The Singapore jets are block 52, built in the late 90s/early 2000s. The particular jet has recently just been upgraded to V-equivalent, with usual RSAF customizations. Thankfully the pilot walked away with no injuries and went back to flying shortly after…. He’s a senior officer and had well over 1,000 hours at incident time. Another peculiar safety decision he had to make was to eject and crash it in base, with only seconds to make that decision.. because less than 5 miles beyond the end of runway is our border with Malaysia.
That is absolutely accurate. Almost immediately after takeoff, all pilots have to turn hard to avoid crossing into Malaysian airspace (We are geographically very very close)
Avionics R&D engineer here. The probability of this fault to occur is way bellow required 1:1e9 per flight hour (=design assurance level A, which is highest in the industry and typically applied to flight controls, loss of which have catastrophic effects), so yes, once in a lifetime
Which I believe means there's (below) a 50% chance of this having occurred within a total of 693,147,200 flight hours... or around 79,126 flight years. For reference, the entire Air Force flies around 1-2 million hours per year, or around 144-228 flight years per year.
It sounds like it should not have happened in like 500 years. But if it depends on gyros with high-speed moving parts, it’s probably like once every 100 years for the first 30 years. Degrading to once every 20 years for the next 20 years and once every 5 years for the next 10. I know nothing, I’m just guessing.
@@Andrew-13579ring laser gyros have no moving parts, dither motor if required excepted - don’t know what spec the gyros are in the F-16, but I would expect them to a. Be of ring laser design, and b. Of the type that don’t require a dither motor. i.e. no moving parts at all. I could be wrong, but most modern aircraft use some form of laser gyros with no moving parts, I’d be surprised if the F-16 used something of lesser quality.
couldnt there be some type of systematic failure? Voting error? Or maybe that the gyros are prone to some type of malfunction that with low probability happens only in 1 gyro but if it happens to both of them by sheer luck you can have this situation? I havent really looked into that but this type of failure is extreme amount of luck or maybe there is something deep in the system that could result in it.
@@phil_nicholls Mover read (at 9:48) the part of the report that explains that the F-16 does indeed use mechanical gyroscopes. More recently developed aircraft tend to use solid state gyroscopes, e.g., the Honeywell units in A320s and the Thales units in A350s use ring laser gyroscopes, as you suggested.
Thanks for the update C.W., glad the pilot didn't hesitate to choose ejection. I taught the maintenance of this system to numerous foreign customers, including the RSAF, over my 28-year career at GD then LM. This was truly a rare event which couldn't be predicted. One note of interest, the pitch, roll and yaw gyros are the exact same part number. The mounting orientation and the wiring harness connectors determine which axis each one senses and which axis the signal feeds. The wiring installation prevents cross-connecting between the axes.
Having the same part number must have been a conscious design decision. I'd imagine it helps simplify logistics quite a fair bit. And the harness/orientation bit you mentioned too.
im still trying to process moving mechanical spinning gyroscope input into electronic computer language for the system..the more i think about it the more i crave cheeseburgers..
Kudos to the pilot for getting out on this crash, kind of scary the final report is already out from such a resent crash, one good thing like you say is at least this will be something that will be maintained in case it might happen again. Thank you, Mover, for your break down and insight into this mishap.
Yeah, once 1 is rejected, it's like "I have three gyros. Two of them agree and one of them is saying something different. That one must be wrong." Even if the computer looks at all four, since 2 and 3 were giving similar results, there's no clear way to resolve the situation.
I was involved in the releasable accident investigations of the F-16’s introduction to the active force (12th AF TAC). With the 4 flight control computers failure modes originally got down to two which disagreed the system failed. That was changed so that if the one in control was not reacting appropriately, time permitting, the pilot could manually select the last flight control computer. If that one did not respond appropriately it was time to get out. As you observed, takeoff allows very little time to analyze the problem and the pilot did well to recognize it was an unrecoverable situation and ejected in a timely manner.
Wow .. thank you for your footnote; makes the build-in of this clip even more interesting for Singaporeans who are keen to know more about what happens in our protected skies ... May we never take our protected skies for granted ... thk u🎉
In my country's Air Force (Portugal), there was a similar event. The F-16AM (MLU) was being tested by the pilot and some faults came up (he didn't specify in the interview) i suppose FLCS faults, but weren't too serious. He decided to RTB, and when trying to land, the jet would pitch up and down full deflection. He had to eject. In the interview, he only says it was a problem with some axis, he didn't specify. But he ejected safely and was flying another F-16 two days after. Naturally he was evaluated by doctors prior to flying again.
Met a US F-16 pilot who had a similar issue. He was doing dogfight sets with a wingman over Alaska, at night in marginal weather. When they terminated and started to head back home, he realized all of his attitude indications were showing a continuous right hand roll. According to his description, some kind of cushion in the control stick encoder assembly failed and caused the last stick input to be repeated to the flight computer until another input was made. He somehow managed to land the jet that way.
As you should be. Just keen to role out the last of the F-16s and buy more F-35s or the upgraded Eagle. That said, your country already contributes disproportionally to the security of our region so perhaps an unfair ask. I know personally how respected the RSAF are by the RAAF.
As a Singaporean, I was quite shocked! Singapore is known to be very strict and has high standards, so me and I think everyone collectively were quite shocked at this event. However, I am quite glad no one got hurt and the pilot ejected safely.
Can't say that when it comes to the MRT right? Maybe in between some Ding Dong decides to use China parts or software as economic replacements and cause this incident. Just saying.
that only applies to motor vehicles, strict licensing and inspection regulations.. our cars cost like homes in the US...our homes cost like ships in the US
retired safety systems engineer here... potential design flaw... when you have redundant voted inputs you do NOT switch in a HOT spare as if it were a raid 5 array that detected a fault and now needs rebuilding... you do your voting if either use your 2/3 inputs cross checking with other inputs (not redundant channels but other inputs that do provide some information about the channel or you simply switch over to the backup channel... while you may not have more (beyond the 2/3 plus backup) inputs that are exactly the same there are at least 3 (likely redundant sets) of accelerometers that baring complete gyro failures should be able to create a "safe" mode of flight.... definitely not a high performance flight mode but enough to get you on the ground again... this is the basic conundrum of "do I use 2/3 logic" or "do I do 3/4 logic" with or without backups... all while SWAP + cost constrained... I would be willing to bet that in the more modern (digital vs analog as changes are much easier to make) versions of the control computer that a safe mode will be created... redundancy alone does not provide defense in depth which is what the system also needs to function and be safe... this was a common mode failure and switching in a hot spare backup does not properly address that failure mode... bear in mind that 3 axis of accelerometers also provide (at likely lower accuracy) P R Y info to perform sanity checks on other inputs... just like the 737 max was a gross design flaw because they used out of range inputs on the AOA input (which were not redundant but could be verified with other air data computer inputs) use any of them would confirm a fault while allowing for a safe mode to get back on the ground, while pitch gyros and accelerometers might not be measuring actual AOA they provide a reality check on the actual failed sensor... boeing did not want to hear this either...
"...just like the 737 max was a gross design flaw because they used out of range inputs on the AOA input (which were not redundant but could be verified with other air data computer inputs).." SO not only did Boeing offer an option of just one AOA sensor to the airlines, which was actually taken up by a few, they did not provide the sanity backup with other sensors as you describe???? How has no one gone to jail over this? How callous can someone be with other peoples families?
Thank you! Excellent, well written comment on a great talking point. (The 737 max part is inexcusable and why there was no "reasonability check" between various bits of data to show that the AOA was erroneous is beyond me. Although those accidents went far beyond sensors and into trim authority, type training and certification testing issues) My conclusion regarding the F-16 is that it just "isn't critical enough" that additional cross checking is required in the Flight Control computer. It's a fighter aircraft with an ejection seat... Maybe they decided that the likelihood of this failure being apparent in the system was so slim, that a cross check of identical components was enough. I have worked on other military aircraft avionic systems, but on aircraft without an ejection seats, where the level of checking you refer to certainly DOES take place. One, two or three sensors process the data for X system, but information from Y and Z systems, which may be completely unrelated are used as a "reasonableness check" to see that everything makes sense. So in the event that sensor 1 for x system was giving erroneous readings, it would use the data from sensor 2 to compare directly, sensor 3 may be used to give a 2/3 majority for that data. BUT if a sensor on system Y and/or system Z doesn't detect a change in something, it lets system X know that the 2/3 data it is getting seems implausible. Then instead of telling the pilot there is a miscompare, or flagging a background fault, it might remove the data and replace with a "fail flag" to prevent erroneous data being given to the crew, whilst they can also see there has been a major failure with something. Sorry for the wordy reply, I'm not comfortable giving too much of a real world example, because of the subject matter, but this is still understandable hopefully.
Back in the 80s I saw within a year a Tomcat and a Corsair crash. The A-7 couldn’t get one of the mains to go down so they belly landed her at Cecil Field and the F-14 did a flyby at Mach and bird strike in both engines they fought it and climbed but eventually punched out the only LZ was the Atlantic.
Incredibly rare to have more than one failure in a redundant system where those multiple failures *_agree_* with each other and thus can cause enough doubt to be cast on the remaining working systems to instead have those working systems ignored. Incredible. If multiple systems of the same type fail, at the very least you don't expect them to agree with one another so well that they make the working systems look like the problem!
Even more crazy when you think about the fact that these rate gyros were very rare to go back and require replacement. That was a lot of small holes that had to align perfectly to cause this incident.
Yeah, totally "freak" incident (engineer here - not aeropace or avionics, but strong safety & failure analysis background). Glad they came up with a mitigation procedure, even though *statistically* it is unlikely to ever happen again over the history of the entire F-16 fleet in service. (However, correlary procedures are probably a good idea for all aircraft that have a similiar "all computer" flight control system, because likelihood is probably similar for all of the other families of aircraft where Robbie the Robot is voting on input validity). Probably the most important *practical* lesson coming out of this is the pilot's realization of theb situtation (even if he had no idea at the time what was wrong) and immediate trained reaction. Enohacizing his correct and timely decision to punch out to all pilots is probably the most important takeaway here. Because the next situation some pilot faces will almost certainly *not* be the coincidental simulataneous *and nearly identical* failure of two of the primary gyros in such a way that they appear to be the good data, thus causing them to "vote #1 off the island" and then, once #4 got brought into the circuit, "vote #4 off the island" because again we had 2x gyros saying one thing and 1 gyro saying something different. (I'm not even sure how one would design around this faikure mode, either, without increasing the number of gyros to 5 or more, and in case of a disagreement between the primary 3, taking an "at large" vote of all the gyros... espexially given thr extremely low prpbabikity of two gyros both being in the "top 3" faiking simultaneously, with false readings that were both "plausible" *and* close enough to each other to appear to be potentially correct... that was multiple extremely low probability failues occurring at the same time, with any one of the low probability failures breaking the other way stopping the mishap.)
