-06 and ICSA-26-204-07 on the same day, July 23, 2026 - a heap overflow reachable from an MMS Initiate request in libIEC61850 (CVE-2026-49035, CVSS v4 9.2) and an out-of-bounds read in lib60870's security-statistics ASDU parser. Re-framed as one defect class that has recurred at the same decode boundary since 2022, and the IEC 62443-4-1 SVV-3 fuzz gate that would have closed it once instead of four times.
Read the postWhen the Remedy Needed a Recall: BMW's Third Integrated-Brake Campaign (26V422) Through an ISO 26262-7 and IATF 16949 Lens
NHTSA campaign 26V422 (July 1, 2026) is BMW's third recall on the same Continental integrated brake unit in 29 months — 428 vehicles, and it explicitly re-opens cars already repaired under 24V104 and 24V739. Re-framed as an ISO 26262-7 production-conformity gap and a corrective-action effectiveness loop that never closed.
Read the postWhen the Pump Couldn't See the Leak: The Omnipod Cannula-Tear Class I Recalls Through an ISO 14971 and IEC 60601-2-24 Lens
FDA classified Insulet's second Omnipod field action of 2026 as Class I on July 2: a cannula tear just above the skin lets insulin leak outside the body while the Pod reports normal delivery - roughly 7 million Pods, 24 serious injuries, plus 476 from the sibling March recall. Re-framed as a one-sided detection architecture and a closed loop feeding its own leak.
Read the postWhen Losing Your Head Was the Selling Point: The URKL Humanoid Combat Debut Through an ISO 12100 and Combat-Robotics Lens
At the July 17, 2026 debut of EngineAI's URKL humanoid fighting league in Shenzhen, a T800 lost its head to a high kick and kept fighting on torso-based control - then handlers walked into the ring past its still-active opponent. Re-framed as an undefined fault reaction, a missing rated containment, and the combat-robotics safety case the humanoid world forgot to import.
Read the postWhen the Fix Was a Checklist and the Checklist Shipped Broken: The 737 MAX Cabin-Overheat AD Chain Through an ARP4761A and 25.1309 Lens
FAA AD 2026-14-11 (July 13, 2026) is the third AD in five months chasing one 737 MAX failure mode: a tripped BAT BUS SECT 2 breaker sends an erroneous ground signal that closes the ram air doors and drives cabin heat uncontrollably high - and the newest AD exists because the prior checklist shipped missing steps 1-8. Re-framed as an unenumerated sneak circuit and an unverified procedural risk control.
Read the postWhen the Regulator Wrote 'Functional Insufficiency': The Zoox Heavy-Smoke Recall (26E044) Through an ISO 21448 and UL 4600 Lens
NHTSA equipment recall 26E044 (July 16, 2026): an unoccupied Zoox robotaxi drove into heavy smoke obscuring an uncordoned fire scene in Las Vegas, stopped inside it, and was reversed out by a remote teleguidance operator. Re-framed as a dual-role triggering condition, an MRC-placement gap, and the NHTSA letter that put ISO 21448's own vocabulary on the record.
Read the postWhen the Safe State Was a Stopped Ventilator: The ResMed Astral Supercapacitor Early Alert Through an ISO 80601-2-72 and ISO 14971 Lens
FDA Early Alert (July 15, 2026): a leaking supercapacitor in pre-October-2024 ResMed Astral 100/150 life-support ventilators can corrode the main PCBA and latch the machine into a fail-safe state that stops therapy - five serious injuries, and spare boards so scarce the fix is rationed by clinical risk tier. Re-framed as an unbounded wear-out mode, a protective subsystem turned initiator, and the third power-subsystem field action on this platform in a decade.
Read the postWhen the Free PLC Compiled the Attacker's Code: The OpenPLC v3 File-Write RCE Through an IEC 62443 and IEC 61511 Lens
CISA advisory ICSA-26-190-01 (July 9, 2026) covers CVE-2026-14480 in OpenPLC v3 - an authenticated file-write flaw where an attacker-controlled filename drops a malicious .cpp into the runtime core directory, which the PLC compiles into its own binary on the next program start. Re-framed as a missing IEC 62443-4-2 input-validation control, an end-of-life component with no secure-development lifecycle behind it, and a soft-PLC quietly carrying process-safety functions IEC 61511 never assessed it to hold.
