reverser unlocked 767
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Did I read it correctly? Or like the old story of the Fox guarding the Chicken house.
To: Flight Safety
In other words the probability of reoccurrence on a 767 is still there.
The FAA is saying that the probability of occurrence on aircraft designed to the latest specification is 10e7 at the highest level of probability to 10e9 at the lowest probability and when it does occur the situation will be controllable.
These figures can only be proved by the manipulation of numbers that may or may not be representative of the actual design. Basically, what the FAA is saying is “Tell us a lie and we will believe you providing you can show us where you got your numbers”.
In real life the only document relative to safety and by definition reliability is the Safety Hazard Analyses. They never see the FMECA or the reliability analyses unless they come to the manufacturer and request to see these documents. I have been doing this type of work since 1968 and I have never seen the FAA request to see the documents.
In one case that I am very familiar with is when the FAA was notified of design flaws on a commercial aircraft and when they finally investigated the problem two people were fired but the FAA never required a design change and neither did the CAA, LBA and the DGCA.
In other words the probability of reoccurrence on a 767 is still there.
The FAA is saying that the probability of occurrence on aircraft designed to the latest specification is 10e7 at the highest level of probability to 10e9 at the lowest probability and when it does occur the situation will be controllable.
These figures can only be proved by the manipulation of numbers that may or may not be representative of the actual design. Basically, what the FAA is saying is “Tell us a lie and we will believe you providing you can show us where you got your numbers”.
In real life the only document relative to safety and by definition reliability is the Safety Hazard Analyses. They never see the FMECA or the reliability analyses unless they come to the manufacturer and request to see these documents. I have been doing this type of work since 1968 and I have never seen the FAA request to see the documents.
In one case that I am very familiar with is when the FAA was notified of design flaws on a commercial aircraft and when they finally investigated the problem two people were fired but the FAA never required a design change and neither did the CAA, LBA and the DGCA.
Join Date: Jan 2001
Location: Dallas, TX USA
Posts: 739
Likes: 0
Received 0 Likes
on
0 Posts
Lu, in other words, we're stuck with the following 2 "fixes" to prevent a reoccurrence:
1. Redesign the current reverser system to minimize the possiblity of a full reverser deployment.
2. Train the flight crew for the near instant responses that are required to save the aircraft, because of it's poorer aerodynamic performance when a reverser does deploy.
Both of these have been done, but without any aerodynamic fixes, this is not a full solution.
Lomapaseo, the current Regs DO require that any new aircraft with high by-pass turbofans be controllable with a full reverser deployment. You could be right about the actual outcome of such an event, but at least the current Regs contain the correct requirements.
1. Redesign the current reverser system to minimize the possiblity of a full reverser deployment.
2. Train the flight crew for the near instant responses that are required to save the aircraft, because of it's poorer aerodynamic performance when a reverser does deploy.
Both of these have been done, but without any aerodynamic fixes, this is not a full solution.
Lomapaseo, the current Regs DO require that any new aircraft with high by-pass turbofans be controllable with a full reverser deployment. You could be right about the actual outcome of such an event, but at least the current Regs contain the correct requirements.
Join Date: Sep 2000
Location: England
Posts: 303
Likes: 0
Received 0 Likes
on
0 Posts
assym reverse and ETOPS
Impact on ETOPS 207 minute worst case scenario if the second "high drag" case was to occur at the wrong time?
The reverser can be restored to the forward thrust position; or
The airplane is capable of continued safe flight and landing under any possible position of the thrust reverser.
Questions:
1. Is depressn fuel usage rate still the worst case range-wise or would it just depend upon the degree of reverser deployment?
2. Is there any 767 or 777 SOP for shutting down the offending engine in the hope of achieving a better SFC?
The reverser can be restored to the forward thrust position; or
The airplane is capable of continued safe flight and landing under any possible position of the thrust reverser.
Questions:
1. Is depressn fuel usage rate still the worst case range-wise or would it just depend upon the degree of reverser deployment?
