24 ms·
Boeing 787 Suffers Rare Dual Engine Failure on Landing
- laretluval 8y agoI hope people are beginning to understand that the presence of software in any system is a liability.
- minedwiz 8y agoBoeing 777 is also digital fly-by-wire and has never suffered an issue attributable to software error.
- gedy 8y ago"Well, I don’t think there is any question about it. It can only be attributable to human error."
- glup 8y agoAfter serverless comes codeless.
- lsllc 8y ago"low code" is a thing apparently.
- rpeden 8y agoAirbus has been been doing "codeless" development with Esterel products for quite a while. I put codeless in quotes, because I believe the tools to generate code at the end of the day - but it's not code that is written by humans, and it is generated based on formally verified models. I believe this is what Airbus uses: http://www.esterel-technologies.com/products/scade-suite/ http://www.esterel-technologies.com/products/scade-suite/
- Glawen 8y agoYes they generate c code which is compiled. I don't know if the model is formally verified, but the whole toolchain from esterel, including the library blocks are certified (aicraft, automitive, industrial and train safety levels) It does not mean that any software done with this tools is thus certified, you need to apply the safety methodology to certify it
- glup 8y agoVery interesting! Trying to understand a bit better... does this mean that a human writes some logic, then it gets translated into a formally-verified model? Or these are pieces of verified code with strict combinatorial rules and the human does the composition?
- cpcallen 8y agoIndeed. And that is just an extension of the danger presented by electronic systems generally. When learning to fly sailplanes, I was always grateful that the "primitive" wood, steel and canvas gliders I flew had purely mechanical linkages between the controls and the control surfaces, and only one instrument that required electricity at all (and even that was duplicated by a purely mechanical version). Obviously automation has great advantages, but inevitably the increased complexity comes with risks which are more difficult to fully comprehend.
- mikeash 8y agoI’m also a glider pilot and I also appreciate the simplicity of the basic systems, but I feel like it’s worth noting that you’re far more likely to die in a glider crash than you are in a modern airliner full of complex software.
- mikeash 8y agoSoftware is like any other technology. It can be a liability or an asset or both depending on how it’s built. Sometimes software fails and sometimes it even kills people, but how many lives has it also saved because of things like collision avoidance and accurate navigation?
- CodeSheikh 8y agoCorrection: "I hope people are beginning to understand that the presence of poorly-tested software in any system is a liability."
- collyw 8y agoWell tested software still has bugs. Ones that haven't been tested for.
- CodeSheikh 8y agoSo it makes it a not Well tested then if scenarios have not been tested. My point.
- laretluval 8y agoTautological.
- quickthrower2 8y agoFor all software that does something useful, there exist scenarios that are not tested.
- anonu 8y agoI think software has existed in computer systems for 7 or 8 decades now - and the pitfalls are well understood. I think the problem is one of simplicity vs complexity. New systems today rely on dozens - hundreds even - of packages and libraries - many of which are not written by the implementer. How can you ensure reliability in all these components? This is why engineering from first principles - even in today's software development environment - is important. Unfortunately, the trends are in the other direction.
- dmead 8y agoyou would be wrong.
- AnimalMuppet 8y agoThat's not a very useful reply. Can you explain where anonu is wrong? Can you explain why? Can you give some evidence? A bare dismissal is like five-year-olds arguing: "Did too!" "Did not!" It's not useful to advance the conversation, and it's not effective at persuading people.
- noir_lord 8y agoIt's quite possible that software creates new failure modes (as programmers I'm sure we all feel that to be true some days) while at the same time preventing more. When the software fails (if it did) we assume the software makes it more dangerous because we have a concrete example of what happened but not what could have happened in it's absence. This is what may eventually stall self driving cars for many years, the first time one does the PR equivalent of smashing through the local orphanage. We as a society are notoriously poor at assessing systemic risks. Now to address your point about evidence, I'm curious how you could control for other confounding factors. Airliners are safer today than ever before (based on passenger miles) but how do you control for better engines, material science, procedures if you compare say 1979 to 2019.