I'm curious sir to hear your thought's on the Boeing 737 max being offered to some airlines with only one AOA indicator, which was absolutely critical to the control of the planeand with 200 people on board. On top of the AOA issues, the fact that the pilots werent aware of the augmented control even being fitted which meant they were not aware of the greater likelihood of runaway trim. Aside frm Boeing, the FAA was aware of the option of one angle of attack indicator, and even at a distance should have been aware of the much greater risk of the pilots not expecting a run-away trim event. Hundreds of these aircraft were to be flying all over the world. With your background, you would know that this arrangement would be guaranteed to lead to numerous fatalities over the course of the life of the model. (Unfortunately it didn't take long for the first two to occur). Have you ever seen a situatio such as this where numerous people would have known that completely avoidable fatalities were going to occur. I personally haven't in any field of engineering I have been involved in. I suspect that given the loss of life that was guranteed to occur at some stage, I would contend that even if it was just proven I had known about it, and not said anything, and even if not in my area of my responsibility, I am fairly sure under Australian law I would be criminally prosecuted. Under a similar criminal code to the US. I cannot understand why this has not occurred in this case, save for I think one appalling engineer who deliberately tried to disguise the issue. I apologise for being so verbose. BUT I Have seen many corners cut in engineering in my own and in when working in the US and Europe. But they are more breaches of rules that assist safety, not full on actions Making it all but certain that eventually a large number of people will be killed. Have you ever seen anything similar? Why are not many more people being prosecuted. Any of our families would have been travelling on the 737-max as originally configured at some stage, until a couple went down - probably earlier than expected but was known it was an inevitable.
I believe in at least one airliner model there is a switch to explicitly select which gyro to use. In fact there has been an accident due to the crew also voting to use the bad one. In a fighter things happen really fast so the pilot would not normally have time to play around with gyro selection if he even recognizes the possible problem.
Absolutely!!! Glad to hear that stated, and doubt we are the only ones in the semi-geek fraternity.. Unfortunate/depressing that channels covering the likes of the Kardashians smash their numbers.
Hi Mover, nice to hear from you again. Thanks for explaining how things work in a jet, it's really interesting to hear how things work from the pilots point of view.😊
Very interesting failure mode. I suspect the computer was taking gyro readings with no up/down input as it's sitting flat on the ground, and that's why it passed the test. Probably no way to cause manually input changes to the gyro to test to see if they are reporting valid data.
Not sure how Lockheed could change th FLCS to avoid this. The originial logic made sense to reject the sensor readings that are the odd ones out. When you have 3 sensors and 2 out of the 3 are similar... its less likely that the single different sensor reading is infact the correct reading. You would then expect the 4th sensor to verify/compare this intial assesment. If the 4th sensor now also reads the same as the odd sensor (the correct reading), then you have a split decision as you have 4 sensors reading 2 different readings making both seem just as possible as the other. How the FLCS then decides to chose which readings to accept and which ones to reject is hard to do. I can think of a few ways to address this but will be interesting to see how Lockheed would fix this or not touch it all considering how rare it is to occur per F16 flight hour.
Wonder too if there could be a solution but from what it looks like the FCS basicly degraded to a duplex System and the deviations were small enough to not be filtered. At that point it'd just be luck of the draw.
As a software weenie and aviation buff I could easily see the 2 out of 3 winning, bring in the 4th and it get rejected too. You *could* set it up such that a double failure within the 4 gets the computer's attention. One failing - expected once in a while. Two simultaneously? Very rare. You could make it suspicious enough to then check the 2 v 2. If one side is in disagreement with each other, these are probably the failing ones. If it really is 2 similar vs 2 similar, which do you believe? It *could* (maybe) in the case of rate gyros put in inputs to the flight control surfaces that given the current speed, attitude, alpha, altitude (density), weight/weapons, etc. should produce an expected pitch rate. Obviously there's a margin of error here, that's why they have the gyros for precise data. But it should be able to come up with a nominal expected pitch rate for a couple of quick inputs. It would then have a third "seat of the pants" data point to decide which of the 2 v 2 to believe. Maybe. Don't know if it has the computing power for that, if it could reasonably be done in time to make a difference, and if the calculations could come up with a pitch rate with enough confidence to differentiate between two different data sets from the two sets of conflicting gyros.
Any time it has to bring in the backup gyro, I would say a comparison should be made to the 1st rejected gyro. 50 years worth of the time, its going to agree that the 1st rejection was correct. But if not, then there has to be a tie breaker. The pilot could break that tie, but I wonder if data could as well. Monitoring airspeed and altitude to "guess" the pitch of the craft and then factor that into which 2 of the 4 gyros to trust. Pilot gets an explicit warning to confirm, of course, but it might be enough to stabilize flight and get the plane back on the ground in 1 piece.
@@Taidaan I thought this too. If you have a 50-50 split after the back-up kicks in then it should be up to the pilot to manually select which one gives the better data to the computer via observation. in this case data A (2-3) was making the aircraft response negatively to controls. Being able to select from data B (1-4) would have produced a stable configuration and could be used. This wouldn't need to be a matter of selecting which gyros to use, just which set of conflicting data. If the computer sorts it to just A and B like above, the pilot could get a FLCS FAIL, which they acknowledge with the master caution. Then if it detects the 50-50 after the 4th chimes in it says FLCS DATA OVRD over AB and the conflict should be fixed. Is it worth all of this programming for such a rare event? No, probably not. As he said, these planes are aging and you're going to have bad gyros cropping up and the likelihood increases substantially.
@@Taidaan The time to look at the warning, understand it (it's a rare occurrence), and decide which pair is faulty, could mean the plane goes into the ground ... with the pilot
Hopefully this report will be quickly shared among all F-16 users. It will be interesting if it triggers reports of similar past events. If a pattern is identified, this early report might save lives in the future.
No pattern this is literally a once in a lifetime kind of failure. I worked on the aircraft for 20 years and rate gyros just didn't go bad. So for one rate gyro to go bad in two branches with similar failed outputs thus the FLCS thought they were good outputs is crazy rare.
I feel like they deserve some extra kudos on getting that report out quickly! Would have been sweet to have the extra info that the Air Force provides related to exactly how the jet was oriented at the time of the upset, hiw many g's were pulled, altitude the pilot ejected at, and all that good stuff, but this answers all the high points.
I’m not surprised that we are able to come up with the report faster than the USAF, since the government is answerable to taxpayers. but as pointed out, we may not have as many details comparatively speaking. Singapore dun have a Freedom of Information Act unlike the US - we also appear more particular about our OPSEC
Sometimes, that extra detail is important to know. I wouldn't say the US Air Force is not concerned with OPSEC and withholding any information which could compromise their ability to execute their mission, but, being answerable to your taxpayers also means telling them exactly what happened. I mean, if I wrecked my parents' car, they wouldn't just accept a summary. They would want the full breakdown of who, what, when, where, and why. Again tho, I am only saying all that to defend my point about the value of more information, not to discredit in any way the amazing job done by the RSAF in getting their report out to their citizens, and the world, rapidly, with a clear reason as to what happened, and a warning for the rest of the fleet so that this could possibly save others lives. So, please don't misinterpret my longwinded comment as some kind of slight against their wonderful work. The pilot seemed incredibly skilled to be able to distinguish this error so rapidly and get out of the jet with his life. All around, it was a masterclass of professionalism, and they made Singapore proud on what could have been a dark day.
On paper, Singapore has 59 F-16 (after 1 crashed) and 40 F-15. Not counting those on overseas attachment, and if all F-16s are grounded. There is only some F-15 defending Singapore. They cannot afford this risk, not when Singapore is surrounded by ... ... F-35B only coming in 2026 and F-35A only coming in much later. Unless RSAF get the AH-64 to take on intercepting roles, I think they need to conclude the report fast and get the F-16 flying ASAP.
@ChongSunLim95131 very good point. I don't think the F-16s, though, are really the answer to the F-35 threat. At least not without a substantial investment into other tech. I hear some tech that China is working on, mesh AI electronic warfare was successful against an F-18 Growler wave, apparently. I usually am suspicious of info coming out of China, but the commander on the American side of that confrontation was also sacked, so there was certainly something to that engagement that went poorly for us. Analysts seem to be connecting the AI-driven electronic warfare to this ability for the Chinese to brute force their way right through our jamming and gain firing solutions that they were not able to just a year or two before. It's damn impressive. Anyway, my point was, it would probably require some kind of technology like that, paired with the F-15 and F-16 to counter those F-35s if they were to become a threat to your nation. Is that your concern though? I didn't believe there were nations in possession of F-35s that were hostile towards Singapore.
This is really extraordinary. To have 2 of 3 gyros fail but give the SAME READING, that's pretty wild to think about. Of course gyro 1 would be rejected then, and once gyro 4 was promoted, it too is beat by gyro 2 & 3 outvoting gyro 4's reading. As an engineer, not sure what you would do when you have a 50/50 split even if you were to compare all 4 readings (instead of rejecting #1, then rejecting #4). You'd have 1 and 4 saying one thing, and 2 and 3 saying something else. Which do you believe?
I have read or listen to test pilots debriefs, even those available from Armstrong or Aldrin. They share this common trait that Mover brilliantly displays here: surgical description of events with absolute clarity of how things work. Something actually quite similar to Professor Feynman's lectures. I am not alone in this, I know, but I really love these mishap analysis, especially because it can contribute to reasserting a very much needed mindset of effort, merit, knowledge, preparation, responsibility. You sir honor those who fly and those who, sadly, lost their lives in mishaps. 👍
I believe this might be the second known failure of an F-16 flight control system. Early 1990s at Purdue I attended a discussion of the F-16 flight control system by a test pilot who evaluated different stores configurations at Edwards AFB. He described a flight control failure where a false under-voltage alert caused the hydrazine backup generator to start while the normal engine-driven generator was still making electricity. This extra electrical power caused an over-voltage that fried the four flight control computers in sequence. The horizontal stab went to a static park position and the jet immediately departed controlled flight and hit the ground before the pilot could punch out. This incident was presented as the only known flight control failure of an F-16 at the time. I don't recall if it was a digital or analog system.