2. Is there any 767 or 777 SOP for shutting down the offending engine in the hope of achieving a better SFC?
Registered User
Join Date: Jul 2004
Location: Brasil
Posts: 4
Likes: 0
Received 0 Likes
on
0 Posts
Recall Items
I am totally sure that reverser unlocked should be done as recall items as eng fire is.
Otherwise with full thrust and heavy you will gona crash specially in high elevations airports eg:Bogota.
Goog Flights
Victor Lemmi
FO B767
Varig Airlines
Otherwise with full thrust and heavy you will gona crash specially in high elevations airports eg:Bogota.
Goog Flights
Victor Lemmi
FO B767
Varig Airlines
Lu Zuckerman,
As always, it is always a lot easier to understand design weaknesses and failings after an accident has revealed the actual failure modes. As you are very well aware, it takes very well trained, experienced and talented folks to uncover every failure mode possible in a complex system prior to certification and entry to service.
But, normally we would expect the manufacturer to uncover any weaknesses in his design during the certification analysis and flight test period (rather than the “flight test” occur on airline revenue service). I guess the amount of the manufacturer’s analysis and test resources that are attributed to any aspect of the design depend on the criticality of the system and the likelihood of failure and the danger posed by performing flight test. This in turn relies very heavily on the historic experience of the design and test teams as well as being guidance provided by certification requirements.
The accident clearly demonstrated that the design and the certification process was fatally flawed in this case.
BTW, according to the accident report, Boeing did conduct flight test (somewhat limited) and analysis on the reverser deployed in flight on the B767 (see accident report extract below:
http://www.rvs.uni-bielefeld.de/publ...daRPT.html#2.4
In starting this thread, Kichwa tembo poses the question as to why the Reverser Deployed in Flight is not a checklist memory item. Only Boeing could provide the definitive answer, but the following extract of the accident report may have some hints as to why.
http://www.rvs.uni-bielefeld.de/publ...daRPT.html#2.4
In essence it says:
1. A reverser deployed in flight and was not and probably could not be restowed.
2. The aircraft was not controllable with a reverser deployed without extraordinary control action (not guaranteed by the average line pilot).
3. Inadequate design and certification by Boeing and FAA.
This gave Boeing very little room to move. That is, only by making in-flight reverser impossible, would the B767 be able to continue in airline service.
Therefore, if in-flight reverser deployment was made impossible, there would obviously be no need for a checklist memory item.
(Edited to fix the report links)
As always, it is always a lot easier to understand design weaknesses and failings after an accident has revealed the actual failure modes. As you are very well aware, it takes very well trained, experienced and talented folks to uncover every failure mode possible in a complex system prior to certification and entry to service.
But, normally we would expect the manufacturer to uncover any weaknesses in his design during the certification analysis and flight test period (rather than the “flight test” occur on airline revenue service). I guess the amount of the manufacturer’s analysis and test resources that are attributed to any aspect of the design depend on the criticality of the system and the likelihood of failure and the danger posed by performing flight test. This in turn relies very heavily on the historic experience of the design and test teams as well as being guidance provided by certification requirements.
The accident clearly demonstrated that the design and the certification process was fatally flawed in this case.
BTW, according to the accident report, Boeing did conduct flight test (somewhat limited) and analysis on the reverser deployed in flight on the B767 (see accident report extract below:
http://www.rvs.uni-bielefeld.de/publ...daRPT.html#2.4
The original engine installed on the B767 was the Pratt and Whitney JT9D-7R4. In-flight thrust reverser controllability tests and analysis performed on this airplane were applied to later B767 engine installations such as the PW4000, based upon similarities in thrust reverser, and engine characteristics. The original flight test on the B767 with the JT9D-7R4 involved a deployment with the engine at idle power, and at an airspeed of approximately 200 KIAS, followed by a general assessment of overall airplane controllability during a cruise approach and full stop landing. In compliance with FAR 25.933(a)(2), Boeing demonstrated, at 10,000 feet and 220 KIAS, control of the airplane in cruise flight. The engine remained in idle reverse thrust for the approach and landing as agreed to by the FAA. Controllability at other portions of the flight envelope was substantiated by an analysis prepared by the manufacturer and accepted by the FAA.
