Virtual A320 Triple Hydraulic failure

[Giggey]

Hi all.
Yesterday during a 5 hrs leg i was discussing with my cpt about it.
What in case of a triple idraulic failure?

Airbus doesn't even consider it and ok, it's pretty impossible for it to happen but.......just for training what would you think will happen?

A. Sure death

B. Just with rudder and Diff. Thrust. what would happen to the trim which is mechanically connected but inoperative with absolute loss of Hyd power?

I said that it would be probably death, but in case of a non abnormal trim position maybe, with God's assistance something would have been possible to do.

let me know what do you think about.

cheers and merry Xmas to all.

GJ.

[EGGW]

Aaaah, a triple Hydraulic failure, OK.

Well unlikely in the extreme, with leak isolation valves. Anyhow, try asking the TRI/E next time in the sim for this scenario, after all the boxes are ticked. It can be done, but is VERY hard work, even with 1 doing thr/levers, the other the rudder. If you had a tad of x-wind, nah, find somewhere else to land if possible.

EGGW

[Clandestino]

B. Just with rudder and Diff. Thrust

Eerrm.... what rudder?

Perhaps there have been some modifications lately, but all 319/20 in our fleet have hydraulically operated rudder. It can be mechanically signalled in case of total electric loss, but there has to be at least one hyd sys alive. It might be yellow or green via eng pumps or blue via RAT but you definitively need hydro pressure to move it.

So was there a change in the flt ctl architecture or did I miss something?

[hetfield]

There have been plenty of DUAL HYD SYS LOSS (G/Y).

It's only a matter of time until a tripple happens.....

[Giggey]

This is what i was in doubt of.
as far as i know in the "mechanical backup" the rudder is still operative but i was also told that it's the only surface still connected mechanically and it should work in any case even in a complete hyd loss scenario.
if it's not like that i now have the answer as it's a sure death.

cheers

[Germstone]

different frame but did someone say sioux city

http://en.wikipedia.org/wiki/United_Airlines_Flight_232

[Giggey]

I checked it on Fcom and even the rudder is operated hydraulically than with the 3 sys inop even the rudder is gone.

gj

[Tail-take-off]

as far as i know in the "mechanical backup" the rudder is still operative but i was also told that it's the only surface still connected mechanically and it should work in any case even in a complete hyd loss scenario.


The term mechanical back up refers to the loss of all flight control computers which would leave you with Stab Trim, Rudder & thrust control (symetrical giving some additional pitch control & asymetric giving additional yaw control).

With no hydraulics you only have thrust control.

As to the question of rudder control try moving the rudder while shut down on the ground. Now add the aerodymamic forces at anywhere from 0 - 350 kts :confused:

[electricdeathjet]

It should be possible to get near a runway, I seem to remember a certain DHL A-300 landing in Iraq with a total hydraulic loss.
I have had a go in the sim with a triple system loss and it was surprisingly controllable, but we didnt have an attempt in landing....

[NigelOnDraft]

I have had a go in the sim with a triple system loss and it was surprisingly controllable, but we didnt have an attempt in landing....And do you really think the Sim is accurately modelled with no Hydraulics :{ In fact, do you think it has been modelled at all, and if so, how ;)
NoD

[Fropilot]

From a B707 manual

"Failure of more that two TRU is so unlikely that it is not even considered here"

So what a wing could fall off.
A control cable could snap.

Give me a new QRH

[Max Angle]

And do you really think the Sim is accurately modelled with no Hydraulics
Well I don't suppose it is but it does represent a reasonably accurate aerodynamic model of the aircraft and I suspect that the way it behaves with the hydraulics switched off is not a million miles away from how the aircraft would behave under similar circumstances. I have had a go in a 320 sim and although you can fly it around the sky on engine thrust fairly easily it becomes pretty much impossible once you try to maneuver for an approach and landing. My admiration for the the two (that I know of) crews that have pulled it off for real is immense. Not just an Airbus problem of course, every Boeing from 747 onwards has needed hydraulic power to move the surfaces, the 737 was last one with manual reversion.

[Reel Marine]

Well in a virtual state, anything can happen.

But in the REAL world, loose all 3 hydraulics and unless your chuck yeager with the throttles, your DEAD.

It's as easy as that, and has been on all airbus aircraft. some have defied logic such as the A300 in baghdad but it takes a great amount of skill to land the aircraft under these circumstances.

[Essential Buzz]

Apparently if it happens - in any aircraft - the recommendation is to extend the gear as soon as possible. The rationale is that this assists in damping the inevitable phugoid motion from using thrust to control pitch.

