ANNEX K

 

MD11 Technical Discussions

- Agreeing to Disagree

Subject: Agree with MD-11 F/O - situations do deteriorate. From: John S

Date: Sun Sep 13 19:14:15. Do not rush to judgment upon the actions of the Swissair crew. Situations can start off as mildly attention-getting yet deteriorate [sometimes quickly, sometimes gradually]. The nature of "smoke in the cockpit" checklists are necessarily further debilitating because it involves progressively shutting down systems, avionics and electrical distribution busses in order to quell [and perhaps identify the source of] the smoke. You end up with a quite "crippled" jet. However, no-one would expect to lose transponder, DFDR and CVR power plus all COM radios. These are normally protected by having some powered by a "Flight Essential bus". The fact that the investigators have recovered pieces of cockpit overhead panels that have melted would indicate that the [probably electrical] fire was unable to be controlled. This would seem to me to indicate that the glitch was in the wiring "to" the busses. No amount of circuit-breaker pulling will rectify a situation where the wiring is shorting out [which is presently the best bet]. I'd suspect the captain had to kill all the electrics to try and halt the fire. In an electric jet that's a pretty terminal decision on a dark night over black water [and perhaps above an undercast]. An unusual attitude recovery would be unlikely because of weight, inertia and no external flight attitude references [i.e. to say "which way is up?"]. Because of the progressive nature of developments in such an emergency the only way to combat them is to make allowance for them in aircraft design and standard emergency checklists. I advocate that, at the first sign of a smoke in the cockpit situation arising, the first step on the checklist should be a single switch selection of a "Flight Essential bus". After having thus killed all possibility of a fire taking hold, crews can then resolve the situation further at their leisure - even at their scheduled destination if weather, maintenance, residual configuration and external ATC support permit. However, normally it would be good judgment for the captain to land enroute - it's simply prudent. I'm afraid what we had here with SR 111 was an act of God actively aided and abetted by the McDD design team and cost-cutters about 11 years ago. For my part I'd still plug for the "third man" [flight engineer or systems supervisor] who can off-load the pilots tremendously in such circumstances. Could any-one fly the jet on a dark night with one hand on the yoke and the other wielding a hand-held fire extinguisher, at the same time trying to reference the manual and turn up which circuit-breaker or switch........No I think that in the long Swissair tradition that crew did the best they could in the circumstances. The fact that they committed themselves to a turn-away from Halifax in order to lose fuel and height was probably the most prudent thing to do in the circumstances then prevailing. The fact that it shortly thereafter came drastically unstuck is irrelevant to his earlier decision. Many dark brown smells in cockpits come and go, wafting away with the aircon air exchange.

~ Re: Agree with MD-11 - situations do deteriorate. From: MD-11Fr8Dog . Host:173-1-231.ipt.aol.com Date: Mon Sep 14 06:32:14. On Sun Sep 13 19:14:15,

John S wrote: The nature of "smoke in the cockpit" checklists are necessarily further debilitating because it involves progressively shutting down systems, avionics and electrical distribution busses in order to quell [and perhaps identify the source of] the smoke. You end up with a quite "crippled" jet.

MD-11Fr8Dog: You indeed display your lack of knowledge on the "Smoke/fumes of unknown origin" for the MD-11. The procedure is designed to enable a single crew member to run/monitor electrical loads/air systems in a systematic way so as not to "progressively" shutdown systems. Primarily there is ONE switch for this purpose!! It is called the SMOKE ELEC/AIR switch and has 4 positions:

NORM

3/1 OFF gen channel 3/bleed air 1 and pack 1 secured, 2/3 OFF gen channel 3/bleed air 1 and pack 1 restored and gen channel 2/bleed air 3 and pack 3 secured, 1/2 OFF gen channel 2/bleed air 3 and pack 3 restored and gen channel 1/bleed air 2 and pack 2 secured.

So there shouldn't be a "progressively...crippled" jet.

