Posts by user "tdracer" [Posts: 96 Total up-votes: 415 Page: 5 of 5]¶

There are good, valid reasons for the ICAO accident investigation rules - and one of those rules says they'd don't release information until it is properly vetted and validated. As I posted previously, the preliminary report actually had more data that most - it would have been very easy for them to have simply said that the engines quit - one second apart - starting 3 seconds after liftoff. Instead they added detail, including a brief synopsis of a pilot conversation regarding the fuel switches. All this is factual. What they don't release is non vetted information and speculation - such as who moved the switches and why - because that's still being investigated.
Early releases of unvetted data can not only cause unproductive public reactions, it can result in external pressures being applied to the investigative team that can adversely affect their ability to come to the correct cause. Furthermore, I cannot recall a single preliminary report that contained anything like an actual CVR transcript. Those are routinely included in the final report, but not preliminary reports. About the only time you'll see unvalidated information is when there is a suggestion that there is an imminent air safety threat - in which case appropriate emergency inspections are ordered (sometimes even aircraft groundings).

I have a pretty vivid memory: In the aftermath of the Chicago DC-10 crash when the engine ripped off the wing, a couple of days later some department head (I don't remember if he was FAA or NTSB) stood on the podium holding a broken bolt and pronounced that it was the reason the engine came off. Unvetted information that turned out to be complete BS - but resulted in massive outrage that 'the engine was held on by one bolt' - more BS. Fortunately it didn't derail the investigation - and even had a silver lining in that the order bolt inspections lead to the discovery of the actual pylon structural damage that had caused the engine mount to fail. Similarly, after the Columbia Space Shuttle disaster - I watched the clueless head of NASA stand in from of the TV cameras and state as fact that a piece of foam could never have punched a hole in the Columbia wing (obviously never studied that mass*velocity squared thing) - which of course we again know was complete BS.

I've been involved in a few fatal accident investigations - the big one being the Lauda 767, where I was called in early. I was one of the first people to see the FADEC NVM readout that made it painfully obvious that the T/R had deployed at 23,000 ft. - something that we didn't think could happen. We (Boeing) had missed something, and a lot of people had died as a result. It really bothered me (more than once during that investigation, when I got home from work, I just sat down and drank a large glass of Scotch). And not being able to discuss any of it with anyone not involved in the investigation just made it worse. But I knew the rules, understood why there where there, and I followed them.

Very true - which is why the mantra of 'never say never' is a big part of any accident investigation.
But we're talking about here is a failure that's never happened before - affecting two systems that are designed from the ground up to be separate and isolated from each other - occurring nearly simultaneously on both systems. That's where the odds against it become astronomical.

First off, as has already been pointed out, the French prosecutor was not working to ICAO standards for an accident.
Ok, so they put in the preliminary report that the captain intentionally turned both fuel switches to CUTOFF, causing the crash. The Captain and his family is vilified, criminal investigations are launched. Vengeful relatives of those killed in the crash attack - perhaps even kill - members of the captain's family.
Then it turns out that it's NOT what happened... The captain's reputation and his family have already been destroyed - irreparable damage has been done, and no amount of retractions and apologies for the mistake are going to correct that.

Is it really too much to ask that we allow the investigation team to verify and validate their information before we throw someone to the wolves?

Yea DAR, it's time for another break. It's been days since anything really new has been posted - just hamster wheel arguments of the same theories, and even stuff that I thought had been thoroughly discredited, dead, and buried has come back to life (e.g. TCMA and the fuel condition switches both unilaterally changing state).

If something new comes up - then either reopen or someone can start a new one.

Having gone on countless flight tests during my career, I was always impressed by the competence and abilities of the Boeing Flight Test Pilots. Most of the flight tests I participated in involved at least one engine shutdown and windmill relight (part of our standard 'First of Model' FADEC software cert flight). The pilots would always use extreme care to make sure they got the correct engine - including putting their hand on the fuel switch and having the other pilot confirm it was the correct switch before setting it to CUTOFF.

