Airbus 380 loses engine, goes 5000 miles
This poorly handled icing software glitch could have occurred in the ITCZ over mid-Atlantic then the story may have had a different outcome.
This is called a common mode failure. ALL aircraft with software controls that have been built on prior assumptions - even if the software is dual designed for resilience - can suffer these failures. Yes they are rare but when a software failure like this occurs ALL your software controlled super reliable engines are likely to go. Are even your engineers on telemetry to your engines aware of the wrong assumptions made by the analysts, software designers, programmers and verification testers?
This is called a common mode failure. ALL aircraft with software controls that have been built on prior assumptions - even if the software is dual designed for resilience - can suffer these failures. Yes they are rare but when a software failure like this occurs ALL your software controlled super reliable engines are likely to go. Are even your engineers on telemetry to your engines aware of the wrong assumptions made by the analysts, software designers, programmers and verification testers?
up.It is related to Ice Crystal Icing - a poorly understood phenomena that has also affected CF6, PW2000, and GE90 engines over the years.
GE is looking at addressing the GEnx issue using software, but that's just because that can be done quicker and cheaper than a hardware change. It's also far from a given that the s/w change will actually work.
Join Date: Jan 2008
Location: Netherlands
Age: 46
Posts: 343
Likes: 0
Received 0 Likes
on
0 Posts
Since 4 engine commercial jet airliners started flying in the 1960s I cannot think of one accident on a 4 engined jet airliner due to multiple engine failure resulting in insufficient thrust to remain airborne. I am not counting fuel exhaustion as those were not mechanical failures of the engine.
Hi Procede,
The thread has been about losing an engine and continuing to destination with no major issues rather than one event causing multiple failures - and nobody has come up with an example of that
The thread has been about losing an engine and continuing to destination with no major issues rather than one event causing multiple failures - and nobody has come up with an example of that
Join Date: May 2005
Location: Mars
Posts: 527
Likes: 0
Received 0 Likes
on
0 Posts
It is simple probabilities; it doesn't matter how many engines you have, the risk of losing one stays about the same but if you do lose one on a twin you have lost half your thrust and will probably have to divert whereas on a 4 only a quarter is lost and you will probably not. On a 380 losing one you still can miss all the terrain in the world by a healthy margin. The crew did exactly what any seasoned aviator would be expected to do with a single system failure and what the regulations were designed to allow for.
Using the divert argument above you could have a hundred engines and some would think you should divert when down to 99 and you know what they would be right but only if continuing would have resulted in taking a meteorite strike!
This thread confirms 2 things to me that I already knew; 1. how many people like to pretend to be experts on anonymous websites and 2. how incapable of logical thought some real pilots actually are.
To quote from a dead stick F16 pilot when told his Mayday was number 2 behind a B52 with an engine failure "yikes, that will be the dreaded 7 engine approach!"
Using the divert argument above you could have a hundred engines and some would think you should divert when down to 99 and you know what they would be right but only if continuing would have resulted in taking a meteorite strike!
This thread confirms 2 things to me that I already knew; 1. how many people like to pretend to be experts on anonymous websites and 2. how incapable of logical thought some real pilots actually are.
To quote from a dead stick F16 pilot when told his Mayday was number 2 behind a B52 with an engine failure "yikes, that will be the dreaded 7 engine approach!"
Join Date: Jan 2008
Location: United Kingdom
Posts: 274
Likes: 0
Received 0 Likes
on
0 Posts
Procede
I am aware of the El Al but did not include it as although it lost two engines the accident was not caused by insufficient thrust to remain airborne. They accelerated and raised the flaps and in the 747 when the flaps are up the outboard ailerons are locked out. The combination of damage to the lift devices on the wing and lock out of outboard ailerons led to a loss of roll control.
I agree that all 4 engines can be knocked out by something like volcanic ash. However I reiterate that no 4 engine jet airliner to my knowledge has been lost by continuing after an engine failure and having a further loss of engine power.