- AnimalMuppet 8y ago
- jessaustin 8y agoIt's a liability when you're getting equipment serviced, whether there's software or not. We have a Cat 287B skid-steer. After a month of inactivity, it wouldn't come out of "park" mode. A mechanic lifted the cab, tested a couple of solenoids, and stated "must be a bad computer". This is an old machine, so I called Cat and confirmed that it doesn't actually have a computer. I took up the floorboard and found some wires that had been chewed by rodents. We're lucky we don't have a computer, because replacing it wouldn't have helped...
- Someone1234 8y agoMy take-away is a little different: As software grows it is hard to quantify. If you have several small distinct systems, you can often quantify them down to inputs, outputs, and expected logic. Once systems get too complex, you have too many possible states, and bugs are harder to find (and the system cannot be fully defined). I often go back to the famous Therac-25 accident. The bug in Therac-25 existed LONG before the accident, but there were two systems interacting, one system checked the other system's output and threw away invalid state. Once those two systems were merged, it was only then that the bug turned into an accident. If aircraft stopped building monolithic software and instead built parts that ran on software, parts that could each be individually verified, it would likely result in safer software.
- AnimalMuppet 8y agoThe trend over the last 20 years has been that 1: airliners are getting safer and safer and 2: airliners contain more and more software. True, the software introduces new failure modes. But the presence of software in airliners seems to be less a liability than the absence of software.
- outworlder 8y ago> I hope people are beginning to understand that the presence of software in any system is a liability. I do not understand this point of view. If you don't have software, you are going to replace it with something mechanical. Or with people. Or lose the functionality entirely. Do you want to bring back a 'flight engineer' to operate airliner engines? Do you want to bring back mechanical autopilots? Analog computers? Let's ditch GPS while we are at it (GPS failures can cause deaths, specially under poor visibility).
- laretluval 8y agoMore precisely. For two systems offering the same functionality, the one that does so using less software should be preferred, because software of any nontrivial complexity is irreducibly buggy.
- nitinreddy88 8y agoHow many easter eggs will emerge from Boeing. In last 2 months, we had similar incidents from Boeing where an undocumented software safety kicked in and causing trouble for everyone
- aaronbrethorst 8y agoand causing trouble for everyone You mean killed 189 people, right? https://en.wikipedia.org/wiki/Lion_Air_Flight_610 https://en.wikipedia.org/wiki/Lion_Air_Flight_610
- danielvf 8y agoThat aircraft was being knowingly flown with [edit: a broken sensor]. It was unsafe on takeoff. The final problem that brought the aircraft down - the trim run-away - happens all the time in airliners you've flown in. When the run-away starts, the pilot is supposed to flip two switches to disable the trim system motors. In the Lion Air crash, it is indeed believed that a software bug from the misbehaving sensors started the run-away, but again, handling trim run-aways are something that pilots are supposed to train for and deal with. 737's are even safer here than many airliners, because after you disable the electric trim motors, you have manual wheels in the cockpit that you can rotate to set the trim back to what it should be. Some other airliners in common use don't have these manual trim controls - you have to disable a trim run-away in time, or it's game over.
- Someone1234 8y ago> That aircraft was knowingly flown with multiple broken sensors. It was unsafe on takeoff. You'll need to cite that, since it contrary to any information I can find on the Lion Air accident e.g.: > The chief executive officer of Lion Air, Edward Sirait, said the aircraft had a "technical issue" on Sunday night, but this had been addressed in accordance with maintenance manuals issued by the manufacturer. Engineers had declared that the aircraft was ready for takeoff on the morning of the accident Your claim that it was "unsafe to takeoff" and had "multiple broken sensors" is pretty remarkable. So I'll definitely need to see a source backing up such remarkable claims.
- onewhonknocks 8y agoI'm not sure this is a bug. It sounds like pilot-error to me (I am not a pilot): "In the bulletin, Boeing said that selecting full reverse too quickly upon landing before the aircraft has fully transitioned to ground mode could cause the system to activate."