http://www.rvs.uni-bielefeld.de/publ...daRPT.html#2.4
The circumstance of this accident, however, bring into question the adequacy or interpretation of the FAA requirements and the demonstration/analyses that were required. This accident indicates that changes in certification philosophy are necessary. The left engine thrust reverser was not restored to the forward thrust position prior to impact and accident scene evidence is inconclusive that it could have been restowed. Based on the simulation of this event, the airplane was not capable of controlled flight if full wheel and full rudder were not applied within 4 to 6 seconds after the thrust reverser deployed. The consideration given to high-speed in-flight thrust reverser deployment during design and certification was not verified by flight or wind tunnel testing and appears to be inadequate.
1. A reverser deployed in flight and was not and probably could not be restowed.
2. The aircraft was not controllable with a reverser deployed without extraordinary control action (not guaranteed by the average line pilot).
3. Inadequate design and certification by Boeing and FAA.
This gave Boeing very little room to move. That is, only by making in-flight reverser impossible, would the B767 be able to continue in airline service.
Therefore, if in-flight reverser deployment was made impossible, there would obviously be no need for a checklist memory item.
(Edited to fix the report links)
Last edited by FlexibleResponse; 26th Jul 2004 at 06:57.
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
10e9 is a myth perpertrated on the airline industry.
To: FlexibleResponse
It is my understanding that the very nature of the failure that caused the in-flight deployment of the thrust reverser precluded the ability of the pilot to restore the reverser to the stowed position.
The thrust reverser controls were in the in-flight position and there were two levels of protection that had to fail in order for the reverser to deploy. The internal failure bypassed these two protective elements causing the deployment.
I completely agree with your conclusions that the FMECA of the thrust reverser actuator should have been analyzed in such a way that all possible failure modes would be eliminated. In this case they were not and this type of failure is basic to all hydraulic systems and should have been considered.
As far as Boeings responsibility they accepted the analyses of the thrust reverser actuator manufacturer and simply plugged their failure predictions into their math model for predicting operational safety.
A similar situation is that of the B-737 fatal fire at Manchester, England. P&W in their analyses of the engine indicated that the combustor can would never explode so Boeing never built in any protection for shrapnel containment on the underside of the wing.
No aircraft manufacturer has the personnel nor the time to second-guess their suppliers and as such they accept whatever documentation is supplied by those suppliers. The only thing they can do is tighten the specs governing the design of supplied components.
It is my understanding that the very nature of the failure that caused the in-flight deployment of the thrust reverser precluded the ability of the pilot to restore the reverser to the stowed position.
The thrust reverser controls were in the in-flight position and there were two levels of protection that had to fail in order for the reverser to deploy. The internal failure bypassed these two protective elements causing the deployment.
I completely agree with your conclusions that the FMECA of the thrust reverser actuator should have been analyzed in such a way that all possible failure modes would be eliminated. In this case they were not and this type of failure is basic to all hydraulic systems and should have been considered.
As far as Boeings responsibility they accepted the analyses of the thrust reverser actuator manufacturer and simply plugged their failure predictions into their math model for predicting operational safety.
A similar situation is that of the B-737 fatal fire at Manchester, England. P&W in their analyses of the engine indicated that the combustor can would never explode so Boeing never built in any protection for shrapnel containment on the underside of the wing.
No aircraft manufacturer has the personnel nor the time to second-guess their suppliers and as such they accept whatever documentation is supplied by those suppliers. The only thing they can do is tighten the specs governing the design of supplied components.
I completely agree with your conclusions that the FMECA of the thrust reverser actuator should have been analyzed in such a way that all possible failure modes would be eliminated. In this case they were not and this type of failure is basic to all hydraulic systems and should have been considered.
As far as Boeings responsibility they accepted the analyses of the thrust reverser actuator manufacturer and simply plugged their failure predictions into their math model for predicting operational safety.