I am aware of the El Al but did not include it as although it lost two engines the accident was not caused by insufficient thrust to remain airborne. They accelerated and raised the flaps and in the 747 when the flaps are up the outboard ailerons are locked out. The combination of damage to the lift devices on the wing and lock out of outboard ailerons led to a loss of roll control.
I agree that all 4 engines can be knocked out by something like volcanic ash. However I reiterate that no 4 engine jet airliner to my knowledge has been lost by continuing after an engine failure and having a further loss of engine power.
I agree that all 4 engines can be knocked out by something like volcanic ash. However I reiterate that no 4 engine jet airliner to my knowledge has been lost by continuing after an engine failure and having a further loss of engine power.
Crash: Kalitta B742 at Bogota on Jul 7th 2008, engine fire, impacted a farm house
- a non-recoverable surge of engine #4 during rotation resulting in the loss of engine power, the combined effects of an inefficient high pressure turbine, excessive slack space at the tips of the blades, reduced chord and leading edges of the fan blades and the high altitude contributed to the engine failure.
- an undetermined anomaly in engine #1 which manifested itsself in engine surges and resulted in the loss of engine power. The failure to maintain proper minimum aircraft speed during climb out and the resulting use of emergency extra power exposed the anomaly leading to the engine failure.
- an undetermined anomaly in engine #1 which manifested itsself in engine surges and resulted in the loss of engine power. The failure to maintain proper minimum aircraft speed during climb out and the resulting use of emergency extra power exposed the anomaly leading to the engine failure.
I can think of a number of incidents and accidents due to multiple engine failures due to 'common cause' - usually environmental such as adverse weather, volcanic ash, and birds. While I suppose one could make a reasonable argument that more than 2 engines is an advantage with birds (less likely to get critical bird strikes on all engines), for extreme weather or volcanic ash the number of engines makes little difference. Just off the top of my head I know of at least two 747 four engine power loss events due to ash, and two 747 three engine power loss events due to extreme weather (fortunately all ended happily).
I can't think of a single twin accident due to independent power loss on both engines, yet it took me literally seconds so come up with a 4 engine accident due to independent power loss on two engines (it helped that I was involved in the investigation
)
Join Date: Jan 2008
Location: United Kingdom
Posts: 274
Likes: 0
Received 0 Likes
on
0 Posts
tdracer
Good points all well made. I was thinking more of scheduled passenger flights but the Kalitta is interesting. On a normal takeoff after an engine failure it should not be necessary to increase thrust on the remaining engines. If I remember correctly the 747/2 thrust was not governed with the Pratt and Whitney JT9 engines and if firewalled they were only guaranteed to give 5 minutes of thrust.
By maintaining a speed below V2 after lift off, raising the nose to 17 degress resulting in activation of the the stick shaker and firewalling the engines the crew doomed themselves. The second engine failure was in effect caused by the crew.
Good points all well made. I was thinking more of scheduled passenger flights but the Kalitta is interesting. On a normal takeoff after an engine failure it should not be necessary to increase thrust on the remaining engines. If I remember correctly the 747/2 thrust was not governed with the Pratt and Whitney JT9 engines and if firewalled they were only guaranteed to give 5 minutes of thrust.
By maintaining a speed below V2 after lift off, raising the nose to 17 degress resulting in activation of the the stick shaker and firewalling the engines the crew doomed themselves. The second engine failure was in effect caused by the crew.
I don't see the value of arguing between two vs four when considering the subject event (neither an incident nor an accident in my book).
The consideration is mostly the risk of anything else going wrong either dependently or independently and its probable effect on the flight.
It seems that almost all of us focus solely on the remaining engines and their probability of failure. Although I've not seen any comments assessing the impact on a 5 hr flight should a second engine fail on a quad.
I'm not prepared to take sides in what-if arguments of this kind since all the data I've seen regarding independent failures in cruise says that at worst it's an extremely small contributor to overall in-flight risk for all fleets.
The consideration is mostly the risk of anything else going wrong either dependently or independently and its probable effect on the flight.