There have been studies done (NASA?) with a view to someday include a "thrust only" reversion into future flight control software.

[františek dobrota]

http://dtrs.dfrc.nasa.gov/archive/00000326/01/TM4320.pdf

http://dtrs.dfrc.nasa.gov/archive/00000329/01/TM4324.pdf

:ok:

[electricdeathjet]

Quote:
And do you really think the Sim is accurately modelled with no Hydraulics :{ In fact, do you think it has been modelled at all, and if so, how ;)
NoD

NOD
I forgot to mention it wasn't a microsoft flight sim!!
I gather that modern simulators are considered to be training tools, so I would assume that a no hydrauic flight has been modelled, otherwise we wouldn't have been able to do so...
We didn't attempt a landing because I think crashing an airplane in the sim is considered negative training! :eek:

[hetfield]

If the SIM is "lost" with 3 HYD SYS LOSS, giv'm a try without touching the controls.

Try to fly it just by thrust/asy-thrust.

[Mad (Flt) Scientist]

I gather that modern simulators are considered to be training tools, so I would assume that a no hydrauic flight has been modelled, otherwise we wouldn't have been able to do so...

Nope, sorry. Modern full flight simulators are indeed training tools, and as such are intended to enable teaching of the various approved or recommended procedures, normal, abnormal and emergency.

If it's not in the flight manual, there is no expectation you'll be trained on it, and therefore no-one's going to waste time fine tuning the sim for a case that "doesn't exist".

The sim may also not be tuned for various combinations of failures; it may be representative, or it may not, depending on whether the failures interact in interesting ways or not. There's a set of generic validation tests for a sim, and there may be additional ones based on a specific training regime, but anything outside of that is rather nebulous.

[fantom]

MFS speaks the truth.

Yesterday, I tried to demo a proper stall (not the girly one) in a 320 sim..

We got down to (about) Vsw-30 kts before a good downward V/S developed. The recovery was normal but the sim would not fly anymore in spite of an indicated 210 kts.

It wasn't programmed for that manoeuvre and didn't expect to be asked.

[captain87]

I think it would be the hardest abnormal situation to manage but it's nearly impossible to happen according the system's redundancy. A Triple Hyd Failure would mean that all the three systems have a leak and/or the engines are out with RAT locked in its IN position ... In this case I think that the Mechanical backup wouldn't be possible according the loss of the thrust levers efficiency that are hydralicaully operated.
I'm not sure ... but I believe this extreme situation should be out of consideration and I hope that the engineers have worked fine in order to avoid it.

captain87 (airline pilot student)

[Broomstick Flier]

EB,

quote
There have been studies done (NASA?) with a view to someday include a "thrust only" reversion into future flight control software.
unquote

NASA (Dryden) developed the PCA (Propulsion Controlled Aircraft) concept using a MD-11 as testbed. There was a very nice article on this on an old Flight Internatinal magazine. The plane being controlled via the MCP, no need to direct handle the levers.

Some additional information: http://www.nasa.gov/centers/dryden/history/pastprojects/PCA/md11.html

Cheers

BF

[Reimers]

The green and yellow double failure seldomly occurs as two independent failures. Mostly the second failure is caused by the continuous operation of the PTU that connects both systems. Three simultanious failures are even more remote.

[Techman]

What should be of more concern than a loss of all hydraulics, is the apparent lack of understanding from qualified crews of how the primary flight controls of their aircraft function.

[rogerg]

If the problem cant be solved with the QRH then you are in "no mans land" How it works is probably of of little use.
One instructor I had in the USA talked about the "BRT" levers. These were the thrust levers. " When you push the BRT levers forward the big round things make more noise, that all you need to know"

[Torqueman]

guys I think a real lot has to go wrong to be looking at this scenario. You would have to virtually empty out all three hydraulic systems. Pretty unlikely.

Two Engine driven pumps

One electric pump with a ptu to the other side

another electric pump on blue sys and a rat as back up........

thats a fair bit of redundancy.

[hetfield]

guys I think a real lot has to go wrong to be looking at this scenario. You would have to virtually empty out all three hydraulic systems. Pretty unlikely.

Are you aware that already many HYD DUAL LOSS happened on 320?

Mostly G/Y, 'cause GREEN RSVR LOW LVL but YELLOW PTU kept running and overheating YELLOW SYS?

So it needs only one of these days without BLUE SYS.....