John S wrote: Now throw a cockpit fire into the mix or an electrical fire that eliminates the complete electrical system for you and you're in a mess!! However, no-one would expect transponder, DFDR and CVR power plus all COM radios to have been lost. These are normally protected by having some powered by a "Flight Essential bus".

MD-11Fr8Dog: The COMMS, CVR and DFDR would be the last thing things on my mind -- AVIATE, NAVIGATE, COMMUNICATE. They're in that order for a reason!! DFDR is AC BUS #3, CVR is RIGHT EMER DC, and the COMMS are various sources. If there is no data going to the DFDR [as in complete loss of elec], no need for it to be powered. It would be helpful for investigators if there was a some way to keep power to the CVR, after a loss of power - but that poses other problems, i.e. would it stop recording after an incident / accident or would it continue to record [on its own self-contained batteries] over the important stuff long after the incident? No amount of circuit-breaker pulling will rectify a situation where the wiring is shorting out [which is presently the best bet].

John S wrote: I'd suspect the captain had to kill all the electrics to try and halt the fire. In an electric jet that's a pretty terminal decision on a dark night over black water [and perhaps above an undercast].

MD-11Fr8Dog: That's why its not done in this aircraft! There is no CB pulling, at least not at my company, and there is no procedure to "kill all the electrics". You just don't do that in a glass cockpit!

John S wrote: An unusual attitude recovery would be unlikely because of weight, inertia and no external flight attitude references [i.e. to say "which way is up?"].

MD-11Fr8Dog: Main problem is attitude reference - this plane does have a Standby Horizon powered by the battery. It should be usable at least during the 15 mins of battery life available with no other power sources. Wet compass and standby AirSpd/ALTimeter is available through out…...provided that these instruments could be seen through any smoke and in spite of their somewhat out-of-the-way positioning.

John S wrote: I'm afraid what we had here with SR 111 was an act of God actively aided and abetted by the McDD design team and cost-cutters about 11 years ago.

MD-11Fr8Dog: Another alarmist and unsubstantiated opinion! Many dark brown smells in cockpits come and go, wafting away with the aircon air exchange. That's the main disadvantage in a 2 man cockpit - you always know who farts!! Sean O'Leary, MD-11 First Officer.

John S replies: The SMOKE ELEC/AIR switch sounds like it's a variation of 3 additional electrical/aircon sources with the fourth being its normal detent. I wonder how long you can afford to leave it in each position? Do you need smoke detector, visual or nasal confirmation before you move it to the next position? It sounds very much as though the source of power for the avionics and systems is just being swapped around to different combinations. That's not really helpful if the smoking failure item just ends up getting its power from somewhere else. Does this solitary 4 position panacea have the capability of reducing the jet to Flight Essential electrics? Doesn't sound like it. Really sounds as if it's a sleight -of-hand amps re-routing trick that's being accomplished here. Aircon Pack secured/pack restored. No workee? Try another combo. Sort of like musical chairs on the deck of the Titanic. Same with gens and bleed air; seems to be always looking for a guilty engine more than something tied to a bus / relay / transformer / inverter etc.? I'd have to say that it's an optimistically ongoing selective `seek' for a benign electrical configuration. It's very much akin to my progressive monitoring off of increasingly vital avionics, systems, generators and busses but with a vital difference - at least eventually the steam-driven checklist gets to [most probably] switch off the offending bit of kit, by process of elimination -whether you happen to realize it or not. I fancy the outcome of that process more than I do your chances of lucking out with one of your additional three switch positions. But, perhaps I'm being too critical of the MD-11's built-in redundancy and automation. At least you do get to move the switch manually. Tell me, does it have an "OFF"position? If it did, perhaps you'd not be in a mess - particularly if, after all your combo selections have been tried, there actually was a selection to electrically inert the jet down to a battery-driven Flight Essential Bus. Otherwise, you'd just have to burn. Couldn't agree more with your aviate/navigate/communicate priorities. It's just that, like TWA 800 and perhaps even the Valujet accident, nothing really substantive was forthcoming from FDR or CVR. Be nice to have the transponder continually powered though. It won't chew up much battery. Even if the MD-11 FDR was battery-powered and only picking up one channel [and that was attitude info from a standby AI [with a time reference]], that would be magic for an accident investigator. Shouldn't be impossible to rig. Coupled with intercom and ambients from a CVR it would be a wealth of info. It's starting to look like, for the MD-11, jeopardy will rule in future because there'll be sparse info and only reasonable conjecture [vice determinate conclusions]. That's the worst of all worlds. -bad for all the global MD-11 operators, bad for discerning pax, bad for Company bottom lines. As for continuance recording on the CVR you simply g stop it at 9 or 10 and you'll not lose data due to battery power. After a simple incident, switching it off should be the last item on the checklist.

