10 ms·

Boeing’s answer seems to say if you accidentally pull the thrust reverser lever before the aircraft is on the ground it just force shuts down the engines. That

Boeing’s answer seems to say if you accidentally pull the thrust reverser lever before the aircraft is on the ground it just force shuts down the engines. That sounds like an odd safety override. Surely a better solution would be to just not activate reverse thrust. Unlike car engines a jet engine can’t just be quickly restarted if it accidentally shuts down. It typically takes 30-60 seconds to get going. This and earlier incidents are highlighting the dangers automation can add to mission critical systems. No pilot wants to hear notices about “hey, so in case you didn’t know our programmers added some code that does this strange uncommanded thing when you push buttons a certain way”

DoofusOfDeath 8y ago
Is that true even if the turbines are still spinning very fast?
- joezydeco 8y ago
  A thrust reverser isn't like the reverse gear on your car. It's a vent that opens to blow exhaust gases to the front instead of behind.
emiliobumachar 8y ago
A tough call. Your solution would disappoint a pilot who actually wanted to slow down ASAP more than Boeing's solution, and might contribute to a runway overrun.
- ravingraven 8y ago
  No, it would not. If the engine is shut down moments before touching down it would mean that there would be no reverse thrust after touching down since it takes a considerable amount of time to re-start a turbo-fan (not 60 seconds as OP wrote as the engine is still spooling but still a significant amount of time and I don't think that any pilot would go through the workload and checklists of re-starting an engine during the landing roll anyway). This leads to a longer braking distance. The sane choice would be to not engage reverse thrust at all (until the pilot has reset the reverse thrust throttle) or to only engage reverse thrust once the landing gear has weight on it.
  - dmead 8y ago
    hundreds of people are going to die.
    - Retra 8y ago
      Only if the people in this thread are designing aircraft. Presumably the actual aircraft designers have more experience reasoning through these kinds of problems.
  - jagger27 8y ago
    > or to only engage reverse thrust once the landing gear has weight on it. Having reverse thrust depend on a sensor that could fail seems like a poor choice. What if the landing gear don't drop? Is there a situation where you would still want reverse thrust without landing gear?
    - usefulcat 8y ago
      How would that work exactly? Surely the engines will be among the first things to be destroyed on 'landing' if the gear aren't down.
      - rpeden 8y ago
        It depends on where the engines are mounted. There was a Tu-154 that landed gear-up in Greece, then took off again, dropped the landing gear, and landed normally. https://en.wikipedia.org/wiki/Mal%C3%A9v_Flight_262 https://en.wikipedia.org/wiki/Mal%C3%A9v_Flight_262
      - jagger27 8y ago
        There are plenty of examples of non-catastrophic belly landings. I'm no pilot or aircraft engineer, so I don't know for sure if you'd want reverse thrust in such a situation. https://en.wikipedia.org/wiki/Belly_landing https://en.wikipedia.org/wiki/Belly_landing
    - rpeden 8y ago
      Sometimes you'd like to have reverse thrust in-flight if you want to descend really, really quickly. Airliners don't have that feature anymore, but the C-17 and C-5 do. Actually, maybe some ex-Soviet airliners can still do it. DC-8s being used by cargo airlines could possibly still technically do it, but don't use the ability.
sbradford26 8y ago
So the bulletin says that activating the thrust reversers too soon can cause un-commanded high trust. Activating it too soon by itself does not cause a shutdown. But one monitor that could stop the engine would be the overspeed monitor. The un-commanded high thrust might have tripped the overspeed monitor on the turbines and shut both of them down. There are numerous other monitors on the engines that might also play a role. So determining root cause might still take a while still.
cm2187 8y ago
I thought that most modern aircrafts were not allowing the reverse to be deployed if the wheels didn't touch the runway. Talking about an odd safety override. It's kind of a self-destruct button.
- metalliqaz 8y ago
  It's not an odd safety override. An overthrust situation is always dangerous for various reasons. One of the more spectacular is the possibility of liberating airfoils from the engine and shooting them into the cabin. It's not a self-destruct button, it's anti-destruct limit. As for the thrust reverser, there are many integrated systems on the aircraft. It's possible that the cockpit detected weight-on-wheels, but the flight mode hadn't yet transitioned for the engine controls.
  - cm2187 8y ago
    By self destruct, I meant switching off the engines in flight seems to me to be a terribly dangerous behavior.
    - ricardobeat 8y ago
      I think almost every plane can glide safely for a lot longer than it takes to restart the engines. Could be dangerous at low altitudes still.
      - aaronmdjones 8y ago
        That and restarting an engine in-flight is faster than starting it on the ground because it's already spinning (by virtue of sailing through the air, like a windmill). This is, aptly, called windmill starting.
    - t0mas88 8y ago
      Switching off is much safer than a turbine overspeed past certain limits. Because an engine failure (one engine) is a situation all pilots are trained for and it has an almost certain safe outcome. Airplanes fly and land just fine on a single engine. We all train for engine failures all the time. On the other hand, a runaway engine fire or uncontained turbine failure is much much more likely to cause a crash. So almost all jet engines are designed to have a shutdown (sometimes helped by the built-in fire extinguishers) as a worst case outcome. The quick response drill for an engine overspeed or temperature past certain limits is to shut it down immediately and pull the fire extinguisher handle.
ken 8y ago