A similar situation is that of the B-737 fatal fire at Manchester, England. P&W in their analyses of the engine indicated that the combustor can would never explode so Boeing never built in any protection for shrapnel containment on the underside of the wing.
As far as Boeings responsibility they accepted the analyses of the thrust reverser actuator manufacturer and simply plugged their failure predictions into their math model for predicting operational safety.
A similar situation is that of the B-737 fatal fire at Manchester, England. P&W in their analyses of the engine indicated that the combustor can would never explode so Boeing never built in any protection for shrapnel containment on the underside of the wing.
You are badly misinformed yet again regarding your comment about P&W using an analysis to indicate that the combustor can would never explode.
The in-service data preceeding the accident speaks for itself and several similar cans had exploded and were ejected harmlessly onto the runway.
While your post objectives may be noble you diminish your credibility to preach your proffession when you manufacture or abscribe erroneous supporting facts.
Guest
Posts: n/a
RatherBe flying. The 737-200 in Canada that you referred to had just touched down and reverse had been selected. Then the crew spotted the snow plough, cancelled reverse real quick and went around. If I recall correctly, the pilot heaved back on the stick to clear the snow plough but one of the reversers was not quite fully closed when the gear oleo's extended as part of the rotation. That disconnected the hydraulics to the reverse system. As you said, the pilots thumb was broken when the throttle came back to idle with the reverse operation.
The aircraft then crashed with one engine at full thrust and the other at idle reverse. I don't know if it was a controlled crash and how many got hurt. I think it was after that accident that Boeing got sued for having the word Caution - rather than the word Warning, in their Ops manual when discussing that you must not execute a GA once the reverses have been selected after touch down. Caution meaning that you might bust something and Warning meaning you might get hurt.
The aircraft then crashed with one engine at full thrust and the other at idle reverse. I don't know if it was a controlled crash and how many got hurt. I think it was after that accident that Boeing got sued for having the word Caution - rather than the word Warning, in their Ops manual when discussing that you must not execute a GA once the reverses have been selected after touch down. Caution meaning that you might bust something and Warning meaning you might get hurt.
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
Yeah but....
To: lomapaseo
P&W performed a thermal stress analysis, a thermal creep analysis and several other types of analyses concerning deformation and elongation of the combustor can. Based on these analyses it was determined that the combustor can had a reliability of 1 10e9. Obviously from what you have indicated there were several other explosions of the combustor can and therefore the combustor can did not meet the predicted reliability of 1 10e9. My question is what did the FAA do regarding the inability to meet the predicted level since this is what Boeing relied on in the design of the under wing surface.
If this is the case the nacelle had to be torn apart for the combustor can to fall harmlessly onto the runway. Also with an uncontained explosion there had to be a fire. So while the remnants of the combustor can were laying on the runway what was happening to the aircraft?
You are badly misinformed yet again regarding your comment about P&W using an analysis to indicate that the combustor can would never explode
The in-service data preceeding the accident speaks for itself and several similar cans had exploded and were ejected harmlessly onto the runway.
P&W performed a thermal stress analysis, a thermal creep analysis and several other types of analyses concerning deformation and elongation of the combustor can. Based on these analyses it was determined that the combustor can had a reliability of 1 10e9 . Obviously from what you have indicated there were several other explosions of the combustor can and therefore the combustor can did not meet the predicted reliability of 1 10e9. My question is what did the FAA do regarding the inability to meet the predicted level since this is what Boeing relied on in the design of the under wing surface.
There was no analysis performed, nor requested/required, to show anything would meet a E-9 reliability. Its ludicrous to expect a structural part to show such a reliability in a hot section of an engine.
The FAA does not pretend that such a reliability can be met and Boeing must presume under FAR 25.903D1 that any part of the engine may be ejected from the engine towards their aircraft.
If this is the case the nacelle had to be torn apart for the combustor can to fall harmlessly onto the runway. Also with an uncontained explosion there had to be a fire. So while the remnants of the combustor can were laying on the runway what was happening to the aircraft?
