Today's Message Index:
----------------------
1. 12:10 PM - IFALPA's take on the A380 Issue (dongirod)
2. 03:58 PM - Re: IFALPA's take on the A380 Issue (William J Hamilton)
3. 05:34 PM - Re: IFALPA's take on the A380 Issue (Deneal Schilmeister (MacbookPro))
4. 06:03 PM - FW: IFALPA's take on the A380 Issue (Deneal Schilmeister (MacbookPro))
5. 08:00 PM - Re: IFALPA's take on the A380 Issue (cybersuperstore)
Message 1
INDEX | Back to Main INDEX |
NEXT | Skip to NEXT Message |
LIST | Reply to LIST Regarding this Message |
SENDER | Reply to SENDER Regarding this Message |
|
Subject: | IFALPA's take on the A380 Issue |
I got this from a friend, not sure of any of the info, but thought it
might be interesting to some on the list.
Don
Subject: IFALPA's take on the A380 Issue
Here is a review written by IFALPA after they looked at the stuff that's
so far come out of the QF A380 incident.
As far as "Fly-by-Wire" and redundancy go it really doesn't matter how
many wires you have going to an item if they are all routed thru the
same
area! Airbus and Rolls have some serious redesign work ahead of them.
It also poses some really troubling questions that have the potential to
shake up the entire system from certification authorities through
regulators, through airline training departments. It also blows away the
Airbus
mantra that their jets are so smart that you can stuff an inexperienced
crew
from Nigeria in the cockpit, and as long as they can keep the wings
level
until the A/P is turned on, and then slavishly follow what the totally
brilliant and foolproof ECAM system tells them is wrong and what to do
in what
order, all will be well....[Amen to this comment]
Qantas A380 Uncontained Engine Failure
Background
On Thursday 4th November a Qantas A380, registration VH-OQA suffered an
uncontained intermediate pressure turbine wheel failure of the No 2
engine at
about 6000 feet on departure from Singapore. The aircraft returned for
landing safely but the crew had around 54 ECAM messages to deal with and
a
substantial loss of systems on board the aircraft. It took about an hour
to
deal with all those messages.
There were, and are, a number of Airworthiness Directives out on the
engine for inspection; some are new and some are from previous problems.
The
issue appears to be oil leaking from the bearing into the Intermediate
Pressure/High Pressure turbine wheel structural area causing an intense
local
fire that compromised the structure of the turbines.
The aircraft was substantially damaged but landed safely.
Systems Loss and Damage Synopsis:
Investigations are ongoing and there is much speculation in the media
and
around the industry but the major issue for the ADO committee to
consider
is the secondary damage and systems loss that the aircraft suffered.
A brief description follows of the known, and public, issues:
=A2 The No 2 engine suffered an uncontained failure of IP rotor
which
separated from the engine and penetrated the wing and body fairing of
the
aircraft.
=A2 The rotor penetrated the forward wing spar and exited the
upper surface
of the wing.
=A2 The main electrical loom in forward section of wing was cut
causing loss
of engine control (thrust ok) on No 1 and no ability to shut it down
with
Fire Handle.
=A2 The power drive unit for the leading edge devices was severed
in the
same location,
=A2 The crew were unable to discharge any fire bottles for engine
No 1 and
No 2.
=A2 All electrical hydraulic pumps that side were lost.
=A2 A piece of rotor penetrated the body fairing and severed a
wiring loom
in that location.
=A2 Another piece of the rotor damaged the aft fuel transfer
gallery and
caused leaks in the left mid and inner fuel feed tanks =93 one of
which was
substantial. This led to a lateral imbalance problem.
=A2 The crew were unable to jettison or transfer fuel forward.
This led to
indications of an aft cg problem.
=A2 Emergency Outer tank transfer only resulted in the right hand
outer
tank transferring =93 the left hand tank failed to transfer - this
helped the
lateral imbalance.
=A2 There was damage to the fairing housing the RAT, flaps and
flap track
fairings.
=A2 Total loss of the Green hydraulic system,
=A2 ECAM indicated loss of both electrical hydraulic pumps on No 4
engine
(Yellow system).
=A2 Landing Gear required gravity extension.
=A2 No anti skid on wing gear hence only emergency brakes; body
gear braking
normal
=A2 Engines 1 and 4 indicating =98degraded mode=99
=93 which means no N-1
rating limit. Requires all engines to be switched to
=98Alternate=99 mode with a 4%
maximum thrust loss.
=A2 AC bus 1&2 failed.
=A2 No 2 engine electrical generator failed as a result of the
engine
failure
=A2 The APU was started but the crew were unable to connect the
APU bleed
air or the generators to the bus system.
=A2 No 1 air conditioning pack failed.
=A2 Autothrust was not available.
=A2 The satellite phone system would not work.
ECAM Management:
When the failure occurred something like 54 ECAM messages appeared on
the
screen. These set off the Master Warning and Master Caution many times;
to
the point of distraction of the crew. The First Office started the stop
watch when the first master warning went off and from there it took the
crew
50 minutes or so to clear the messages down to the Status page.