This is an issue carmakers have had to deal with, too, since the invention of the automatic transmission: what if you put it in reverse while driving on the highway? There are a number of YouTube videos with people who have tried it. The answer, in a modern car: pretty much nothing. It just stays in Drive. On one car, it turned on the backup camera display!
- blattimwind 8y ago
  Standard transmissions nowadays often include mechanical features as well that make it very difficult / impossible to engage reverse (and first gear) while going forwards at more than a few km/h.
  - dsfyu404ed 8y ago
    Even a 1950s era transmission will still be very hard to force into a gear if the speed difference is too great. Likewise you'll have a very difficult time shifting into reverse or 1st at speed. That's just how syncros work. You might be able to overcome it by double clutching but it would require conscious effort. Even just shifting to reverse while rolling is difficult.
    - inferiorhuman 8y ago
      Still possible though. Years ago a friend and I pulled a manual transmission in a junk yard. He got it home, installed it, and then discovered reverse was completely stripped.
      - dsfyu404ed 8y ago
        A stripped reverse gear would be indicative of failure to put it in reverse. If the connecting rods had fled the engine that would indicate that someone succeeded in getting it into a gear it didn't want to be in.
nck4222 8y ago
Do you have experience with aircraft engine design, or landing protocols, or insight in to the meetings when the engines were designed? If so, I'll take back my words but considering the manufacturer doesn't know exactly why this happened, and the engineers on the ground said it seems like a "software bug", it seems a bit presumptuous and frankly a bit comical to start saying things like: "Surely a better solution would be to just"... Ah well, glad a 5 sentence comment on the internet can resolve an issue in a hardware, software, and social engineering challenge decades in the making.
- maxxxxx 8y ago
  I always love it when you have worked on something for months and someone new comes by and says "Why don't you just X?".
  - markholmes 8y ago
    In this case, possibly years
  - ergothus 8y ago
    It's worse when they are right though. I wish I could say that had not happened to me.
    - maxxxxx 8y ago
      I am fine with that. In most cases they aren't though. Or they don't understand the whole environment.
      - jiveturkey 8y ago
        My experience is about 50/50, both with my own mistakes and with others. Generally when one is very close to the problem, one sees the environment as immutable. Because, well you spent very many hours building that environment, for very good reasons. And your complex solution "has to" work within the constraints of that complex environment. Whereas, the "mind of a child" that doesn't grok the environment, also doesn't have a fixed notion of it. This is anecdotal of course, but maybe half the time what I see happen is that it's easier/better to change the environment and this can only be seen with fresh eyes. It's not the spoon that bends, and it's not you that bends around the spoon. There is no spoon.
hirowan 8y ago
I think you've misunderstood. The system you're describing kicks in when (a) the aircraft is on the ground, (b) commanded thrust is idle and (c) the engines continue to produce thrust above idle (when there is an overthrust condition). Boeing does not cut power to the engines to prevent reverse thrust application in air - that would be absurd. On this particular occasion the system is thought to have malfunctioned in some way (e.g. it might have not registered the application of reverse thrust) triggering a shutdown.
- outworlder 8y ago
  I thought that they did as a mitigation for uncommanded thruster reverser application.
hopler 8y ago
It's weird to call it a "danger" when the automation is making a suboptimal response to override a human error that could crash the plane.
asdfadsfgfdda 8y ago
Thrust reversers can never be deployed while airborne. This engine shutdown system is only enable on the ground. It's designed to shutdown an engine if the engine thrust doesn't match the commanded thrust, so an engine malfunction on the ground cannot cause the plane to taxi out of control. But it is still possible for the pilots to deploy reverse thrust too soon, after touchdown but before there there is enough weight on the wheels to provide sufficient steering. I'm guessing the pilots deployed too soon, and discovered a new corner case.
- sp0ck 8y ago
  Definitely you can use thrust reversers before touchdown at least on B737. I wonder how big is a difference between software on B737 and B787. Aviation industry doesn't have tendency to build software from scratch. Here is example video: https://youtu.be/-RO66a_nvus https://youtu.be/-RO66a_nvus
  - avian 8y ago
    Hey, thanks for this video. I was on a flight that did that some years ago when I was doing a lot of traveling. I don't remember anymore where exactly in Europe it was, but no one I later talked to believed me that the pilot would engage thrust reverser before touchdown.
- burfog 8y ago
  Maybe the 787 won't allow airborne use, but other aircraft allow it. It's useful for steep descent. If the feature were more common, obstructions near airports (like mountains) would be less of an issue. We could build new runways at some airports. https://en.wikipedia.org/wiki/Thrust_reversal#In-flight_operation https://en.wikipedia.org/wiki/Thrust_reversal#In-flight_oper...
phire 8y ago
I'm willing to bet that the plane does prevent the pilot from activating reverse thrust when not on the ground. But what if a thrust reverser self-activated, without being commanded? The previous safety mechanism wouldn't help because it's being bypassed. So there is a secondary safety system that detects such situations. Something along the lines of "I think the trust reversers shouldn't be activated right now, yet they appear to be activated. The engine is clearly malfunctioning, lets shut it down" It appears that this secondary safety system has been activated. There was probably a bug, or a sensor malfunction that triggered it.