- S_A_P 8y agoI tend to agree after reading the bulletin. It seems to be a safety net for the plane/engines that maybe needs better input validation so that a pilot eager to hit the brakes cant do this again. In this context its a UX bug.
- detaro 8y agoDepends if "too quickly" means "clearly dangerous, so the system prevents a risk, and it's clearly the safer thing to do" or "fast enough to trigger the bug"? And even if it is the former, presumably it should be signaled and restart possible afterwards.
- samfisher83 8y agoThere should be manual override. What if this happened in-AIR?
- opwieurposiu 8y agoYou really, really do not want the reverse thrust to turn on in-AIR. That would be way worse then then engine shutting down.
- samfisher83 8y agoI don't mean specifically reverse thrust. I am saying features such as this. The Pilot expects something and computer does something else.
- sbradford26 8y agoThere are usually failsafe modes that disable most of the additional software features. It is pretty rare though for pilots to switch into those modes though since those features are what fly the plan a majority of the time. It is like the issue that are running into with self driving cars, there is a point where the flight controls become so good that pilots are less likely to intervene when something is going wrong.
- sschueller 8y ago"Boeing said that selecting full reverse too quickly upon landing before the aircraft has fully transitioned to ground mode could cause the system to activate." That sounds like apple's "you are holding it wrong" when "antenagate" happened. Not something I want to hear from an aircraft company where people's lives depend on it working.
- Jhndb 8y agoGoing off your quote it just looks like they're describing the symptom?
- mikeash 8y agoIt’s a completely neutral statement, and air travel has a strong culture of not accepting “just don’t screw up” as a solution.
- abfan1127 8y agoAirbus has a limitation on one of their airplanes for Rudder Range - https://www.usatoday.com/story/travel/flights/2012/11/19/airbus-rudder/1707421/ https://www.usatoday.com/story/travel/flights/2012/11/19/air...
- aurailious 8y agoNTSB is probably the best example of a safety investigation agency. Air travel in the US is extremely safe for many good reasons.
- chrisper 8y agoIt doesn't at all. It's an explanation why it might happen.They never said that this behavior won't be fixed or changed. It's not blaming the pilots.
- dajohnson89 8y agoThere is a notion of blame wrapped up with "too quickly".
- deugtniet 8y agoIs there something special about the software in new Boeings? Dual engine failure is nothing to sneeze at, and should never happen. Airbus also had its fair share of software errors in history, but if we count the recent Lion air crash as software related, Boeing has had 2 serious software related incidents in a year and I haven't heard anything serious from airbus. Is it because Airbus started its fly-by-wire development earlier?
- doctoring 8y agoI think with these types of incidents being very rare, it's hard to extrapolate to any kind of patterns. Not within the year, and I'm sure there are more (for both Boeing and Airbus), but this one comes to mind on an Airbus that's pretty scary -- thankfully occurred at cruising altitude: https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72
- Xixi 8y agoThe first Airbus FBW airliner was the A320, introduced in 1988 (31 years ago), while on Boeing side it was the 777, introduced in 1995 (24 years ago). By now I don't think it would make much of a difference, if any at all. If anything quarterly reports to shareholders who only care about the very short-term would be the culprit (or management teams whose bonuses only depend on the next quarter revenues). But numbers are stubborn and don't tell that story: the more recent the plane the safer it is. As such 787 and A350 are probably the safest airliners currently flying, followed by 777 and A380.
- markdown 8y ago> the more recent the plane the safer it is. As such 787 and A350 are probably the safest airliners currently flying, followed by 777 and A380. I'd argue that a new model of an old plane like the 737MAX would be safer, Lion Air incident notwithstanding.