Management
of the ECAM was an issue with the ECAM calling for a transfer of fuel
into
obviously leaking tanks to cure a fuel imbalance. Forward transfer was
also
not possible which generated an ECAM for an aft CG problem that could
not
be rectified. The ECAM also called for a Fuel Quantity Management System
reset which, when carried out, regenerated all the error messages. For
non -
Airbus pilots the Status page is normally where ECAM actions are stopped
and Normal checklists are used, Operational Engineering Bulletins are
considered, resets to recover systems are attempted and any pilot
initiated
abnormal checklists are used.
Preparation for Landing:
It took the crew some time to prepare the aircraft for landing. The
Landing Performance Application of the Electronic Flight Bag did not
appear to
generate correct information which resulted in the crew carefully
entering
eight landing alerts and recalculating the landing performance. The end
result was that the predicted approach speed was around 167 knots and
landing
distance 3850 meters on the 4000 meter runway. Aircraft handling checks
were
carried out in both the clean and landing configuration with adequate
control response and margin demonstrated. This was despite a lateral
imbalance
of around 10 tonnes and a message indicating an aft cg issue.
Landing:
Given the loss of hydraulics the aircraft was in a degraded mode with
only
one aileron working on one wing and two on the other with limited
spoiler
capability. Autothrust was not available and manual thrust was used with
the engines in the alternate mode. Also no leading edge slats were
available
and the gear had to be extended by gravity. Despite this the approach to
landing went as planned expect for a =9CSpeed, Speed=9D call
by the warning
system. The reason for this is unknown but it was cancelled by thrust
application. Touchdown was reported as very smooth and the aircraft
speed was
brought under control with about 600 metres to run. The aircraft was
allowed to
roll near to the end runway to position it near the fire trucks. When
the
aircraft finally stopped the brake temperatures quickly rose to 900
degrees
and a few tires deflated.
Post landing:
When the aircraft stopped the crew attempted to shut down the No 1
engine
but were unable to do so with either the fuel switch or the engine fire
handle. Fuel was leaking from the left hand wing and pooling around the
hot
brakes. The fire crew were organized to smother the fuel with foam and
the
decision was made not to evacuate the aircraft given the running engine,
the
pooling fuel, the potential for serious injuries and the presence of the
fire crews who were attempting to stop the No 1 engine by running a
stream
of water down the intake. When the engines were finally shut down the
aircraft went =9Cdark=9D due to the inability to connect the
APU generators to the
bus system..
------------------------------------------------------
Issues for Consideration:
This event raises a number of issues for consideration by the ADO
committee, Rolls Royce, Airbus and the industry in general. There is no
doubt that
the aircraft was badly damaged by the IP rotor burst. In fact, it is
fortunate that this incident did not end up like the DC-10 in Sioux City
Iowa [Or
American at O'Hare]. >From an aircraft damage tolerance point of view it
is a tribute to the A380, modern design criteria and the redundancy
available later generation aircraft. Certainly the fact that the very
experienced
crew consisted of three Captains, a highly experienced First Officer and
a
very experienced ex-military Second Officer enabled tasks to be shared
including flying the aircraft, dealing with the huge amount of ECAM
messages,
communication and performance calculations. The First Officer managed
the
ECAM and, at times, decisions were made to ignore or not do certain ECAM
procedures that did not seem logical such as transferring fuel into
leaking
tanks. It is worth noting that there were three captains present because
the
Pilot-in-Command was being Annual Route checked by a trainee Check
Captain
who was being supervised by another Check Captain.
Without going into significant explanatory detail the following poses
the
following questions for consideration:
Design:
=A2 Given this and a number of other uncontained turbine rotor
failures
should transport category aircraft be designed to withstand an engine
rotor
burst? Or is this impracticable?
=A2 Conversely, is it possible to design for rotor containment or
mitigation
by the engine in the event of a burst?
=A2 Can engine monitoring systems be developed to warn of an
impending
catastrophic failure? (e.g. a combination of vibration/ rapid core
temperature
changes/parameters out of limits)
=A2 Rolls Royce have mentioned engine self protection systems to
shut down
engines in order to minimise the effect of a rotor burst. How would that
be
implemented? Would warning be given? How critical would an unexpected
shutdown be? What would the false warning rate be?
=A2 Why did some apparently unrelated systems fail in this
incident? (e.g.
Yellow system hydraulic pumps on engine No 4) Is there a common data
management source that is failing under overload or was it damaged in
the
incident?
=A2 Are modern aircraft so complex that failures tend to be
multi-modal and
thus confusing to the crew?
=A2 If an electrical loom to an engine is cut the fail safe mode
is to run
on. What if the engine runs on at high thrust?
=A2 If there had been an engine fire the crew would not have been
able to
use the fire bottles because of the cut loom. Is this system truly
redundant
and effective?
=A2 Given the loss of systems in the wing should the main
electrical loom be
relocated or systems separated to a secondary loom to improve
redundancy?
=A2 The crew were unable to transfer fuel and there was a
substantial fuel
leak from the left wing. What if these failures had occurred in mid
ocean?
Operational Philosophy:
=A2 There were many ECAM messages occurring in the initial
failure. The
constant alerts were distracting and the need to cancel them detracted
from the
procedures.. Should a semi-permanent cancel mode be available? The crew
know they have a problem.
