5 ms·

“The performance of the prime manufacturer can never exceed the capabilities of the least proficient of the suppliers” Software connection: this is known as SL

“The performance of the prime manufacturer can never exceed the capabilities of the least proficient of the suppliers” Software connection: this is known as SLA Inversion [1], the phenomena that you can never be more reliable than your least reliable component. There are ways to get around it, but they involve having multiple redundant but independent paths to achieving a successful result. This is difficult for structural components of an aircraft because each redundant mechanism adds weight and decreases performance & fuel economy. It's somewhat shocking to me that there are no redundant failsafes to something as critical (and potentially error-prone) as a loose bolt in a door plug, though. Or maybe there were and we'll see compound errors in the final FAA report, which will definitely be interesting to read. [1] https://sookocheff.com/post/architecture/stability-antipatterns/#sla-inversion https://sookocheff.com/post/architecture/stability-antipatte...

_a_a_a_ 3y ago
I'd be really surprised if it was just one loose bolt that would allow this to happen, but I don't know. It would be hard to believe they were that stupid, so I'd rather not assume.
- beej71 3y ago
  I'm not a structural engineer or anything, but I don't see how a single missing bolt would allow this to happen. It would have to be at least the two upper retaining bolts, neither of which were particularly picky about torque and both of which had cotter pins on castle nuts, ideally. In my humble, ignorant opinion, this. You heard it here on the Internet. :) Last I heard, though, none of the 4 main bolts were recovered, and they were going to do lab tests to try to determine if they were present to begin with.
  - bcrl 3y ago
    Watch Mayday. There are a number of accidents that were caused by a single bolt, but it is usually a systemic series of faults that allowed that to happen as was the case for Flight 17: https://www.avm-mag.com/a-loose-bolt-and-lives-lost-the-crash-of-emery-flight-17 https://www.avm-mag.com/a-loose-bolt-and-lives-lost-the-cras...
  - WalterBright 3y ago
    Speculation: if none of the 4 bolts were tightened, the bolts may have vibrated loose one by one. The door blew out when the last bolt fell out. Or the wrong bolts were used - bolts that were not strong enough. Or the particular batch of bolts used were not heat treated, making them not strong enough. (You can't tell if a bolt is heat treated by looking at it.)
    - _a_a_a_ 3y ago
      Unlike you I have less than no background in this, most especially in aero, but if the faults were as basic as you've described, that would be not failure but outright engineering negligence.
      - WalterBright 3y ago
        It's not engineering negligence. It's the process that is supposed to implement the design. That said, it's also a goal of engineering to make the process easier. One such technique is to design things in patterns. Then, if something doesn't fit the pattern, attention is easily drawn to it to investigate the problem. Design things so that when they look right, they are right. For example, look at the line of rivets holding an assembly together. They should form a nice neat pattern. I try to write software the same way. I lay out the code in patterns. Anything that looks out of place in the pattern draws attention as being a mistake.
        _a_a_a_ 3y ago
        > It's the process that is supposed to implement the design Not sure I understand, are you saying that this is a failure not of engineering but of processes? In that, the original engineering was sound but somebody took shortcuts in the implementation? Or do you mean something else?
  - noduerme 3y ago
    When I test-drove my 1980 Datsun, the owner had just been working on the brakes. As I drove with him through the neighborhood, I kept hearing a clunk. I thought it was the transmission. Then at about 40mph, the rear driver's side wheel detached and went flying past my door. The rear of the car skidded on the axle until I managed to get it to a stop. Turns out the guy's family had come over right as he was tightening the lugnuts and he forgot to finish them. Maybe only one was properly tightened. He'd wanted $5k for it, but I offered him $2800 as we retrieved the wheel and he accepted.
    - inferiorhuman 3y ago
      Right but that's not a single fastener. A single missing wheel bolt or lug nut is not a catastrophic problem. If all of them are loose or missing that can be a problem.
      - noduerme 3y ago
        I mean, there's a reason there aren't just two. The other ones aren't just for backup but to reduce the stress on each other. So if you have a situation where you think you only needed two, but only one is tight, the other one shears off. In that case, it's one bolt that broke because one other one wasn't tight.
vishnugupta 3y ago
A chain is only as strong as its weakest link.
- WalterBright 3y ago
  That's why every critical thing in an airplane is redundant.
  - logifail 3y ago
    > That's why every critical thing in an airplane is redundant I'm not sure how to understand that claim. Do the emergency doors/door plugs have two bolts? Three bolts? Ten bolts? If the manufacturer and/or the operator is not capable of making sure that all the bolts are always appropriately tightened, what is that claim actually worth? > One crash happened because a maintenance worker taped over the redundant sensors so the airplane could be cleaned, and forgot to remove the tape. The inspection to ensure the tape was removed also failed So from that we learn that failures can stack, just like like redundancies?
    - WalterBright 3y ago
      > Do the emergency doors/door plugs have two bolts? Three bolts? Ten bolts? I don't know the design. But I'm sure it is not one where one bolt failing will cause the door to come off. > If the manufacturer and/or the operator is not capable of making sure that all the bolts are always appropriately tightened, what is that claim actually worth? The process also has to be redundant. One mechanic tightens the bolts, and an inspector checks it and signs off on it. If there are loose bolts shipped, then the inspector has some 'splaining to do. > So from that we learn that failures can stack, just like like redundancies? Zipper failures are not supposed to happen. Any crash is the result of an unexpected zipper failure. The whole airline system is extremely complex, and finding every potential zipper failure is nigh impossible, though everyone involved tries to anticipate every scenario. When a zipper failure happens, then each event in the zipper is corrected. This is how airline travel, an inherently dangerous activity, has become so incredibly safe.
cratermoon 3y ago
I believe we're going to find that it wasn't a single loose bolt, but that all for bolts were missing, somehow.
- jacquesm 3y ago
  No, then the first pressurization would have led to the plug being blown out.
  - throwaheyy 3y ago