Well that doesn't make sense because the power delivery system doesn't send all of the possible power to the FLCS. The converter/regulators look at all of the power sources and sends along what it sees as the best source. This caused a confusing issue for pilots at one point as the aircraft batteries were being overcharged and the converter/regulators doing what they do selected the aircraft battery to power the FLCS which gave the mandatory aircraft battery to FLCS caution light in the cockpit. So you aren't going to get the regular PMG power AND the EPU PMG power going to the system at the same time. One or the other. Unless this was VERY early on in the life of the F-16 and it was prior to the converter/regulators that I worked on in the F-16 FLCS power delivery system.
FCS failures are, like you said, _extremely_ rare, but when one occurs it is usally very serious. Which, I think, leads people to believe that the FBW FCS is a terrible idea. Not so, again as you said most modern fighter jets are inherently unstable, which is great for maneuverability, but abso-fackin-LOOTELY requires the digital FCS. Also, hats off to the investigators for doing a thorough job in such a short time.
I wonder what’s the rate of use vs degradation. The rsaf fly these jets so frequently that they might be the first ones to experience such issues due to increased wear on all components.
It's interesting that the report describes the gyros as the traditional rotating mechanical type, not ring laser gyros or micro-electromechanical (MEMS) gyros as used on most modern airliners. The mean time between failures for mechanical gyros tends to be much shorter. The lower inherent reliability of each unit makes the freak coincidence of dual simultaneous failures of a similar magnitude "less unlikely" by a power of two. An avionics refresh would be nice, but the F-16s have been just a few years from retirement for many many years now, so...
Well I understand why it hadn't been changed just based on my 20 years of working on this aircraft. Rate gyros just didn't fail. They were probably the best item in the FLCS system for reliability.
@@Stubbies2003 Would the oppressive humidity in SIngapore? (and have lived in Alabama as well - makes an AL summer feel mild. I have no idea re affect on humidity of such a device, so very interested in your thoughts.
I think I can explain why gyro 4 was rejected. The control logic doesn't look at all 4 gyros at the same time. Gyro 4 is a back-up only to be considered if one of the main gyros are thrown out by the FCS. Gyro 2 and 3 showed similar inputs, gyro 1 showed correct, but different, inputs. Gyro 1 was rejected and flagged by the system as faulty. Gyro 1 is then dropped from the control hierarchy and is replaced by gyro 4. NOTE, the system is not looking at gyro 1, 2, 3, AND 4. 1 has been declared faulty. It is only looking at 2, 3, and 4. 2 and 3 are the same, 4 is once again correct, but different, so it is declared faulty as well. 2 and 3 are the only remaining "correct" gyros so they have full control. To summarize. - Gyro 1, 2, and 3 in the control hierarchy, 4 is outside the hierarchy as a back-up. - Gyro 2 and 3 fail, but fail in the same way, leading to identical, but incorrect inputs. - FCS declares gyro 1 as faulty because it does not meet consensus with 2 and 3. - Gyro 1 is removed from the control hierarchy and is replaced by gyro 4, which comes off back-up. - FCS compares gyros 2, 3, and 4. Finds that gyro 4 is not in agreement with 2 and 3. - In a 2v1 vote, gyro 4 is declared faulty and removed from the control hierarchy. - 2 and 3 are the only remaining gyros and control the aircraft.
07:30 I can imagine this was sequence of events: Gyroscope 1 deviates. System assumes 1 of bent and takes it offline. Then(!) system brings 4. Now 4 deviates from the majority, is assumed to be bent, and is taken offline.
It is similar too, but not identical. The program was wildly different due to the flight characteristics unique to the aircraft, which are WAY different than an F-16.
Exactly what TSG said. Yes the F-117 did borrow a lot of systems already in use but yeah the flying characteristics of those two aircraft are wildly different. Even the air data system of the F-117 was way more redundant than the F-16. The F-16 having the nose pitot tube and side mounted probe for air data. The F-117 had four pitot tubes.
In Singapore, when faced with an improbable situation, people take it as a superstitious sign to buy a lottery ticket in hopes that the luck would carry over. If the pilot bought a lottery ticket that day and won, it still wouldn't be the most unlikely thing he encountered that day.
2 FCC's collect data normally between 2 sets of sensors, of which 1 set would be primarily and 1 set would be secondary backup. how the primary set of 2 sensors got it wrong yet with such close readings is a true 1 off. I wonder if this would cause a need to ensure both sensor sets are fully functional before fligh? a real 1 off scenario.
Clearly, airliners should also get zero-zero ejection seats. My last flight on United was on a 30 year old bird asking for a South American retirement. Just like us, not all will make it to retirement.
I would guess that if you have three online gyros and two agree and the odd one is tossed out, and then you bring the backup online then it’s still three gyros. The backup indicates the correct state of things and you still have two against one and the backup loses the vote.
Yes, fair comment, but the sensors that produced 'similar' results are not meant to produce similar results outside a very narrow margin. So couldn't you argue that by doing so they were proving themselves to be faulty? Considering the back-up produced dramatically different results? Counter intuitive I know. No ego here, just whole things seems odd, and they are the most numerous fighters in Service with Western airforces so if a degradation issue not adjusted for by code, they'd want t get to the bottom of it.
@@SALUTE-INT-S The FLCS passed the BIT, so the airplane has no way of knowing which gyros are crazy and which are sane. Thus it relies on the probability that two gyros are going to have the same failure at the same time being vanishingly low.
Being a Singapore Citizen, this is my TL;DR: More of my tax dollars have to be allocated to a stringent maintenance program in order to avoid losing even more tax dollars to having the F16 forced to deconstructive lithobraking and scrap salvage. The price of an inherent unstable airframe. The edge in maneuverability, but requiring accurate and reliable computers and sensors to actually allow the plane to be controllable. As the fault developed during take-off, the only thing that can be salvaged intact is the pilot...
There are ways to detect erroneous sensors using sensors made for other reasons. For example, you can compare the pitch rate to measured load factor. You need a flight model of the aircraft in memory to produce expected values that you can then compare to measured values. This can help with the sensor voting scheme. Another example is MCAS. It was literally physically impossible for the 737's angle-of-attack to go bezirk. So a basic integrity check on the sensor should have disabled the system. However, you can estimate angle-of-attack using pitch data in conjunction with inertial or GPS velocity (converted to airspeed using air temperature and pressure) to catch more subtle problems. That Air Florida crash in the early 80s taught us you can use engine pitch to determine rpm and therefore power setting, and a simple check of acceleration using a modem INS would have also caught the low power issue.
Space permitting a nice upgrade could be to replace the mechanical gyros with laser gyros - no bearings or motor to go wrong... I haven't been involved in flight control systems directly but worked on Harrier FADEC, Airbus fuel system computers and many Zero Flight Time simulators (B52/KC135, Airbus A300, A310, Transall C-160, B727, Il-86 (yes!) And others I've surely forgotten. All the best, Rob in Switzerland
Well given the cost associated with the change and how those rate gyros just didn't fail, especially not like this, I can see why this never came up to be replaced.
I gotta say from being both a private pilot and an IT guy, the computer control flight surfaces thing scares the crap out of me, give me cables or redundant hydraulics everyday, I am far to aware of the fragility of computers and their systems to be comfortable trusting my life to them. And yes I am aware they infest everything now.
All nations using the F-16 knew what they were signing up for. This Fighter relies on its inherent instability to outmaneuver other contemporary fighters on a budget The price of using this is reliance on a flight control computer that has to be diligently maintained. Sometimes, even with the best preventative maintenance, the components can fail, and the double poor luck rolls (1. Failure of Gyro and redundancy 2. During Takeoff, with little altitude and airspeed to troubleshoot) results in needing to salvage the pilot and forcing the rest to unplanned lithobraking.
On the part about the correct sensor being removed from the vote and then the spare brought in, this sort of situation also comes up in planning clustered servers. The reason they don't have the fourth sensor "active" in voting is that they need to prevent split votes and ensure that a decision is made - and the chances of the hot spare node providing bad data is roughly equal to the chances of any other node in these circumstances. It's naturally very rare to have two nodes simultaneously fail without a common single point of failure (in the computing world, something like shared power or connectivity are likely ones), especially for them to fail in a way that isn't detected as out of normal bounds. That there was even consideration around this shows there was good planning done during the design of the system - and the fact that this is the first time of decades of flight time is probably a sign they made the right choices there.
Hey Mover, great video as always. Just a quick question, do you think that an FLCS Reset or manually switching to DBU would help in a malfunction like this? If the pilot had time to do any of these 2, of course. I would really like to know your opinion.
I always thought that flight control check was the pilot actuating all the controls. Thats pretty cool it does it itself. I guess now saying it out loud it only makes sense it would be automatic. Just not my first thought
From a total outsider with no knowledge at all of how the jet works - it sounds like gyro 1 was discarded and THEN gyro 4 was activated to bring the active gyros back up to 3 but of course it was outvoted just like 1. It sounds like gyro 4 should be activated before throwing out gyro 1 so it gets a vote too.
@@Motorman2112 This issue is what I lived for 32 years as a FLCS software engineer, so a little bit more in-depth. The military calculates the probability of < 1 in a billion as equal to zero. So, if the probability of an failure of a single device is < 1 in 10,000, the odds of a simultaneous dual failure of redundant devices is zero. So the software design doesn't attempt to manage those kind of failure modes. My gut feel: the pilot either didn't run a FLCS BIT prior to takeoff, or he cycled power on the jet after running the BIT (which resets any failure indications) and didn't run a subsequent BIT.
Had a F111 do a similar thing on T/O in the eighties. Similar flight control computers. Took off with t/o trim setting, at gear up t/0 trim goes away and you retrim manually, it did not work and the nose started slowly down. Full aft stick had no effect, even tried WSOs trim button(nothing). Remembered the guarded standby trim( used by the auto pilot) toggle switch and tried that ( too low to eject) got the nose to come up so I flew a wide pattern with a toggle switch for pitch and a stick for roll. Landed OK. A pretty normal day in the aardvark.