[electricdeathjet]

Look at the rudder system, all 3 hydraulic systems are operating very closely to each other, Souix City, Japan Airlines, both lost all systems from one problem. So why is everyone so certain it will never happen on a a320.
Murphys Law Anyone?
If it can happen, it WILL happen.

[Giggey]

What should be of more concern than a loss of all hydraulics, is the apparent lack of understanding from qualified crews of how the primary flight controls of their aircraft function.



What you should be concern about is that a manufacturer like airbus do not even consider possible that one of his planes could suffer by a triple Hyd fail.
Infact, the Initial Airbus training (cbt) doesnt talk about it,the Fcom doesn talk about it.There is nowere any reference were you can get a secure reply about this question.
The only thing you can do is to go throw the aircraft systems charts (flight control) and say ah yes, with no hyd you are on the ground.

Pilots are human beings and it's not 1 month course for a type rating which would give them the full kwnoledge about the airplane tey will fly.
You need time, lot of study and questions like the one i have asked before say that you really know an aircraft.
And i am surely not the kind of person that would feel is the best just because i'm sitted on a 320.

cheers

[Clandestino]

manufacturer like airbus do not even consider possible that one of his planes could suffer by a triple Hyd fail

Yes they do.

They do the maths and they come out with chances of it happenning so low, that it doesn't justify the installing of the fourth system.

Send PM to PBL, if you'd like to see actual numbers and methods of getting them.

However, PTU that doesn't shut itself off with HYD LO LVL is something that Airbus could have done bettter and I hope it will be rectified.

[hetfield]

Would be interesting what the "maths" say about DUAL HYD SYS LOSS.....

[violator]

They do the maths and they come out with chances of it happenning so low, that it doesn't justify the installing of the fourth system.Less than 10^-9 per flight hour. Just like other catastrophic failures.

Would be interesting what the "maths" say about DUAL HYD SYS LOSS.....Off the top of my head I can't think of a G and Y hyd failure that wasn't caused by inadvertent use of the PTU. Certainly it's the biggest cause by far. It's interesting that despite all the cries from pilots about over automation in FBW Airbuses, pilot control of the PTU is a problem. Should Airbus remove the PTU p/b and automate the system further to prevent overheating and a resulting dual hyd loss?

757 and 767 also have three hydraulic systems, albeit without a PTU.

[hetfield]

It's interesting that despite all the cries from pilots about over automation in FBW Airbuses, pilot control of the PTU is a problem.Yes, it may be a problem. Are you aware that faulty PBs kept YELLOW PTUs running?

Pilot's fault?:ugh:

[Dani]

Most important things have been said.

NASA proved the concept of PCA, FAA desided that it's not justified. They have calculated all safety improvements and do the relation between costs and lifes saved. Those improvements with the most "lifes for the buck" get the nod.

hth,
Dani

[violator]

Yes, it may be a problem. Are you aware that faulty PBs kept YELLOW PTUs running?

Aside from that, IIRC the ECAM action for a G or Y hyd loss doesn't say turn off the PTU! And of course, in the event of a G or Y reservoir low quantity (or overheat) the PTU p/b will be shining away with a lovely 'FAULT' light. The PTU isn't FAULTy though and will be happily pumping the other system into a reservoir overheat. Moral of the story, know your systems.

Or maybe add some more logic to the PTU controller and remove the button altogether...? ;)

[Techman]

Giggey,

It was not meant as a personal attack, but more as an attack on the industry. There seems to be a move towards the "no need to know" philosophy, rather than the "need to know" one. I trust you understand the difference.

As a classically trained engineer, who do give ground courses to aircrews, I find the level of training, and basic knowledge of those participating, to be seriously lacking in one very important aspect, understanding! There is no emphasis on understanding. Complete the exercise and tick the box, that is what training seems to have become. Ham and Enos would have been right at home.

This thread, and many other, are examples of this.

[mnttech]

Techman,

Three cheers!:D What is even worse, is there does not seem to be a place to go look it up either! While the aircraft systems of today can be so interconnected, it would be impossable to keep them all straight during an oral or PC, it would be great to have a "reference" manual that tells the real story.

It seems the older aircraft were built on the thought that the crew would be smarter than the aircraft, and today's aircraft are built on the, oh never mind.

By the scope of this thread, I assume that the cause of the triple failure is running all three systems dry. I'll see if I get some time in the simulator next week and see what ours does. I agree it might not be completely correct, but since the simulator models what happens with each system dry, it should be able to do it with all three empty. Also, some simulators have the real computers, they are just feed inputs.

