Airbus 380 loses engine, goes 5000 miles
Question for any A380 pilots - how much altitude would you need to lose with the loss of one engine?
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes
on
0 Posts
Rather than assuming that all software is broken, or faulty or defective, it's smarter not to wag a finger in the direction of the software but instead to ask searching questions about HOW it was engineered from end to end and to what quality standards, just as you would with a mechanical component.
There is nothing unique about software. It's an engineered product like any other and can be produced to similar quality levels.
There is nothing unique about software. It's an engineered product like any other and can be produced to similar quality levels.
I've been saying much the same thing on these forums for quite some time now. There's simply no comparison between the kind of software we use in homes and businesses - which until recently tended to be fairly free-form in design and loosely specified, and the kind of formally-specified and aggressively tested real-time software that goes into aviation use, among other safety-critical sectors.
That said, the kind of aggressive testing and integration management used in safety-critical systems from the get-go is starting to find its way into modern mainstream software development, and the take-up has been growing exponentially for the last decade or so. It's not dissimilar to how mechanical tech derived from aviation has been filtering into other uses (e.g. anti-lock braking systems on motor vehicles).
And yet in that incident the crew elected to stay in the air for an hour or two - despite their proximity to the airport - to work through the ECAM and thus discover which systems were still functioning. I recommend reading Captain De Crespigny's book on the subject - it makes for entertaining and fascinating reading.
Join Date: Feb 2005
Location: flyover country USA
Age: 82
Posts: 4,579
Likes: 0
Received 0 Likes
on
0 Posts
DozyWannabe:
They were well above max ldg weight (mass), had no flaps, and only one t/r. Had to burn off a bunch of Jet-A to have a prayer of a successful landing.
On the other hand their left wing was leaking like mad, leading to limited roll authority!
the (QF32) crew elected to stay in the air for an hour or two
On the other hand their left wing was leaking like mad, leading to limited roll authority!
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes
on
0 Posts
As the book has it, it wasn't just burning off fuel that led to the "keep flying" decision, it was taking the time to work through the ECAM actions (of which there were over a hundred) - this enabled them to be *certain* of what was working and what wasn't before they attempted a landing. Kudos to the Captain, who freely admits in his book that his instinct was to get on the ground ASAP, but that he was persuaded to keep flying by the rest of his crew and use that time to assess the aircraft's condition thoroughly.
... not withstanding accidents like swissair, my position is generally, "don't make a drama out of a crisis" i.e. if you've got a problem, don't make it a bigger one.
In my opinion the biggest problem in these kind of events is knowing exactly what your problem is - I never liked too many what ifs getting in the way of the "known facts". I think gathering information on which to make a good decision is one of the most difficult things - then there is the time available to do so.
On the QF with the problems they had they may have felt that it was a pretty sure thing that they would have gone off the end if they'd turned straight back in etc - on the other hand with fuel leaks etc ......
If they'd immediately turned back in they would have had no idea, at that stage, of the state of the aircraft and its systems and, therefore, the immediate return could have been suicidal for all sorts of reasons - don't forget we're looking at it with hindsight - in the first 10-20 minutes he had no idea what was wrong with his aircraft.
In my opinion the biggest problem in these kind of events is knowing exactly what your problem is - I never liked too many what ifs getting in the way of the "known facts". I think gathering information on which to make a good decision is one of the most difficult things - then there is the time available to do so.
On the QF with the problems they had they may have felt that it was a pretty sure thing that they would have gone off the end if they'd turned straight back in etc - on the other hand with fuel leaks etc ......
If they'd immediately turned back in they would have had no idea, at that stage, of the state of the aircraft and its systems and, therefore, the immediate return could have been suicidal for all sorts of reasons - don't forget we're looking at it with hindsight - in the first 10-20 minutes he had no idea what was wrong with his aircraft.