=A2 Did the ECAM correctly prioritise the alerts? Probably not
known at this
stage but certainly a few ECAM messages appeared incorrect in the
circumstances (e.g. Fuel transfer into leaking tanks for imbalance).
=A2 Is the modern trend to complete all ECAM/EICAS actions too
time
consuming and distracting to the crew to the detriment of prioritising
the flying
of the aircraft and the landing?
=A2 Should there be an abbreviated ECAM/EICAS procedure that
achieves a safe
mode for landing in the event of an emergency return?
=A2 Is modern aircraft operational philosophy too automation and
functional
system reliant?
Training and Experience:
=A2 This was highly experienced crew. Should this type of failure
be
considered when pairing a 240 hour MPL or cadet pilot graduate with a
relatively
new Captain? Or is the probability too remote and thus acceptable?
=A2 The crew reported in this case that crew resource management
was very
effective and that there was zero cockpit gradient. The crew were
adaptive in
dealing with the multiple and complicated ECAM messages. Should crew
resource training be modified to include crew recognition of the extreme
nature
of the emergency and thus to not slavishly follow checklist procedures
to
the detriment of a timely return to landing?
=A2 Given the move to evidence based training should training
scenarios
include multi-mode failures so that crews can cope with unusual events
or are
they so rare as not to warrant this type of training?
Conclusion:
This incident could easily have been an accident; many of the systems
failures the crew had to deal with would be classed as an emergency on
their
own (e.g. uncontained engine failure, loss of hydraulics, multiple bus
failures and leading edge failure) let alone in combination. The fact
that it
wasn=99t an accident is probably testament to the redundancy built
into the
A380 design and it is certainly due to the training and competency of a
very
experienced crew operating in a team environment. There are many
positive
lessons to be learned from this event.
Captain Richard Woodward
Executive Vice President Technical Standards
IFALPA
Message 2
INDEX | Back to Main INDEX |
PREVIOUS | Skip to PREVIOUS Message |
NEXT | Skip to NEXT Message |
LIST | Reply to LIST Regarding this Message |
SENDER | Reply to SENDER Regarding this Message |
|
Subject: | Re: IFALPA's take on the A380 Issue |
> dongirod <dongirod@bellsouth.net> wrote:
>
> I got this from a friend, not sure of any of the info, but thought it
> might be interesting to some on the list.
>
> Don
>
>
>
> Subject: IFALPA's take on the A380 Issue
>
> Here is a review written by IFALPA after they looked at the stuff that's
>
> so far come out of the QF A380 incident.
>
> As far as "Fly-by-Wire" and redundancy go it really doesn't matter how
> many wires you have going to an item if they are all routed thru the
> same
> area! Airbus and Rolls have some serious redesign work ahead of them.
>
> It also poses some really troubling questions that have the potential to
>
> shake up the entire system from certification authorities through
> regulators, through airline training departments. It also blows away the
> Airbus
> mantra that their jets are so smart that you can stuff an inexperienced
> crew
> from Nigeria in the cockpit, and as long as they can keep the wings
> level
> until the A/P is turned on, and then slavishly follow what the totally
> brilliant and foolproof ECAM system tells them is wrong and what to do
> in what
> order, all will be well....[Amen to this comment]
>
> Qantas A380 Uncontained Engine Failure
> Background
> On Thursday 4th November a Qantas A380, registration VH-OQA suffered an
> uncontained intermediate pressure turbine wheel failure of the No 2
> engine at
> about 6000 feet on departure from Singapore. The aircraft returned for
> landing safely but the crew had around 54 ECAM messages to deal with and
> a
> substantial loss of systems on board the aircraft. It took about an hour
> to
> deal with all those messages.
> There were, and are, a number of Airworthiness Directives out on the
> engine for inspection; some are new and some are from previous problems.
> The
> issue appears to be oil leaking from the bearing into the Intermediate
> Pressure/High Pressure turbine wheel structural area causing an intense
> local
> fire that compromised the structure of the turbines.
> The aircraft was substantially damaged but landed safely.
>
> Systems Loss and Damage Synopsis:
> Investigations are ongoing and there is much speculation in the media
> and
> around the industry but the major issue for the ADO committee to
> consider
> is the secondary damage and systems loss that the aircraft suffered.
>
> A brief description follows of the known, and public, issues:
> The No 2 engine suffered an uncontained failure of IP rotor which
> separated from the engine and penetrated the wing and body fairing of
> the
> aircraft.
> The rotor penetrated the forward wing spar and exited the upper
> surface
> of the wing.
> The main electrical loom in forward section of wing was cut causing
> loss
> of engine control (thrust ok) on No 1 and no ability to shut it down
> with
> Fire Handle.
> The power drive unit for the leading edge devices was severed in the
>
> same location,
> The crew were unable to discharge any fire bottles for engine No 1
> and
> No 2.
> All electrical hydraulic pumps that side were lost.
> A piece of rotor penetrated the body fairing and severed a wiring
> loom
> in that location.
> Another piece of the rotor damaged the aft fuel transfer gallery and
>
> caused leaks in the left mid and inner fuel feed tanks one of which
> was
> substantial. This led to a lateral imbalance problem.