    No. The bolts don’t hold the door/plug against the pressure. There are 12 stops and brackets, separate from the bolts, that take the pressurization load and transfer it to the airframe. The bolts are there to simply prevent the door from translating upwards from behind the stops (as it would when opened as a real door). The bolts could be missing and it could take some time (vibration, landings etc.) for the plug to work its way upwards from behind the stops.
    - jacquesm 3y ago
      You've got that 100% backwards. The 12 stops stop the door from moving inward, the only thing that stops the plug from moving outward is the bolts. See the widely circulated drawing of how that plug is constructed, I think you have inside and outside mixed up.
      - wannacboatmovie 3y ago
        Sorry you couldn't be more wrong here. The parent post describes this correctly. The door rests on the stops (on the inside) which transfer 100% of the pressurization load (from the inside out) into the fuselage. The stops look to be welded or part of the structure. There is no need to prevent movement inward because the force under pressurization is in the opposite direction! This door is apparently a 20 year old design, used on the legacy pre-MAX 737, it was not conceived by idiots. The bolts don't carry this load at all. Their purpose is to keep the door from sliding upwards vertically up and over the stops. The operation of the door for maintenance e.g. like opening a window for ventilation, the bolts are removed, the door is then lifted upwards with the help of springs, sliding past the stops and pops out. There looks to be a small strap to help keep it propped open. Likely the presence of any one of the four bolts that restricts vertical movement would have prevented this, at least until it was discovered at a maintenance checkup. It's possible the door was sitting on the stops with no bolts and enough landings happened inducing vertical loads to cause it to gradually slip out of place. Similar to how you can hold a mattress on top of your car with friction and your hand for a period of time, it just takes one gust of wind in the right direction and the rest is history.
WalterBright 3y ago
> This is difficult for structural components of an aircraft because each redundant mechanism adds weight and decreases performance & fuel economy. All structural (and other flight critical) components in an airliner are redundant. And yes, they add weight, decrease performance, and increase fuel consumption. As for the door, it is also redundant. We'll have to wait and see to find out what the exact cause was before finding a solution. The obviously loose bolts are certainly a problem. The process should be one mechanic installs the bolts, then an inspector inspects it and signs off on it. If you watch "Aviation Disasters" (I watch all of them) there's always multiple causes for each accident, and multiple fixes. One crash happened because a maintenance worker taped over the redundant sensors so the airplane could be cleaned, and forgot to remove the tape. The inspection to ensure the tape was removed also failed.
- zh3 3y ago
  Famously, the 'swiss cheese' model [0, critical article] - every layer has holes, so layers of safety are required to reduce the chances of holes lining up (leading to a failure dropping though - and resulting in an accident). [0] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1298298/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1298298/
- singleshot_ 3y ago
  I’m genuinely curious how you would consider the door (plug) redundant. What else is keeping things (e.g., the mobile phone that fell to the ground) inside the airplane?
lostlogin 3y ago
> It's somewhat shocking to me that there are no redundant failsafes to something as critical (and potentially error-prone) as a loose bolt in a door plug, though. There were warning lights going off suggesting a depressurisation was going to occur, but these were broadly ignored (though flights were restricted to shorter routes). Not quite a fail safe but also not an ideal response. https://www.kptv.com/2024/01/08/watch-live-ntsb-officials-give-update-investigation-into-alaska-airlines-loss-airplane-panel/ https://www.kptv.com/2024/01/08/watch-live-ntsb-officials-gi...
- mulmen 3y ago
  That's not what those lights mean. The warning was for a malfunction of one of the triple-redundant pressure control systems. > Homendy said investigators have learned that before the Friday flight, the “auto-depressurization” warning light came on during or after three previous flights, at least one time while the aircraft was in the air, and once while it was on the ground. Each time, the light was checked out, and Alaska Airlines reported the light turning on was a “benign” issue. Homendy addresses this in the media brief: https://www.youtube.com/watch?v=0jeO5fwRXLo&t=257s https://www.youtube.com/watch?v=0jeO5fwRXLo&t=257s
  - MesaGuy 3y ago
    Homendy's remarks were obviously wrong and premature (sadly expected of the "chair" who is an administrator, not the qualified engineer.) The Alaska Air 1282 plane experience 3 different warnings. The system is "semi" triple redundant in that there is a primary system, a secondary system, and a manual system. In this case, the primary system was "failing", and the plane switched over to the secondary system. Alaska has not explained itself here. However, the most obvious speculation, is that the plane was leaking (badly) and the primary system was probably keeping up with the leak (which is why the problem was intermittent.) But that primary system was likely have to "run all the time" (because it had to keep up with the leak) - and one of two (or both) things likely happened. Either sometimes it could NOT keep up (based on elevation, pressure, and temperature variations), or else the pressure pump was actually overheating (from constantly having to run to keep up with the leak), and occasionally failing. When this happened, the plane control systems would automatically switch to the secondary pump, and light the WARNING LAMP. Given that the problem happened twice in the prior 3 days, the problem was getting worse. AlaskaAir's response was totally inappropriate, and NOT safety focused. They did not ROOT CAUSE the issue, HOPED it was the lamp, or lamp electricals, replaced those parts, and called it good. And the 4th time was the charm, when the plug failed entirely, there having been 3 prior warnings of an issue in pressurization. In my opinion, inexcusable, and the reason I am no longer flying on AlaskaAir. Though I would further speculate that Boeing's inspection procedure instructions probably do not include inspecting the exit door seals, the door plug seal, or the rear pressure cone. Inspecting those things would be much more expensive than just checking the warning light, and the pump operation. (The pressure pumps operating just fine, and the LAMP just fine as well.) So Homendy's statement is almost certainly expected to be shown to be misplaced and premature. I was incredibly surprised that she made the statement.