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes
on
0 Posts
As I said, read the book. The first thing they worked out was the fuel situation, which determined how long they could keep flying to iron out all the other potential issues.
Join Date: Jul 2000
Location: Dubai - sand land.
Age: 55
Posts: 2,832
Received 0 Likes
on
0 Posts
Originally Posted by Glofish
Quote:
Quote:
There are exceptions to the general rule...
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
Contained...
Uncontained...
DIFFERENCE maybe?????
It is actually an interesting case.
Uncontained, yes, but basically only on one side. It shows that an engine on the same side might be affected by an uncontained failure (i.e. AF Concorde) of its neighbor. Here the second engine refused to respond to the throttles. Remains to prove why the third engine, the one that did no longer respond as well but was located on the other side, was influenced by the uncontained failure. Was it software influence? Then the software glitches mentioned earlier on this thread come into play. Else why would an engine on the opposite side be influenced? Or does tdracers experience come into play?
Anyway, as i said an interesting case ........
Quote:
There are exceptions to the general rule...
I'm surprised that nobody has mentioned QF32. IIRC that little drama started out with a single (albeit uncontained) engine failure on a 380.
Contained...
Uncontained...
DIFFERENCE maybe?????
It is actually an interesting case.
Uncontained, yes, but basically only on one side. It shows that an engine on the same side might be affected by an uncontained failure (i.e. AF Concorde) of its neighbor. Here the second engine refused to respond to the throttles. Remains to prove why the third engine, the one that did no longer respond as well but was located on the other side, was influenced by the uncontained failure. Was it software influence? Then the software glitches mentioned earlier on this thread come into play. Else why would an engine on the opposite side be influenced? Or does tdracers experience come into play?
Anyway, as i said an interesting case ........
Join Date: Sep 2011
Location: earth
Posts: 1,098
Likes: 0
Received 0 Likes
on
0 Posts
WK
There is no confusion. Your analysis might be correct, but what a lot of contributors are saying, and what a lot of 4-potters keep brushing under the table, is that when an incident occurs, it might be contained for a while, seemingly under control, but it can turn into a uncontained/multiple incident in a whim.
The tendency on 4-holers to continue simply because they are allowed is what is on discussion (not their superiority to twins).
tdracer brought up some troubling facts, i brought up my admittedly controversial conclusion.
Concerning QF32, the problem was nicely handled. It could however have turned into a tragedy in a fraction of a second. The SR111 accident showed how fast an incident turns into a catastrophe. The fact that they stayed up in the air for so long is discussed, not only lauded, but they stayed close to a runway all the time, could abort the ECAM frenzy at any moment helped them.
The question remains is if they would have continued for multiple hours? No, certainly not, it looked too serious. But where to draw the line for continued operation with one incident? Where does the statistics and Murphy put the chances of an escalation, even an unrelated one like tdracer brings up, that suddenly puts you in an uncomfortable (QF) situation?
The more i read these contributions, the more i feel that a twin , even under ETOPS, represents an almost safer operation. At least we/they go down asap and by that eliminate more of Mr. Murphy and the ugly stats ........
Take this statement with a pinch of salt though!
There is no confusion. Your analysis might be correct, but what a lot of contributors are saying, and what a lot of 4-potters keep brushing under the table, is that when an incident occurs, it might be contained for a while, seemingly under control, but it can turn into a uncontained/multiple incident in a whim.
The tendency on 4-holers to continue simply because they are allowed is what is on discussion (not their superiority to twins).
tdracer brought up some troubling facts, i brought up my admittedly controversial conclusion.
Concerning QF32, the problem was nicely handled. It could however have turned into a tragedy in a fraction of a second. The SR111 accident showed how fast an incident turns into a catastrophe. The fact that they stayed up in the air for so long is discussed, not only lauded, but they stayed close to a runway all the time, could abort the ECAM frenzy at any moment helped them.