DoofusOfDeath 8y ago

Is that true even if the turbines are still spinning very fast?

joezydeco 8y ago
A thrust reverser isn't like the reverse gear on your car. It's a vent that opens to blow exhaust gases to the front instead of behind.

emiliobumachar 8y ago

A tough call. Your solution would disappoint a pilot who actually wanted to slow down ASAP more than Boeing's solution, and might contribute to a runway overrun.

ravingraven 8y ago
No, it would not. If the engine is shut down moments before touching down it would mean that there would be no reverse thrust after touching down since it takes a considerable amount of time to re-start a turbo-fan (not 60 seconds as OP wrote as the engine is still spooling but still a significant amount of time and I don't think that any pilot would go through the workload and checklists of re-starting an engine during the landing roll anyway). This leads to a longer braking distance. The sane choice would be to not engage reverse thrust at all (until the pilot has reset the reverse thrust throttle) or to only engage reverse thrust once the landing gear has weight on it.
- dmead 8y ago
  hundreds of people are going to die.
  - Retra 8y ago
    Only if the people in this thread are designing aircraft. Presumably the actual aircraft designers have more experience reasoning through these kinds of problems.
- jagger27 8y ago
  > or to only engage reverse thrust once the landing gear has weight on it. Having reverse thrust depend on a sensor that could fail seems like a poor choice. What if the landing gear don't drop? Is there a situation where you would still want reverse thrust without landing gear?
  - usefulcat 8y ago
    How would that work exactly? Surely the engines will be among the first things to be destroyed on 'landing' if the gear aren't down.
    - rpeden 8y ago
      It depends on where the engines are mounted. There was a Tu-154 that landed gear-up in Greece, then took off again, dropped the landing gear, and landed normally. https://en.wikipedia.org/wiki/Mal%C3%A9v_Flight_262 https://en.wikipedia.org/wiki/Mal%C3%A9v_Flight_262
    - jagger27 8y ago
      There are plenty of examples of non-catastrophic belly landings. I'm no pilot or aircraft engineer, so I don't know for sure if you'd want reverse thrust in such a situation. https://en.wikipedia.org/wiki/Belly_landing https://en.wikipedia.org/wiki/Belly_landing
  - rpeden 8y ago
    Sometimes you'd like to have reverse thrust in-flight if you want to descend really, really quickly. Airliners don't have that feature anymore, but the C-17 and C-5 do. Actually, maybe some ex-Soviet airliners can still do it. DC-8s being used by cargo airlines could possibly still technically do it, but don't use the ability.