_a_a_a_ 3y ago

I'd be really surprised if it was just one loose bolt that would allow this to happen, but I don't know. It would be hard to believe they were that stupid, so I'd rather not assume.

beej71 3y ago
I'm not a structural engineer or anything, but I don't see how a single missing bolt would allow this to happen. It would have to be at least the two upper retaining bolts, neither of which were particularly picky about torque and both of which had cotter pins on castle nuts, ideally. In my humble, ignorant opinion, this. You heard it here on the Internet. :) Last I heard, though, none of the 4 main bolts were recovered, and they were going to do lab tests to try to determine if they were present to begin with.
- bcrl 3y ago
  Watch Mayday. There are a number of accidents that were caused by a single bolt, but it is usually a systemic series of faults that allowed that to happen as was the case for Flight 17: https://www.avm-mag.com/a-loose-bolt-and-lives-lost-the-crash-of-emery-flight-17 https://www.avm-mag.com/a-loose-bolt-and-lives-lost-the-cras...
- WalterBright 3y ago
  Speculation: if none of the 4 bolts were tightened, the bolts may have vibrated loose one by one. The door blew out when the last bolt fell out. Or the wrong bolts were used - bolts that were not strong enough. Or the particular batch of bolts used were not heat treated, making them not strong enough. (You can't tell if a bolt is heat treated by looking at it.)
  - _a_a_a_ 3y ago
    Unlike you I have less than no background in this, most especially in aero, but if the faults were as basic as you've described, that would be not failure but outright engineering negligence.
    - WalterBright 3y ago
      It's not engineering negligence. It's the process that is supposed to implement the design. That said, it's also a goal of engineering to make the process easier. One such technique is to design things in patterns. Then, if something doesn't fit the pattern, attention is easily drawn to it to investigate the problem. Design things so that when they look right, they are right. For example, look at the line of rivets holding an assembly together. They should form a nice neat pattern. I try to write software the same way. I lay out the code in patterns. Anything that looks out of place in the pattern draws attention as being a mistake.
      - _a_a_a_ 3y ago
        > It's the process that is supposed to implement the design Not sure I understand, are you saying that this is a failure not of engineering but of processes? In that, the original engineering was sound but somebody took shortcuts in the implementation? Or do you mean something else?
- noduerme 3y ago
  When I test-drove my 1980 Datsun, the owner had just been working on the brakes. As I drove with him through the neighborhood, I kept hearing a clunk. I thought it was the transmission. Then at about 40mph, the rear driver's side wheel detached and went flying past my door. The rear of the car skidded on the axle until I managed to get it to a stop. Turns out the guy's family had come over right as he was tightening the lugnuts and he forgot to finish them. Maybe only one was properly tightened. He'd wanted $5k for it, but I offered him $2800 as we retrieved the wheel and he accepted.
  - inferiorhuman 3y ago
    Right but that's not a single fastener. A single missing wheel bolt or lug nut is not a catastrophic problem. If all of them are loose or missing that can be a problem.
    - noduerme 3y ago
      I mean, there's a reason there aren't just two. The other ones aren't just for backup but to reduce the stress on each other. So if you have a situation where you think you only needed two, but only one is tight, the other one shears off. In that case, it's one bolt that broke because one other one wasn't tight.