[misd-agin]

AA DC-10 had a jammed stabilizer. Not the same as a total hydraulic loss but they were able to land using the #2 engine to change the pitch attitude. Using the wing mounted engines also has a pitching moment(power up, nose up, power back, nose down)

DC-10 into KSUX had total hydraulic failure. Read the NTSB witness statements, and not the final report. CKA Dennis Finch(sp?) saved the day.

A300 had total hydraulic failure after SAM impact. Did one go-around and then landed on the runway.

Total hydraulic failure is possible. It can be survivable but is tough to accomplish. I'm 2 out of 3 in my attempts. Fairly easy, very tough, and then a crash. :sad:

Try it and be humbled...

[chornedsnorkack]

They do the maths and they come out with chances of it happenning so low, that it doesn't justify the installing of the fourth system.

There are plenty of planes with 4 hydraulic systems.

A300 and DC10 have 3 redundant hydraulics. B747 and L1011 have 4. No one seems to have bothered with 5.

The JAL B747 which had a rear bulkhead explosion lost all 4 redundant hydraulic systems, just like the DC10 lost all 3 to tail engine explosion and the DHL A300 lost all 3 to a rocket hit in wingtip.

It follows that multiple common-cause failures are not an unlikely event - has happened 3 times already - you could be the fourth.

A320 has 3 hydraulic systems - like A300. But unlike A300 and A310, the A320 has glass cockpit, fly by wire and sidesticks.

If an A320 were to lose one wingtip and all three hydraulics just like the A300 did - how would the cockpit controls react?

[hetfield]

Concerning maths, with almost 6.000 A320 delivered chances are getting high for a triple HYD LOSS.

[Tail-take-off]

With regard to earlier posts about whether a sim would accurately reproduce the flight characteristics first airbus would have to establish exactly what those characteristics are.

Do you really think they are going to want to fly around with no hydraulics just to see what an extremely unlikely failure would be like?

[hetfield]

Leave the hydraulic systems on, don't touch stick and rudder, use eng thrust to try it in the sim.

Edited:

Ooops, I'm afraid this doesn't work in the 320 SIM due to the Flight Control Logic, sorry guys and gals.

(Apart from that it works out in the A300 SIM, but that's another story).

hetfield

[Saint-Ex]

Re CHORNEDSNORKACK`s post. The DHL A300 did not loose its port wingtip, it lost the outer 2 flaps. The aileron stayed on the wing Cockpit controls effect would have been the same if on an A320 ie zilch.

[chornedsnorkack]

The DHL A300 did not loose its port wingtip, it lost the outer 2 flaps. The aileron stayed on the wing Cockpit controls effect would have been the same if on an A320 ie zilch.

Ah, so an extended part of wingtip was directly damaged. But the cockpit controls were affected in the sense that, e. g. the structurally intact elevator, rudder and opposite wing were not controllable because of no hydraulic fluids.

[PBL]

Well, let's try some *very* crude estimates to give people an idea of what they can conclude without even leaving the armchair to look up the systems. And let me estimate without leaving *my* armchair to go look anything up.

Malinge told the CPI that the A320 family had accumulated about 60 million flight hours.

There have been dual hydraulic failures. Let's suppose there have been 60 of them to make the arithmetic easy. That makes one dual-failure in 1 million flight hours.

Suppose in each of these cases the two systems failed independently. We can take the posterior reliability of each, the MTBF to be 1,000 hours (1,000 x 1,000 = 1 million).

So what is the expected MTBF for three systems? 1,000 x 1,000 x 1,000 = 10^9 hours. So we can expect another
940 million flight hours to go before seeing one.

60 million under the belt, 940 million to go. How many hours a year does an A320 fly, and how many of them are
there? Well, they have been in service 19 years. Let us assume a constant rate of production, x aircraft per year, and that all of them carry on flying for ever at identical levels, say y hours per year. Then there will be xy hours
flown in the first year, 2xy in the second year, 3xy in the
third year, and so on. And we know
xy + 2xy + 3xy + ..... + 19xy = 60 million.

xy + 2xy + ..... +19xy = xy(1 + 2 + 3 + ... + 19) = xy.190 = 60 million

So xy = about 316,000.

Now we want to know how many years it is going to be before the fleet accumulates 1 billion hours. We want to
solve for n in
316,000(1 + 2 + 3 + .... + n) = 1,000,000,000

That is, (1 + 2 + .... + n) = about 3,165.