But even Flight Test pilots can have a brain fart. Didn't happen to me, but it did happen to one of my best friends. They were doing in-flight start testing of the 757/RB211-535 (and the Rolls engine is a bit notorious for being a fickle in-flight starter). They were doing a corner point condition when the test engine went into a hot start. One of the observers said something like 'it's gone hot, shut it down'. The left seat pilot calmly reached down and shutdown the good engine . Fortunately they were at about 30k, and they were able to recover and get both engines restarted before losing to much altitude.

I was told the Flight Test pilot in question was immediately demoted from "Experimental Flight Test" to "Production Flight Test" (where they do routine shakedown flights of new production aircraft prior to delivery).

I think the most pertinent 'findings' have been released - that they found nothing wrong on the aircraft side and there are no fleet safety concerns with the 787.

Someone set both fuel switches to CUTOFF about a second apart. That's the 'what'. Figuring out the who and why is far more complicated and will take time. As safetypee notes, their obligations there are not to us or the media, and they need to do their absolute best to get it right. The 'why' might well drive changes far and wide in the industry.

I watched it last night - nothing new or that hasn't been discussed endlessly here. Reasonably even handed, although I didn't like all the attention to the 737 MAX fiasco (IMHO, a Red Herring with regard to this crash).
Go into some detail regarding the possibility of pilot suicide (although not much attention to the "brain fart" possibility) - with the obligatory rebuttal from another pilot.
Lots of interviews with grieving relatives.

To be fair, we're not the target audience - for 99% of the traveling public, it was a decent summary of what's currently known about the accident and educated them with regard to what's currently known. Too much tear-jerker stuff for my tastes, but that's the state of TV these days.

With regard to my use of the term "brain fart" - I have never, ever referred to myself doing something stupid as an 'action slip' - I always say I had a 'brain fart' (or perhaps a 'senior moment').
I don't really consider it disrespectful to referrer to someone else doing something stupid with the exact same term I'd use to describe myself doing the same thing.
You are free to free differently.

Good grief - I hate it when politics get involved in accident investigations.
Let the professional investigators do their jobs - keep the politics and theatrics out of it.

Sadly, people will sue anyone with deep pockets - regardless of the facts.
Prime example, Boeing was sued for the Bagram 747-400F crash - after the report was released that the inadequate, overloaded cargo tie-down straps had failed causing the cargo shift.

As has been discussed multiple times in this thread (and the other related threads), the fuel switches are hard-wired from the flight deck to the engines (and the FDR information comes from that same hard-wired signal).
There are no known ways that a 'core' system fault could shutdown the engines.

I do wonder about the stab system faults - although apparently corrected, a good pilot would have reviewed the log and known there had been issues. It might have left him 'pre-loaded' to take action for a stab system problem - which turned into an 'action slip' of moving the fuel levers.

There is absolutely nothing ambiguous about the statement "switches t ransitioned to CutOff". The preliminary report reports the facts as currently known about the investigation - any ambiguity in the report is in areas that require conclusions - not facts (e.g. why the switches moved, or who moved them).
When you need invent stuff (or new meanings) for your hypothesis to work, it's time come up with a new hypothesis...

More click-bait BS - the 787 has enhanced engine monitoring - GE specifically uses something called an "EMU" - Engine Monitoring Unit - a box on the engine separate from the FADEC that monitors and records 'engine health data'. The EMU records the data, and can also send out reports (via ACARS or WiFi type downlink) so that ground based assets can keep track of the engine health and direct the operator when to overhaul the engine or to remove an engine before a pending fault can result in a shutdown.
Most of the engine health monitoring sensors are not only not required for dispatch, there is no requirement to ever fix them if they fail (since they are not involved in the FADEC engine control algorithms) - the failure of an engine health monitor sensor only means you don't get as good of health monitoring data for that engine (and engine health monitoring is optional and not covered by the regulations).
It's possible - even likely - that the sensor had been faulted for months or even years before that flight.
Totally irrelevant to the accident.
These people are really clutching at straws in their attempt to make this Boeing's fault.