Thx for covering this. Very interesting. I wonder if the STAMP safety methodology proposed by Prof. Nancy Leveson would have uncovered this. In her work she warns that in the age of control by software our (mechanical) ideas about redundancy are outdated. I know too little about STAMP to comment; have to really start reading those books ... But obviously in civil AF477 taught us something about an outdated mechanical redundancy mindset.
Curious if the flight control logic compares the 4th backup reading to the original no. 1 reading that was already rejected to assess if the choice should be reconsidered…although then it might be 2 vs. 2 and who knows how to vote based on that 😬
No, if you had no redundancy this failure would happen with a single gryo breaking, this situation is “once in a lifetime” because the redundant systems broke in a similar way simultaneously. In no way did redundancy cause this.
The F16 is slightly aerodynamically unstable. Wikipedia: The use of a FLCS computer made it possible to build the F-16 as an aircraft with instability around the longitudinal axis at subsonic speed. The F-16 is the first production fighter aircraft intentionally designed to be slightly aerodynamically unstable, also known as relaxed static stability (RSS), to both reduce drag and improve maneuverability. In aviation, an aircraft is said to have relaxed stability if it has low or negative stability. An aircraft with negative stability will have a tendency to change its pitch and bank angles spontaneously. An aircraft with negative stability cannot be trimmed to maintain a certain attitude, and will, when disturbed in pitch or roll, continue to pitch or roll in the direction of the disturbance at an ever-increasing rate. Without a computer, the F-16 would therefore not be controllable by the pilot at subsonic speeds. To avoid unwanted deviations from the flight path, the FLCS processes thousands of measured values per second and automatically activates the actuators on the control surfaces. Control commands from the pilot are received and implemented in such a way that the aircraft does not go out of control. In addition, depending on certain parameters (e.g. flight attitude, speed and angle of attack), various limitations take effect. This prevents lateral gliding, a high angle of attack and manoeuvres that would expose the aircraft to more than nine times the acceleration due to gravity, among other things.
Yeah I worked avionics on the 16 and the rate gyros just don't go bad. I can't even think of 10 instances in 20 years on the aircraft where rate gyros had to be replaced. I went through some EPs but it doesn't even look like DBU is something that could have been a fix here and there was even a warning of NOT using DBU since it could vote back in values that the FLCS had previously voted out. Which, ironically here, were the good values. So yeah this is definitely a once in a lifetime kind of fail and I'm curious as to what in the world they are going to have to do to keep this from being an issue going forward. Based on how this failed and I'd imagine at the speed at which the problem progressed odds are good the pilot had no choice but to bail out.
I was wondering how an inherently unstable aircraft controlled 100% by fly by wire and computer controlled flight surfaces can maintain itself over a long period of time (by fighter jet standards). So are the flight control surfaces constantly moving? How on Earth can it sustain that without it breaking down? Does the aircraft have to be maintained and rebuilt all the time, or are the control mechanisms that well built that they are able to be in almost constant use without needing much maintenance? Has this gotten better in the F35 and F22? It just seems the more complex the vehicle the more error prone they must be. Does it make the pilot nervous that so much is out of his/her control?
I heard a story of a similar character. The pitot tube was plugged, probably by a wasp, causing the 2 speed signals from the pitot tube to be prefered over the 1 signal from the side mounted. Swiss cheese indeed.
@@Stubbies2003 Except for certain passenger aircraft that can carry up to 200 people, i.e. the 737-max which was offered with only one AOA sensor. Criminal.
Mechanical gyros....in wonder if there could be a drop-in ring laser replacement? I'm a civilian pilot flying charter and I don't even like mechanical gyros anymore.
Because it's highly unlikely that 2 systems fail simultaneously, AND that these 2 failed systems would give the same readings to vote out the 3rd and the back-up ...
It adds the backup because you can only determine which gyro is wrong with 3 sources, not two. It already believed nr 1&2 were right, so when the backup is added, it’ll do the same as with 1,2 and 3, which is compare 1,2 and 4. 4 is off when 1 &2 are similar, soo 4 gets thrown out. This is correct behaviour. The problem here is that you have two wineries but believable sources that indicate the same. That’s a 1E-10 event, which is acceptable as it is better than the standard 1E-9 that is applicable for CAT. Soo that is why nr 4 was voted out and that’s why this is correct behaviour.
strange, approaching stupid, not to have used secondary input from accelerometers, and AOA sensor(s) to determine either/and correctness of the rate gyros, or the expected response to the control outputs... this seems so basic, that even us simple mobile phone guys used 'extra" redundancy to act as corrective input to motion tracking software, going on 15 years ago...
I'm thinking the computer rejected the backup gyro because it then became the outlier after the third one was rejected. How about a nice game of chess?
you'd think that the backup gyro's reading would hold more weight when the system makes these decisions given that it's probably less used and thus less degraded than the others, right?
It's constantly in use, on hot standby, it's just not included in the vote. It's not like a stopped standby pump (or whatever) that is only started up when another fails When you need it, it has to be available instantly You can't spin up a gyro while your aircraft is erratically moving around - it needs to know what a static situation with no roll, no pitch, no yaw is.
It adds the backup because you can only determine which gyro is wrong with 3 sources, not two. It already believed nr 1&2 were right, so when the backup is added, it’ll do the same as with 1,2 and 3, which is compare 1,2 and 4. 4 is off when 1 &2 are similar, soo 4 gets thrown out. This is correct behaviour. The problem here is that you have two erroneous but believable sources that indicate the same. Assuming erroneous but believable flight control output is CAT, combined with the 2 out of 3 source voting, then two erroneous but believable sensor outputs need to be AT LEAST 1E-9 (considering FCCs and other inputs, the requirements for this failure condition would be much smaller) Soo that is why nr 4 was voted out and that’s why this is correct behaviour.
The F-16 has a manual 'Pitch override' mode that bypasses the FLCS, (normally used for deep stall recovery) Wouldn't this allow some control in this situation?
learnt something new from the comments, when you have multiple votes, use all of them at the same time instead of sequentially discarding and bringing in the redundant vote. The overall margin of error will actually improve.
If the computer is holding 2 and 3 as true and discarding 1 as false, then if 4 agrees with 1, or is different from 2 and 3, then it must also be false??
Standard control theory. You want an odd number, so you can vote out bad units. If you want extra redundancy, in case one fails, you put a spare that gets brought in if there’s one voted out. If the two failures are in the main trio… you’re out of luck. Replacing those parts with solid state fiber optic gyros might make sense. They don’t have moving parts and last nearly forever…
The Singapore jets are block 52, built in the late 90s/early 2000s with lots of custom upgrades. The fleet has just completed another round of upgrade making them V-standard equivalents (with custom systems of their own).
Hey, hey, hey Mover...slow down with the technical terms there...the plane looks like it is "doing the funky chicken"! And yeah, if you're the pilot of a plane that doesn't know to keep the pointy end forward because the flight control computer sorta forgot...that is a bad day! I can sorta understand the logic that once the #1 gyro data was rejected as erroneous, #2-3 were correct and then when #4 was activated and also didn't agree with #2-3 and it was rejected makes sense.
This certainly isn't a thing you can blame the pilot for. The sequence of events would be almost comical if it didn't crash a plane. The odds of this are probably one in a trillion, at least.
I'm a student at NTU which is nearby Tengah airbase and served my national service at tengah airbase on the day i told my friend who didnt know there was an airbase there was the same day the f16 crashed talk about a jinx 💀
In laymans terms military aircraft are designed to be intrinsicly unstable to maximise manouverability. If they were designed to be intrinsicly stable, like civilian aircraft generally are, they would first have to overcome the intrinsic stability before they could start a manouver with the delay, potentially, causing fatal consequences.
The F-16 is the first one to be inherently unstable (relaxed static stability is what they called it) and fix the problem of that instability with flight control computers which gave you the added performance.
The Singapore jets are block 52, built in the late 90s/early 2000s.
The particular jet has recently just been upgraded to V-equivalent, with usual RSAF customizations. Thankfully the pilot walked away with no injuries and went back to flying shortly after…. He’s a senior officer and had well over 1,000 hours at incident time.
Another peculiar safety decision he had to make was to eject and crash it in base, with only seconds to make that decision.. because less than 5 miles beyond the end of runway is our border with Malaysia.
Could have been awkward! 🙂
Very awkward.
Miss opportunity to have nasi lemak and teh tarik with us😂
@@kazumahaz563 haha, make sure u buy them good ones.
That is absolutely accurate. Almost immediately after takeoff, all pilots have to turn hard to avoid crossing into Malaysian airspace (We are geographically very very close)
Avionics R&D engineer here. The probability of this fault to occur is way bellow required 1:1e9 per flight hour (=design assurance level A, which is highest in the industry and typically applied to flight controls, loss of which have catastrophic effects), so yes, once in a lifetime
Which I believe means there's (below) a 50% chance of this having occurred within a total of 693,147,200 flight hours... or around 79,126 flight years. For reference, the entire Air Force flies around 1-2 million hours per year, or around 144-228 flight years per year.
It sounds like it should not have happened in like 500 years. But if it depends on gyros with high-speed moving parts, it’s probably like once every 100 years for the first 30 years. Degrading to once every 20 years for the next 20 years and once every 5 years for the next 10. I know nothing, I’m just guessing.
@@Andrew-13579ring laser gyros have no moving parts, dither motor if required excepted - don’t know what spec the gyros are in the F-16, but I would expect them to a. Be of ring laser design, and b. Of the type that don’t require a dither motor. i.e. no moving parts at all.
I could be wrong, but most modern aircraft use some form of laser gyros with no moving parts, I’d be surprised if the F-16 used something of lesser quality.
couldnt there be some type of systematic failure? Voting error? Or maybe that the gyros are prone to some type of malfunction that with low probability happens only in 1 gyro but if it happens to both of them by sheer luck you can have this situation? I havent really looked into that but this type of failure is extreme amount of luck or maybe there is something deep in the system that could result in it.
@@phil_nicholls Mover read (at 9:48) the part of the report that explains that the F-16 does indeed use mechanical gyroscopes. More recently developed aircraft tend to use solid state gyroscopes, e.g., the Honeywell units in A320s and the Thales units in A350s use ring laser gyroscopes, as you suggested.
Thanks for the update C.W., glad the pilot didn't hesitate to choose ejection. I taught the maintenance of this system to numerous foreign customers, including the RSAF, over my 28-year career at GD then LM. This was truly a rare event which couldn't be predicted. One note of interest, the pitch, roll and yaw gyros are the exact same part number. The mounting orientation and the wiring harness connectors determine which axis each one senses and which axis the signal feeds. The wiring installation prevents cross-connecting between the axes.