There was no analysis performed, nor requested/required, to show anything would meet a E-9 reliability. Its ludicrous to expect a structural part to show such a reliability in a hot section of an engine.
The FAA does not pretend that such a reliability can be met and Boeing must presume under FAR 25.903D1 that any part of the engine may be ejected from the engine towards their aircraft.
If this is the case the nacelle had to be torn apart for the combustor can to fall harmlessly onto the runway. Also with an uncontained explosion there had to be a fire. So while the remnants of the combustor can were laying on the runway what was happening to the aircraft?
In short there is no requirement to perform a system safety analysis on a structural element and in the case of engine elements the FARs require the presumption that any such element will eventually fail and that the aircraft design need take some degree (not total) of mitigation.
Last edited by lomapaseo; 27th Jul 2004 at 22:07.
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
It depends on your point of view.
To: lomapaseo
The first part of the quote is correct. There is no established reliability goal for structures. Structures based on all of the testing are assumed to have a reliability of 1 and are therefore not included in the reliability and safety equation. On the other hand the airframe manufacturer establishes the reliability requirement for the engine and the engine manufacturer will perform a reliability calculation using known or generic failure rates to establish the reliability to meet the airframe manufacturers requirements. Then again the engine manufacturer must also comply with FAR AC 25-1309-1A which states the probability of a given occurrence. In this case an uncontained explosion that could result in loss of the aircraft or fatalities which is labeled catastrophic. The probability of occurrence is 1 10e9. Granted as you have indicated there were several occurrences of the combustor can exploding with no fatalities but the Manchester accident proves that it can result in fatalities.
So the engine manufacturer had to assume that it could happen so they performed the analyses to prove (at least on paper) that it had a probability of occurrence of 1 10e9.
A similar case occurred on the Sioux City DC-10. GE performed all types of analyses and tests and concluded that the fan disc would never fail under normal operating conditions. Quality control failed to detect grains of sand in the casting, which resulted in a stress riser. 1 10e9 is a myth and can never be achieved yet the FAA and all the other certification authorities claim that this level of safety can be achieved. I worked on one program where the safety analysts concluded that the probability of catastrophic failure on a primary flight control system was 1 10e18.
I worked on another program where the DGCA established system failures that were catastrophic. On most of the systems in the secondary flight controls there were as many as 60-70 different elements that if they failed could result in catastrophic failure. In order to realize the top system probability of 1 10e9 we had to create failure rates for mechanical components that were in excess of 1 10e12 and as high as 1 10e16 and the DGCA accepted our findings without asking us how we derived the failure rates. The FAA eventually certified this aircraft and accepted all of the numbers that were used in the safety calculations.
In short there is no requirement to perform a system safety analysis on a structural element and in the case of engine elements the FARs require the presumption that any such element will eventually fail and that the aircraft design need take some degree (not total) of mitigation.
The first part of the quote is correct. There is no established reliability goal for structures. Structures based on all of the testing are assumed to have a reliability of 1 and are therefore not included in the reliability and safety equation. On the other hand the airframe manufacturer establishes the reliability requirement for the engine and the engine manufacturer will perform a reliability calculation using known or generic failure rates to establish the reliability to meet the airframe manufacturers requirements. Then again the engine manufacturer must also comply with FAR AC 25-1309-1A which states the probability of a given occurrence. In this case an uncontained explosion that could result in loss of the aircraft or fatalities which is labeled catastrophic. The probability of occurrence is 1 10e9. Granted as you have indicated there were several occurrences of the combustor can exploding with no fatalities but the Manchester accident proves that it can result in fatalities.
So the engine manufacturer had to assume that it could happen so they performed the analyses to prove (at least on paper) that it had a probability of occurrence of 1 10e9.
A similar case occurred on the Sioux City DC-10. GE performed all types of analyses and tests and concluded that the fan disc would never fail under normal operating conditions. Quality control failed to detect grains of sand in the casting, which resulted in a stress riser. 1 10e9 is a myth and can never be achieved yet the FAA and all the other certification authorities claim that this level of safety can be achieved. I worked on one program where the safety analysts concluded that the probability of catastrophic failure on a primary flight control system was 1 10e18.