The question remains is if they would have continued for multiple hours? No, certainly not, it looked too serious. But where to draw the line for continued operation with one incident? Where does the statistics and Murphy put the chances of an escalation, even an unrelated one like tdracer brings up, that suddenly puts you in an uncomfortable (QF) situation?
The more i read these contributions, the more i feel that a twin , even under ETOPS, represents an almost safer operation. At least we/they go down asap and by that eliminate more of Mr. Murphy and the ugly stats ........
Take this statement with a pinch of salt though!
Join Date: Sep 2011
Location: earth
Posts: 1,098
Likes: 0
Received 0 Likes
on
0 Posts
GBS
please quote the whole statement!
It was based on the remark "The more i read these contributions ...."
and this includes your latest.
What about the pinch of salt? Good business sense, but none of humour it seems.
please quote the whole statement!
It was based on the remark "The more i read these contributions ...."
and this includes your latest.
What about the pinch of salt? Good business sense, but none of humour it seems.
White Knight - I don't think it's confusion in so much as predictable thread drift. The perceived wisdom (or lack there of) of continuing on after an engine out on a quad pretty much inevitably morphed into a discussion of the relative merits of a quad vs. a twin.
Back in the early days of ETOPS, there were lots of studies related to engine failures, when they happened, and when did they contribute to significant incidents or accidents. For example, it was discovered that relatively few engine failures occurred during cruise - most occurred during takeoff/initial climb, or top of descent/descent - when ETOPS wasn't a significant concern.
But - in what was probably the most controversial finding - the probability of an accident as the result of a non-common cause engine failure was greater on a quad or a tri than a twin.
The reason was pretty simple: Commercial Airliners are designed to fly just fine after the shutdown of one engine - in fact when we do system safety assessments, we consider basic engine shutdowns no worse than major (even on a twin). But, an engine can do something worse than simply quit - it can catch fire or fail uncontained - and failures of that type have caused a number of crashes over the years. The more engines on an aircraft, the greater the odds that one of those engines will fail in a catastrophic manner (I said it was controversial
).
Now I fully expect to get flamed for posting this by the "quad centric" group, but the studies were vetted by a number of experts and was eventually accepted by the Feds as the foundation of current ETOPS.
Listen, I work twins and quads (at the moment 747, 757, and 767 - in the past 737 classics and 777). They are all safe, and there are relative advantages both ways. But it's not only simplistic to state that adding engines makes an aircraft safer, its not supported by the data.
Back in the early days of ETOPS, there were lots of studies related to engine failures, when they happened, and when did they contribute to significant incidents or accidents. For example, it was discovered that relatively few engine failures occurred during cruise - most occurred during takeoff/initial climb, or top of descent/descent - when ETOPS wasn't a significant concern.
But - in what was probably the most controversial finding - the probability of an accident as the result of a non-common cause engine failure was greater on a quad or a tri than a twin.
The reason was pretty simple: Commercial Airliners are designed to fly just fine after the shutdown of one engine - in fact when we do system safety assessments, we consider basic engine shutdowns no worse than major (even on a twin). But, an engine can do something worse than simply quit - it can catch fire or fail uncontained - and failures of that type have caused a number of crashes over the years. The more engines on an aircraft, the greater the odds that one of those engines will fail in a catastrophic manner (I said it was controversial
).Now I fully expect to get flamed for posting this by the "quad centric" group, but the studies were vetted by a number of experts and was eventually accepted by the Feds as the foundation of current ETOPS.
Listen, I work twins and quads (at the moment 747, 757, and 767 - in the past 737 classics and 777). They are all safe, and there are relative advantages both ways. But it's not only simplistic to state that adding engines makes an aircraft safer, its not supported by the data.
But - in what was probably the most controversial finding - the probability of an accident as the result of a non-common cause engine failure was greater on a quad or a tri than a twin.
A "a non-common cause engine failure" implies more than one engine failing, right ?