It seems that almost all of us focus solely on the remaining engines and their probability of failure. Although I've not seen any comments assessing the impact on a 5 hr flight should a second engine fail on a quad.
I'm not prepared to take sides in what-if arguments of this kind since all the data I've seen regarding independent failures in cruise says that at worst it's an extremely small contributor to overall in-flight risk for all fleets.
Join Date: Sep 2002
Location: ex-DXB
Posts: 927
Likes: 0
Received 0 Likes
on
0 Posts
The A380 is fantastic at this sort of minor problem.
I trust you all have heard EK's aircraft order from this afternoon..?
50 more 380's ordered so a total of 101 on order with 39 already in service.
(+ 150 777 X's)
I trust you all have heard EK's aircraft order from this afternoon..?
50 more 380's ordered so a total of 101 on order with 39 already in service.
(+ 150 777 X's)
Join Date: Feb 2006
Location: United States
Posts: 216
Likes: 0
Received 0 Likes
on
0 Posts
It seems that almost all of us focus solely on the remaining engines and
their probability of failure. Although I've not seen any comments assessing the impact on a 5 hr flight should a second engine fail on a quad.
In FAA land the second engine failure in a quad is addressed by FAR 121.193, compliance with which is a part of preflight planning.
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
I'm right in the middle of that program, and I can absolutely guarantee that event had absolutely nothing to do with software - glitch or otherwise. You're basically just making up.
It is related to Ice Crystal Icing - a poorly understood phenomena that has also affected CF6, PW2000, and GE90 engines over the years.
GE is looking at addressing the GEnx issue using software, but that's just because that can be done quicker and cheaper than a hardware change. It's also far from a given that the s/w change will actually work.
up.It is related to Ice Crystal Icing - a poorly understood phenomena that has also affected CF6, PW2000, and GE90 engines over the years.
GE is looking at addressing the GEnx issue using software, but that's just because that can be done quicker and cheaper than a hardware change. It's also far from a given that the s/w change will actually work.
"Boeing says the flight test effort is focused on “verifying operational elements” of a change to the engine control software. The testing included monitoring the development of ice crystals on the GEnx-2Bs powering RC021, one of the company’s test airframes that has recently been used to evaluate fuel system upgrades and other performance improvements. The fully-instrumented aircraft was originally designated for 747-8I launch customer Lufthansa, but was retained as a test asset after the German carrier opted not to take the modified airframe.The software changes to the GEnx-2B full authority digital engine control unit are designed to help the engine itself detect the presence of ice crystals when the aircraft is flying through a convective weather system. If detected, the new algorithms will schedule variable bleed valves to open and eject ice crystals that may have built up in the area aft of the fan, or in the flowpath to the core. The modification to the GEnx control logic leverages similar changes made to improve the ability of the CF6 to operate in similar icing conditions."
Boeing, GE Test Upgrades To Counter Engine Icing
And to return to my original point if there is an error in that 'new' software (like an incorrect assumption on the effects of icing (e.g, whether liquid water can be found at -40C above FL400 - it can) and therefore what changes are required in the engine; then the engines' software could all make the same incorrect decision on icing. I am not saying that they will I am saying that they could, there is no such thing as error free software or error free design (unless of course you have 'fixed the last bug' ) The software design/code itself becomes the common mode failure point and the number of engines is immaterial.
Ian, where exactly in that Av Week did you see reference to a s/w 'glitch', as I again quote your post:
A software "glitch" is when the software does not function as intended. The GEnx software in this event worked exactly as intended.
Since you obviously didn't read my response, I'll repeat it:
The problem is Ice Crystal Icing (ICI) - which is fundamentally a hardware problem. ICI can cause ice to form internal to the engine core, in areas where it's normally too hot for ice to form. When this ice sheds, it can damage blades and/or quench the burner. GE is trying to address the ICI problem using software changes, because if they have to change the hardware it'll be hugely expensive and take a long time. They may or may not be successful with this approach.
This poorly handled icing software glitch could have occurred in the ITCZ over mid-Atlantic then the story may have had a different outcome.