Re Circuit-breaker pulling. I have seen a circuit-breaker fail, the RAWS [rad alt warning system] catch fire [smoked up] and the problem was only resolved by pulling it. Guess we never should have rammed it home after it first popped. However you tend to get a bit blase because it was always in the descent checklist to pull and reset it [to give it a fresh datum in a different geographic pressure system]. Probably all the pulling and resetting over the years was what u/s'd the RAWS CB itself and caused the problem. It may well prove necessary to pull a malfunctioning protective device such as a single or ganged CB when it doesn't pop of its own accord. Yes, positioning of standby gyros and the like does tend to ruin your scan. It's quite conducive to an unusual attitude developing - particularly if a smoky situation has been allowed to develop. Scan is further ruined if there are any toppled gyros visible to confuse and disorient. Won't get into any religious fracas with you re Acts of God but I will promise to drop my drawers on any nominated LA street corner if there isn't an "eventual" FAA directive for significant rejigging of the MD-11 electrics and wiring. I agree with your sentiments about dark brown smells. Give me the good clean fun of an engine failure [and or fire] any day. They're so much easier to nut out than smells and smokes that wax and wane. You're never ever sure, in the absence of visible smoke whether you should start the checklist, pause it, complete it or hand over to the copilot at the first sign of anything, go hold up in the bog and hope he sorts it out [you can tell yourself it's character building and a wonderful career step for him]. I'll conclude by telling a "wary". One dark and stormy night we were steaming along at 300 kts plus at FL260 in an Electra when a bit of prop flew off and went through the fuse. It entered and exited. Nearly killed someone sitting on the crapper. The next 10 minutes were the worst combination of vibration and confusion I've had outside of a bordello raid [but that's another story]. The old bucket of bolts was shaking so much you couldn't read the gauges even after we slowed to 180. It was eventually sorted out by shining an Aldis lamp on the prop discs and voting on which one appeared slower [due loss of solidity]. We made the right "D" but it was more luck than skill. Guess who's idea the Aldis Lamp trick was? You guessed it - the Flt engineer's. I'd straight run out of ideas and was ready to pull all the E Handles one at a time, starting at #1, glide rather than break up. Ever noticed how two people attempting to achieve the same thing will remain in a state of argumentative dissonance yet resolve their confusion and achieve consonance when a well motivated third party appears? That's how I feel about the Flt eng's value on the flight deck.

John S also wrote: A few easy questions Sean:

  1. Can you fly the MD-11 boost-out? i.e. are there some great big handles you can pull to disengage the hyd packages to aileron, rudder, elevator? Or does a total electrics and no ADG = bird no fly?
  2. Are the hyd pumps all electrically- or eng-driven? If there were hyd pumps on each engine, the ADG's hyd would simply be for an MD-11 glider [confirm?]
  3. If the gear, flaps, speedbrakes, spoilers and LE devices are electrically selectable and hyd- actuated, what non-electric reversion modes are there for each service [if any]? What about the three-axis trims?
  4. Windscreen wipers: are they either/both electric or hydraulic?
  5. Emergency wheelbrakes: - accumulator pressure only?
  6. Thrust reversers: hyd only? / but electrically selectable?
  7. Is ADG manually deployable? [i.e. cable-operated]. With ADG in HYD position there's no elec generator capability? You couldn't swap between because you'd lose hyd power to flight controls I'd imagine.
  8. With ADG in hyd mode and relying on Battery power, #2 will be flamed out and aft transfer pumps will be inop [but dump will still be possible] - confirm?

