|
|
Îò
|
Ýêçîò
|
|
|
Ê
|
Ýêçîò
|
|
|
Äàòà
|
14.06.2003 16:33:02
|
|
|
Ðóáðèêè
|
Àâèàòåõíèêà; 1945-1991;
|
|
Âîò, íàïðèìåð, åù¸ áîëåå íåîðäèíàðíûé àíàëîã ËÏ Òó-204 Ñ7 íàä Îìñêîì. (+)
www.aviationsafetyonline.com
www.aviationsafetyonline.com
Íå áóäó îñêîðáëÿòü âàñ ñâîèì ïåðåâîäîì... :) Òóò âñ¸ äîñòàòî÷íî ïîíÿòíî...
13 MINUTES
»ENGINES TURNING OR PASSENGERS SWIM«
Air Transat Flight 236 experienced an all engine flame out en route over the Atlantic during »extended twin operation standards« (ETOPS) .
Shortcomings in carriers maintenance procedures cited and many questions for the accident investigation commission.
by Tim van Beveren, Miami (updated: September 10, 2001)
Airbus A330 rated pilots are considering getting this aircraft listed under the category »world’s biggest certified gliders« in their licenses. The latter has become the new nickname for the Airbus A330-200 since the early morning hours of Friday, August 24th, when Air Transat Flight TS 236 diverted from its route from Toronto, Ontario (CYYZ) to Lisbon Portugal (LPPT) performing a »dead stick« emergency landing into the island of Terceira, Azores.
In an exemplary performance Captain Robert Piche (49) and his First Officer Dirk DeJager (28) performed at their best, thereby saving the lives of 293 passengers and 11 other crewmembers. The aircraft, registered as C-GITS, received minor damages to its landing gear. This was mainly because eight of the ten tires burst and a small brake-induced fire at the main gear wheels after a landing at higher than normal approach speeds and the braking action without reverse thrust assistance on the 10,865-foot runway at Lajes Airport[i] (LPLA)
According to preliminary information released by the Portuguese Aircraft Accident Prevention and Investigation Cabinet (GPIAA),[ii] the timeline of the event was as follows:
At 0548 Zulu time[iii], Santa Maria Oceanic Control received an emergency declaration from flight TS 236 after the pilots had ascertained that a fuel leak could be the reason for a fuel loss.
12 Minutes earlier, at 0536 Zulu, the crew became aware of a fuel imbalance between the left and right wing main fuel tanks. The electronic centralized aircraft monitoring (ECAM)[iv] system in this case will generate a warning on the display and call for the fuel imbalance procedure to be performed by the crew.
Following the troubleshooting and recalculating the remaining fuel quantity in the tanks, the crew decided at 0541 Zulu to divert to the closest available airfield, which was Lajes Airport on Terceira Island. The position of the aircraft at that time was approximately at 4220N/02230W at flight level 390 (39,000 feet). The crew informed Air Traffic Control that their remaining fuel was insufficient to continue the flight to their planned destination. This happened five minutes after the first indication of an abnormal situation and seven minutes before the declaration of an emergency.
At 0613 Zulu, still at 39,000 feet and about 135 nautical miles from Lajes the crew reported that the right engine had flamed out. In the following 13 minutes the aircraft lost all its remaining useable fuel and consequently the left engine flamed out at 0626 Zulu. At that time the aircraft was still 85 nautical miles away from the airfield and luckily still at an altitude of 34,500 feet.
The crew then deployed the ram air turbine (RAT) which provided emergency power to vital flight systems and one hydraulic system.
In a pitch-dark plane and without the onboard public address system available due to lack of electrical power, the flight attendants prepared the passengers for a ditching at sea. Air Traffic Control provided radar vectors to the pilots, who proceeded on an engine-out night visual approach. Passengers from Flight 236 later reported the situation on board during the following 20 minutes of gliding into Lajes Airport as »chaotic and panic-stricken«. According to newspaper reports[v], eyewitnesses were quoted describing the landing as »brutal and hysterical«. They further accused the cabin crew of »panicking«. Many passengers underwent a traumatic event, and some have announced their intent to sue Air Transat for »pain and suffering« compensation.