A major reason why an intentional pilot act is so awful - aside from the normal revulsion to murder - is that nobody really knows what to do about it.
Travel by air is incredibly safe today because we've had a century of accidents to study, understand, and put things in place to prevent a future occurrence - be it improved flight deck procedures, better aircraft design of systems and redundancy, or safety systems like TCAS and GPWS (or in many cases, some combination of those).
But collectively we don't have a clue what to do about something like Germanwings. Oh sure - various steps were taken such as never leaving one pilot alone in the flight deck - but that's basically just 'feel-good'. We did something so now everyone can feel safe again.
When the awful truth is that if one of the pilots decides he/she wants to crash the aircraft - there is -all that we can do to stop them. It doesn't particularly matter the motive - suicide, religious nuttier, some political motive, etc. - if a pilot wants to crash bad enough, they'll find a way.
BTW, I still lean towards the 'action slip' explanation - but we're not much better at preventing than preventing a future intentional action crash.

Similar. For example, temperatures and/or pressures are measured at certain points in the gas path. Some of those measurements are used in the engine control algorithms - but not all. The others are used in engine health algorithms that are used measure how healthy (i.e. efficient) the compressor/turbine/burner are. If one of those health monitoring sensors fails, it has zero effect on the engine control as those measurements are not used for engine control (some don't even go to the FADEC, and if they do - it's simply as a pass-through to whatever health monitoring system is being used). Now, when that health monitoring sensor has a fault - it does set a maintenance message, but that message does not impact dispatch in any way.

Engine control system faults are grouped into four categories.
The most serious become "No Dispatch" - the fault is serious enough that the FADEC can no longer reliably control the engine and/or the probability of a shutdown becomes unacceptably high.
The second category is 'short time' faults - these are loss of redundancy faults - dispatch is still allowed for a short time to allow the aircraft to get somewhere that the fault can be corrected. These faults set a Status level message on EICAS (I'm sure Airbus does something similar) - that leads to dispatch via the MEL (usually 10 or 20 days).
The third category is 'long term' faults - which is exactly what it sounds like. Long term faults must be checked and corrected periodically (generally between 500-2000 hours depending on the engine type and fleet history) - the long term fault interval is now defined in the engine manual (under 'life limited parts). If you go back to the early days of FADEC (e.g. 747-400), there was a CMR to periodically check for and correct long term faults - but operators hate CMRs (paperwork nightmare) so later FADECs incorporated into the engine manual.
The fourth category are 'don't care' faults - faults that only involve engine health monitoring generally fall under that category. There is no requirement to ever check for - never mind correct - those faults.

THIS!!! While there is attention paid to factors to help prevent pilot mistakes, every safety analysis pretty much assumes that a pilot it not going to intentionally endanger an aircraft.
The Boeing fuel switch design is beautiful in its simplicity. A toggle switch - with detents to discourage unintentionally movement - hardwired directly from the switch to the engine with just an interposing relay. Further, the actual devices on the engine that turn the fuel ON or OFF are of a design that - if they lose power - they simply stay where they are. This latest theory that a problem with the aircraft electrical system caused it to lose electrical power and the lack of aircraft power caused the engines to shutdown was ridiculous from the start. That simply cannon happen.
When we started working on ETOPS, we looked at the historical rate for various shutdown causes and literally assigned design requirements that various systems had to stay below those rates.
For example, in the engine controls arena, we were allowed something like 2 shutdowns per million hours for engine control faults (I don't recall the exact number, but it was on that order or magnitude). Switch failures would fall under controls, but the historical rate of switch failure caused shutdowns is small enough that the overall rate would be vanishingly small.