I worked on another program where the DGCA established system failures that were catastrophic. On most of the systems in the secondary flight controls there were as many as 60-70 different elements that if they failed could result in catastrophic failure. In order to realize the top system probability of 1 10e9 we had to create failure rates for mechanical components that were in excess of 1 10e12 and as high as 1 10e16 and the DGCA accepted our findings without asking us how we derived the failure rates. The FAA eventually certified this aircraft and accepted all of the numbers that were used in the safety calculations.
Join Date: Feb 2003
Location: Zanzi's Bar
Age: 59
Posts: 233
Likes: 0
Received 0 Likes
on
0 Posts
R deployed at ZRH
Guys,
We train at Cranebank.
It’s a B763 wit RR engines. No FADEC at sim.
Ours r B762 wit GE 56500 kg. No FADEC, old models.
At ZRH 16 MTOW (climb restricted), 30 deg, QNH 1003
Escape path KLO 2.5 miles LT to ZUE
L REV deployed 10 sec after lift-off.
If engine is not shutdown within 10 sec - mandatory crash.
Training dept accepts but does not officially sanction PNF shutting down engine by "Fuel Control Switch - Cutoff" action from memory.
Don’t bother to close thrust lever as long as you shut down the bad engine...
Even wit engine shutdown U can barely make it through the valley wit GPWS screaming abuse!
We train at Cranebank.
It’s a B763 wit RR engines. No FADEC at sim.
Ours r B762 wit GE 56500 kg. No FADEC, old models.
At ZRH 16 MTOW (climb restricted), 30 deg, QNH 1003
Escape path KLO 2.5 miles LT to ZUE
L REV deployed 10 sec after lift-off.
If engine is not shutdown within 10 sec - mandatory crash.
Training dept accepts but does not officially sanction PNF shutting down engine by "Fuel Control Switch - Cutoff" action from memory.
Don’t bother to close thrust lever as long as you shut down the bad engine...
Even wit engine shutdown U can barely make it through the valley wit GPWS screaming abuse!
Last edited by swish266; 27th Jul 2004 at 19:30.
. On the other hand the airframe manufacturer establishes the reliability requirement for the engine and the engine manufacturer will perform a reliability calculation using known or generic failure rates to establish the reliability to meet the airframe manufacturers requirements.
The engine manufacturer is under no statuatory obligation to provide such data during an aircraft certification and indeed does not provide it officialy. the aircraft manufacturere has however on his own, collected such data on past engine models and used it to show compliance to his regulatory agency.
Then again the engine manufacturer must also comply with FAR AC 25-1309-1A which states the probability of a given occurrence. In this case an uncontained explosion that could result in loss of the aircraft or fatalities which is labeled catastrophic.
Again you are mistaken, there is no requirement nor means by which the engine manufacturere need comply with 25.1309, In fact the engine manufacturer need only show compliance with FAR 33.75 which does not require any analysis against uncontained engine failures
The probability of occurrence is 1 10e9. Granted as you have indicated there were several occurrences of the combustor can exploding with no fatalities but the Manchester accident proves that it can result in fatalities.
So the engine manufacturer had to assume that it could happen so they performed the analyses to prove (at least on paper) that it had a probability of occurrence of 1 10e9.
Wrong for the same reasons cited above
A similar case occurred on the Sioux City DC-10. GE performed all types of analyses and tests and concluded that the fan disc would never fail under normal operating conditions. Quality control failed to detect grains of sand in the casting, which resulted in a stress riser. 1 10e9 is a myth and can never be achieved yet the FAA and all the other certification authorities claim that this level of safety can be achieved.
Yet again you are mistaken. No such analysis was performed by GE prior to Sioux City although they may have offered an uncorroborated opinion that they could not forsee such a failure
I worked on one program where the safety analysts concluded that the probability of catastrophic failure on a primary flight control system was 1 10e18.