So do you mean the relative probability of multiple engine failures on a quad vs a twin ?
Or do you mean, given multiple engine failures, the relative probability of an accident ? Nobody could possibly argue that that's higher with 2 remaining engines than with none.
Looks like we're back in compound/conditional probability territory - I'd really like to see some numbers, if anybody has some.
What about the pinch of salt?
Last edited by Good Business Sense; 21st Nov 2013 at 10:24.
A "a non-common cause engine failure" implies more than one engine failing, right ?
So do you mean the relative probability of multiple engine failures on a quad vs a twin ?
Or do you mean, given multiple engine failures, the relative probability of an accident ? Nobody could possibly argue that that's higher with 2 remaining engines than with none.
So do you mean the relative probability of multiple engine failures on a quad vs a twin ?
Or do you mean, given multiple engine failures, the relative probability of an accident ? Nobody could possibly argue that that's higher with 2 remaining engines than with none.
However, there is a small subset of engine failures that are not benign - uncontained disc failures, engine fires, etc. While we design to minimize the threat, these non-benign failures have resulted in a number of crashes over the years. What I was trying to say was, the greater the number of engines on an aircraft, the greater the risk of experiencing one of these non-benign engine failures that would result in a catastrophic outcome.
The reason I brought in 'non common cause' is that common cause failures - by definition - can affect all engines on an aircraft so it really doesn't matter how many engines you have. If the mechanic leaves the o-rings out of all the engines, your fuel load is so contaminated that the engines can't function properly, or you fly through volcanic ash and all the engines flame out, 4 vs. 2 doesn't matter much.
Join Date: Jan 2008
Location: Netherlands
Age: 46
Posts: 343
Likes: 0
Received 0 Likes
on
0 Posts
or you fly through volcanic ash and all the engines flame out, 4 vs. 2 doesn't matter much.
BA 9: British Airways Flight 9 - Wikipedia, the free encyclopedia
KLM 867: KLM Flight 867 - Wikipedia, the free encyclopedia
tdracer
Agree 
The problems generally occur during the landing phase mostly due to workload increases.
There is not much data on enroute problems with multiple engines as I have said before, but just studying the crew responses in all phases of flight leads me to suspect that twins are not any less safe then quads and quads certainly have more engine annomalies per flight
What I was trying to say was, the greater the number of engines on an aircraft, the greater the risk of experiencing one of these non-benign engine failures that would result in a catastrophic outcome.
The problems generally occur during the landing phase mostly due to workload increases.
There is not much data on enroute problems with multiple engines as I have said before, but just studying the crew responses in all phases of flight leads me to suspect that twins are not any less safe then quads and quads certainly have more engine annomalies per flight
With 4 engines there is a higher probability that you will still have an engine producing thrust. At least that is what BA and KLM found.
BA 9: British Airways Flight 9 - Wikipedia, the free encyclopedia
KLM 867: KLM Flight 867 - Wikipedia, the free encyclopedia
BA 9: British Airways Flight 9 - Wikipedia, the free encyclopedia
KLM 867: KLM Flight 867 - Wikipedia, the free encyclopedia
In both cases the flight crew was able to get engines restarted after they dropped out of the ash cloud, but make no mistake - all four engines failed. Not really a valid 2 vs. 4 data point.
tdracer
re: KLM Flight 867 and BA Flt 9
I believe only after repeated tries and a few prayers. Some speculation that the hot and cold cycles of multiple restart attempts might have shed some of the glassy stuff off the innards , but like you said not a 2 vs 4 data arguement
re: KLM Flight 867 and BA Flt 9
In both cases the flight crew was able to get engines restarted after they dropped out of the ash cloud
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes
on
0 Posts
Also re: KLM Flight 867 and BA Flt 9, and apropos of nothing - as it's not really relevant to the thread, but if I recall correctly, the damage was such that three of the four engines on the BA jet and all four on the KLM jet needed to be replaced.