Just as a followup to the above, Boeing and the FAA both say that although the issue is real, it’s been sensationalized by some media (quelle surprise!). They say it’s “not an immediate safety issue” and will be addressed in due course. Still, not a great look for Boeing amid its other troubles.
I agree this seems a little sensationalized. There are Airworthiness Directives published almost every single day and they don’t make the news.
The common language understanding of the term “unsafe condition” is quite different than the regulatory one. It’s still a condition that requires correction, but it doesn’t mean “ZOMG plane will go boom!” the way the media spins it.
I don’t know the numbers and specifics on this case, but an ignition/fire in a fuel tank is coded as potentially leading to a “catastrophic” event. This means that the aircraft design has to be such that the probability of the event happening is less than 1x 10^-9 per flight hour. If Boeing discovered a failure mode that raises that probability to 2x10^-9, it’s still an unsafe condition requiring correction but isn’t an immediate safety issue as it’s still pretty much extremely improbable. Of course if the event is more likely to occur, say 1x10^-5 events per flight hour, then the issue would be deemed an immediate safety issue and corrective action would have to happen much sooner.
There is extensive regulatory guidance to follow to make the decision on what systems and risks are categorized as catastrophic, hazardous, major and minor, what probability outcomes those have to have, and from there, how to determine response time to correct the issue (anything from"immediate grounding" to “within 5 years”).
Here’s a wikipedia article as a starting point but it’s an incredibly complex field of engineering. My work consumes these risk assessments but I’ve never created them.
I don’t know; if they’re actually listening to their engineers and trying to fix problems before they happen, that’s a step in the right direction.
Another would be moving their headquarters back to Seattle.
Just want to say thank you for that very informative insider analysis.
You’re welcome. This stuff gets super nerdy and technical really fast and it can be hard to simplify in layman’s terms. I enjoy trying to teach but I don’t always succeed!
Totally unrelated but fun little regulatory fact that’s part of what got me hooked onto the concepts and arguments around certification and airworthiness;
The standard pertaining to doors used to read something to the effect that indication in the cockpit should exist to tell the crew when the doors were closed, latched and locked.
After various incidents and whatnot, the regulations changed. They now read that there should be indication in the cockpit to inform the crew when the door is not closed, latched and locked.
The simple logical shift there, with one word, is massive in terms of effects and philosophy pertaining to safe design. A successfully closed door isn’t particularly interesting from a safety perspective. A door that appears to be closed, but may not be, is a huge concern!
I freaking love this airworthiness stuff and all the nuances that go with it.
Not good to lose one of these wonderful planes, and even worse to lose the pilot.
Someone here posted ages ago describing instrument panel lights following a “normally off” design (I think that was the phrase they used). I noticed the same thing on the dashboard of my car. There’s an indicator that shows when my headlights are on, and another for the high beams. There’s another indicator that shows when the traction control is off.
It’s interesting to see the analysis of aircraft accidents. There are times when everything the flight crew needs to know is right in front of them, but hidden in plain sight, as it were. There are so many controls and gauges that finding what matters is the tough part. It’s impressive, and a testament to the designers, that it all works as well as it does.
I know it under the term “dark cockpit”. It minimizes distraction, reduces nuisance messages, and presents only the information a pilot needs to understand the state of the aircraft and what actions they need to perform in response to it.
You don’t need a light on to tell you the engine is running as it should. You need to be told when it’s running in a problematic state, or something has failed, so that you can respond to that and resolve it.
I’m also frequently amazed at how complex this all is -even if I work in the field and see some of this stuff get developed - and how efficient modern designs are in the interest of increasing safety.
I do less work in cockpit than in cabin. I’m much more interested in keeping the untrained, uninformed, and inattentive passenger safe. How can we design and communicate what we expect a passenger to do in response to the aircraft? How to we maximize survivability?
I gather it wasn’t always that way. I think the status lights used to be on when the corresponding system was on, and off when it was off.
The problem was just what you suggest. When something was wrong, it didn’t really call much attention, which is the whole reason for having status lights in the first place.
It seems super obviious now, but those are the sorts of things we’ve learned over the years.
Absolutely! I did a training course where I got to play in a couple simulators (not full flight, sadly) and we compared a Challenger 601 with a 605. The earlier model was old school flashy Christmas tree: lights for everything and lots of nuisance indications (like, turn on the battery, and both engine systems would freak out because they weren’t running, even if you hadn’t started them at all yet). The second, being newer, was much simpler and less overwhelming by far!
When I’m in a much newer plane, it’s almost odd how little indication there is. You can flip to status pages but nothing is getting your attention unless it really matters (or the plane thinks it matters; a plane on jacks with flaps deployed tends to immediately tell you it’s stalling!)
Is there a ‘lamp test’ button and checklist step, though? Otherwise any discrete indicator light could easily fail to the unsafe side, couldn’t it?
There will be a lamp test and each fault light typically has two lamps. Additionally there will be other annunciations depending on the severity of the problem. A typical setup would be that if a fault light comes on then a master warning light on the glare shield will flash and there may also be chimes as an aural attention getter. If the lamp in the fault light itself has failed you will still get the two master warning lights and the chimes.
The dark cockpit concept is great. To set up the overhead panel in the A320 you push any buttons that have a white “OFF” light illuminated. All you are left with prior to engine start is six lights, the APU power, APU available, APU bleed lights, two fault lights for the engine generators, and a light showing that the CVR is recording on the ground. With a quick glance you can see that you won’t be embarrassed by trying to start the engines with the fuel pumps off (for example).
There are still some lights that are on to show the status of a system. For example the engine anti-ice buttons on the overhead panel are ON in blue when the system is on, no lights when the system is off but functional, and there is a fault light if the system is not working correctly. The APU systems have lights to show their status as well.
As a general rule you could say that systems that are used at the crew’s discretion will have an advisory ON light while systems that are permanently operating unless there is a fault will have no light when all is well.
Some quite incredible footage of an aircraft apparently making an engine-out landing at Bankstown, Sydney.
That was almost bad.
Looks like the pilot kept the gear and flaps up to glide as far as possible.
Isn’t there a story about Bob Hoover at Edwards; was gonna land short so he bounced the wheels off a road, over the boundary fence, and then landed safely?
As in, a good landing is one you walk away from.
The Spitfire looked relatively intact so maybe a flat spin.
The nice thing about setting up a landing is that you can trim the plane and watch to see if the landing spot doesn’t rise in the view (meaning you’re going to be short). It looked great until flying over the large building. That would have make me think twice. I would have landed in the street with the wheels down (if possible) and called Uber for a trip to the nearest bar.
I think they headed to the bar anyway…
Meanwhile, also in Australia, just a refreshing non-mechanical incident of passenger freakout
Not on my aviation "situation " bingo card.