> The crew were unable to jettison or transfer fuel forward. This led
> to
> indications of an aft cg problem.
> Emergency Outer tank transfer only resulted in the right hand outer
> tank transferring the left hand tank failed to transfer - this
> helped the
> lateral imbalance.
> There was damage to the fairing housing the RAT, flaps and flap
> track
> fairings.
> Total loss of the Green hydraulic system,
> ECAM indicated loss of both electrical hydraulic pumps on No 4
> engine
> (Yellow system).
> Landing Gear required gravity extension.
> No anti skid on wing gear hence only emergency brakes; body gear
> braking
> normal
> Engines 1 and 4 indicating degraded mode which means no
> N-1
> rating limit. Requires all engines to be switched to Alternate
> mode with a 4%
> maximum thrust loss.
> AC bus 1&2 failed.
> No 2 engine electrical generator failed as a result of the engine
> failure
> The APU was started but the crew were unable to connect the APU
> bleed
> air or the generators to the bus system.
> No 1 air conditioning pack failed.
> Autothrust was not available.
> The satellite phone system would not work.
>
> ECAM Management:
> When the failure occurred something like 54 ECAM messages appeared on
> the
> screen. These set off the Master Warning and Master Caution many times;
> to
> the point of distraction of the crew. The First Office started the stop
> watch when the first master warning went off and from there it took the
> crew
> 50 minutes or so to clear the messages down to the Status page.
> Management
> of the ECAM was an issue with the ECAM calling for a transfer of fuel
> into
> obviously leaking tanks to cure a fuel imbalance. Forward transfer was
> also
> not possible which generated an ECAM for an aft CG problem that could
> not
> be rectified. The ECAM also called for a Fuel Quantity Management System
>
> reset which, when carried out, regenerated all the error messages. For
> non -
> Airbus pilots the Status page is normally where ECAM actions are stopped
>
> and Normal checklists are used, Operational Engineering Bulletins are
> considered, resets to recover systems are attempted and any pilot
> initiated
> abnormal checklists are used.
>
> Preparation for Landing:
> It took the crew some time to prepare the aircraft for landing. The
> Landing Performance Application of the Electronic Flight Bag did not
> appear to
> generate correct information which resulted in the crew carefully
> entering
> eight landing alerts and recalculating the landing performance. The end
> result was that the predicted approach speed was around 167 knots and
> landing
> distance 3850 meters on the 4000 meter runway. Aircraft handling checks
> were
> carried out in both the clean and landing configuration with adequate
> control response and margin demonstrated. This was despite a lateral
> imbalance
> of around 10 tonnes and a message indicating an aft cg issue.
>
> Landing:
> Given the loss of hydraulics the aircraft was in a degraded mode with
> only
> one aileron working on one wing and two on the other with limited
> spoiler
> capability. Autothrust was not available and manual thrust was used with
>
> the engines in the alternate mode. Also no leading edge slats were
> available
> and the gear had to be extended by gravity. Despite this the approach to
>
> landing went as planned expect for a Speed, Speed call by the
> warning
> system. The reason for this is unknown but it was cancelled by thrust
> application. Touchdown was reported as very smooth and the aircraft
> speed was
> brought under control with about 600 metres to run. The aircraft was
> allowed to
> roll near to the end runway to position it near the fire trucks. When
> the
> aircraft finally stopped the brake temperatures quickly rose to 900
> degrees
> and a few tires deflated.
>
> Post landing:
> When the aircraft stopped the crew attempted to shut down the No 1
> engine
> but were unable to do so with either the fuel switch or the engine fire
> handle. Fuel was leaking from the left hand wing and pooling around the
> hot
> brakes. The fire crew were organized to smother the fuel with foam and
> the
> decision was made not to evacuate the aircraft given the running engine,
> the
> pooling fuel, the potential for serious injuries and the presence of the
>
> fire crews who were attempting to stop the No 1 engine by running a
> stream
> of water down the intake. When the engines were finally shut down the
> aircraft went dark due to the inability to connect the APU
> generators to the
> bus system..
> ------------------------------------------------------
>
> Issues for Consideration:
> This event raises a number of issues for consideration by the ADO
> committee, Rolls Royce, Airbus and the industry in general. There is no
> doubt that
> the aircraft was badly damaged by the IP rotor burst. In fact, it is
> fortunate that this incident did not end up like the DC-10 in Sioux City
> Iowa [Or
> American at O'Hare]. >From an aircraft damage tolerance point of view it
>
> is a tribute to the A380, modern design criteria and the redundancy
> available later generation aircraft. Certainly the fact that the very
> experienced
> crew consisted of three Captains, a highly experienced First Officer and
> a
> very experienced ex-military Second Officer enabled tasks to be shared
> including flying the aircraft, dealing with the huge amount of ECAM
> messages,
> communication and performance calculations. The First Officer managed
> the
> ECAM and, at times, decisions were made to ignore or not do certain ECAM
>
> procedures that did not seem logical such as transferring fuel into
> leaking
> tanks. It is worth noting that there were three captains present because
> the
> Pilot-in-Command was being Annual Route checked by a trainee Check
> Captain
> who was being supervised by another Check Captain.