Read the postWhen the Dispatch Relief Was the Safety Margin: The A220 HPV Butterfly-Clip Emergency AD Through an ARP4761A and MMEL Lens
FAA Emergency AD 2026-13-52 (effective July 7, 2026) and Transport Canada CF-2026-33R1 pull seven MMEL dispatch-relief items and eighteen CAS-message conditions across the entire A220 fleet after missing and broken HPV butterfly clips turned up in a repair shop. Re-framed as a latent failure ARP4761A should have bounded and the MMEL justification whose independence assumption just died.
Read the postWhen the Reaction Wheel Would Boot Anything: The CubeSpace CW0057 Secure-Boot Gap Through a NIST SP 800-193 and SPARTA Lens
CISA advisory ICSA-26-183-02 (July 2, 2026) covers CVE-2026-13743 in the CubeSpace CW0057 reaction wheel - the attitude-control actuator authenticates firmware with a CRC-32 integrity check that confirms the bits arrived intact but never checks who signed them. Re-framed as a NIST SP 800-193 Protect/Detect/Recover gap, a CWE-347 signature-verification miss, and a supply-chain persistence foothold the SPARTA matrix already names.
Read the postWhen the Rollaway Monitor Was Asleep: The Ford 26V402 Park-Pawl Recall Through an ISO 26262 and FMVSS 114 Lens
NHTSA recall 26V402 (June 24, 2026) covers 741,195 Ford and Lincoln trucks and SUVs whose transmissions can momentarily engage the parking pawl while moving, silently damaging the park system - and whose EPB rollaway detection, credited to close a 2022 investigation, may be asleep with the PCM when the parked vehicle finally rolls. Re-framed as a latent dual-point fault and a safety-mechanism availability claim nobody verified.
Read the postWhen the Knob Could Lie About the Oxygen: The GE HealthCare Giraffe and Panda Blender Recall Through an ISO 14971 and IEC 60601-1-8 Lens
FDA classified GE HealthCare's Giraffe and Panda infant-resuscitation blender correction as Class I on June 22, 2026 after the air-oxygen blender knob shaft was found able to loosen, letting delivered FiO2 drift from the set value with nothing in the delivery path to catch it. Re-framed as a missing IEC 60601-1 essential-performance claim, an ISO 11195 gas-mixer gap, and the independent-oxygen-monitor risk control GE now recommends by hand but never built in.
Read the postWhen the Maintenance Manual Disabled the Monitor: The Boeing 737NG Thrust-Reverser Lock-Indication AD Through an ARP4761A and 25.933 Lens
FAA NPRM AD-2025-00364-T (91 FR 15566, March 30, 2026) proposes inspections across all Boeing 737-600/-700/-700C/-800/-900/-900ER airplanes after a report that an AMM rigging procedure can leave a thrust reverser indicating 'locked' when it is not. Re-framed as a latent monitor failure ARP4761A should have bounded, a 14 CFR 25.933/25.1309 single-failure gap, and a recurrence of the same defeat the FAA already chased in 2019's AD 2019-18-03.
Read the postWhen the Safety Limits Were One Network Packet Away: The Universal Robots PolyScope 5 Command-Injection Flaw (CVE-2026-8153) Through an ISO 10218:2025 and IEC 62443 Lens
CISA advisory ICSA-26-134-17 (May 14, 2026) and Universal Robots' PSIRT advisory cover CVE-2026-8153, an unauthenticated OS command injection (CWE-78, CVSS 9.8) in the PolyScope 5 Dashboard Server that hands a network attacker root on a UR cobot controller - the same controller that enforces the ISO/TS 15066 power-and-force limits keeping an operator safe in the shared workspace. Re-framed as the cybersecurity risk assessment ISO 10218:2025 now demands, a missing IEC 62443 conduit boundary, and the safety-function integrity claim one unsanitized string defeats.
Read the postWhen the Relay Could Be Reflashed Over Its Own Engineering Port: The Siemens SIPROTEC 5 DIGSI 5 File-Upload Advisory Through an IEC 62443 and IEC 61850 Lens
CISA re-released ICSA-26-174-02 on June 23, 2026 over CVE-2025-40808 - an authenticated arbitrary file upload via the DIGSI 5 engineering protocol that can brick a Siemens SIPROTEC 5 protection relay or silently rewrite its trip logic. Re-framed as a missing IEC 62443-4-2 input-validation and integrity control, an unsigned-firmware gap no allow-list fully closes, and a protection-independence claim defeated by one upload.