Since you obviously didn't read my response, I'll repeat it:
The problem is Ice Crystal Icing (ICI) - which is fundamentally a hardware problem. ICI can cause ice to form internal to the engine core, in areas where it's normally too hot for ice to form. When this ice sheds, it can damage blades and/or quench the burner. GE is trying to address the ICI problem using software changes, because if they have to change the hardware it'll be hugely expensive and take a long time. They may or may not be successful with this approach.
Join Date: Sep 2007
Location: UK
Posts: 11
Likes: 0
Received 0 Likes
on
0 Posts
Error free software
I'll bite on this though I tend to keep quiet, but my background in safety critical systems and formal proof of correctness of software gives me a certain amount of practical experience.
The software industry is a strange place. Much commercial software is of appalling quality and really is a disgrace to the profession. If anything tangible, say buildings or mechanical things were built so atrociously, it would be plain to any observer what a festering lash-up was being presented.
However, just because a lot of software is of lamentable quality does not imply that, therefore, all software is equally bad.
The software industry arguably seriously dates back to the late 1950s (I would personally pick the introduction of Algol 60 as a watermark but you can argue with that; its genesis dates it to the middle 50s).
In academic areas the skills and techniques necessary to produce software that is equally as well engineered as any counterpart in the civil, aeronautical or electronic engineering domains were vigorously pursued from around that time.
There is NO magic whatsoever in producing software to any arbitrary quality level you choose. The methods and techniques are 'well known', i.e. more than one person exists who understands them (sorry, academic joke in that last clause). As in any field of engineering, however, quality comes at a cost.
If you are prepared to pay the cost you can get the quality, just as in any field. Because software of such quality is rarely required outside of safety critical systems, the practitioners are not found on every street corner but you can find them and train them and implement the end-to-end quality and traceability that would be expected in other fields.
When that is done you are no more likely to get bad software than you are to get a defective compressor blade or contaminated fuel. And it so happens that the investment in quality has the unusual characteristic that the software can be endlessly duplicated at no cost (apart from audit and trace), unlike mechanical components where the cost is not only in the design but also the duplication.
Rather than assuming that all software is broken, or faulty or defective, it's smarter not to wag a finger in the direction of the software but instead to ask searching questions about HOW it was engineered from end to end and to what quality standards, just as you would with a mechanical component.
There is nothing unique about software. It's an engineered product like any other and can be produced to similar quality levels.
The software industry is a strange place. Much commercial software is of appalling quality and really is a disgrace to the profession. If anything tangible, say buildings or mechanical things were built so atrociously, it would be plain to any observer what a festering lash-up was being presented.
However, just because a lot of software is of lamentable quality does not imply that, therefore, all software is equally bad.
The software industry arguably seriously dates back to the late 1950s (I would personally pick the introduction of Algol 60 as a watermark but you can argue with that; its genesis dates it to the middle 50s).
In academic areas the skills and techniques necessary to produce software that is equally as well engineered as any counterpart in the civil, aeronautical or electronic engineering domains were vigorously pursued from around that time.
There is NO magic whatsoever in producing software to any arbitrary quality level you choose. The methods and techniques are 'well known', i.e. more than one person exists who understands them (sorry, academic joke in that last clause). As in any field of engineering, however, quality comes at a cost.
If you are prepared to pay the cost you can get the quality, just as in any field. Because software of such quality is rarely required outside of safety critical systems, the practitioners are not found on every street corner but you can find them and train them and implement the end-to-end quality and traceability that would be expected in other fields.
When that is done you are no more likely to get bad software than you are to get a defective compressor blade or contaminated fuel. And it so happens that the investment in quality has the unusual characteristic that the software can be endlessly duplicated at no cost (apart from audit and trace), unlike mechanical components where the cost is not only in the design but also the duplication.
Rather than assuming that all software is broken, or faulty or defective, it's smarter not to wag a finger in the direction of the software but instead to ask searching questions about HOW it was engineered from end to end and to what quality standards, just as you would with a mechanical component.