>
> Without going into significant explanatory detail the following poses
> the
> following questions for consideration:
>
> Design:
> Given this and a number of other uncontained turbine rotor failures
> should transport category aircraft be designed to withstand an engine
> rotor
> burst? Or is this impracticable?
> Conversely, is it possible to design for rotor containment or
> mitigation
> by the engine in the event of a burst?
> Can engine monitoring systems be developed to warn of an impending
> catastrophic failure? (e.g. a combination of vibration/ rapid core
> temperature
> changes/parameters out of limits)
> Rolls Royce have mentioned engine self protection systems to shut
> down
> engines in order to minimise the effect of a rotor burst. How would that
> be
> implemented? Would warning be given? How critical would an unexpected
> shutdown be? What would the false warning rate be?
> Why did some apparently unrelated systems fail in this incident?
> (e.g.
> Yellow system hydraulic pumps on engine No 4) Is there a common data
> management source that is failing under overload or was it damaged in
> the
> incident?
> Are modern aircraft so complex that failures tend to be multi-modal
> and
> thus confusing to the crew?
> If an electrical loom to an engine is cut the fail safe mode is to
> run
> on. What if the engine runs on at high thrust?
> If there had been an engine fire the crew would not have been able
> to
> use the fire bottles because of the cut loom. Is this system truly
> redundant
> and effective?
> Given the loss of systems in the wing should the main electrical
> loom be
> relocated or systems separated to a secondary loom to improve
> redundancy?
> The crew were unable to transfer fuel and there was a substantial
> fuel
> leak from the left wing. What if these failures had occurred in mid
> ocean?
>
> Operational Philosophy:
> There were many ECAM messages occurring in the initial failure. The
> constant alerts were distracting and the need to cancel them detracted
> from the
> procedures.. Should a semi-permanent cancel mode be available? The crew
> know they have a problem.
> Did the ECAM correctly prioritise the alerts? Probably not known at
> this
> stage but certainly a few ECAM messages appeared incorrect in the
> circumstances (e.g. Fuel transfer into leaking tanks for imbalance).
> Is the modern trend to complete all ECAM/EICAS actions too time
> consuming and distracting to the crew to the detriment of prioritising
> the flying
> of the aircraft and the landing?
> Should there be an abbreviated ECAM/EICAS procedure that achieves a
> safe
> mode for landing in the event of an emergency return?
> Is modern aircraft operational philosophy too automation and
> functional
> system reliant?
>
> Training and Experience:
> This was highly experienced crew. Should this type of failure be
> considered when pairing a 240 hour MPL or cadet pilot graduate with a
> relatively
> new Captain? Or is the probability too remote and thus acceptable?
> The crew reported in this case that crew resource management was
> very
> effective and that there was zero cockpit gradient. The crew were
> adaptive in
> dealing with the multiple and complicated ECAM messages. Should crew
> resource training be modified to include crew recognition of the extreme
> nature
> of the emergency and thus to not slavishly follow checklist procedures
> to
> the detriment of a timely return to landing?
> Given the move to evidence based training should training scenarios
> include multi-mode failures so that crews can cope with unusual events
> or are
> they so rare as not to warrant this type of training?
>
> Conclusion:
> This incident could easily have been an accident; many of the systems
> failures the crew had to deal with would be classed as an emergency on
> their
> own (e.g. uncontained engine failure, loss of hydraulics, multiple bus
> failures and leading edge failure) let alone in combination. The fact
> that it
> wasnt an accident is probably testament to the redundancy built into
> the
> A380 design and it is certainly due to the training and competency of a
> very
> experienced crew operating in a team environment. There are many
> positive
> lessons to be learned from this event.
>
> Captain Richard Woodward
> Executive Vice President Technical Standards
> IFALPA
Folks,
The IFALPA VP who wrote this is also a QANTAS captain.
The details are correct, if abbreviated, the complete analysis of the interacting
multiple failures are not yet complete, but the limitations of the "computer
knows best" Airbus approach is showing its limitations here.
As another QF mate of mine said of Airbus: "Its all about democracy, and the computers
have 51% of the vote".
For those of you familiar with the B777, in a "apples and apples" event in the
777, the likely cockpit complications would be considerably less.
The normal crew for the A380 is still two pilots, with an event such as this, life
for two pilots would have been very busy.
One comment, about cockpit authority gradient, a flat (indeed almost non-existent)
gradient is almost achieved in QANTAS, it certainly helps.
I know all the crew involved, except the S/O, two are ex-students of mine ( the
supervising Senior Check and the operating Captain) and it is clear even to the
detractors of the "real" QANTAS, that the crew and years of training showed.
This is not stopping the senior management (none are pilots or engineers) dumbing
down the flight operation, indeed it seems much of the operation is gradually
being moved to Singapore, initially the Jetstar division, to be operated by
short term contract pilots, with training being done by outside contractors.
Once again, accountants can tell you the cost of everything, but the value of nothing.
Regards,
Bill Hamilton
QF Check and Training Captain, retired.