Now, (1 + 2 + .... + n) = n.(n+1)/2 so we want to solve for
n where n.(n+1) = 6,330. Now, n.(n+1) is a little over n^2, so let's just take the square root of 6,330, say of 6,400, which is about 80 (since 8^2 = 64). So we are round about 80 years of service life before we expect to see a triple failure, and we have had 20 years already, so we can expect another 60 years without one. Don't explain that plane to be flying in line service in 60 years.

All that without leaving the armchair to get a calculator!

Now, about those dual failures. There are, as has been mentioned, dual failures with common cause, namely concerning the PTU. The third system is independent of this common cause, so assuming all failures (including dual failures) are independent is a conservative assumption.

The only non-conservative assumption I see in this is that A320 family aircraft are not produced at a constant rate per year since service intro, but at an increasing rate. However, look at one of the other assumptions. Is is *really* true that one loses one hydraulic system every one thousand flight hours in an A320? I don't think so, I think it is *much, much* more rarely than this. That more than makes up for any increased production rate.

As NoD and T-t-o have said, don't expect the sim, even the Iron Bird, to accurately portray what's going to happen for real in this scenario, for the reasons they have mentioned.

PBL

[hetfield]

How many hours had the 747 be flown until a QUAD HYD LOSS with JAL?

How many hours had the DC 10 flown until the tripple Loss at Sioux?

How was that calculation?

[PBL]

Gee, hetfield, I'd forgotten about that!

you're right. All that math can't help. It's going to happen tomorrow!

PBL

[hetfield]

I don't hope so.

But if it happens, YOU are not the person at the controls.

[violator]

While that calculation is good, you're assuming that hydraulic system failures are independent events, but they're not. Most (all?) of A320 G&Y failures have been caused by inadventent PTU selection. All total hydraulic failures on commercial aircraft have been caused by structural damage. A strengthened floor would have saved THY981 (along with McDD listening to Convair/General Dynamics' concerns about the floor, not getting the FAA to change their mind about the floor strength, fitting the supporting plate to prevent the torque tube from deforming, not falsifying records &c.) The addition of a fourth hydraulic system probably wouldn't have helped. Four hydraulic systems didn't save JAL123.

Of course, the proliferation of EHAs in new designs means that ship-wide hydraulic failure won't condemn future aircraft (and the A380).

[PGA]

Just out of interest: Can anybody explain to me how exactly the PTU can cause either the G or Y system to fail in case of a hyd low rsvr lvl ?

I don't quite see the logic?

Thanks in advance

[hetfield]

@PGA

If you have a GREEN SYS loss due to RSVR LOW LVL the Y PTU shouldn't run. Otherwise you will have YELLOW RSVR OVHT and so a DUAL LOSS.

This happened many times due to wrong switching as well as PB failures.

[PGA]

@ Hetfield,

Thanks I got that bit but I fail to understand why the say Y system would then overheat?

[hetfield]

There is no "load" on the PTU cause on the green side no fluid, it speeds up like hell.

[PBL]

While that calculation is good, you're assuming that hydraulic system failures are independent events

Correct. Explicitly. So now we are getting into what the figures can mean. They are a decision guide. In order to let such figures guide one in making decisions, one does indeed need a feel for what such calculations can say, and what they can't. And the independence assumption is the trickiest of the lot.

There are obviously people here who don't know what such calculations can say and what they can't, and I don't see how to give a feel for this which can be packed into a dozen words.

What the figures are good at showing is that, even if you know about or have experienced a simultaneous failure of two systems, that does not necessarily mean you or anyone else needs seriously to worry about a failure of three.

but they're not.

I think you mean that not all hydraulic failures need be caused by independent subsystem failures. Correct. Being hit by a missile might be a common cause failure of all three hydraulic systems. The calculation obviously does not account for failures caused by external events, such as missiles or mid-air collisions or such.

It is also the case that there have been features of certain architectures that slipped through the regulators, such as the common-cause failure near Sioux City. But that was a glaring design error which should have been caught at review time by the hazard analysis. Throwing blades was not exactly an unknown event. And when doing the hazard analysis obviously either nobody had asked what the worst outcome could have been when number 2 throws a blade, or had done so and not answered the question correctly.

Calculations of likelihood don't help when significant design-analysis errors are made

On the other hand, when it comes down to it I don't actually know what hazard analysis techniques were current when that AC was designed.

Most (all?) of A320 G&Y failures have been caused by inadventent PTU selection.

Note that I took account of that specific common-cause failure, and it played a conservative role in the argument.

[/QUOTE]All total hydraulic failures on commercial aircraft have been caused by structural damage.[/QUOTE]

Right, as far as I know.