Nevertheless, the airplane touched down on runway 33 at 0646 Zulu, with a direct and favorable headwind of 8 knots and unlimited visibility.
During the emergency evacuation of the aircraft nine passengers and two crewmembers received minor injuries. The evacuation was performed within 90 seconds, thereby meeting certification requirements.
However, something definitely not meeting the certification requirements was a black hole on the aircraft’s flight data and cockpit voice recorders. This disturbing fact was revealed in the early stage of the subsequent investigation. The Investigators were obviously puzzled that the state of the art digital flight data recorder (DFDR) and cockpit voice recorder (CVR) stopped recording about 20 minutes prior to the successful landing. According to Airbus Industrie, on an A 330 the mandatory flight parameters are stored in the DFDR and it »can store the data of the last 25 hours. It stores this data on a fireproof and shockproof tape. An underwater locator beacon is attached to the DFDR.«[vi] Further, the manual says:
» The recording system energizes automatically.
- On the ground during the first five minutes after the aircraft
electric network is energized
- On the ground with one engine running
- In flight (whether the engines are running or not)«[vii]
Could someone image the frustration of the aircraft accident investigation board, after successfully recovering the recorders from a depth of 20,000 feet, if the event would have had an »unlucky ending«?
It is still unclear why the recorders ceased operation after Flight 236 lost its second engine. A hint might be found again in the Airbus literature[viii]: »On the ground, the recording system stops automatically five minutes after the second engine shuts down.« Could it have been that the computer system of the modern A 330 was not programmed to distinguish between an »in-flight engine shut-down« and a »normal shut-down« on the ground?
Probably not, but in regards to the powering of these recorders a design related problem in the A 330 becomes obvious. According to more solid information presented by Air Transport Intelligence on September 4th[ix] the Transportation Safety Board (TSB) of Canada[x] has confirmed that the flameout of both engines stopped the electrical power supply to the aircraft’s alternating current (AC) power buses. In an A330 the AC power buses are supplied with electrical current by the generators at each engine and by the auxiliary power unit (APU)[xi]. The flight data recorder is powered by the AC Bus no 2. Therefore, without any engine driven generators or the APU running, it will be inoperative.
When flight 236 lost its second engine the aircraft was still at 34,500 feet and thereby at too high an altitude to start the APU. The crew would have had to descend and give up the saving altitude in order to start the APU. On the other hand: with no usable fuel left in the tanks it would not be possible to start the APU after this point in time.
With other comparable aircraft, for example the Boeing B 757/767 series, a similar event would not have the same consequences in regards to the operation of the recorders. As soon as the ram air turbine is extended, it will power the recorders, which in addition are powered by the batteries. Nevertheless, in an incident involving a United Airlines Boeing 767 on March 4th, 2001 departing from Maui, Hawaii, the National Transportation Safety Board (NTSB) investigators have determined[xii] that the respective flight data recorder stopped recording data for a period »less then half a minute« after both engines spooled down below idle setting. The recorder resumed normal recording when the power of both engines was increasing.
However, the really »exciting aspect« in the Azores accident seems to be how it became possible that the aircraft lost its second engine only 13 minutes after the first engine died of »fuel starvation«.
A very rough calculation about the remaining fuel on board when the incident started leads to the assumption that fuel spilled out the ruptured fuel line at a rate of almost 200 to 300 kilograms per minute, though the fuel pipes are relatively small in diameter.
In fact, both Rolls Royce Trend 700 engines went dry because of a fuel leak in one of the fuel pipes leading towards the engine. Only five days after the accident Airbus and engine manufacturer Rolls-Royce issued an urgent all operators telex[xiii], advising an inspection of all A330 with Trent 700 engines and to perform a prior service bulletin (SB)[xiv]. The service bulletin was addressing a problem with the clearance between fuel and hydraulic pipes. It was originally issued back in March 1999.[xv] The telex confirms the source of the fuel leak was »a damaged fuel feed pipe.« The damage was due to «interference with the hydraulic pipe from the aft hydraulic pump in the vicinity of the high pressure fuel pump inlet.« According to Airbus[xvi] this interference can result in »a significant fuel leak« and these pipes should be modified as part of the earlier Rolls-Royce service bulletin to ensure adequate clearance.