Message 3
INDEX | Back to Main INDEX |
PREVIOUS | Skip to PREVIOUS Message |
NEXT | Skip to NEXT Message |
LIST | Reply to LIST Regarding this Message |
SENDER | Reply to SENDER Regarding this Message |
|
Subject: | Re: IFALPA's take on the A380 Issue |
Here are comments (in bold) I received after I forwarded that report to a
"mate" of mine that is an Airbus capt for UPS (also ex- Central Air):
" Is the modern trend to complete all ECAM/EICAS actions too time
consuming and distracting to the crew to the detriment of prioritising
the flying of the aircraft and the landing? *YES*
Should there be an abbreviated ECAM/EICAS procedure that achieves a safe
mode for landing in the event of an emergency return?
*I would just ignore the ecam, Land asap and make sure the gear is down
before touchdown.
*I've found many scenarios in Sim training where the ECAM becomes a
burden. When you're done with the ECAM items, you still have to
supplement it with the paper checklist and figure out the proper point
to enter the checklist. We have 6 known anomaly's on our A300's that we
are told to ignore. I would rather use the Paper checklist and forget
about ECAM.
On 1/22/11 5:55 PM, "William J Hamilton" <wjrhamilton@optusnet.com.au>
wrote:
> Folks,
> The IFALPA VP who wrote this is also a QANTAS captain.
>
> The details are correct, if abbreviated, the complete analysis of the
> interacting multiple failures are not yet complete, but the limitations o
f the
> "computer knows best" Airbus approach is showing its limitations here.
>
> As another QF mate of mine said of Airbus: "Its all about democracy, and
the
> computers have 51% of the vote".
>
> For those of you familiar with the B777, in a "apples and apples" event i
n the
> 777, the likely cockpit complications would be considerably less.
>
> The normal crew for the A380 is still two pilots, with an event such as t
his,
> life for two pilots would have been very busy.
>
> One comment, about cockpit authority gradient, a flat (indeed almost
> non-existent) gradient is almost achieved in QANTAS, it certainly helps.
>
> I know all the crew involved, except the S/O, two are ex-students of mine
(
> the supervising Senior Check and the operating Captain) and it is clear e
ven
> to the detractors of the "real" QANTAS, that the crew and years of traini
ng
> showed.
>
> This is not stopping the senior management (none are pilots or engineers)
> dumbing down the flight operation, indeed it seems much of the operation
is
> gradually being moved to Singapore, initially the Jetstar division, to be
> operated by short term contract pilots, with training being done by outsi
de
> contractors.
>
> Once again, accountants can tell you the cost of everything, but the valu
e of
> nothing.
>
> Regards,
> Bill Hamilton
> QF Check and Training Captain, retired.
Message 4
INDEX | Back to Main INDEX |
PREVIOUS | Skip to PREVIOUS Message |
NEXT | Skip to NEXT Message |
LIST | Reply to LIST Regarding this Message |
SENDER | Reply to SENDER Regarding this Message |
|
Subject: | FW: IFALPA's take on the A380 Issue |
Here are comments I received after I forwarded that report to a "mate" of
mine that recently retired as a manager in Boeing=B9s (nee McDonnell Douglas=B9
)
Phantom Works:
------ Forwarded Message
Great report. Really interesting =AD fascinating. Here are a few of my
thoughts:
* You can contain blade failures, but not rotor failures. I have first hand
experience with two rotor failures =AD F100 engine #169 which failed on the
test stand at St. Louis, and an F404 engine in F-18 TF2 that failed in
flight and took out the other engine, causing loss of the aircraft. The
pilots, Garry Post and ???, both survived. Rotors always fail in thirds, an
d
the energy of the failed components is so incredible that the weight
associated with containment is prohibitive.
* These guys were damn lucky in addition to being highly skilled. A lesser
skilled crew probably would not have brought the aircraft back. It was
incredibly fortunate that there were three Captains onboard =AD what are the
odds of that?
* Not to pick on Airbus, but I don=B9t understand how taking out one wire
bundle could cause the loss of function. The spec as I remember is that
redundant wire bundles have to be routed a minimum of 18 inches apart.
Thanks for sharing!
------ End of Forwarded Message
Message 5
INDEX | Back to Main INDEX |
PREVIOUS | Skip to PREVIOUS Message |
NEXT | Skip to NEXT Message |
LIST | Reply to LIST Regarding this Message |
SENDER | Reply to SENDER Regarding this Message |
|
Subject: | IFALPA's take on the A380 Issue |
Hi Don,
Thanks for forwarding. Fascinating reading.
Nico
_____
From: owner-commander-list-server@matronics.com
[mailto:owner-commander-list-server@matronics.com] On Behalf Of dongirod
Sent: Saturday, January 22, 2011 12:08 PM
Subject: Commander-List: IFALPA's take on the A380 Issue
I got this from a friend, not sure of any of the info, but thought it might
be interesting to some on the list.
Don
Subject: IFALPA's take on the A380 Issue
Here is a review written by IFALPA after they looked at the stuff that's
so far come out of the QF A380 incident.
As far as "Fly-by-Wire" and redundancy go it really doesn't matter how
many wires you have going to an item if they are all routed thru the same
area! Airbus and Rolls have some serious redesign work ahead of them.
