Posts about: "Engine Failure (All)" [Posts: 505 Page: 26 of 26]¶

1: Intentional misuse by pilots is basically ignored in aviation design. If you want to start changing that, there's a *lot* of things to address. This is very different to the world of industrial safety, where the operator is the enemy.

2: Switch failures leading to engine failure are counted as an in-flight shut down for ETOPS purposes, meaning <1 per 100K engine flight hours. So long as the failures are independent , this shouldn't be an issue.

AFAIK Embraer has the switches interlocked with the thrust levers so they won't cut off unless at idle, and Citations require moving the thrust lever past idle?
Obviously Boeing can't easily change "standard practice", especially if they want to keep training costs for pilots switching types low, but that doesn't mean it's not a good idea in general.
If this logic fails "when it is really needed", the pilot can still pull the fire handle. Or the engine won't start, but then they'd still be sitting at the airport. But I don't think the aircraft that already have this have had issues?

THIS!!! While there is attention paid to factors to help prevent pilot mistakes, every safety analysis pretty much assumes that a pilot it not going to intentionally endanger an aircraft.
The Boeing fuel switch design is beautiful in its simplicity. A toggle switch - with detents to discourage unintentionally movement - hardwired directly from the switch to the engine with just an interposing relay. Further, the actual devices on the engine that turn the fuel ON or OFF are of a design that - if they lose power - they simply stay where they are. This latest theory that a problem with the aircraft electrical system caused it to lose electrical power and the lack of aircraft power caused the engines to shutdown was ridiculous from the start. That simply cannon happen.
When we started working on ETOPS, we looked at the historical rate for various shutdown causes and literally assigned design requirements that various systems had to stay below those rates.
For example, in the engine controls arena, we were allowed something like 2 shutdowns per million hours for engine control faults (I don't recall the exact number, but it was on that order or magnitude). Switch failures would fall under controls, but the historical rate of switch failure caused shutdowns is small enough that the overall rate would be vanishingly small.

Yes, the more complex a system becomes, the greater number of failure modes could be envisioned.

This reasoning doesn't correspond with how modern aircraft are designed and constructed though. They have been made ever more complex, precisely in the name of safety.

If you take this "any new complexity adds potential unintended consequences" philosophy to the extreme, why not stay with cable operated flight controls, remove flap extension protection or WOW sensors, or any one of the systems that are designed into modern aircraft?
It usually takes something bad to happen in the exact same way a few times before a change is made. I hope this is not one of those situations.

So dual failure would be <1 per 10 billion engine flight hours. With ~100 million hours of commercial flight each year that might claim to be "once a century". I hope I got the maths right?

I don't have much confidence in those numbers, but it is certainly a rationale.Colour me skeptical. People are not that good at avoiding profitable trade that sometimes results in disasters.