Background
In a normal aircraft an emergency power configuration would result
from
a rotary switch selection of just that (with a decal saying "EMERGENCY
BUS"). In
fact, if I recall correctly, in the old SP2H Neptune it was labelled
as that. It
provided DC and AC from rotary inverters (vice AC GEN). You had a
chart from which
to extract remaining batt life in different configurations. As far
as I recall, it
was impossible to power certain non-essential items off it (such as
CWHomer,
Tactical displays, sonobuoy Bearing indicators etc). You couldn't
crank start the
jets but you could open the jet doors and derive enough ergs to windmill
light-off. However the jet throttles were electric and weren't to
be moved
(recommendation). No two aircraft have the same design philosophies.
Frequently,
in much modified airframes, the design was a flagrant compromise and
just
developed (or grew like Topsy).
Not so with the MD11. It was electronically developed
from the DC10 with a specific exclusion of the third crew member in
mind. It always stuck in my mind that Hiltebrand, Swissair Chief Pilot,
was so horrified at the investigator's suggestion that sr111 had suffered
a "total electrics". As you can see from the following outline
(see below) of the functions of the Smoke/Elec/Air switch it just
swaps around configurations looking for a benign one. It never permanently
removes power off circuits because its philosophy was simply to cut
out faulty aircon packs, generators and bleed air sources (and their
associated circuitry). It never entertained a loss of all generators
including the ADG, nor any circumstance in which the wiring would
be a common denominator affecting any position selection of that critical
switch. Gerden has said as much in one of his Press Releases. I'd
doubt very much that it is as you said, i.e. that once down to batt
power they are on virgin wire. I would suggest that if all GENS were
tripped the BATT is simply left to face the music and assume the load
(under the MD11 design philosophy that simply refused to entertain
total loss of generating sources). I would also doubt if that circumstance
would give rise to any automatic monitoring off of excessive loads
- simply because it was never in their remit to design for a circumstance
in which the aircraft would suffer manifold (supposedly unrelated?)
failures and couldn't continue to fly. i.e. There is an EMERG Bus
but there is no selection provision for that bus. I also doubt that
it was possible to switch off all GENS.
If we look at a few more clues before
I come to my conclusion:
a. 10:22:39
The Skipper calmly asked the F/O if he was in the aircon checklist
(no real panic at that stage, they'd just turned away from Halifax
to dump). At this stage they'd had the oxy masks on for about 6 mins,
they'd been smelling the smell for 12 minutes and the F/O had lifted
the hatch to check the E/E Bay. The DFDR discloses that they had assumed
an airconditioning problem and had spent some time pageing through
the aircon schematics on the synoptics screen before running that
checklist.
b. Shortly
after, 10:24:15 smoke worsening, the
first Smoke/Elec/Air selection of 3/1 OFF was made (i.e. GEN 3 &
AC BUS THREE OFF). This tripped the autopilot (warbler heard in the
background of a transmission). However another autopilot selection
should be available, even until the IRS fails 15 mins into battery
power only. Up to this point, the tail tank is directly feeding the
#2 engine via the #2 engine tail-tank pump, powered by Right Emer
AC. However, Right Emer AC & DC Bus are also killed by a 3/1 OFF
selection and #2 engine fuel is therefore now being fuel-fed only
by the transfer pumps (various busses). Because neither smoke nor
smell of an active fire dissipates quickly the F/O felt compelled
to make another selection (brilliant checklist philosophy and design
/ brilliant switch design with its multiplicity of connections and
lame-brained functions).
c. When the
F/O next selected (i.e.2/3 OFF), as I understand it, they were then
onto BUSSES One and Three and went from Gens 2 & 1 to Gens
1 & 3. i.e. Because the problem was IFE related on Bus Two he'd
thereby effectively quelled the situation for a few moments. However,
because neither smoke nor smell dissipates quickly (and fire had taken
hold of insulation blankets) he felt compelled to make another selection
(brilliant checklist philosophy and design/brilliant switch design
with its multiplicity of connections and lame-brained functions).
d. By selecting
½ OFF He had reselected the IFE's Bus (AC2 with the rapidly worsening
elec fault/fire). The checklist has a NOTE: (not a Caution or WARNING)
that:
" Emergency power transfer is inhibited
with Smk/Elec/Air Selector in the ½ OFF position".
Up to this point the #2 tail engine pump was being powered by the
transfer pumps but fuel-feed was supposed to switch to #2 Tail pump
on Right Emer AC bus. If the #2 Engine flameout occurred at this point
(because of the failure to switch back - bus-tie sensing relay again),
the result may well have been that Generator 2 couldn't come on line.