I worked on another program where the DGCA established system failures that were catastrophic. On most of the systems in the secondary flight controls there were as many as 60-70 different elements that if they failed could result in catastrophic failure. In order to realize the top system probability of 1 10e9 we had to create failure rates for mechanical components that were in excess of 1 10e12 and as high as 1 10e16 and the DGCA accepted our findings without asking us how we derived the failure rates. The FAA eventually certified this aircraft and accepted all of the numbers that were used in the safety calculations.
garbage in = garbage out
The engine manufacturer is under no statuatory obligation to provide such data during an aircraft certification and indeed does not provide it officialy. the aircraft manufacturere has however on his own, collected such data on past engine models and used it to show compliance to his regulatory agency.
Then again the engine manufacturer must also comply with FAR AC 25-1309-1A which states the probability of a given occurrence. In this case an uncontained explosion that could result in loss of the aircraft or fatalities which is labeled catastrophic.
Again you are mistaken, there is no requirement nor means by which the engine manufacturere need comply with 25.1309, In fact the engine manufacturer need only show compliance with FAR 33.75 which does not require any analysis against uncontained engine failures
The probability of occurrence is 1 10e9. Granted as you have indicated there were several occurrences of the combustor can exploding with no fatalities but the Manchester accident proves that it can result in fatalities.
So the engine manufacturer had to assume that it could happen so they performed the analyses to prove (at least on paper) that it had a probability of occurrence of 1 10e9.
Wrong for the same reasons cited above
A similar case occurred on the Sioux City DC-10. GE performed all types of analyses and tests and concluded that the fan disc would never fail under normal operating conditions. Quality control failed to detect grains of sand in the casting, which resulted in a stress riser. 1 10e9 is a myth and can never be achieved yet the FAA and all the other certification authorities claim that this level of safety can be achieved.
Yet again you are mistaken. No such analysis was performed by GE prior to Sioux City although they may have offered an uncorroborated opinion that they could not forsee such a failure
I worked on one program where the safety analysts concluded that the probability of catastrophic failure on a primary flight control system was 1 10e18.
I worked on another program where the DGCA established system failures that were catastrophic. On most of the systems in the secondary flight controls there were as many as 60-70 different elements that if they failed could result in catastrophic failure. In order to realize the top system probability of 1 10e9 we had to create failure rates for mechanical components that were in excess of 1 10e12 and as high as 1 10e16 and the DGCA accepted our findings without asking us how we derived the failure rates. The FAA eventually certified this aircraft and accepted all of the numbers that were used in the safety calculations.
garbage in = garbage out
Iconoclast
Join Date: Sep 2000
Location: The home of Dudley Dooright-Where the lead dog is the only one that gets a change of scenery.
Posts: 2,132
Likes: 0
Received 0 Likes
on
0 Posts
garbage in = garbage out.
To: lomapaseo
You have in just a very few words proved my point about the probability of 1 10e9 being unattainable. In the analyses of mechanical components the reliability numbers are very suspect to say the least. These numbers are fed into the FMECA, which in turn is fed into the safety hazards analyses. Once plugged into the hazard analyses they are manipulated using Boolean algebra. If the numbers that went into the original reliability math model are suspect then anything that is developed using these numbers is also suspect. The safety hazards analysis is used to develop the certification reports turned over to the certification authorities by the airframe manufacturer.
The certification authority establishes the frequency of events that would result in catastrophic loss as well as the frequency of other types of failures. These frequencies are contained in FAR-AC-1309-1A. Based on the levels of different failure rates to be met in the design the airframe manufacturer will apportion his various systems down to the elements that make up the systems. The airframe manufacturer will based on his design will then issue a specification for the various sub system components to include a failure rate for the respective parts. The certification authority has nothing to do with this as long as the airframe manufacture in the manipulation of his respective numbers show that they meet if not exceed the certification requirements.
The way it works after the apportionment the various vendors will show that they can meet the apportioned numbers and if they do the lower numbers will always through the manipulation by Boolean algebra will meet the certification specification.