sbradford26 8y ago

So the bulletin says that activating the thrust reversers too soon can cause un-commanded high trust. Activating it too soon by itself does not cause a shutdown. But one monitor that could stop the engine would be the overspeed monitor. The un-commanded high thrust might have tripped the overspeed monitor on the turbines and shut both of them down. There are numerous other monitors on the engines that might also play a role. So determining root cause might still take a while still.

cm2187 8y ago

I thought that most modern aircrafts were not allowing the reverse to be deployed if the wheels didn't touch the runway. Talking about an odd safety override. It's kind of a self-destruct button.

metalliqaz 8y ago
It's not an odd safety override. An overthrust situation is always dangerous for various reasons. One of the more spectacular is the possibility of liberating airfoils from the engine and shooting them into the cabin. It's not a self-destruct button, it's anti-destruct limit. As for the thrust reverser, there are many integrated systems on the aircraft. It's possible that the cockpit detected weight-on-wheels, but the flight mode hadn't yet transitioned for the engine controls.
- cm2187 8y ago
  By self destruct, I meant switching off the engines in flight seems to me to be a terribly dangerous behavior.
  - ricardobeat 8y ago
    I think almost every plane can glide safely for a lot longer than it takes to restart the engines. Could be dangerous at low altitudes still.
    - aaronmdjones 8y ago
      That and restarting an engine in-flight is faster than starting it on the ground because it's already spinning (by virtue of sailing through the air, like a windmill). This is, aptly, called windmill starting.
  - t0mas88 8y ago
    Switching off is much safer than a turbine overspeed past certain limits. Because an engine failure (one engine) is a situation all pilots are trained for and it has an almost certain safe outcome. Airplanes fly and land just fine on a single engine. We all train for engine failures all the time. On the other hand, a runaway engine fire or uncontained turbine failure is much much more likely to cause a crash. So almost all jet engines are designed to have a shutdown (sometimes helped by the built-in fire extinguishers) as a worst case outcome. The quick response drill for an engine overspeed or temperature past certain limits is to shut it down immediately and pull the fire extinguisher handle.

ken 8y ago

This is an issue carmakers have had to deal with, too, since the invention of the automatic transmission: what if you put it in reverse while driving on the highway? There are a number of YouTube videos with people who have tried it. The answer, in a modern car: pretty much nothing. It just stays in Drive. On one car, it turned on the backup camera display!

blattimwind 8y ago
Standard transmissions nowadays often include mechanical features as well that make it very difficult / impossible to engage reverse (and first gear) while going forwards at more than a few km/h.
- dsfyu404ed 8y ago
  Even a 1950s era transmission will still be very hard to force into a gear if the speed difference is too great. Likewise you'll have a very difficult time shifting into reverse or 1st at speed. That's just how syncros work. You might be able to overcome it by double clutching but it would require conscious effort. Even just shifting to reverse while rolling is difficult.
  - inferiorhuman 8y ago
    Still possible though. Years ago a friend and I pulled a manual transmission in a junk yard. He got it home, installed it, and then discovered reverse was completely stripped.
    - dsfyu404ed 8y ago
      A stripped reverse gear would be indicative of failure to put it in reverse. If the connecting rods had fled the engine that would indicate that someone succeeded in getting it into a gear it didn't want to be in.