- SomeHacker44 8y agoMany actual pilots would likely disagree. Shoehorning vastly different planes into the same type certificate can be dangerous. Convenient for pilots due to certification and recurrency issues, but not necessarily a good idea. Do you really want a pilot to jump into a 737MAX who only ever flew the -100? I bet the memory items are very different if not also all the speeds and weights. (NB: jet pilot, not Boeing airliner pilot though)
- exabrial 8y agoSort of off topic, but reverse thrust sort of boggles my mind. If you're sucking air in from the front of the aircraft and ejecting it out the front, don't those forces counterbalance each other?
- minedwiz 8y agoReverse thrust doesn't come directly out the front of the engine - it's vented out the side (or, in very old engines, redirected from the back exhaust): https://upload.wikimedia.org/wikipedia/commons/d/df/F-GTAR_Air_France_%283698209485%29.jpg https://upload.wikimedia.org/wikipedia/commons/d/df/F-GTAR_A...
- cpcallen 8y agoThat makes it even more surprisingly counterintuitive. I think the important thing to consider is the relative velocities of the intake and exhaust air (the latter being much larger).
- vpribish 8y agothat is a misleading way to put it - the reverse-thrust air does indeed move toward the front of the plane. it also moves outward, and is often taken from the sides of the engine, but a component of the (reversed) thrust is definitely going opposite the usual direction. here is a thermal image of a modern jet with thrust reverses on : http://www.rusaviainsider.com/russias-mc-21-tested-for-reverse-thrust-behavior/ http://www.rusaviainsider.com/russias-mc-21-tested-for-rever...
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- seiferteric 8y agoYour forgetting that the cool dense intake air is expanded (greatly) in the engine via combustion with fuel, so the volume of air being exhausted is much greater than went in and at much higher pressure, this is where the thrust comes from in the first place. It's not just a big fan :)
- code4tee 8y agoBoeing’s answer seems to say if you accidentally pull the thrust reverser lever before the aircraft is on the ground it just force shuts down the engines. That sounds like an odd safety override. Surely a better solution would be to just not activate reverse thrust. Unlike car engines a jet engine can’t just be quickly restarted if it accidentally shuts down. It typically takes 30-60 seconds to get going. This and earlier incidents are highlighting the dangers automation can add to mission critical systems. No pilot wants to hear notices about “hey, so in case you didn’t know our programmers added some code that does this strange uncommanded thing when you push buttons a certain way”
- DoofusOfDeath 8y agoIs that true even if the turbines are still spinning very fast?
- joezydeco 8y agoA thrust reverser isn't like the reverse gear on your car. It's a vent that opens to blow exhaust gases to the front instead of behind.
- emiliobumachar 8y agoA tough call. Your solution would disappoint a pilot who actually wanted to slow down ASAP more than Boeing's solution, and might contribute to a runway overrun.
- ravingraven 8y agoNo, it would not. If the engine is shut down moments before touching down it would mean that there would be no reverse thrust after touching down since it takes a considerable amount of time to re-start a turbo-fan (not 60 seconds as OP wrote as the engine is still spooling but still a significant amount of time and I don't think that any pilot would go through the workload and checklists of re-starting an engine during the landing roll anyway). This leads to a longer braking distance. The sane choice would be to not engage reverse thrust at all (until the pilot has reset the reverse thrust throttle) or to only engage reverse thrust once the landing gear has weight on it.
- leowoo91 8y agoWell, Rolls Royce monitors those engines remotely and have access to their logs afaik. So, it should be clear by now whether it has been called from software or not.
- metalliqaz 8y agoThat's not true. A full investigation will be required to reconstruct events from all data stored by the various Aircraft systems, including the engines.
- sargun 8y agoHow do you restart the Boeing 787 in mid-air? With the lack of an APU (they use li-on batteries, I think?), what's the mid-air engine restart procedure?
- stephen_g 8y agoThe 787 does have an APU and a ram air turbine (RAT) as well as the batteries.
- walrus01 8y agoThe 787 absolutely has an apu, I think you may be confusing engines with no bleed air.