Read the postWhen the Monitor Wore Out on the Shaft It Was Watching: The ATR 42 Flap-Asymmetry Detector AD Through an ARP4761A and 25.671 Lens
FAA AD 2026-09-13 (effective June 18, 2026) adopts EASA AD 2025-0087 across all ATR 42-200/-300/-320 airplanes after a flap asymmetry detector was found with worn splines, no longer engaged to the interconnection shaft it exists to watch. Re-framed as a dormant-monitor failure ARP4761A should have bounded, a 25.671/25.701 common-mode gap, and a certification maintenance task that arrived only after a mechanic found it on the bench.
Read the postWhen the Restraint Became the Hazard: The Honda Odyssey 26V227 Inadvertent Airbag Recall Through an ISO 26262 and ISO 21448 Lens
NHTSA recall 26V227 (filed April 9, 2026) covers 440,830 model-year 2018-2022 Honda Odyssey minivans whose SRS ECU can fire the side and side-curtain airbags over potholes and speed bumps - the deployment-threshold margin treats road shock as a side crash. Re-framed as an ISO 26262-3 Clause 7 commission row rated ASIL D, an ISO 21448 Known Unsafe triggering condition, and a 2021 'no safety concern' closure that should have been a requirement.
Read the postWhen 'No Fix Planned' Lands on a Safety-Capable PLC: The Mitsubishi MELSEC iQ-F FX5 DoS Advisories Through an IEC 62443 and IEC 62061 Lens
CISA advisories ICSA-26-169-05 and -06 (June 18, 2026) disclose two remotely triggerable denial-of-service flaws in the EtherNet/IP and Ethernet modules of Mitsubishi's MELSEC iQ-F FX5 - the same compact PLC family that carries a SIL 3 / PL e safety extension, and one flaw ships marked 'no fix planned.' Re-framed as a missing IEC 62443-4-2 availability control, an unbuilt zone-and-conduit boundary, and the IEC 62061 safe-state requirement that should never have depended on the attacked path.
Read the postWhen the Console Rebooted and Said Nothing: The Abiomed Impella Controller Restart Through an IEC 62304 and IEC 60601-1-8 Lens
FDA Early Alert (May 21, 2026) warns that a software error in Abiomed's Automated Impella Controller can force the console to restart during left-ventricular support - stopping the pump for ~35 seconds with a black screen and no alarm, two serious injuries and one death so far. Re-framed as an IEC 62304 Class C segregation failure, an IEC 60601-1-8 alarm gap, and the ISO 14971 risk row that asks what annunciates when the monitor itself reboots.
Read the postWhen the Service Letter Said 'Not Safety of Flight': The UPS MD-11 Pylon-Separation Crash Through a 14 CFR 25.571 and ARP4761A Lens
UPS Flight 2976, an MD-11F, lost its left engine and pylon on rotation out of Louisville on Nov 4, 2025, killing 15. The NTSB's May 2026 hearing traced it to a fatigue crack in a pylon aft-mount spherical bearing race that Boeing flagged in a 2011 Service Letter and judged 'not a safety of flight condition.' Re-framed as a misclassified 25.571 Principal Structural Element and five derived requirements.
Read the postWhen the Detector Was Already in the Catalog: The Volkswagen ID.4 Battery-Fire Recalls Through an ISO 26262 and UN GTR 20 Lens
Volkswagen filed three overlapping ID.4 recalls (Dec 2025-Jan 2026) over high-voltage battery fires traced to shifted electrodes from SK Battery America. The largest - NHTSA 26V030, 43,881 vehicles - exists only because a Self-Discharge Detection function that would have warned drivers before three known fires was never installed. Re-framed as an ASIL D safety mechanism left unallocated, a UN GTR 20 occupant-warning gap, and five derived requirements.
Read the postWhen the Routine Was the Hazard: The Unitree G1 Public-Demo Strikes Through an ISO 10218 and ISO/TS 15066 Lens
A Unitree G1 roundhouse-kicked a child at a public demo in Urumqi on June 1, 2026 - the third bystander-contact event in Chinese humanoid performances this year. The robot wasn't rogue; it followed its script. Re-framed as a missing ISO 12100 risk assessment, an unrun ISO 13855 separation calculation, and five derived requirements for the most dangerous operating mode in robotics: the demo.