It also poses some really troubling questions that have the potential to
shake up the entire system from certification authorities through
regulators, through airline training departments. It also blows away the
Airbus
mantra that their jets are so smart that you can stuff an inexperienced crew
from Nigeria in the cockpit, and as long as they can keep the wings level
until the A/P is turned on, and then slavishly follow what the totally
brilliant and foolproof ECAM system tells them is wrong and what to do in
what
order, all will be well....[Amen to this comment]
Qantas A380 Uncontained Engine Failure
Background
On Thursday 4th November a Qantas A380, registration VH-OQA suffered an
uncontained intermediate pressure turbine wheel failure of the No 2 engine
at
about 6000 feet on departure from Singapore. The aircraft returned for
landing safely but the crew had around 54 ECAM messages to deal with and a
substantial loss of systems on board the aircraft. It took about an hour to
deal with all those messages.
There were, and are, a number of Airworthiness Directives out on the
engine for inspection; some are new and some are from previous problems. The
issue appears to be oil leaking from the bearing into the Intermediate
Pressure/High Pressure turbine wheel structural area causing an intense
local
fire that compromised the structure of the turbines.
The aircraft was substantially damaged but landed safely.
Systems Loss and Damage Synopsis:
Investigations are ongoing and there is much speculation in the media and
around the industry but the major issue for the ADO committee to consider
is the secondary damage and systems loss that the aircraft suffered.
A brief description follows of the known, and public, issues:
. The No 2 engine suffered an uncontained failure of IP rotor which
separated from the engine and penetrated the wing and body fairing of the
aircraft.
. The rotor penetrated the forward wing spar and exited the upper surface
of the wing.
. The main electrical loom in forward section of wing was cut causing loss
of engine control (thrust ok) on No 1 and no ability to shut it down with
Fire Handle.
. The power drive unit for the leading edge devices was severed in the
same location,
. The crew were unable to discharge any fire bottles for engine No 1 and
No 2.
. All electrical hydraulic pumps that side were lost.
. A piece of rotor penetrated the body fairing and severed a wiring loom
in that location.
. Another piece of the rotor damaged the aft fuel transfer gallery and
caused leaks in the left mid and inner fuel feed tanks - one of which was
substantial. This led to a lateral imbalance problem.
. The crew were unable to jettison or transfer fuel forward. This led to
indications of an aft cg problem.
. Emergency Outer tank transfer only resulted in the right hand outer
tank transferring - the left hand tank failed to transfer - this helped the
lateral imbalance.
. There was damage to the fairing housing the RAT, flaps and flap track
fairings.
. Total loss of the Green hydraulic system,
. ECAM indicated loss of both electrical hydraulic pumps on No 4 engine
(Yellow system).
. Landing Gear required gravity extension.
. No anti skid on wing gear hence only emergency brakes; body gear braking
normal
. Engines 1 and 4 indicating 'degraded mode' - which means no N-1
rating limit. Requires all engines to be switched to 'Alternate' mode with a
4%
maximum thrust loss.
. AC bus 1&2 failed.
. No 2 engine electrical generator failed as a result of the engine
failure
. The APU was started but the crew were unable to connect the APU bleed
air or the generators to the bus system.
. No 1 air conditioning pack failed.
. Autothrust was not available.
. The satellite phone system would not work.
ECAM Management:
When the failure occurred something like 54 ECAM messages appeared on the
screen. These set off the Master Warning and Master Caution many times; to
the point of distraction of the crew. The First Office started the stop
watch when the first master warning went off and from there it took the crew
50 minutes or so to clear the messages down to the Status page. Management
of the ECAM was an issue with the ECAM calling for a transfer of fuel into
obviously leaking tanks to cure a fuel imbalance. Forward transfer was also
not possible which generated an ECAM for an aft CG problem that could not
be rectified. The ECAM also called for a Fuel Quantity Management System
reset which, when carried out, regenerated all the error messages. For non -
Airbus pilots the Status page is normally where ECAM actions are stopped
and Normal checklists are used, Operational Engineering Bulletins are
considered, resets to recover systems are attempted and any pilot initiated
abnormal checklists are used.
Preparation for Landing:
It took the crew some time to prepare the aircraft for landing. The
Landing Performance Application of the Electronic Flight Bag did not appear
to
generate correct information which resulted in the crew carefully entering
eight landing alerts and recalculating the landing performance. The end
result was that the predicted approach speed was around 167 knots and
landing
distance 3850 meters on the 4000 meter runway. Aircraft handling checks were
carried out in both the clean and landing configuration with adequate
control response and margin demonstrated. This was despite a lateral
imbalance
of around 10 tonnes and a message indicating an aft cg issue.
Landing:
Given the loss of hydraulics the aircraft was in a degraded mode with only
one aileron working on one wing and two on the other with limited spoiler
capability. Autothrust was not available and manual thrust was used with
the engines in the alternate mode. Also no leading edge slats were available
and the gear had to be extended by gravity. Despite this the approach to
landing went as planned expect for a "Speed, Speed" call by the warning
system. The reason for this is unknown but it was cancelled by thrust
application. Touchdown was reported as very smooth and the aircraft speed
was
brought under control with about 600 metres to run. The aircraft was allowed
to
roll near to the end runway to position it near the fire trucks. When the
aircraft finally stopped the brake temperatures quickly rose to 900 degrees
and a few tires deflated.