- t0mas88 8y agoJust like any other jet enige... Get it to spin fast enough, enable the igniters and add fuel. Be careful with how fast they spin before adding fuel, too slow and things get very hot and melt. Getting them to spin fast enough in a 787 is a bit different from a traditional jet engine, because traditionally you spin them by pneumatic power (from ground, APU or the engine) and in the 787 you spin them by electric power (from ground, battery, APU, other engine or RAT). But there isn't much difference from a pilot's point of view.
- russellbeattie 8y agoI would bet this is going to get a lot more common as a whole generation of heads-down nerdy programmers who got into the industry because of sheer geek joy get replaced by Stack Overflow copy/paste Uber brogrammers who are just looking for a paycheck to fund their weekends in Tahoe. I mean, that's OK and all, but they need to stick to making Fyre apps that crush it by changing the world through social influencers or whatever and stay away from heavy machinery like automated cars and fucking airplanes. Sadly, supply and demand isn't going to let this happen. This, combined with rampant ageism that forces out the older workers who know better means we're all going to be seeing this a lot more over the next decade. "Remember when that Facetime bug made national news?? LOL! Those were the good old days!"
- _davebennett 8y agoInteresting perspective
- metalliqaz 8y agoThis comment is ignorant as shit. Critical aircraft systems are certified Design Assurance Level A. Programmers are one small part of the development cycle. Every line of code is reviewed, validated, and verified.
- Rooster61 8y agoOddly enough, your comment makes me think that you are writing it from the perspective of a member of the very group of programmers you decry. Companies that write high-risk, life-critical systems don't just let any ole J. Random Hacker work on such critical systems, and I don't think anyone who has worked in such a field would realistically think that these "brogrammers" as you say would be seriously considered for such a position. Companies don't play around with this kind of thing as failures are EXTREMELY expensive in terms of both funds and reputation.
- JBReefer 8y agoAren't almost all of the software engineers on those projects writing tests and formally verifying software?
- stephenr 8y agoDid anyone else find it odd that it took 40 minutes to get the plane towed back to the terminal?
- wtvanhest 8y agoIt probably takes 15 minutes to drive there, 10 minutes to hook up the plane and 15 minutes to drag it back. Seems to make sense to me.
- kd0amg 8y agoIt might make me worry about their fire response capability. On the other hand, there's probably an element of triage involved here (no immediate threat once the runway was closed). More generally, I would expect problems that a tow truck solves to not be as urgent as problems that a fire truck solves, so garaging the tow truck farther away seems plausible.
- mhb 8y agoNot anyone who's ever been on a commercial flight.
- marcinzm 8y agoThe article is a bit ambiguous to me about whether it was 40 minutes after landing or 40 minutes after they failed to restart the engines. The former is sensible to me since it'd take time for them to try to restart the engines and make sure the plane is otherwise safe (probably some kind of checklist to do as well). Some other articles on this explicitly say it was 40 minutes after landing.
- 0xFFFE 8y agoSeems like reasonable choice on the Boeing's part, the objective of the reverse thrust is to provide additional braking to the aircraft, if shutting down the engine has similar effect (albeit to a lesser extent), why not? Better than getting stuck in a dangerous situation if the reverse thrust was deployed prematurely.
- booi 8y agoYou're joking right? The engine is required for nearly everything else including but not limited to applying thrust to abort the landing.
- nabla9 8y agoIt's likely software as they suspect. Another possibility is that there was something wrong with the fuel.
- mrguyorama 8y agoThe young 777 had a vaguely similar situation that was caused by a fuel filter freezing up https://en.wikipedia.org/wiki/British_Airways_Flight_38 https://en.wikipedia.org/wiki/British_Airways_Flight_38
- ken 8y agoThis is straight out of chapter 1 of Alan Cooper's "The Inmates Are Running the Asylum" (2004). What do you get when you cross a computer and an airplane? A computer!
- cbhl 8y agoThe Boeing 787 is now about nine years old. I wonder how much of this is operator proficiency triggering latent bugs (aka, "pilots got too good at pushing buttons quickly"). The bugs in the Therac 25 were only discovered after the machine had been in production for a while (you had to be typing "too quickly" in order to get the software to trigger the bug with the safety interlock).