Read the postWhen the Backup Was the Operator: The Draeger Atlan A350 Anesthesia Workstation Correction Through an ISO 80601-2-13 and ISO 14971 Lens
FDA Early Alert (May 18, 2026) expands Draeger's October 2024 Urgent Medical Device Correction on Atlan A350 and A350 XL anesthesia workstations after a manufacturing impurity in the piston ventilator drive can stop mechanical ventilation before or during a case. Re-framed as a missing ISO 80601-2-13 essential-performance row, a 21 CFR 820.70 process-control gap, and the alarm requirement nobody wrote.
Read the postWhen the Charger Was the Conduit: The ABB Terra AC OCPP Heap Overflow Through an IEC 62443-4-2 and ISO 15118 Lens
CISA advisory ICSA-26-146-01 (May 26, 2026) republishes ABB PSIRT 9AKK108471A8948 for CVE-2025-5517, a heap-based buffer overflow in the OCPP message parser of the Terra AC Wallbox that lets a malicious or hijacked CSMS take remote control of a Level-2 EV charger. Re-framed as a missing IEC 62443-4-2 CR 3.5 input-validation control, an absent OCPP Security Profile 3 deployment, and five derived cybersecurity requirements.
Read the postWhen the Crew Was the HUMS: The Airbus H145 D-3 Rotor Hub-Shaft Emergency AD Through an ARP4761A and 14 CFR 29.571 Lens
FAA Emergency AD 2026-08-51 (effective May 14, 2026) and EASA EAD 2026-0078-E ground the H145 / MBB-BK 117 D-3 fleet over a cracked main-rotor hub-shaft detected only after the crew flew a vibrating helicopter. Re-framed as a 14 CFR 29.571 PSE gap, an ARP4761A Particular Risks row, and the AC 29 MG-15 HUMS allocation that should have caught the crack before the pilot did.
Read the postWhen the Safety Mechanism Becomes the Hazard: The Hyundai 26V316 Phantom-Braking Recall Through an ISO 21448 SOTIF Lens
NHTSA recall 26V316 (May 2026) covers 421,078 model-year 2025-2026 Hyundai Tucson and Santa Cruz vehicles after the Mobis front-camera Forward Collision Avoidance software produced unintended braking - four crashes, four alleged injuries, 376 field reports. Re-framed as an ISO 26262-3 Clause 7 HARA commission row, an ISO 21448 Known Unsafe triggering-condition entry, and five derived requirements.
Read the postWhen the Slat Could Lie and the Flight Deck Couldn't Tell: The Boeing 787 LEOLA AD Through an ARP4761A and AC 25-19A Lens
FAA NPRM 2026-05327 (March 18, 2026) supersedes the 2019 interim AD on Boeing 787 leading-edge outboard slats - six years of operational checks and an AFM icing prohibition were never the safety case, just a holding pattern. Re-framed as a Catastrophic FHA row that demanded a design change, a Common Mode Analysis gap on the torque brake, and a CMR finally arriving as 27-CMR-14.
Read the postWhen the Bug Shipped Inside the Firmware: The SENTRON 7KT PAC1261 Advisory Through an IEC 62443-4-1 Lens
CISA advisory ICSA-26-134-14 (May 14, 2026) rates the Siemens SENTRON 7KT PAC1261 Data Manager CVSS 9.1 for a request-smuggling device takeover - but the flaw is CVE-2025-22871, a Go net/http bug public and patched 13 months earlier. Re-framed as a missing IEC 62443-4-1 SBOM, an absent defect-management feed, and five derived cybersecurity requirements.
Read the postThree Recalls, One Dark Cluster: Stellantis's Instrument-Panel Software Failures Through an ISO 26262 Lens
Three FCA US recalls in six months - 72,509 Ram trucks, 65,348 more, and 20,271 Jeep and Dodge EVs - all trace to instrument-cluster software that goes blank. Re-framed as a QM-rated display silently carrying ASIL C warnings, a missing dependent-failure analysis, and five derived requirements.
Read the postWhen the Safe State Wasn't Safe: The ACCOLADE Pacemaker Class I Recall Through an ISO 14971 and IEC 62304 Lens
FDA confirmed a Class I recall correction for 1.4 million Boston Scientific ACCOLADE pacemakers and CRT-Ps - four deaths, 2,557 serious injuries from a battery defect that latches the device into a fixed-rate Safety Mode. Re-framed as a missing ISO 14971 risk row for the risk control measure itself and an IEC 62304 software-maintenance regression.