PBL

[chornedsnorkack]

All total hydraulic failures on commercial aircraft have been caused by structural damage. A strengthened floor would have saved THY981 (along with McDD listening to Convair/General Dynamics' concerns about the floor, not getting the FAA to change their mind about the floor strength, fitting the supporting plate to prevent the torque tube from deforming, not falsifying records &c.) The addition of a fourth hydraulic system probably wouldn't have helped. Four hydraulic systems didn't save JAL123.

But a 747 DID have the same kind of accident like THY981. A cargo door opened, the floor duly failed and 9 passengers were blown into Pacific Ocean.

Unlike the DC-10 which fell out of the sky, the 747 kept flying and landed happily, minus the nine passengers sucked out. Something must have saved the 747.

[PBL]

Since the PTU comes on when the differential in a 3000psi nominal system is 500 psi, and the direction is automatic, then more has to be wrong for there to be such low pressure on one side such that both the PTU is working and it has low enough load for it to overheat.

What is that "lot more that has to be wrong"?

Obviously if G is leaking, you don't want to be pumping fluid over. But if everything else is OK, it doesn't happen. What else has to fail?

PBL

[hetfield]

Obviously if G is leaking, you don't want to be pumping fluid over.

Do you know the 320 systems?

[PBL]

But a 747 DID have the same kind of accident like THY981. A cargo door opened, the floor duly failed

The flight control lines are routed differently on a B747.

PBL

[PBL]

hetfield,

I'd be glad of a precise answer in one message, if there is one and you are willing to give it. I don't want to go back and forth with one-sentence interactions.

PBL

[hetfield]

To my limited knowledge there is no "fluid to pump over" on 320, 340, 330, 300.

Oh yes, FUEL.

But that's not what we are talking about.

[PBL]

Hetfield,

understand you're unwilling to answer the question. Thanks anyway

PBL

[hetfield]

Just stick to the last ? (question mark)

[PBL]

Hetfield,

you are quite welcome to misunderstand what I say, build straw men and shoot them down, not answer my questions, anything you want.

PBL

[violator]

PBL, the PTU transfers hydraulic pressure (via shaft power) between the G and Y systems. There's no fluid transfer.

IIRC, PTU logic is based on p/b, the delta p between G and Y being >500psi and a few other things mainly related to engine start, cargo door operation, flt etc. Reservoir low quantity plays no part, so if either the G or Y system has a leak the PTU will start once the pressure in the leaking system is below 2500PSI and won't stop until the PTU p/b is pressed.

[PBL]

PBL, the PTU transfers hydraulic pressure (via shaft power) between the G and Y systems. There's no fluid transfer.

I think you might find there is actually some path whereby fluid might pass between G and Y or vice versa. And certainly if there is low or no fluid in the G system, there has been a transfer of fluid from G to somewhere. Where?

I could probably carry on all day like this, but I am not interested in playing language games. I was hoping that somebody who knew of a specific scenario might care to share it here.

PBL

[hetfield]

It's not a language game at all.

BTW I'm very dissapointed about your system knowledge.

@Giggey

Obviously you asked a very good question. Maybe exceeding some scientists cababilities and making some drivers to have a look in the manuals.

Happy New Year

[TyroPicard]

hetfield
Leave the hydraulic systems on, don't touch stick and rudder, use eng thrust to try it in the sim.

Wouldn't work, mate.. the FBW system compensates for thrust changes and keeps you the right way up - even with one at TOGA and one at Idle. Failing all three hydraulic systems might at least give some spoiler or aileron upfloat to make it interesting..
TP

[PBL]

BTW I'm very dissapointed about your system knowledge.


If you look a little more closely, you will find that I have given you no information about my system knowledge at all.

.................... I am here because I had hoped that on this forum of experienced aviators there might be some people who could tell me things I don't know, and some who might like to learn things which I could tell them.

[Edit: material on the discomfort I feel with what is, to me, the often puerile level of interaction on this forum, that I am surprised to find coming from people who self-describe as technical professionals.]

Hetfield, despite your reticence, I would still be grateful if you would share with me your personal knowledge of how both primary A320 hydraulic systems fail together in line service.

PBL

[idg]

I have not read the entire thread so apologies if I am covering what has already been said but...