Because the #2 GEN didn't come on line all loads then automatically
transferred (by bus-tie sensing relay) to GEN #1 (which promptly overload/underfreq
tripped). The BATT was then being rapidly flattened by the massive
Normal and shorting loads (or the BATT CB blew), all electrical and
electronic Hell broke loose.
The checklist has a warning that
"the First Officer must be the Pilot Flying when the Smoke
Switch is moved to the 1/2 OFF position." (i.e. Captain's displays
will be OFF)
However, the copilot next reported his
Display Unit (Flight Insts) had failed. In short order everything
then failed including the Captain's display, the DFDR and finally
the CVR (lower drainage items last). #2 tail jet flamed out as the
fuel pump’s power failed. That would have (momentarily until
the caution panels and audio failed) Xmas-tree'd the cockpit and increased
the pucker factor by tenfold.They would have then been in a darkened
cockpit in their smoke-masks and headsets without any means of communicating
with each other - because the intercom and radios and ALL lighting
would also have failed. They were well on the way to (or instantly
into) an unrecoverable unusual attitude (terminal for a heavy jet
under 10,000ft) caused by total loss of attitude
references.
d. I'm pretty sure that, if you allow
a battery to flatten entirely (or trip its CB), you will not
be able to reset a tripped generator. So, even if the F/O had gone
on to another selection he would probably not have had any joy. I'm
not sure about the MD11 ADG deployment (whether it's an electrical
selection or, as per the DC10, mechanical via a lanyard).If the McDD
designers are true to form it will have been electrical. However,
once again I'm not sure whether, in the absence of any amps from a
flat (shorted or BATT CB tripped) battery, the ADG gen would come
on line. Modern generators, even though capable of self-excitation,
are normally electronically monitored as they come on line because
they have to be PROVEN to be socially acceptable before their output
can soil the pure electricity required by modern avionics. If there's
no batt power there's no monitoring and no on-line acceptance (IMHO).
I'd be very interested as to whether the ADG was stowed or deployed
when sr111 hit the water. I'd guess "stowed".
Unfortunately, with electrics (in an electric
jet), once things stop playing the game according to Hoyle you are
in a world of hurt (and total confusion because it's literally beyond
your experience and training). The MD11 was simply not designed for
electrical cataclysms - yet that is precisely what happened. The failures
were outside the parameters for which it was designed. That occurred
courtesy of Kapton wiring, metallized mylar insulation, cost-cutting
the third crewman, commercial pressure to incorporate the IFE, poorly
designed smoke-masks and goggles and a critical smk/elec switch designed
by Nero. Of course the smoke checklist design philosophy should get
a mention - but at the end of the day the battle was lost because
of an initial human failure setting off a chain of seemingly distinct
(but actually concerted) events. A singular failure of a bus-tie relay
switch provoked a very safety conscious airline into replacing all
in the fleet. Perhaps "if it ain't broke don't fix it" has
a lot to be said for it.
The raison d'etre of the bus-tie sensing
relay is for it to be the auto-switching terminus for all the power,
- so obviously it would be the first port of call for any misdirected
shorting volts. Conversely if its installation is "murphied"
and a short happens after "power on" to the newly installed
item, the resulting damage is simply a function of whimsy (i.e. a
madman can depart a bus terminus in any direction). In similar fashion,
a bus-tie sensing relay is so epicentric
to the whole system (and the smoke/elec switch) that any fault with
it should have given rise to a major maintenance checkout of the whole
electrical system. As we now know, it didn't - and it was probably
the beginning of the rot (good old "ground-checked serviceable"
- I wonder if all engines and systems were turned up for that particular
write-up). Without all systems and Gens operating I don't see how
anybody can write up something such as a bus-tie sensing relay as
serviceable. The deadly clincher was probably a full first and business
class all turning on their IFE's about an hour out (as boredom struck).
It may well be that I'm way off beam here.
There may well be a load protection device in circuit that stops excessive
loads being placed upon the batteries. However those devices are also
liable to disruption by being shorted out and BATT CB's can blow.
It may be that AC Generators can come on line irregardless of BATT
health. It may well prove to be the chafing damage to the wiring caused
by the in-ceiling movements of both port and starboard front doors
that started the electrical fire. One is really whistling in the dark,
not being privy to the actual circuitry design and specs. You can
only surmise that, if 15 minutes of essentialities were supposed to
be available, they were and something else (such as a worsening fire)
caused the rapid conclusion. However, in that case I'm sure a few
further words would have been said on R/T. The evidence of the CVR/DFDR
and transponder cutting out points to a massive crash of the electrical
system and that would tend to support my theory. Melting aluminium
takes a lot out of a battery. If any-one would like to pick holes
in my latest version of likely events, feel free.