So to quote you, GARBAGE IN =GARBAGE OUT. It is your system not mine.
garbage in = garbage out
The certification authority establishes the frequency of events that would result in catastrophic loss as well as the frequency of other types of failures. These frequencies are contained in FAR-AC-1309-1A. Based on the levels of different failure rates to be met in the design the airframe manufacturer will apportion his various systems down to the elements that make up the systems. The airframe manufacturer will based on his design will then issue a specification for the various sub system components to include a failure rate for the respective parts. The certification authority has nothing to do with this as long as the airframe manufacture in the manipulation of his respective numbers show that they meet if not exceed the certification requirements.
The way it works after the apportionment the various vendors will show that they can meet the apportioned numbers and if they do the lower numbers will always through the manipulation by Boolean algebra will meet the certification specification.
So to quote you, GARBAGE IN =GARBAGE OUT. It is your system not mine.
Lu
Congratulations you finally put forth an excellent argument without resorting to uncorroborated facts.
Most of the large transport uncommanded thrust reverser deployments were ultimately shown to be caused by a two degree of fail-safe system which had decayed into at least one leg with very poor reliability (at least 10,000 times worse than the initial analysis} coupled with latent failures of at least one other system. The reliability issues wer traced to uncorroborated assumptions (no attempt to verify with data), while the latent failures were either wear out which went undetected or misassembly.
Certainly nothing to brag about and hence the need for increased regulatory attention.
Congratulations you finally put forth an excellent argument without resorting to uncorroborated facts.
Most of the large transport uncommanded thrust reverser deployments were ultimately shown to be caused by a two degree of fail-safe system which had decayed into at least one leg with very poor reliability (at least 10,000 times worse than the initial analysis} coupled with latent failures of at least one other system. The reliability issues wer traced to uncorroborated assumptions (no attempt to verify with data), while the latent failures were either wear out which went undetected or misassembly.
Certainly nothing to brag about and hence the need for increased regulatory attention.
A quote from the Lauda Air crew less than 7 minutes before reverser deployment:
Capt: what's it say in there about that just oh
F/O: additional system failures may cause in-flight deployment. expect normal reverse operation after landing
A chill runs down my spine when I open my B737 QRH and go to the REVERSER checklist:
Condition: The REVERSER light illuminated indicates a fault is detected in the related engine reverser system.
Note: Additional system failures may cause inflight deployment.
Expect normal reverser operation after landing.
I think if I EVER see an amber Reverser light illuminate on the overhead panel, I'll be bringing that engine back to idle thrust and continuing the flight as though I had an engine failure. Infact I might as well shut it down and be done with it.
Double system failure. Triple system failure. 10e9 bla bla bla. Don't care anymore. It's too easy to simply make that engine impotent and fly another 25 years.
Thankyou to the conributers of this thread. I learn something everyday.
Capt: what's it say in there about that just oh
F/O: additional system failures may cause in-flight deployment. expect normal reverse operation after landing
A chill runs down my spine when I open my B737 QRH and go to the REVERSER checklist:
Condition: The REVERSER light illuminated indicates a fault is detected in the related engine reverser system.
Note: Additional system failures may cause inflight deployment.
Expect normal reverser operation after landing.
I think if I EVER see an amber Reverser light illuminate on the overhead panel, I'll be bringing that engine back to idle thrust and continuing the flight as though I had an engine failure. Infact I might as well shut it down and be done with it.
Double system failure. Triple system failure. 10e9 bla bla bla. Don't care anymore. It's too easy to simply make that engine impotent and fly another 25 years.
Thankyou to the conributers of this thread. I learn something everyday.
Last edited by Blip; 29th Jul 2004 at 04:48.
I think if I EVER see an amber Reverser light illuminate on the overhead panel, I'll be bringing that engine back to idle thrust and continuing the flight as though I had an engine failure. Infact I might as well shut it down and be done with it.
after bringing the suspect engine back to idle and the flickering unlock light went out, they then adavanced the throttle and Oh boy it deployed and rolled the aircraft over 190deg