Having the same part number must have been a conscious design decision. I'd imagine it helps simplify logistics quite a fair bit. And the harness/orientation bit you mentioned too.
Glad this one started with "they interview the pilot". Thank you for covering these and putting them in layman's terms.
im still trying to process moving mechanical spinning gyroscope input into electronic computer language for the system..the more i think about it the more i crave cheeseburgers..
could've been by ouija board
Kudos to the pilot for getting out on this crash, kind of scary the final report is already out from such a resent crash, one good thing like you say is at least this will be something that will be maintained in case it might happen again. Thank you, Mover, for your break down and insight into this mishap.
I'd assume Gyro #4 was promoted since Gyro 1 was rejected. Still best two out of three, so it rejected 4 like it'd rejected 1 before.
That’s what I was thinking too
Yeah, once 1 is rejected, it's like "I have three gyros. Two of them agree and one of them is saying something different. That one must be wrong." Even if the computer looks at all four, since 2 and 3 were giving similar results, there's no clear way to resolve the situation.
Yup, it’s never going to compare 1 vs 4. You’d never expect two gyros to fail and give similar data while doing so. Wild set of circumstances.
"Handle like eggs"
Exactly.
I was involved in the releasable accident investigations of the F-16’s introduction to the active force (12th AF TAC). With the 4 flight control computers failure modes originally got down to two which disagreed the system failed. That was changed so that if the one in control was not reacting appropriately, time permitting, the pilot could manually select the last flight control computer. If that one did not respond appropriately it was time to get out.
As you observed, takeoff allows very little time to analyze the problem and the pilot did well to recognize it was an unrecoverable situation and ejected in a timely manner.
Wow .. thank you for your footnote; makes the build-in of this clip even more interesting for Singaporeans who are keen to know more about what happens in our protected skies ...
May we never take our protected skies for granted ... thk u🎉
Never thought I’d see you cover our air force’s incident. Cheers!
For God's sake we bought it from the US, we expect this!
In my country's Air Force (Portugal), there was a similar event. The F-16AM (MLU) was being tested by the pilot and some faults came up (he didn't specify in the interview) i suppose FLCS faults, but weren't too serious. He decided to RTB, and when trying to land, the jet would pitch up and down full deflection. He had to eject. In the interview, he only says it was a problem with some axis, he didn't specify. But he ejected safely and was flying another F-16 two days after. Naturally he was evaluated by doctors prior to flying again.
Met a US F-16 pilot who had a similar issue. He was doing dogfight sets with a wingman over Alaska, at night in marginal weather. When they terminated and started to head back home, he realized all of his attitude indications were showing a continuous right hand roll. According to his description, some kind of cushion in the control stick encoder assembly failed and caused the last stick input to be repeated to the flight computer until another input was made. He somehow managed to land the jet that way.
Thanks for covering this report and going in-depth sharing your aviation knowledge. Proud to be a Singaporean and love for the RSAF
As you should be.
Just keen to role out the last of the F-16s and buy more F-35s or the upgraded Eagle. That said, your country already contributes disproportionally to the security of our region so perhaps an unfair ask. I know personally how respected the RSAF are by the RAAF.
As a Singaporean, I was quite shocked! Singapore is known to be very strict and has high standards, so me and I think everyone collectively were quite shocked at this event. However, I am quite glad no one got hurt and the pilot ejected safely.
Can't say that when it comes to the MRT right? Maybe in between some Ding Dong decides to use China parts or software as economic replacements and cause this incident. Just saying.
that only applies to motor vehicles, strict licensing and inspection regulations.. our cars cost like homes in the US...our homes cost like ships in the US
@@fidelcatsro6948My dude if you think cars are expensive in the US you have no idea how much it costs to own a car in Singapore.
retired safety systems engineer here... potential design flaw... when you have redundant voted inputs you do NOT switch in a HOT spare as if it were a raid 5 array that detected a fault and now needs rebuilding... you do your voting if either use your 2/3 inputs cross checking with other inputs (not redundant channels but other inputs that do provide some information about the channel or you simply switch over to the backup channel...
while you may not have more (beyond the 2/3 plus backup) inputs that are exactly the same there are at least 3 (likely redundant sets) of accelerometers that baring complete gyro failures should be able to create a "safe" mode of flight.... definitely not a high performance flight mode but enough to get you on the ground again...
this is the basic conundrum of "do I use 2/3 logic" or "do I do 3/4 logic" with or without backups... all while SWAP + cost constrained... I would be willing to bet that in the more modern (digital vs analog as changes are much easier to make) versions of the control computer that a safe mode will be created... redundancy alone does not provide defense in depth which is what the system also needs to function and be safe... this was a common mode failure and switching in a hot spare backup does not properly address that failure mode... bear in mind that 3 axis of accelerometers also provide (at likely lower accuracy) P R Y info to perform sanity checks on other inputs... just like the 737 max was a gross design flaw because they used out of range inputs on the AOA input (which were not redundant but could be verified with other air data computer inputs) use any of them would confirm a fault while allowing for a safe mode to get back on the ground, while pitch gyros and accelerometers might not be measuring actual AOA they provide a reality check on the actual failed sensor... boeing did not want to hear this either...
"...just like the 737 max was a gross design flaw because they used out of range inputs on the AOA input (which were not redundant but could be verified with other air data computer inputs).."
SO not only did Boeing offer an option of just one AOA sensor to the airlines, which was actually taken up by a few, they did not provide the sanity backup with other sensors as you describe????
How has no one gone to jail over this? How callous can someone be with other peoples families?
Thank you!
Excellent, well written comment on a great talking point.
(The 737 max part is inexcusable and why there was no "reasonability check" between various bits of data to show that the AOA was erroneous is beyond me. Although those accidents went far beyond sensors and into trim authority, type training and certification testing issues)
My conclusion regarding the F-16 is that it just "isn't critical enough" that additional cross checking is required in the Flight Control computer.
It's a fighter aircraft with an ejection seat...
Maybe they decided that the likelihood of this failure being apparent in the system was so slim, that a cross check of identical components was enough.
I have worked on other military aircraft avionic systems, but on aircraft without an ejection seats, where the level of checking you refer to certainly DOES take place.
One, two or three sensors process the data for X system, but information from Y and Z systems, which may be completely unrelated are used as a "reasonableness check" to see that everything makes sense.
So in the event that sensor 1 for x system was giving erroneous readings, it would use the data from sensor 2 to compare directly, sensor 3 may be used to give a 2/3 majority for that data.
BUT if a sensor on system Y and/or system Z doesn't detect a change in something, it lets system X know that the 2/3 data it is getting seems implausible.
Then instead of telling the pilot there is a miscompare, or flagging a background fault, it might remove the data and replace with a "fail flag" to prevent erroneous data being given to the crew, whilst they can also see there has been a major failure with something.
Sorry for the wordy reply, I'm not comfortable giving too much of a real world example, because of the subject matter, but this is still understandable hopefully.
Excellent. Agree with you.
Looking forward to your review of the Ellsworth B-1 AIB from January. Never read an AIB remotely like it in my life.
Same!
I read it, too. The lack of communication at many levels of that organization doomed the airplane.
Back in the 80s I saw within a year a Tomcat and a Corsair crash. The A-7 couldn’t get one of the mains to go down so they belly landed her at Cecil Field and the F-14 did a flyby at Mach and bird strike in both engines they fought it and climbed but eventually punched out the only LZ was the Atlantic.
Incredibly rare to have more than one failure in a redundant system where those multiple failures *_agree_* with each other and thus can cause enough doubt to be cast on the remaining working systems to instead have those working systems ignored. Incredible.
If multiple systems of the same type fail, at the very least you don't expect them to agree with one another so well that they make the working systems look like the problem!
Even more crazy when you think about the fact that these rate gyros were very rare to go back and require replacement. That was a lot of small holes that had to align perfectly to cause this incident.
You do a fantastic job of breaking these down.
He broke that plane?
Yeah, totally "freak" incident (engineer here - not aeropace or avionics, but strong safety & failure analysis background). Glad they came up with a mitigation procedure, even though *statistically* it is unlikely to ever happen again over the history of the entire F-16 fleet in service. (However, correlary procedures are probably a good idea for all aircraft that have a similiar "all computer" flight control system, because likelihood is probably similar for all of the other families of aircraft where Robbie the Robot is voting on input validity).
Probably the most important *practical* lesson coming out of this is the pilot's realization of theb
situtation (even if he had no idea at the time what was wrong) and immediate trained reaction. Enohacizing his correct and timely decision to punch out to all pilots is probably the most important takeaway here.
Because the next situation some pilot faces will almost certainly *not* be the coincidental simulataneous *and nearly identical* failure of two of the primary gyros in such a way that they appear to be the good data, thus causing them to "vote #1 off the island" and then, once #4 got brought into the circuit, "vote #4 off the island" because again we had 2x gyros saying one thing and 1 gyro saying something different. (I'm not even sure how one would design around this faikure mode, either, without increasing the number of gyros to 5 or more, and in case of a disagreement between the primary 3, taking an "at large" vote of all the gyros... espexially given thr extremely low prpbabikity of two gyros both being in the "top 3" faiking simultaneously, with false readings that were both "plausible" *and* close enough to each other to appear to be potentially correct... that was multiple extremely low probability failues occurring at the same time, with any one of the low probability failures breaking the other way stopping the mishap.)
I'm curious sir to hear your thought's on the Boeing 737 max being offered to some airlines with only one AOA indicator, which was absolutely critical to the control of the planeand with 200 people on board. On top of the AOA issues, the fact that the pilots werent aware of the augmented control even being fitted which meant they were not aware of the greater likelihood of runaway trim.
Aside frm Boeing, the FAA was aware of the option of one angle of attack indicator, and even at a distance should have been aware of the much greater risk of the pilots not expecting a run-away trim event.
Hundreds of these aircraft were to be flying all over the world. With your background, you would know that this arrangement would be guaranteed to lead to numerous fatalities over the course of the life of the model. (Unfortunately it didn't take long for the first two to occur).
Have you ever seen a situatio such as this where numerous people would have known that completely avoidable fatalities were going to occur.
I personally haven't in any field of engineering I have been involved in.