Read the postWhen the Robot Bought a Plane Ticket: Southwest's Humanoid Ban Through a 49 CFR 175 and ISO 13482 Lens
Southwest Airlines banned humanoid and animal-like robots from its cabin and checked baggage on May 13, 2026 after a 70-lb humanoid named Bebop blew the 100-Wh installed-battery limit on Flight 1568 and a 3.5-ft humanoid named Stewie bought a window seat from Las Vegas to Dallas. Re-framed as a missing transport-mode operating state, an absent hazmat conformance flowdown, and five derived requirements every humanoid product file should already have.
Read the postWhen the Skin Was Off by a Mil: The A320neo Sofitec Fuselage Panel AD Through a Part 21 and ARP4761A Lens
FAA Emergency AD 2026-09-06 (effective May 26, 2026) forces a fleet-wide thickness map of forward-fuselage skin panels on 628 Airbus A319/A320/A321neo aircraft after Sofitec Aero found stretch-and-mill deviations. Re-framed as a 14 CFR Part 21 quality-system gap, an AS9100D supplier-flowdown failure, and the Particular Risks Analysis row ARP4761A would have expected.
Read the postThe Car Saw the Flood and Drove In Anyway: Waymo's Untraversable-Lane Recall Through an ISO 21448 Lens
Waymo recalled 3,791 robotaxis on May 12, 2026 after an unoccupied vehicle detected a flooded San Antonio roadway, slowed, and drove in anyway - ending up in Salado Creek. Re-framed as a SOTIF functional insufficiency, a missing ODD exit condition, and a behavior-policy requirement that was never gated on road-speed class.
Read the postWhen the Robot Said the Staple Line Closed: The SureForm 30 Class I Recall Through an IEC 80601-2-77 Lens
FDA classified Intuitive Surgical's 8mm SureForm 30 Gray Reload recall as Class I on May 5, 2026 after one death and four serious injuries traced to incomplete staple lines on blood vessels. The engineering story isn't the staple - it's that the robot reported a completed fire without verifying outcome. Re-framed as a missing IEC 80601-2-77 essential-performance verification, an ISO 14971 row that should have been Catastrophic, and an IEC 62304 Class C supervisor gap.
Read the postWhen the Manual Was the Exploit: The April 2026 Iranian-PLC Advisory Through an IEC 62443 and IEC 61511 Lens
CISA AA26-097A (April 7, 2026) confirms Iranian-affiliated CyberAv3ngers compromising Rockwell CompactLogix and Micro850 PLCs across U.S. water, wastewater, energy, and government sites. Re-framed as a missing IEC 62443-3-2 zone/conduit, an IEC 62443-3-3 SR-1.1/1.2 control gap, and an IEC 61511 11.2.10 SIS independence violation - with worked rows, a fault tree, and five derived requirements.
Read the postWhen the Battery Lies and the UI Freezes: The Ivenix LVP Class I Recall Through an IEC 62304 Lens
FDA classified the Fresenius Kabi Ivenix Large Volume Pump software recall as Class I in February 2026 - two anomalies (silent battery shutdown and a fail-stop UI freeze on a leading-zero input) on a Class C device. Re-framed as missing IEC 62304 unit verification, an ISO 14971 risk row that should have been Catastrophic, and an IEC 60601-1-8 alarm conformance gap.
Read the postWhen Ham Radio Crashes the Transponder: The Boeing 787 ISSPU AD Through an ARP4761 Lens
FAA AD 2026-04832 grounds 150 Boeing 787s for ISSPU replacement after CW interference quietly killed the Mode S transponder. Re-framed as a missing FHA row, a Common Mode Analysis gap, a DO-160G Section 20 test envelope hole, and five traceable derived requirements.
Read the postThree Headlines, Three Engineering Fixes: How a FuSa Lens Turns Tesla, Waymo, and Nvidia News into Solvable Problems
A walk through the Tesla NHTSA EA26002 visibility probe, Waymo's school-bus software recall, and the Nvidia Jetson Orin CVE disclosures - translated into HARA rows, fault trees, FMEA snippets, derived requirements, and TARA scenarios. Two audit-style workbooks attached.
Read the post