- Rooster61 8y agoConsidering the level of fly-by-wire that goes into airframes nowadays, I could certainly see such features added to older airframes through flight-software updates after they are already in service. I have no idea if that's how it's done in the field, though.
- bluGill 8y agoSoftware updates are done. However the manufacture has to recertify the airplane with the FAA first. This is expensive, requiring months of testing and a lot of paperwork. Each plane model getting the update needs to be re-certified, it isn't good enough to say that it works on this other model even if the planes are identical for purposes of that software.
- deleted 8y ago[deleted]
- t0mas88 8y agoIt's not very typical for pilots to push buttons quickly. Especially not the thrustreversers and engine and flight controls. But it is entirely possible that nobody pulled the reversers while still airborne in 9 years, because it's a very strange thing to do. A bit like opening your car door while still driving 60 mph... Nobody does that in normal operation.
- NAHWheatCracker 8y agoA bit like opening your car door while still driving 60 mph... Nobody does that in normal operation. You don't open and shut a door when you notice it didn't fully close because you can hear the wind?
- Rooster61 8y agoThe second high-profile potentially deadly software caused failure related to automated safety features in as many years (if that ends up being the cause, of course). Very glad the touchdown went nominally. Had they pushed the point of touchdown just a bit further down the tarmac, they'd have skittered right off the pavement.
- jiveturkey 8y ago> Engineers inspected the engines and could find no reason for the dual failure. With the post-inspection finding nothing to cause the engines to fail, engineers are saying the likely cause for the shutdown is a software issue onboard the aircraft. Very interesting that a) one of the first checks by engineers is not an evaluation of the software "log" or similar. either they have a specific checklist they MUST go by and that checklist doesn't include software log, and/or such log is simply not available to them. b)"likely cause"? again, why don't engineers have easy access to a software event log? I can very well imagine such instrumentation of software caused events not even existing for the shit apps we build, but for safety critical systems in an airplane? The log MUST exist. Why don't engineers on the ground have easy access to it. The software is integral these days.
- Glawen 8y agoAnd where would you store these logs ? I'm sure the engine stores its faults somewhere, but i'm not expecting more. You have to realise that you can run safety critical software on certified microcontrollers, which have usually like 10 mb of flash. Moreover it is an aicraft, and worse it is an engine, so I guess that the mechanical requirements are insane (able to withstand a lot of vibrations, operate in -60 to 160 deg celsius, withstand cosmic rays). A samsung ssd does not fit the bill. It's probable however that the aircraft communications lines are recorded in a black box, but you can only see the data exchanged by the ECUs, not the relevant internal variables telling you about the bug. Mind you i'm not working in the aicraft industry, my assumptions may be false, but my guess is that the engine controller is on the engine itself.
- esemor 8y agoI think the auto shutdown of engines in flight, in case it senses reverse thrust, is a great design. The 787 is a replacement for my 767 (currently a pilot on the aircraft) and in 1991 a Lauda Air 767 suffered a failure in one of its thrust reverser and it became activated during cruise. The aircraft was destroyed in flight. The thrust reversers should not activate during flight (a air/ground sensors prevents that) but as it is a catastrophic failure, having the engine shut down automatically seems like a great fail safe device. In this case it seems that the 787 engines were reversed before the air/ground sensor had sensed ground and it is a potential problem.
- focom 8y agoThere is Airplane pilot on HN? I am surprised, did you make a career switch from IT?
- sandov 8y ago"Hacker: A person who delights in having an intimate understanding of the internal workings of a system [...]"
- bobowzki 8y agoI'm always amazed how diverse the people on HN are. Not everyone is an IT professional but we share a passion for technology.
- newnewpdro 8y ago'Passionate' is not the adjective I would use to describe my feelings towards technology.
- andrewflnr 8y agoMaybe more like passion in the "crime of..." sense?