In this regard, other disturbing facts emerged in the Canadian media[xvii] shortly after the accident. Prior to the accident, Air Transat had replaced the right engine after tiny metal filings had been detected in the engine’s oil. During this repair, not all work recommended by the manufacturer Rolls-Royce, was completed, especially not the recommended service bulletin mentioned above, as some spare parts required were not in stock at the Montreal-based maintenance facility. A concerned senior Transat Air mechanic had warned his supervisor just five days before the ill-fated flight that the particular plane was not ready to fly. The mechanic was so worried about the situation that he tape-recorded the telephone conversation with his supervisor, who overruled the mechanic's advice to not release the aircraft back to service after the engine replacement was performed.
Though this particular negligence on behalf of the supervisor might have contributed considerably to the near catastrophe on August 24th, it should never have developed such dramatic consequences. Modern aircraft are built and certified based on the concept of redundancy. A single fault with one of the aircraft systems should not lead to such a serious and life-threatening situation. Appropriate safeguards are required to be built into the airplane's systems, especially to prevent such an event. »A leak in one pipe should not result in two engine shutdowns. That is a serious concern.« said former TSB of Canada Chairman Benoit Bouchard in a press conference on August 28, in Ottawa.
Therefore let’s have a closer look into the A 330 fuel system design: According to the Airbus graphic display of its fuel system[xviii], a low-pressure valve should automatically shut off the fuel flow to an engine before fuel may leave the tank in the aircraft’s separate wing structure. This valve should close itself when, for example, the engine master switch is placed to the »cut-off« position or when the »fire push button« at the overhead panel is pushed (the latter not very desirable as the aircraft will lose other vital systems, like cabin pressurization, from that side).
In the event of a fuel leak, Airbus recommends two optional procedures, unfortunately leaving the crew with a choice as to which option to follow in case of a fuel leak[xix]:
If the leak is at an engine, the affected engine has to be shut off. Part of the shut-off procedure is to set the engine master switch to the »off« position. This should close the associated low-pressure valve in the fuel pipe leading to the engine.
But right underneath these actions to be performed by the crew, the procedure states further: »The Xfeed valve« (the cross-feed valve enabling the transfer of fuel between the two main tanks of the aircraft) »can now be selected open for rebalancing or allow the use of the fuel from both wings.«
Obviously this would not have produced the desired effect, as Flight 236 thereby still lost all remaining fuel. On the other hand, this action seemed to be quite prudent in the specific situation since the aircraft was unbalanced after the right tank went dry.
The other option should be followed if the leak is not from an engine or the leak could not be located. In the latter case, the cross feed valve »must remain closed to prevent the leak affecting both sides«. The left and right hand side inner tanks should be split. Airbus further recommends in this case to descend to the gravity fuel-feeding ceiling, which is about 23,000 feet.
When this altitude is reached all fuel pumps should be shut off. The manufacturer believes that »in almost all cases, switching the pumps off will prevent any further loss of fuel.« It further cautions: »All pumps must be switched off, even if the leak is from one wing only, as there are some failures on one side that will result in fuel loss from the other side…«
However, a little detail not mentioned in this procedure can be found at a different location in the four-volume aircraft operation manual[xx]: the fuel tank cross-feed valve is »automatically opened« in case of an electric emergency after both engines fail. A dual engine flameout will lead to this exact scenario as all generator power is lost with the dead engines. Only essential flight-systems remain powered by the extendable little turbine at the outer fuselage that will provide enough electrical energy and hydraulic pressure to vital systems, like the forward wing slats. Fuel would be equally distributed between the two tanks.
Here seems to be the answer for the loss of the second engine of Flight 236, as by this point in the chain of events, the remaining fuel from the left tank would have be cross-fed to the right tank and consequently, it all spilled out via the ruptured fuel line.