Airbus have warned of a situation that could indeed lead to a 'Dual HYD Failure'. The circumstances were a leak in the Green system after start that was not picked up all the way to Take-Off. On T/O the leak rate increased and total GRN system loss ensued but the warnings are inhibited because of flight phase. As has been pointed out before, the Yellow system began to drive the PTU, but with no fluid to drive in the GRN system it spins at an almighty rate and very quickly overheats the Yellow system. The aircraft now climbs above 1500' and lo and behold a Green system failure and Yellow 'Failure'! Of course the Ylw is actually an overheat that could be reinstated once cooled, but from memory the crew didn't bother with that they just went straight back to land.

In similar circumstances once the Ylw fluid had cooled and the PTU selected off the yellow could have been re-instated.

Oh yes another thing...

An Airbus rep told me of instances of Green to Yellow transfer but it is not 'intentional'. It occurs in the brake shuttle valves (Green / Yellow system) perhaps when seals fail internally? Sorry can't remember the exact details now.
Happy New Year to all.

[PBL]

An Airbus rep told me of instances of Green to Yellow transfer but it is not 'intentional'

Thank you, idg. I wonder whether he was talking about known instances, or merely about what he knows about the hazard analysis in the certification basis?

Let me give some indication for those who might be interested but do not know, how a hazard analyst might go about analysing such systems.

First, heshe might look at the crude system diagram in 1.29 and observe that there are at least two devices which connect between the G and Y hydraulic systems. (idg is reporting a third, which I don't believe is indicated in those diagrams, but I can't be bothered to go check.) Now, for each of those devices the certification basis for the AC will include documents, amongst them one assigning the level of criticality of the device, and another giving an argument in detail as to how the device satisfies the assigned level of criticality.

Now, I don't know the detailed design of those devices; I have never seen such engineering documents. And I doubt anybody else here who is willing to say something has either, because those documents are prima facie proprietary and the people seeing them form an restricted group bound by non-disclosure agreement, and nobody who takes their code of practice seriously (i.e. all engineers except for the occasional crackpot) is going to violate non-disclosure for the sake of some guy asking questions on an anonymous web forum, unless there is something seriously, seriously wrong (which I doubt).

So my question to violator was a "leading question". In other words I already know that (as a hazard analyst interprets these words) there are paths between G & Y through which fluid can theoretically travel. Any, say, HAZOP-like analysis will explicitly consider such a scenario and its consequences, but as I said I do not know what techniques are used in the certification basis.

Now, I have never seen any hazard analysis on any piece of complex equipment which was completely correct, without exception. It may be beyond the bounds of current human capability to devise one for such a thing as a commercial aircraft that was exceptionlessly correct. Most of them have faults. Some of them, occasionally, have glaring holes. And I know, for certain specific aircraft that interest us, that there are hazards whose severity (technical term) is catastrophic (also a technical term) that have not been mitigated, because we have reverse-engineered and identified them.

I thank idg also for explaining the PTU-overheat scenario in a little more detail. My next question if I were to follow that line would be of course what the consequences are of that abnormal state that the PTU gets into, but as I said, I doubt anybody here with either the detailed engineering design or the certification basis documentation sitting in front of himher would be inclined to answer.

Sorry for the length of this note. I'm just trying another writing technique to try to avoid this pointless, and to my mind rather silly, one-sentence repartee. I do hope I can get back to brevity; I'd rather just ask a simple question and hope for a sensible answer.

PBL

[hetfield]

@TyroPicard

HAPPY NEW YEAR

You were a little faster than me and absolutely correct about simulating a total HYD loss 320 family in the SIM. Like you said the Flight Control Logic is still aktiv.

Sorry for that.:)

Did it in the A300 SIM and there it works, cause switching all pumps off screws the SIM up.

@idg

Yes, fully correct. Beside that scanario there have been incidents of DUAL LOSS due to PB failures. The crew handled the situation very well, but the PTU PB even switched to OFF kept the PTU running.

[IFixPlanes]

There are obviously people here who don't know what such calculations can say and what they can't, and I don't see how to give a feel for this which can be packed into a dozen words.

Replace "such calculations" with "FCOM" :}

[PBL]

IFixPlanes,

well, there are obviously people here who don't know the FCOM in detail either. But what has this issue to do with knowing or not knowing the FCOM? As people have pointed out, losing three hydraulic systems is not considered operationally.

PBL

[hetfield]

@IFixPlanes

Thx for your input;)

This thread has shown clearly that also a scientist should take a look to the system description before talking :mad:.

[Torqueman]

An Airbus rep told me of instances of Green to Yellow transfer but it is not 'intentional'. It occurs in the brake shuttle valves (Green / Yellow system) perhaps when seals fail internally? Sorry can't remember the exact details now.