- x220 8y agoBEGIN KEYBASE SALTPACK ENCRYPTED MESSAGE. kiS2n6W4XB3QNEC peK0YLJK3LrUU4J ZUfCVBNUhWDXYby TkGZ91n3S9ep9c4 eKR2g2cXo4w1rxv MbLStzP8j7bPSKT 8FFt3dDpm3pMG1O UyCAed0l3GtoadX 51BWBdetJCgOzmw FhrciyUXrDnqwHz zaS1YQao8KgZT01 IdzgApjslh23dxR TwadRIu1swS1fVs diIvDSHnwqH4DwF QCbvcCeiSetv4fD xqTvVG7yj1nCLy4 9Pt3TlOUT72cHCH VmQLuI68X5ERp0K HIBvSrS1yThzILN yUqZ8sFQk8nDtUa 829LWJr54KpP66l JkW1Aj6o9kO0W6I qCv6uLEvk0u15bv ESIGVFOv9YxC3IL gqPxgTTAE6zhwSX f1LgR9msZqNzaqa GDXXxeUq33gJ4Mn S5aaYZQeiWmklPK 14Q7j9xVgo3hnaH dmt3kmy88IFXPKQ dZuebIdwXmMxjxg EJenNubVc0UCus8 LUOH9o9aTiLk7G5 0evoFIg7uiAac9G ib1DtE0UMrTI260 Ozf6r7x8wXtmDzH E3kOBRiUMtd2bPG roh7wIGZPdcaVmd ftY658blAA6HjPR vdZVR3wqKDwBES8 88oy8bMwgsLNxGS CLCq1pPxB9iP9wy yPkb82R5xdMMN8y XyHheuQrAC5tDBW wQ9JOqxNymDkKXE EVl62aqexReErEm t83saUws9pB1yST R1jfWNB9K98lvKp koms8iW4D4QX4yc y2aXd95rESqX03n gv3mCtWhQP1eLZb GI1n7um4d9C0yKb KTkbLXP04W7TWvS EzjGqg1OtruqyZ4 RzBvlpbVoK6yyrU lHkTNM7b5f3J48R UDFh1X6sqTeNntk bPRMk1rYW37Tbde 7AUTgZxxke64cRR TdG3gE3HBmvCs01 ZyDk9VUVHqAXJzV 0McKxFEXFRJ3Bdv LWzumu4qUGe4kOZ VHPCnUFQiDKuwuI Wmsn2dBYjVTY48j pSQgVrw8oi2cnyl 8gajc8FoWKd0mtA 43IctiiTCeQ6ZAh vhoudLc6QUwI6UR fgO9DBSKmYqFISh . END KEYBASE SALTPACK ENCRYPTED MESSAGE.
- anderspitman 8y agoOh Dreamliner, still[0] making me look bad 12 years later. [0] https://news.ycombinator.com/item?id=9477941 https://news.ycombinator.com/item?id=9477941
- whizzkid 8y agoI have never ever thought avionics software development would be in such a condition that you described in the link. I am surprised to say the least. I have always imagined avionics developers in a different way. Like having a thick rulebook to go through to add a new line to codebase etc.
- anderspitman 8y agoKeep in mind my experience was almost exclusively with communications systems, which are important but nowhere near as vital as things like autopilot. Things could very likely be better there, or at a different company. And even many of the things I worked on were like you describe. There is a lot of red tape and testing to make certain changes, and the industry documents are often strict. But it wasn't always clear how much of that actually made things better/safer and how much was just fluff.
- dreamcompiler 8y agoI had expected this story was about a Rolls-Royce problem; their Trent 1000 engines are giving the 787 a bad name. But it looks like it was just a normal software interlock that would never cause a problem during flight.