vishnugupta 3y ago

A chain is only as strong as its weakest link.

WalterBright 3y ago
That's why every critical thing in an airplane is redundant.
- logifail 3y ago
  > That's why every critical thing in an airplane is redundant I'm not sure how to understand that claim. Do the emergency doors/door plugs have two bolts? Three bolts? Ten bolts? If the manufacturer and/or the operator is not capable of making sure that all the bolts are always appropriately tightened, what is that claim actually worth? > One crash happened because a maintenance worker taped over the redundant sensors so the airplane could be cleaned, and forgot to remove the tape. The inspection to ensure the tape was removed also failed So from that we learn that failures can stack, just like like redundancies?
  - WalterBright 3y ago
    > Do the emergency doors/door plugs have two bolts? Three bolts? Ten bolts? I don't know the design. But I'm sure it is not one where one bolt failing will cause the door to come off. > If the manufacturer and/or the operator is not capable of making sure that all the bolts are always appropriately tightened, what is that claim actually worth? The process also has to be redundant. One mechanic tightens the bolts, and an inspector checks it and signs off on it. If there are loose bolts shipped, then the inspector has some 'splaining to do. > So from that we learn that failures can stack, just like like redundancies? Zipper failures are not supposed to happen. Any crash is the result of an unexpected zipper failure. The whole airline system is extremely complex, and finding every potential zipper failure is nigh impossible, though everyone involved tries to anticipate every scenario. When a zipper failure happens, then each event in the zipper is corrected. This is how airline travel, an inherently dangerous activity, has become so incredibly safe.

cratermoon 3y ago

I believe we're going to find that it wasn't a single loose bolt, but that all for bolts were missing, somehow.

jacquesm 3y ago
No, then the first pressurization would have led to the plug being blown out.
- throwaheyy 3y ago
  No. The bolts don’t hold the door/plug against the pressure. There are 12 stops and brackets, separate from the bolts, that take the pressurization load and transfer it to the airframe. The bolts are there to simply prevent the door from translating upwards from behind the stops (as it would when opened as a real door). The bolts could be missing and it could take some time (vibration, landings etc.) for the plug to work its way upwards from behind the stops.
  - jacquesm 3y ago
    You've got that 100% backwards. The 12 stops stop the door from moving inward, the only thing that stops the plug from moving outward is the bolts. See the widely circulated drawing of how that plug is constructed, I think you have inside and outside mixed up.
    - wannacboatmovie 3y ago
      Sorry you couldn't be more wrong here. The parent post describes this correctly. The door rests on the stops (on the inside) which transfer 100% of the pressurization load (from the inside out) into the fuselage. The stops look to be welded or part of the structure. There is no need to prevent movement inward because the force under pressurization is in the opposite direction! This door is apparently a 20 year old design, used on the legacy pre-MAX 737, it was not conceived by idiots. The bolts don't carry this load at all. Their purpose is to keep the door from sliding upwards vertically up and over the stops. The operation of the door for maintenance e.g. like opening a window for ventilation, the bolts are removed, the door is then lifted upwards with the help of springs, sliding past the stops and pops out. There looks to be a small strap to help keep it propped open. Likely the presence of any one of the four bolts that restricts vertical movement would have prevented this, at least until it was discovered at a maintenance checkup. It's possible the door was sitting on the stops with no bolts and enough landings happened inducing vertical loads to cause it to gradually slip out of place. Similar to how you can hold a mattress on top of your car with friction and your hand for a period of time, it just takes one gust of wind in the right direction and the rest is history.