There is nothing unique about software. It's an engineered product like any other and can be produced to similar quality levels.
Join Date: Sep 2011
Location: earth
Posts: 1,098
Likes: 0
Received 0 Likes
on
0 Posts
I can't think of a single twin accident due to independent power loss on both engines, yet it took me literally seconds so come up with a 4 engine accident due to independent power loss on two engines (it helped that I was involved in the investigation )
You are able to sustain with experience what i tried to bring up concerning this incident.
It is certainly possible and can even make sense to continue with a 4-pod after loss of one. I simply wanted to point out that the risk involved might be higher than a lot of fellow pros insinuate on this pages. So extended continuation should maybe be considered more conservatively.
Lomeopaso stated rightfully that is is NOT a matter of comparison 2 vs 4 engines. A twin is on emergency when losing one, a 4-pot is in an abnormal situation and not in that presumed cosy "continue" situation. Your quote underlines that.
One additional word to the mentioned monitoring and advising by the Tech departments while on abnormal situations or with tech troubles: Every advise we get on ACARS today has a nice footer with a disclaimer about responsibility. This leaves me with some mixed feelings about remote advise, not to say control .....
Up there we are still alone in matter of decision making. Many companies like to pretend that they only advise us, but in effect many of them apply more pressure than help. But when the s#!t hits the fan they leave us out in the rain.
tdracers comment should make some of us reconsider. A 4-holer is a more comfortable aircraft to operate than a twin. But even a 4-holer gets into a abnormal situation when it loses one pot.
Join Date: Aug 2013
Location: Land of 1,000 Dances
Age: 63
Posts: 68
Likes: 0
Received 0 Likes
on
0 Posts
There are exceptions to the general rule...
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
HighandFlighty
Once again the thread is about shutting one down on a four engine and continuing on enroute with three and then having a further problem leading to an incident/accident - QF32 quite different
Once again the thread is about shutting one down on a four engine and continuing on enroute with three and then having a further problem leading to an incident/accident - QF32 quite different
Join Date: Jul 2000
Location: Dubai - sand land.
Age: 55
Posts: 2,832
Received 0 Likes
on
0 Posts
Originally Posted by HighAndFlighty
There are exceptions to the general rule...
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
Uncontained...
DIFFERENCE maybe?????
tdracers comment should make some of us reconsider. A 4-holer is a more comfortable aircraft to operate than a twin. But even a 4-holer gets into a abnormal situation when it loses one pot.
but the deciding difference to me is that when a twin loses 1 the response is direct against an SOP
when a quad loses one, more involved consideration is needed and the variety of actions is greater.
I still have no opinions in this incidence but maintain that our armchair judgements bear no significance other than what-ifs
Join Date: Sep 2011
Location: earth
Posts: 1,098
Likes: 0
Received 0 Likes
on
0 Posts
There are exceptions to the general rule...
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
Uncontained...
DIFFERENCE maybe?????
It is actually an interesting case.
Uncontained, yes, but basically only on one side. It shows that an engine on the same side might be affected by an uncontained failure (i.e. AF Concorde) of its neighbor. Here the second engine refused to respond to the throttles. Remains to prove why the third engine, the one that did no longer respond as well but was located on the other side, was influenced by the uncontained failure. Was it software influence? Then the software glitches mentioned earlier on this thread come into play. Else why would an engine on the opposite side be influenced? Or does tdracers experience come into play?
Anyway, as i said an interesting case ........
Join Date: Jan 2006
Location: US
Posts: 2,205
Likes: 0
Received 0 Likes
on
0 Posts
Question for any A380 pilots - how much altitude would you need to lose with the loss of one engine?
Off the top of my head I'd say a twin has to descend 10-15,000'. Engine out can be in the high teens or low-mid 20's for the weights I've checked.
Off the top of my head I'd say a twin has to descend 10-15,000'. Engine out can be in the high teens or low-mid 20's for the weights I've checked.
Last edited by misd-agin; 20th Nov 2013 at 12:45. Reason: spellling