- Animats 8y agoThis is really strange. Not only did they have a dual engine failure, they couldn't restart while stuck on the runway. After 40 minutes, the aircraft had to be towed in. Then maintenance couldn't find a fault. This is an ANA aircraft, which means it's probably maintained well and flown by competent pilots. Looking forward to a good analysis on this. Most large aircraft have a "weight on wheels" switch, activated when the aircraft is on the ground. There might be some bad interaction between the "weight on wheels" sensing and the thrust reverser protection. Pure speculation: initial touchdown, pilots deploy reversers, small bounce into the air, weight on wheels switches open, engine controller detects flight condition with thrust reversers deployed and shuts down engines. The other side of this kind of failure is dealing with unintended thrust reverser deployment in flight. Here's an overview.[1] Historically, it wasn't a big deal at altitude, but on some newer aircraft, it is, and so stronger steps have been taken to avoid it. [1] https://lessonslearned.faa.gov/ll_main.cfm?TabID=3&LLID=34&LLTypeID=2 https://lessonslearned.faa.gov/ll_main.cfm?TabID=3&LLID=34&L...
- mveety 8y agoIt might be less of a small bounce than the nose wheel not being on the ground and/or not having enough weight on it. I know Airbus and Boeing handle this differently, but I don't remember the details (I want to say Airbus allows reverse thrust once the mains are firmly on the ground but the nose isn't, but I need to check my manuals). I really do find the inability to restart extremely interesting though. I'd bet it's a bug somewhere, but it would be alarming if Boeing programmed in a lock-out on the failed engine(s) (I've heard it talked about as a solution to the sudden deployment of reverse thrust in flight) .
- reidacdc 8y agoYour speculative scenario has actually happened, but on a significantly less computerized Boeing 737, in 1978.[1] In that case, the aircraft touched down, reversers were deployed, a runway obstacle (a snowplow) appeared, and the pilots attempted to go around. They got airborne and cleared the obstacle, but as they lifted off, the "squat switches" on the main gear opened. One of the reversers was still deployed, and with the squat switches open, was no longer powered, and could not retract. The aircraft was uncontrollable, and crashed. In that case, shutting down the reversed engine would likely have been preferable, although if we're doing counter-factuals, telling the snowplow driver about the airplane's revised arrival time is your go-to move, I think. [1] https://en.wikipedia.org/wiki/Pacific_Western_Airlines_Flight_314 https://en.wikipedia.org/wiki/Pacific_Western_Airlines_Fligh...
- mensetmanusman 8y agoOne engine should be iOS and the other Android to prevent simultaneous bugs in the future.
- jshprentz 8y agoAviation professionals discussed this incident on the Aviation Herald website. http://avherald.com/h?article=4c2fe53a http://avherald.com/h?article=4c2fe53a
- MFLoon 8y agoThe Professional Pilots Rumor Network (PPRUNE) is a pretty awesome forum full of aviation professionals discussing aviation at a high level, I always go there for aviation news commentary. The thread on this isn't very extensive yet, but has some interesting commentary https://www.pprune.org/rumours-news/617426-ana-787-engines-shutdown-during-landing.html https://www.pprune.org/rumours-news/617426-ana-787-engines-s...
- dorfsmay 8y agoI wonder if it could be ice in the fuel line. Ice doesn't leave trace by the time it melts. This has happened in the past on a different type of plane (Boeing 777). https://www.telegraph.co.uk/news/uknews/1950444/Heathrow-crash-landing-caused-by-fuel-freeze.html https://www.telegraph.co.uk/news/uknews/1950444/Heathrow-cra...
- ncmncm 8y agoDoes nobody remember the Lockheed aircraft that ran off the end of the runway because both the brakes and lift spoilers refused to deploy? It was another case of misguided safety interlock. IIRC, they landed 20 knots fast because of storm conditions; the brakes wouldn't go with too little weight sensed, and the lift spoilers wouldn't go above a certain speed. Catch-22!
- redleggedfrog 8y agoWait, what - Rolls Royce?! The same company that makes the some of the most expensive and unreliable cars on the market? Boeing, Boeing, what were you thinking?
- anotheryou 8y agowhy a shutdown and not a denial of going to reverse thrust in the first place? or does it shut down when you open throttle in reverse thrust and allow you to switch the engine configuration beforehand?