WalterBright 3y ago

> This is difficult for structural components of an aircraft because each redundant mechanism adds weight and decreases performance & fuel economy. All structural (and other flight critical) components in an airliner are redundant. And yes, they add weight, decrease performance, and increase fuel consumption. As for the door, it is also redundant. We'll have to wait and see to find out what the exact cause was before finding a solution. The obviously loose bolts are certainly a problem. The process should be one mechanic installs the bolts, then an inspector inspects it and signs off on it. If you watch "Aviation Disasters" (I watch all of them) there's always multiple causes for each accident, and multiple fixes. One crash happened because a maintenance worker taped over the redundant sensors so the airplane could be cleaned, and forgot to remove the tape. The inspection to ensure the tape was removed also failed.

zh3 3y ago
Famously, the 'swiss cheese' model [0, critical article] - every layer has holes, so layers of safety are required to reduce the chances of holes lining up (leading to a failure dropping though - and resulting in an accident). [0] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1298298/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1298298/
singleshot_ 3y ago
I’m genuinely curious how you would consider the door (plug) redundant. What else is keeping things (e.g., the mobile phone that fell to the ground) inside the airplane?

lostlogin 3y ago

> It's somewhat shocking to me that there are no redundant failsafes to something as critical (and potentially error-prone) as a loose bolt in a door plug, though. There were warning lights going off suggesting a depressurisation was going to occur, but these were broadly ignored (though flights were restricted to shorter routes). Not quite a fail safe but also not an ideal response. https://www.kptv.com/2024/01/08/watch-live-ntsb-officials-give-update-investigation-into-alaska-airlines-loss-airplane-panel/ https://www.kptv.com/2024/01/08/watch-live-ntsb-officials-gi...

mulmen 3y ago
That's not what those lights mean. The warning was for a malfunction of one of the triple-redundant pressure control systems. > Homendy said investigators have learned that before the Friday flight, the “auto-depressurization” warning light came on during or after three previous flights, at least one time while the aircraft was in the air, and once while it was on the ground. Each time, the light was checked out, and Alaska Airlines reported the light turning on was a “benign” issue. Homendy addresses this in the media brief: https://www.youtube.com/watch?v=0jeO5fwRXLo&t=257s https://www.youtube.com/watch?v=0jeO5fwRXLo&t=257s
- MesaGuy 3y ago
  Homendy's remarks were obviously wrong and premature (sadly expected of the "chair" who is an administrator, not the qualified engineer.) The Alaska Air 1282 plane experience 3 different warnings. The system is "semi" triple redundant in that there is a primary system, a secondary system, and a manual system. In this case, the primary system was "failing", and the plane switched over to the secondary system. Alaska has not explained itself here. However, the most obvious speculation, is that the plane was leaking (badly) and the primary system was probably keeping up with the leak (which is why the problem was intermittent.) But that primary system was likely have to "run all the time" (because it had to keep up with the leak) - and one of two (or both) things likely happened. Either sometimes it could NOT keep up (based on elevation, pressure, and temperature variations), or else the pressure pump was actually overheating (from constantly having to run to keep up with the leak), and occasionally failing. When this happened, the plane control systems would automatically switch to the secondary pump, and light the WARNING LAMP. Given that the problem happened twice in the prior 3 days, the problem was getting worse. AlaskaAir's response was totally inappropriate, and NOT safety focused. They did not ROOT CAUSE the issue, HOPED it was the lamp, or lamp electricals, replaced those parts, and called it good. And the 4th time was the charm, when the plug failed entirely, there having been 3 prior warnings of an issue in pressurization. In my opinion, inexcusable, and the reason I am no longer flying on AlaskaAir. Though I would further speculate that Boeing's inspection procedure instructions probably do not include inspecting the exit door seals, the door plug seal, or the rear pressure cone. Inspecting those things would be much more expensive than just checking the warning light, and the pump operation. (The pressure pumps operating just fine, and the LAMP just fine as well.) So Homendy's statement is almost certainly expected to be shown to be misplaced and premature. I was incredibly surprised that she made the statement.