I suspect that given the loss of life that was guranteed to occur at some stage, I would contend that even if it was just proven I had known about it, and not said anything, and even if not in my area of my responsibility, I am fairly sure under Australian law I would be criminally prosecuted. Under a similar criminal code to the US.
I cannot understand why this has not occurred in this case, save for I think one appalling engineer who deliberately tried to disguise the issue.
I apologise for being so verbose. BUT I Have seen many corners cut in engineering in my own and in when working in the US and Europe. But they are more breaches of rules that assist safety, not full on actions Making it all but certain that eventually a large number of people will be killed.
Have you ever seen anything similar? Why are not many more people being prosecuted. Any of our families would have been travelling on the 737-max as originally configured at some stage, until a couple went down - probably earlier than expected but was known it was an inevitable.
I believe in at least one airliner model there is a switch to explicitly select which gyro to use. In fact there has been an accident due to the crew also voting to use the bad one. In a fighter things happen really fast so the pilot would not normally have time to play around with gyro selection if he even recognizes the possible problem.
The rate gyro bit for the F-16 happens completely in the background and there is no pilot control or vote in the matter.
CW lemoine + Ward Carroll + what’s going on with shipping + Steve Lehto are the ultimate small size UA-camrs
Absolutely!!! Glad to hear that stated, and doubt we are the only ones in the semi-geek fraternity..
Unfortunate/depressing that channels covering the likes of the Kardashians smash their numbers.
Hi Mover, nice to hear from you again. Thanks for explaining how things work in a jet, it's really interesting to hear how things work from the pilots point of view.😊
Very interesting failure mode. I suspect the computer was taking gyro readings with no up/down input as it's sitting flat on the ground, and that's why it passed the test. Probably no way to cause manually input changes to the gyro to test to see if they are reporting valid data.
Not sure how Lockheed could change th FLCS to avoid this. The originial logic made sense to reject the sensor readings that are the odd ones out. When you have 3 sensors and 2 out of the 3 are similar... its less likely that the single different sensor reading is infact the correct reading. You would then expect the 4th sensor to verify/compare this intial assesment. If the 4th sensor now also reads the same as the odd sensor (the correct reading), then you have a split decision as you have 4 sensors reading 2 different readings making both seem just as possible as the other. How the FLCS then decides to chose which readings to accept and which ones to reject is hard to do. I can think of a few ways to address this but will be interesting to see how Lockheed would fix this or not touch it all considering how rare it is to occur per F16 flight hour.
Wonder too if there could be a solution but from what it looks like the FCS basicly degraded to a duplex System and the deviations were small enough to not be filtered. At that point it'd just be luck of the draw.
As a software weenie and aviation buff I could easily see the 2 out of 3 winning, bring in the 4th and it get rejected too. You *could* set it up such that a double failure within the 4 gets the computer's attention. One failing - expected once in a while. Two simultaneously? Very rare. You could make it suspicious enough to then check the 2 v 2. If one side is in disagreement with each other, these are probably the failing ones. If it really is 2 similar vs 2 similar, which do you believe? It *could* (maybe) in the case of rate gyros put in inputs to the flight control surfaces that given the current speed, attitude, alpha, altitude (density), weight/weapons, etc. should produce an expected pitch rate. Obviously there's a margin of error here, that's why they have the gyros for precise data. But it should be able to come up with a nominal expected pitch rate for a couple of quick inputs. It would then have a third "seat of the pants" data point to decide which of the 2 v 2 to believe. Maybe. Don't know if it has the computing power for that, if it could reasonably be done in time to make a difference, and if the calculations could come up with a pitch rate with enough confidence to differentiate between two different data sets from the two sets of conflicting gyros.
Any time it has to bring in the backup gyro, I would say a comparison should be made to the 1st rejected gyro. 50 years worth of the time, its going to agree that the 1st rejection was correct. But if not, then there has to be a tie breaker. The pilot could break that tie, but I wonder if data could as well. Monitoring airspeed and altitude to "guess" the pitch of the craft and then factor that into which 2 of the 4 gyros to trust. Pilot gets an explicit warning to confirm, of course, but it might be enough to stabilize flight and get the plane back on the ground in 1 piece.
@@Taidaan I thought this too. If you have a 50-50 split after the back-up kicks in then it should be up to the pilot to manually select which one gives the better data to the computer via observation. in this case data A (2-3) was making the aircraft response negatively to controls. Being able to select from data B (1-4) would have produced a stable configuration and could be used. This wouldn't need to be a matter of selecting which gyros to use, just which set of conflicting data. If the computer sorts it to just A and B like above, the pilot could get a FLCS FAIL, which they acknowledge with the master caution. Then if it detects the 50-50 after the 4th chimes in it says FLCS DATA OVRD over AB and the conflict should be fixed.
Is it worth all of this programming for such a rare event? No, probably not. As he said, these planes are aging and you're going to have bad gyros cropping up and the likelihood increases substantially.
@@Taidaan The time to look at the warning, understand it (it's a rare occurrence), and decide which pair is faulty, could mean the plane goes into the ground ... with the pilot
I really appreciate these videos, mover.
Hopefully this report will be quickly shared among all F-16 users. It will be interesting if it triggers reports of similar past events. If a pattern is identified, this early report might save lives in the future.
No pattern this is literally a once in a lifetime kind of failure. I worked on the aircraft for 20 years and rate gyros just didn't go bad. So for one rate gyro to go bad in two branches with similar failed outputs thus the FLCS thought they were good outputs is crazy rare.
I feel like they deserve some extra kudos on getting that report out quickly! Would have been sweet to have the extra info that the Air Force provides related to exactly how the jet was oriented at the time of the upset, hiw many g's were pulled, altitude the pilot ejected at, and all that good stuff, but this answers all the high points.
I’m not surprised that we are able to come up with the report faster than the USAF, since the government is answerable to taxpayers.
but as pointed out, we may not have as many details comparatively speaking. Singapore dun have a Freedom of Information Act unlike the US - we also appear more particular about our OPSEC
Sometimes, that extra detail is important to know. I wouldn't say the US Air Force is not concerned with OPSEC and withholding any information which could compromise their ability to execute their mission, but, being answerable to your taxpayers also means telling them exactly what happened.
I mean, if I wrecked my parents' car, they wouldn't just accept a summary. They would want the full breakdown of who, what, when, where, and why.
Again tho, I am only saying all that to defend my point about the value of more information, not to discredit in any way the amazing job done by the RSAF in getting their report out to their citizens, and the world, rapidly, with a clear reason as to what happened, and a warning for the rest of the fleet so that this could possibly save others lives. So, please don't misinterpret my longwinded comment as some kind of slight against their wonderful work. The pilot seemed incredibly skilled to be able to distinguish this error so rapidly and get out of the jet with his life. All around, it was a masterclass of professionalism, and they made Singapore proud on what could have been a dark day.
On paper, Singapore has 59 F-16 (after 1 crashed) and 40 F-15. Not counting those on overseas attachment, and if all F-16s are grounded. There is only some F-15 defending Singapore. They cannot afford this risk, not when Singapore is surrounded by ... ... F-35B only coming in 2026 and F-35A only coming in much later. Unless RSAF get the AH-64 to take on intercepting roles, I think they need to conclude the report fast and get the F-16 flying ASAP.
@ChongSunLim95131 very good point. I don't think the F-16s, though, are really the answer to the F-35 threat. At least not without a substantial investment into other tech.
I hear some tech that China is working on, mesh AI electronic warfare was successful against an F-18 Growler wave, apparently. I usually am suspicious of info coming out of China, but the commander on the American side of that confrontation was also sacked, so there was certainly something to that engagement that went poorly for us. Analysts seem to be connecting the AI-driven electronic warfare to this ability for the Chinese to brute force their way right through our jamming and gain firing solutions that they were not able to just a year or two before. It's damn impressive.
Anyway, my point was, it would probably require some kind of technology like that, paired with the F-15 and F-16 to counter those F-35s if they were to become a threat to your nation.
Is that your concern though? I didn't believe there were nations in possession of F-35s that were hostile towards Singapore.
This is really extraordinary. To have 2 of 3 gyros fail but give the SAME READING, that's pretty wild to think about. Of course gyro 1 would be rejected then, and once gyro 4 was promoted, it too is beat by gyro 2 & 3 outvoting gyro 4's reading. As an engineer, not sure what you would do when you have a 50/50 split even if you were to compare all 4 readings (instead of rejecting #1, then rejecting #4). You'd have 1 and 4 saying one thing, and 2 and 3 saying something else. Which do you believe?
I have read or listen to test pilots debriefs, even those available from Armstrong or Aldrin. They share this common trait that Mover brilliantly displays here: surgical description of events with absolute clarity of how things work. Something actually quite similar to Professor Feynman's lectures.
I am not alone in this, I know, but I really love these mishap analysis, especially because it can contribute to reasserting a very much needed mindset of effort, merit, knowledge, preparation, responsibility.
You sir honor those who fly and those who, sadly, lost their lives in mishaps.
👍
I believe this might be the second known failure of an F-16 flight control system. Early 1990s at Purdue I attended a discussion of the F-16 flight control system by a test pilot who evaluated different stores configurations at Edwards AFB. He described a flight control failure where a false under-voltage alert caused the hydrazine backup generator to start while the normal engine-driven generator was still making electricity. This extra electrical power caused an over-voltage that fried the four flight control computers in sequence. The horizontal stab went to a static park position and the jet immediately departed controlled flight and hit the ground before the pilot could punch out. This incident was presented as the only known flight control failure of an F-16 at the time. I don't recall if it was a digital or analog system.
Well that doesn't make sense because the power delivery system doesn't send all of the possible power to the FLCS. The converter/regulators look at all of the power sources and sends along what it sees as the best source. This caused a confusing issue for pilots at one point as the aircraft batteries were being overcharged and the converter/regulators doing what they do selected the aircraft battery to power the FLCS which gave the mandatory aircraft battery to FLCS caution light in the cockpit.
So you aren't going to get the regular PMG power AND the EPU PMG power going to the system at the same time. One or the other. Unless this was VERY early on in the life of the F-16 and it was prior to the converter/regulators that I worked on in the F-16 FLCS power delivery system.
Singaporean here, appreciate an your take on the situation
FCS failures are, like you said, _extremely_ rare, but when one occurs it is usally very serious. Which, I think, leads people to believe that the FBW FCS is a terrible idea. Not so, again as you said most modern fighter jets are inherently unstable, which is great for maneuverability, but abso-fackin-LOOTELY requires the digital FCS.