Apart from the fact that the crew of flight 236 would have had to identify, in pitch-dark night, the location of the leak which was somewhere outside the aircraft and probably behind closed cowlings, these choices of procedure are »not believed to be optimal« among the pilot community. The pilots of flight 236 had to rely only on the indications on their ECAM screen prior to applying any of these procedures. As the system will only give fuel information referring to displayed digits of fuel used, fuel flow by each engine, and position of respective fuel valves, this troubleshooting will not give immediate hints to the nature of the problem. The crew will discover that they have less fuel than expected, but depending on where the respective data is sensed (e.g. fuel burn at the engine) the display will not reveal the location of a suspected leak.
So apparently the pilots of flight 236 made the right decision in not descending too low and thereby giving up the saving altitude (aviator's proverb: most useless in aviation: »the runway behind, the fuel burned and the altitude above you«). In case all engine power is lost, one wants to remain as high as possible in order to reach an appropriate landing site by gliding.
Due to the absence of information on the aircraft’s recorders, it is still not known why the crew of flight 236 lost all fuel and consequently both engines and if this was due to »crew induced« or »aircraft related« automatic actions in the sequence of events. Airbus pilots are puzzled about the fact that their colleagues were not able to isolate the tanks and prevent the fuel from leaking out through the ruptured fuel pipe on the right engine. This and other issues will remain the focus of the investigation for some time.
The independent powering of flight data and cockpit voice recorders is already an industry issue since the earliest recommendations stemming from the investigation into the crash of Swissair flight 111 on September 2nd, 1998. The TSB, strongly supported by similar recommendations from their US counterpart, the NTSB, had urged almost two and a half years ago that the recorders should be powered independent of the aircraft’s main systems to assure electrical power in the event of an electrical emergency.
The accident has led to very drastic consequences for the Canadian operator Air Transat. The charter carrier, who began its operation in 1987 and services routes from Canada to Europe and southern destinations, operates a fleet of 24 Boeing, Lockheed and Airbus aircraft.
Immediately upon reports emerging about the Air Transat mechanic and his supervisor, the airline’s ETOPS certification for their three Airbus A 330 aircraft was reduced from 180 minutes to one hour. The »extended twin operation standards« allow operation of aircraft with only two sources of power for up to 207 minutes[xxi]. Within this timeframe the aircraft should be kept operational in case one engine fails and a diversion to a suitable landing field in range can be conducted safely. Cynics have another interpretation for the abbreviation »ETOPS«: »engines turning or passengers swim«.
The ETOPS certification for Transat’s four Boeing 757 and its four Airbus A 310 aircraft was restricted to 90 minutes during all flights. A special audit of the carrier's maintenance practices was launched. In addition, Transport Canada has ordered all Air Transat pilots to take remedial training in fuel management and emergency procedures for long flight under ETOPS.
Thus far, the airline was fined US $ 160,000 for violating maintenance requirements. The supervisor who released the accident aircraft into service was suspended and may face further charges.
The Canadian Transport Minister David Collenette confirmed that this fine was the largest in Canadian aviation. »The amount is so high because this plane flew 14 times with the equipment and engines configured inappropriately«, Collenette was quoted by Canadian media.
But the question remains: are the current extended twin operation standards safe, especially on fuel and time saving routes over open waters and over the poles? The event of Transat flight 236 should be taken seriously into any further considerations, as it proves that an ETOPS certified aircraft may loose all engine power within a time span of only 13 minutes.
Taking into account the previous mentioned United Airlines Boeing 767 event during March of this year, at least both most commonly used twin engine aircrafts from both leading manufacturers have now proven that there might be a much higher potential for a catastrophic loss of an ETOPS-certified aircraft than commonly anticipated.
Few pilots believe that a ditching in the Atlantic, in case of an emergency, is a venture that will go flawlessly. Most aircraft will break apart and, depending upon impact forces, many passengers that survive the impact may simply drown. A ditching at sea is nothing like one of the animated pre-flight video demonstrations presented to passengers during the required safety instructions before take-off. Everyone knows that, but at the same time, everyone accepts the risk. Mathematical calculations convinced many that the risk factor for such an event is only at about »10-9« or in other words »one in a billion«, - while others are still not ashamed of citing »10-16 « for statistical purposes at the same time demanding a general rule of 180 to 207 minutes for twin engine operations. The Air Transat Flight 236 event has thereby beaten even the more conventional figures…
Ñ íàèëó÷øèìè. Ñåðãåé