nck4222 8y ago

Do you have experience with aircraft engine design, or landing protocols, or insight in to the meetings when the engines were designed? If so, I'll take back my words but considering the manufacturer doesn't know exactly why this happened, and the engineers on the ground said it seems like a "software bug", it seems a bit presumptuous and frankly a bit comical to start saying things like: "Surely a better solution would be to just"... Ah well, glad a 5 sentence comment on the internet can resolve an issue in a hardware, software, and social engineering challenge decades in the making.

maxxxxx 8y ago
I always love it when you have worked on something for months and someone new comes by and says "Why don't you just X?".
- markholmes 8y ago
  In this case, possibly years
- ergothus 8y ago
  It's worse when they are right though. I wish I could say that had not happened to me.
  - maxxxxx 8y ago
    I am fine with that. In most cases they aren't though. Or they don't understand the whole environment.
    - jiveturkey 8y ago
      My experience is about 50/50, both with my own mistakes and with others. Generally when one is very close to the problem, one sees the environment as immutable. Because, well you spent very many hours building that environment, for very good reasons. And your complex solution "has to" work within the constraints of that complex environment. Whereas, the "mind of a child" that doesn't grok the environment, also doesn't have a fixed notion of it. This is anecdotal of course, but maybe half the time what I see happen is that it's easier/better to change the environment and this can only be seen with fresh eyes. It's not the spoon that bends, and it's not you that bends around the spoon. There is no spoon.

hirowan 8y ago

I think you've misunderstood. The system you're describing kicks in when (a) the aircraft is on the ground, (b) commanded thrust is idle and (c) the engines continue to produce thrust above idle (when there is an overthrust condition). Boeing does not cut power to the engines to prevent reverse thrust application in air - that would be absurd. On this particular occasion the system is thought to have malfunctioned in some way (e.g. it might have not registered the application of reverse thrust) triggering a shutdown.

outworlder 8y ago
I thought that they did as a mitigation for uncommanded thruster reverser application.

hopler 8y ago

It's weird to call it a "danger" when the automation is making a suboptimal response to override a human error that could crash the plane.

asdfadsfgfdda 8y ago

Thrust reversers can never be deployed while airborne. This engine shutdown system is only enable on the ground. It's designed to shutdown an engine if the engine thrust doesn't match the commanded thrust, so an engine malfunction on the ground cannot cause the plane to taxi out of control. But it is still possible for the pilots to deploy reverse thrust too soon, after touchdown but before there there is enough weight on the wheels to provide sufficient steering. I'm guessing the pilots deployed too soon, and discovered a new corner case.

sp0ck 8y ago
Definitely you can use thrust reversers before touchdown at least on B737. I wonder how big is a difference between software on B737 and B787. Aviation industry doesn't have tendency to build software from scratch. Here is example video: https://youtu.be/-RO66a_nvus https://youtu.be/-RO66a_nvus
- avian 8y ago
  Hey, thanks for this video. I was on a flight that did that some years ago when I was doing a lot of traveling. I don't remember anymore where exactly in Europe it was, but no one I later talked to believed me that the pilot would engage thrust reverser before touchdown.
burfog 8y ago
Maybe the 787 won't allow airborne use, but other aircraft allow it. It's useful for steep descent. If the feature were more common, obstructions near airports (like mountains) would be less of an issue. We could build new runways at some airports. https://en.wikipedia.org/wiki/Thrust_reversal#In-flight_operation https://en.wikipedia.org/wiki/Thrust_reversal#In-flight_oper...

phire 8y ago

I'm willing to bet that the plane does prevent the pilot from activating reverse thrust when not on the ground. But what if a thrust reverser self-activated, without being commanded? The previous safety mechanism wouldn't help because it's being bypassed. So there is a secondary safety system that detects such situations. Something along the lines of "I think the trust reversers shouldn't be activated right now, yet they appear to be activated. The engine is clearly malfunctioning, lets shut it down" It appears that this secondary safety system has been activated. There was probably a bug, or a sensor malfunction that triggered it.