Also, hats off to the investigators for doing a thorough job in such a short time.
I wonder what’s the rate of use vs degradation. The rsaf fly these jets so frequently that they might be the first ones to experience such issues due to increased wear on all components.
i work in the rsaf on the other fighter platform and our 16s are OOOOOOLD im 23 this year and mid life upgrade or not our vipers are older than me
I was born when F16 was conceived! be thankful for what you have!
Previously the news reported that RSAF's latest F-16 upgrades are intended to last until 2030. After that they might be replaced by F-35s
Extremely rare to have two sensors (gyros) fail at exactly the same time...plus, agree with each other!
its 30+deg C here throughout the year... even plastic chairs and stools crumble like dust after being left in the sun
It's interesting that the report describes the gyros as the traditional rotating mechanical type, not ring laser gyros or micro-electromechanical (MEMS) gyros as used on most modern airliners. The mean time between failures for mechanical gyros tends to be much shorter. The lower inherent reliability of each unit makes the freak coincidence of dual simultaneous failures of a similar magnitude "less unlikely" by a power of two. An avionics refresh would be nice, but the F-16s have been just a few years from retirement for many many years now, so...
Well I understand why it hadn't been changed just based on my 20 years of working on this aircraft. Rate gyros just didn't fail. They were probably the best item in the FLCS system for reliability.
@@Stubbies2003 Would the oppressive humidity in SIngapore? (and have lived in Alabama as well - makes an AL summer feel mild.
I have no idea re affect on humidity of such a device, so very interested in your thoughts.
I think I can explain why gyro 4 was rejected. The control logic doesn't look at all 4 gyros at the same time. Gyro 4 is a back-up only to be considered if one of the main gyros are thrown out by the FCS. Gyro 2 and 3 showed similar inputs, gyro 1 showed correct, but different, inputs. Gyro 1 was rejected and flagged by the system as faulty. Gyro 1 is then dropped from the control hierarchy and is replaced by gyro 4. NOTE, the system is not looking at gyro 1, 2, 3, AND 4. 1 has been declared faulty. It is only looking at 2, 3, and 4. 2 and 3 are the same, 4 is once again correct, but different, so it is declared faulty as well. 2 and 3 are the only remaining "correct" gyros so they have full control.
To summarize.
- Gyro 1, 2, and 3 in the control hierarchy, 4 is outside the hierarchy as a back-up.
- Gyro 2 and 3 fail, but fail in the same way, leading to identical, but incorrect inputs.
- FCS declares gyro 1 as faulty because it does not meet consensus with 2 and 3.
- Gyro 1 is removed from the control hierarchy and is replaced by gyro 4, which comes off back-up.
- FCS compares gyros 2, 3, and 4. Finds that gyro 4 is not in agreement with 2 and 3.
- In a 2v1 vote, gyro 4 is declared faulty and removed from the control hierarchy.
- 2 and 3 are the only remaining gyros and control the aircraft.
Great analysis, thanks Mover
07:30 I can imagine this was sequence of events: Gyroscope 1 deviates. System assumes 1 of bent and takes it offline. Then(!) system brings 4. Now 4 deviates from the majority, is assumed to be bent, and is taken offline.
Thanks for your analysis! 👍🏼
Wow! That's just crazy how this happened! Glad the pilot survived.
The F-117 used the same flight control system.
It is similar too, but not identical. The program was wildly different due to the flight characteristics unique to the aircraft, which are WAY different than an F-16.
Exactly what TSG said. Yes the F-117 did borrow a lot of systems already in use but yeah the flying characteristics of those two aircraft are wildly different. Even the air data system of the F-117 was way more redundant than the F-16. The F-16 having the nose pitot tube and side mounted probe for air data. The F-117 had four pitot tubes.
no wonder they get chased out of russia for spying!
Good info and analysis! Keep 'em coming!
In Singapore, when faced with an improbable situation, people take it as a superstitious sign to buy a lottery ticket in hopes that the luck would carry over. If the pilot bought a lottery ticket that day and won, it still wouldn't be the most unlikely thing he encountered that day.
2 FCC's collect data normally between 2 sets of sensors, of which 1 set would be primarily and 1 set would be secondary backup.
how the primary set of 2 sensors got it wrong yet with such close readings is a true 1 off.
I wonder if this would cause a need to ensure both sensor sets are fully functional before fligh?
a real 1 off scenario.
Clearly, airliners should also get zero-zero ejection seats. My last flight on United was on a 30 year old bird asking for a South American retirement. Just like us, not all will make it to retirement.
A bird asked you for a chance to retire to South America? Cant it just fly south by itself?
I would guess that if you have three online gyros and two agree and the odd one is tossed out, and then you bring the backup online then it’s still three gyros. The backup indicates the correct state of things and you still have two against one and the backup loses the vote.
Yes, fair comment, but the sensors that produced 'similar' results are not meant to produce similar results outside a very narrow margin. So couldn't you argue that by doing so they were proving themselves to be faulty? Considering the back-up produced dramatically different results?
Counter intuitive I know. No ego here, just whole things seems odd, and they are the most numerous fighters in Service with Western airforces so if a degradation issue not adjusted for by code, they'd want t get to the bottom of it.
@@SALUTE-INT-S The FLCS passed the BIT, so the airplane has no way of knowing which gyros are crazy and which are sane. Thus it relies on the probability that two gyros are going to have the same failure at the same time being vanishingly low.
Finally! someone pronounced Tengah correctly
No way , we made it to Mover's reviews guys
Hopefully, this will be a lesson learned for all Viper operators. This check should be a routine for all older models.
Being a Singapore Citizen, this is my TL;DR: More of my tax dollars have to be allocated to a stringent maintenance program in order to avoid losing even more tax dollars to having the F16 forced to deconstructive lithobraking and scrap salvage.
The price of an inherent unstable airframe. The edge in maneuverability, but requiring accurate and reliable computers and sensors to actually allow the plane to be controllable. As the fault developed during take-off, the only thing that can be salvaged intact is the pilot...
There are ways to detect erroneous sensors using sensors made for other reasons. For example, you can compare the pitch rate to measured load factor. You need a flight model of the aircraft in memory to produce expected values that you can then compare to measured values. This can help with the sensor voting scheme. Another example is MCAS. It was literally physically impossible for the 737's angle-of-attack to go bezirk. So a basic integrity check on the sensor should have disabled the system. However, you can estimate angle-of-attack using pitch data in conjunction with inertial or GPS velocity (converted to airspeed using air temperature and pressure) to catch more subtle problems. That Air Florida crash in the early 80s taught us you can use engine pitch to determine rpm and therefore power setting, and a simple check of acceleration using a modem INS would have also caught the low power issue.
Space permitting a nice upgrade could be to replace the mechanical gyros with laser gyros - no bearings or motor to go wrong... I haven't been involved in flight control systems directly but worked on Harrier FADEC, Airbus fuel system computers and many Zero Flight Time simulators (B52/KC135, Airbus A300, A310, Transall C-160, B727, Il-86 (yes!) And others I've surely forgotten. All the best, Rob in Switzerland
Or combine both systems so there's no 4 identical instruments
Well given the cost associated with the change and how those rate gyros just didn't fail, especially not like this, I can see why this never came up to be replaced.
I was close to the air base when I got the news of this crash just 10 minutes after the time of crash. Plenty of speculations
I gotta say from being both a private pilot and an IT guy, the computer control flight surfaces thing scares the crap out of me, give me cables or redundant hydraulics everyday, I am far to aware of the fragility of computers and their systems to be comfortable trusting my life to them. And yes I am aware they infest everything now.
All nations using the F-16 knew what they were signing up for. This Fighter relies on its inherent instability to outmaneuver other contemporary fighters on a budget
The price of using this is reliance on a flight control computer that has to be diligently maintained.
Sometimes, even with the best preventative maintenance, the components can fail, and the double poor luck rolls (1. Failure of Gyro and redundancy 2. During Takeoff, with little altitude and airspeed to troubleshoot) results in needing to salvage the pilot and forcing the rest to unplanned lithobraking.
Excellent. Thank you
literally my country
i have only heard of this because of you how are you so quick
nvm its 3 months ago what the fu
On the part about the correct sensor being removed from the vote and then the spare brought in, this sort of situation also comes up in planning clustered servers. The reason they don't have the fourth sensor "active" in voting is that they need to prevent split votes and ensure that a decision is made - and the chances of the hot spare node providing bad data is roughly equal to the chances of any other node in these circumstances.
It's naturally very rare to have two nodes simultaneously fail without a common single point of failure (in the computing world, something like shared power or connectivity are likely ones), especially for them to fail in a way that isn't detected as out of normal bounds. That there was even consideration around this shows there was good planning done during the design of the system - and the fact that this is the first time of decades of flight time is probably a sign they made the right choices there.
Thank you for sharing.....very interesting...
Hey Mover, great video as always. Just a quick question, do you think that an FLCS Reset or manually switching to DBU would help in a malfunction like this? If the pilot had time to do any of these 2, of course. I would really like to know your opinion.
I always thought that flight control check was the pilot actuating all the controls. Thats pretty cool it does it itself. I guess now saying it out loud it only makes sense it would be automatic. Just not my first thought
From a total outsider with no knowledge at all of how the jet works - it sounds like gyro 1 was discarded and THEN gyro 4 was activated to bring the active gyros back up to 3 but of course it was outvoted just like 1. It sounds like gyro 4 should be activated before throwing out gyro 1 so it gets a vote too.
That doesn't really help you. Now you have 2 pairs of gyros disagreeing with each other; which pair do you go with?
@mikebridges20 At least you'd know that you don't know. Even picking a pair at random would give a 50% chance to recover the situation.
@@Motorman2112 The pilot isn't in the decision loop; it's all software (pilot couldn't act NEARLY fast enough).
@@mikebridges20 That's understood, I'm using "you" in the same way you are. From the perspective of the computer / the person programming it.
@@Motorman2112 This issue is what I lived for 32 years as a FLCS software engineer, so a little bit more in-depth. The military calculates the probability of < 1 in a billion as equal to zero. So, if the probability of an failure of a single device is < 1 in 10,000, the odds of a simultaneous dual failure of redundant devices is zero. So the software design doesn't attempt to manage those kind of failure modes.
My gut feel: the pilot either didn't run a FLCS BIT prior to takeoff, or he cycled power on the jet after running the BIT (which resets any failure indications) and didn't run a subsequent BIT.