On Mon Sep 14 10:23:21, MD-11Fr8Dog wrote: On Mon Sep 14 09:11:36, Tom had asked: Is the MD-11 totally fly-by-wire [no flight controls with total loss of electrical power] or does it have hydraulically amplified controls?

All primary and secondary flight controls are hydraulically powered, each by at least two, and in some cases, by all three aircraft hydraulic systems. Sean O'Leary MD-11 First Officer

Subject:Re: MD-11FR8Dog - Need your comments please. From:MD-11Fr8Dog . Date: Sun Sep 13 19:06:19

To John S, A total loss of electrical power is manageable - Battery power for 15 mins with these items operable:

IRU1, IGNA, DEU1, DU1, DU3, MCDU1, INT1 and VOR1.

Deploy the ADG and you get power to the same items for 90 mins with the ADG in the hydraulics position. Put the ADG in electrics mode and now you get back: All DUs, except 2, #2 AFT FUEL PUMP and the TAIL PUMP to ENG2 [now you can restart #2 since it flamed out - 1 & 3 can gravity feed, 2 can't], IRU2, IGNB, DEU2, MCDU2, VOR2, ILS2, and HF2.

All three scenarios are manageable, each more than the previous. But what if the cockpit is burning - on fire - I don't care how much redundancy you have, you're not gonna last long - whether a 2 man or 3 man cockpit! You're trying to relate redundancy, arcing and 2 man vs 3 man into one big ball of wax. It isn't applicable here, IMHO. Quite frankly, I like 3 man better than 2 man, how could I not. I like having that third pilot [as long as he can make a good cup of coffee!! ]. Its much better than having a flight engineer monitoring the systems. We have a PILOT who monitors the flight instruments and the pilots!! MUCH better than the traditional CAP/FO/SO 3 man cockpit! I can't deny that it is BETTER to have 3 vs 2, but the workload in the MD-11 is not as high as one might suspect. ALL of the FE's duties are replaced by the systems' controllers and most of the FE's procedures - normal and abnormal – are done automatically! When we have a malfunction/emergency/abnormal situation in-flight the pilot flying flies the plane and handles the radios, the pilot not flying handles the checklist. And yes, having a 3rd pilot on board would help, but I think it would have just been one more unfortunate lost soul on SR 111!! Sean O'Leary, MD-11 First Officer. on fire....?" Well the whole point is to nip that development in the bud by killing as many volts as you can safely lay your hands on [ASAP]. Do you have a non-toxic hand-held cockpit fire extinguisher? Bet you will soon. FE is the best man to wield that. How hard is it for you to physically see CB panels to check if CB's are popped [or are popping]? You say: "ALL of the FE's duties are replaced by the systems' controllers and most of the FE's procedures - normal and abnormal - are done automatically!" Surely in the electrical failure situation, as things worsen, that's like relying upon a fire-engine that is itself on fire? Distinctly agree with splitting PF/PNF allowing concentration on task at hand [however most captains would insist upon a degree of consultation as critical steps are reached]. What does your smoke checklist say? How many steps? Is it uniform across all operators? Thanks again for the info. Regards, John S.

John S replied: Yes I agree that all is for nought if the fire burns on [probably you're stuffed if it starts in the first place]. Restoring lost services by deploying the air-driven generator may well be what screwed this crew [i.e. by throwing the volts back into the circumstance]. My minimalist approach says to give the normal electrics the heave-ho and just abide by what little you can, leaving the ADG tucked away - as long as it's a guaranteed 15 mins. Loss of #2 eng shouldn't pose a big problem. Fuel dump should always be an option. I never ever thought landing 3 engine at or near max landing weight was a fine thing let alone at well over MLW. IGNA is continuous ignition is it not? Or just your relight? You say "But what if the cockpit is

email IASA                                                  homew.gif                   List of Annexes altimeter.gif