Post landing:
When the aircraft stopped the crew attempted to shut down the No 1 engine
but were unable to do so with either the fuel switch or the engine fire
handle. Fuel was leaking from the left hand wing and pooling around the hot
brakes. The fire crew were organized to smother the fuel with foam and the
decision was made not to evacuate the aircraft given the running engine, the
pooling fuel, the potential for serious injuries and the presence of the
fire crews who were attempting to stop the No 1 engine by running a stream
of water down the intake. When the engines were finally shut down the
aircraft went "dark" due to the inability to connect the APU generators to
the
bus system..
------------------------------------------------------
Issues for Consideration:
This event raises a number of issues for consideration by the ADO
committee, Rolls Royce, Airbus and the industry in general. There is no
doubt that
the aircraft was badly damaged by the IP rotor burst. In fact, it is
fortunate that this incident did not end up like the DC-10 in Sioux City
Iowa [Or
American at O'Hare]. >From an aircraft damage tolerance point of view it
is a tribute to the A380, modern design criteria and the redundancy
available later generation aircraft. Certainly the fact that the very
experienced
crew consisted of three Captains, a highly experienced First Officer and a
very experienced ex-military Second Officer enabled tasks to be shared
including flying the aircraft, dealing with the huge amount of ECAM
messages,
communication and performance calculations. The First Officer managed the
ECAM and, at times, decisions were made to ignore or not do certain ECAM
procedures that did not seem logical such as transferring fuel into leaking
tanks. It is worth noting that there were three captains present because the
Pilot-in-Command was being Annual Route checked by a trainee Check Captain
who was being supervised by another Check Captain.
Without going into significant explanatory detail the following poses the
following questions for consideration:
Design:
. Given this and a number of other uncontained turbine rotor failures
should transport category aircraft be designed to withstand an engine rotor
burst? Or is this impracticable?
. Conversely, is it possible to design for rotor containment or mitigation
by the engine in the event of a burst?
. Can engine monitoring systems be developed to warn of an impending
catastrophic failure? (e.g. a combination of vibration/ rapid core
temperature
changes/parameters out of limits)
. Rolls Royce have mentioned engine self protection systems to shut down
engines in order to minimise the effect of a rotor burst. How would that be
implemented? Would warning be given? How critical would an unexpected
shutdown be? What would the false warning rate be?
. Why did some apparently unrelated systems fail in this incident? (e.g.
Yellow system hydraulic pumps on engine No 4) Is there a common data
management source that is failing under overload or was it damaged in the
incident?
. Are modern aircraft so complex that failures tend to be multi-modal and
thus confusing to the crew?
. If an electrical loom to an engine is cut the fail safe mode is to run
on. What if the engine runs on at high thrust?
. If there had been an engine fire the crew would not have been able to
use the fire bottles because of the cut loom. Is this system truly redundant
and effective?
. Given the loss of systems in the wing should the main electrical loom be
relocated or systems separated to a secondary loom to improve redundancy?
. The crew were unable to transfer fuel and there was a substantial fuel
leak from the left wing. What if these failures had occurred in mid ocean?
Operational Philosophy:
. There were many ECAM messages occurring in the initial failure. The
constant alerts were distracting and the need to cancel them detracted from
the
procedures.. Should a semi-permanent cancel mode be available? The crew
know they have a problem.
. Did the ECAM correctly prioritise the alerts? Probably not known at this
stage but certainly a few ECAM messages appeared incorrect in the
circumstances (e.g. Fuel transfer into leaking tanks for imbalance).
. Is the modern trend to complete all ECAM/EICAS actions too time
consuming and distracting to the crew to the detriment of prioritising the
flying
of the aircraft and the landing?
. Should there be an abbreviated ECAM/EICAS procedure that achieves a safe
mode for landing in the event of an emergency return?
. Is modern aircraft operational philosophy too automation and functional
system reliant?
Training and Experience:
. This was highly experienced crew. Should this type of failure be
considered when pairing a 240 hour MPL or cadet pilot graduate with a
relatively
new Captain? Or is the probability too remote and thus acceptable?
. The crew reported in this case that crew resource management was very
effective and that there was zero cockpit gradient. The crew were adaptive
in
dealing with the multiple and complicated ECAM messages. Should crew
resource training be modified to include crew recognition of the extreme
nature
of the emergency and thus to not slavishly follow checklist procedures to
the detriment of a timely return to landing?
. Given the move to evidence based training should training scenarios
include multi-mode failures so that crews can cope with unusual events or
are
they so rare as not to warrant this type of training?
Conclusion:
This incident could easily have been an accident; many of the systems
failures the crew had to deal with would be classed as an emergency on their
own (e.g. uncontained engine failure, loss of hydraulics, multiple bus
failures and leading edge failure) let alone in combination. The fact that
it
wasn't an accident is probably testament to the redundancy built into the
A380 design and it is certainly due to the training and competency of a very
experienced crew operating in a team environment. There are many positive
lessons to be learned from this event.
Captain Richard Woodward
Executive Vice President Technical Standards
IFALPA
Other Matronics Email List Services
These Email List Services are sponsored solely by Matronics and through the generous Contributions of its members.
-- Please support this service by making your Contribution today! --
|