Had a F111 do a similar thing on T/O in the eighties. Similar flight control computers. Took off with t/o trim setting, at gear up t/0 trim goes away and you retrim manually, it did not work and the nose started slowly down. Full aft stick had no effect, even tried WSOs trim button(nothing). Remembered the guarded standby trim( used by the auto pilot) toggle switch and tried that ( too low to eject) got the nose to come up so I flew a wide pattern with a toggle switch for pitch and a stick for roll. Landed OK. A pretty normal day in the aardvark.
The A Level works really CMI with old disk cassette type diagnostic equipment and getting unreliable errors signals..70s system...
Thx for covering this. Very interesting. I wonder if the STAMP safety methodology proposed by Prof. Nancy Leveson would have uncovered this. In her work she warns that in the age of control by software our (mechanical) ideas about redundancy are outdated. I know too little about STAMP to comment; have to really start reading those books ... But obviously in civil AF477 taught us something about an outdated mechanical redundancy mindset.
Curious if the flight control logic compares the 4th backup reading to the original no. 1 reading that was already rejected to assess if the choice should be reconsidered…although then it might be 2 vs. 2 and who knows how to vote based on that 😬
the rare occurrence when redundancy ends up being bad.
No, if you had no redundancy this failure would happen with a single gryo breaking, this situation is “once in a lifetime” because the redundant systems broke in a similar way simultaneously. In no way did redundancy cause this.
This is like saying "the rare occurrence when having breaks ends up being bad" when the all the breaks in your car failed
Surely there will be a "life expectancy' of the parts based on hours flown, as time proves the time of normal operation, and failure.
The F16 is slightly aerodynamically unstable.
Wikipedia: The use of a FLCS computer made it possible to build the F-16 as an aircraft with instability around the longitudinal axis at subsonic speed. The F-16 is the first production fighter aircraft intentionally designed to be slightly aerodynamically unstable, also known as relaxed static stability (RSS), to both reduce drag and improve maneuverability. In aviation, an aircraft is said to have relaxed stability if it has low or negative stability. An aircraft with negative stability will have a tendency to change its pitch and bank angles spontaneously. An aircraft with negative stability cannot be trimmed to maintain a certain attitude, and will, when disturbed in pitch or roll, continue to pitch or roll in the direction of the disturbance at an ever-increasing rate. Without a computer, the F-16 would therefore not be controllable by the pilot at subsonic speeds. To avoid unwanted deviations from the flight path, the FLCS processes thousands of measured values per second and automatically activates the actuators on the control surfaces. Control commands from the pilot are received and implemented in such a way that the aircraft does not go out of control. In addition, depending on certain parameters (e.g. flight attitude, speed and angle of attack), various limitations take effect. This prevents lateral gliding, a high angle of attack and manoeuvres that would expose the aircraft to more than nine times the acceleration due to gravity, among other things.
Is the gyro electromechanical, a ring laser or newer mems type?
if im not wrong, he said mechanical to electronic thing blah blah..so i assume its mechanicalelectro
Yeah I worked avionics on the 16 and the rate gyros just don't go bad. I can't even think of 10 instances in 20 years on the aircraft where rate gyros had to be replaced. I went through some EPs but it doesn't even look like DBU is something that could have been a fix here and there was even a warning of NOT using DBU since it could vote back in values that the FLCS had previously voted out. Which, ironically here, were the good values. So yeah this is definitely a once in a lifetime kind of fail and I'm curious as to what in the world they are going to have to do to keep this from being an issue going forward. Based on how this failed and I'd imagine at the speed at which the problem progressed odds are good the pilot had no choice but to bail out.
Did I already mentioned that I love the ending song?
no you didnt!
I was wondering how an inherently unstable aircraft controlled 100% by fly by wire and computer controlled flight surfaces can maintain itself over a long period of time (by fighter jet standards). So are the flight control surfaces constantly moving? How on Earth can it sustain that without it breaking down? Does the aircraft have to be maintained and rebuilt all the time, or are the control mechanisms that well built that they are able to be in almost constant use without needing much maintenance? Has this gotten better in the F35 and F22? It just seems the more complex the vehicle the more error prone they must be. Does it make the pilot nervous that so much is out of his/her control?
I heard a story of a similar character. The pitot tube was plugged, probably by a wasp, causing the 2 speed signals from the pitot tube to be prefered over the 1 signal from the side mounted. Swiss cheese indeed.
Well this is exactly why you have standby gains for the air data system to work around such issues.
@@Stubbies2003 Except for certain passenger aircraft that can carry up to 200 people, i.e. the 737-max which was offered with only one AOA sensor. Criminal.
A lot of well educated people in the comments
wish I was that knowledgeable
Weight on wheel switch, or pitot static issue?
Neither. Rate gyro failed in multiple branches with two of the failed branches agreeing with each other so the FLCS assumed those to be correct.
@@Stubbies2003 Was that the confirmed reason? That’s astronomically rare.
Mechanical gyros....in wonder if there could be a drop-in ring laser replacement? I'm a civilian pilot flying charter and I don't even like mechanical gyros anymore.
7:28 I agree, this part seems, at best, illogical. Why have a backup available, only to ignore it when there’s a malfunction?
Because it's highly unlikely that 2 systems fail simultaneously, AND that these 2 failed systems would give the same readings to vote out the 3rd and the back-up ...
It adds the backup because you can only determine which gyro is wrong with 3 sources, not two. It already believed nr 1&2 were right, so when the backup is added, it’ll do the same as with 1,2 and 3, which is compare 1,2 and 4. 4 is off when 1 &2 are similar, soo 4 gets thrown out. This is correct behaviour. The problem here is that you have two wineries but believable sources that indicate the same. That’s a 1E-10 event, which is acceptable as it is better than the standard 1E-9 that is applicable for CAT.
Soo that is why nr 4 was voted out and that’s why this is correct behaviour.
strange, approaching stupid, not to have used secondary input from accelerometers, and AOA sensor(s) to determine either/and correctness of the rate gyros, or the expected response to the control outputs... this seems so basic, that even us simple mobile phone guys used 'extra" redundancy to act as corrective input to motion tracking software, going on 15 years ago...
Probably because of the fact that the aircraft has flown this way for around 50 years with this being the first time it has occurred.
What's the song at the end of your videos? I want to hear more of it!
my cat says it sounds like Come Undone~ by Duran Duran (Instrumental)
I'm thinking the computer rejected the backup gyro because it then became the outlier after the third one was rejected. How about a nice game of chess?
you'd think that the backup gyro's reading would hold more weight when the system makes these decisions given that it's probably less used and thus less degraded than the others, right?
It's constantly in use, on hot standby, it's just not included in the vote.
It's not like a stopped standby pump (or whatever) that is only started up when another fails
When you need it, it has to be available instantly
You can't spin up a gyro while your aircraft is erratically moving around - it needs to know what a static situation with no roll, no pitch, no yaw is.
@Wannes_ thanks for the good explanation, makes sense
It adds the backup because you can only determine which gyro is wrong with 3 sources, not two. It already believed nr 1&2 were right, so when the backup is added, it’ll do the same as with 1,2 and 3, which is compare 1,2 and 4. 4 is off when 1 &2 are similar, soo 4 gets thrown out. This is correct behaviour. The problem here is that you have two erroneous but believable sources that indicate the same. Assuming erroneous but believable flight control output is CAT, combined with the 2 out of 3 source voting, then two erroneous but believable sensor outputs need to be AT LEAST 1E-9 (considering FCCs and other inputs, the requirements for this failure condition would be much smaller)
Soo that is why nr 4 was voted out and that’s why this is correct behaviour.
great ! Thanks.
The F-16 has a manual 'Pitch override' mode that bypasses the FLCS, (normally used for deep stall recovery)
Wouldn't this allow some control in this situation?
No.
Great explanation! They got out, that's #1 !! --bfg
learnt something new from the comments, when you have multiple votes, use all of them at the same time instead of sequentially discarding and bringing in the redundant vote. The overall margin of error will actually improve.
If the computer is holding 2 and 3 as true and discarding 1 as false, then if 4 agrees with 1, or is different from 2 and 3, then it must also be false??
Clear and effective Review.😅
When in doubt bang out. That being said I've never had a bang seat but wished I did a few times.
Standard control theory. You want an odd number, so you can vote out bad units. If you want extra redundancy, in case one fails, you put a spare that gets brought in if there’s one voted out. If the two failures are in the main trio… you’re out of luck.
Replacing those parts with solid state fiber optic gyros might make sense. They don’t have moving parts and last nearly forever…
I’m guessing the newer F16s use laser or digital gyros, both of which are much more rugged and have zero moving parts.
The Singapore jets are block 52, built in the late 90s/early 2000s with lots of custom upgrades. The fleet has just completed another round of upgrade making them V-standard equivalents (with custom systems of their own).
An 'old' plane like the F16 plane continues with upgrades..
Whens the limit of upgrades?
seems to be a lot of once in a life time events happening
As things get old defects are found and fixed. Eventually, only "once in a lifetime" defects are left.
Rest in peace my favourite C bird. PBS
Are they still using mechanical gyros? We've had ring laser gyros since the 80s.
Hey, hey, hey Mover...slow down with the technical terms there...the plane looks like it is "doing the funky chicken"! And yeah, if you're the pilot of a plane that doesn't know to keep the pointy end forward because the flight control computer sorta forgot...that is a bad day! I can sorta understand the logic that once the #1 gyro data was rejected as erroneous, #2-3 were correct and then when #4 was activated and also didn't agree with #2-3 and it was rejected makes sense.
This certainly isn't a thing you can blame the pilot for. The sequence of events would be almost comical if it didn't crash a plane. The odds of this are probably one in a trillion, at least.
Surely it has laser ring gyro's not spinning mass ones?
I'm a student at NTU which is nearby Tengah airbase and served my national service at tengah airbase on the day i told my friend who didnt know there was an airbase there was the same day the f16 crashed talk about a jinx 💀
In laymans terms military aircraft are designed to be intrinsicly unstable to maximise manouverability. If they were designed to be intrinsicly stable, like civilian aircraft generally are, they would first have to overcome the intrinsic stability before they could start a manouver with the delay, potentially, causing fatal consequences.
The F-16 is the first one to be inherently unstable (relaxed static stability is what they called it) and fix the problem of that instability with flight control computers which gave you the added performance.