It is my understanding that this would only occur when the brakes are applied or pressure is sent to the shuttle valve from the Brake control unit. Normally not pressurised. Transfer would stop when brake pressure released.

Also, I'm not sure if the brake hydraulic fuses are before or after the shuttle valves. It's been a while. If they are before they will stop the flow when it gets beyond a normal rate.

In regards to the green system loss. If the warning is inhibited due to flight phase screening to 1500'. The plane does not fly around long below 1500' agl. (maybe a pilot type might tell us how long from takeoff to 1500') I'm tipping it's not long.

Your yellow system might get to an overheat but it still takes time. Depending of course on the amount of work it does in the PTU and other controls. It also depends on the rate of loss of fluid from the green system. It's generally going to keep tyring to make pressure until the reservoir is empty. A small leak will take some time to dissipate the fluid. The Engine pump will continue to make pressure though. The PTU will not come into play.

[Clarence Oveur]

Is there not a flow restrictor fitted to the PTU to limit the maximum RPM? What would generate more heat, the flow a fluid through the motor side of the PTU or the friction in the dry pump side?

[hetfield]

@Toqueman

I know personaly about an incident where G Loss occured during TO run and due to ECAM logic warning was was inhibited until 1.500. Immediatly thereafter Y SYS OVHT. This means about 3 minutes.

[idg]

The Airbus warning was from an actual event when the 'dual failure' occurred. I'll try and get some more info but it actually happened, and happened quickly enough to be present when the a/c climbed above 1500'. Probably about 1min 30 secs.

I'll also try and get a tech diagram of the shuttle valve.

[IFixPlanes]

...An Airbus rep told me of instances of Green to Yellow transfer but it is not 'intentional'. It occurs in the brake shuttle valves (Green / Yellow system) perhaps when seals fail internally? Sorry can't remember the exact details now.
A so called "brake shuttle valves" between green and yellow system does not exist in the A320 braking system. ;)

[františek dobrota]

Last G+Y loss scenario which I know hapens at BA PRG-LHR (A320-100)flight one or two months ago.. Succesfull landing at PRG with full emergecy, one tyre blown-out due temperature. Airbus solution is inhibiton PTU operation below 1500´, probably on new planes only...

[idg]

IFP

Well my manuals talk of 'Dual Shuttle Valves' so I assume Airbus know they exist! However your inference that I'm barking up the wrong 'valve tree' is correct !! :ouch:

The valve that has had most problems in this area is the Parking Brake Operated Valve.

I have a magnificent diagram with cross sections of all the valves but no way of posting it!

Will PM to anyone that requests it!

[IFixPlanes]

I know hat a "Dual Shuttle Valves" exists, but you have mentioned a "brake shuttle valves" whitch is connected to green and yellow hydraulic.
For Images simply use : :ok:
ImageShack® - Online Photo and Video Hosting (http://imageshack.us)
The "Parking Brake Operated Valve" is not so complex:
http://imageshack.us/a/img186/8226/parkingbrakeoperatedvaljq2.th.jpg (http://imageshack.us/photo/my-images/186/parkingbrakeoperatedvaljq2.jpg/)
Parking/Ultimate Emergency Braking - Schematic:
http://imageshack.us/a/img186/1479/parkingultimateemergencht8.th.jpg (http://imageshack.us/photo/my-images/186/parkingultimateemergencht8.jpg/)

[elfinknight]

Hi All
Forgive my ignorance, But unlike the 737 classic series which can allow fluid transfer depending on which system you use to apply the parkbrake and which system is running when you release the park brake. I was under the impression that the A320 use of yellow and green hydraulic systems to the brakes were completly seperate systems with no possibility of fluid transfer, right down to two seperate supply lines to the brakes, and operating seperate pistons. If someone can explain it to me about the A320, i would aprecciate it.

Sorry if I haven't made my query clear, its my first post

[Dream Land]

You are correct! Think of the parking brake handle as a "green system" enable, when parking brake released, it then allows green system pressure.

[PBL]

I was under the impression that the A320 use of yellow and green hydraulic systems to the brakes were completly seperate systems with no possibility of fluid transfer, right down to two seperate supply lines to the brakes, and operating seperate pistons.

It seems from the history of this thread that the interpretation of the word "possibility" depends on whether you are a pilot or engineer considering the normal operation of the systems or whether you are a systems safety analyst considering what can go wrong.

They don't transfer fluid during normal operation. However, there appear to be ways to get cross leaks that involve something not doing what it should do.

PBL

[DesiPilot]

This is what I read in a website (http://wisdomseva.com/ghyds.html) created by an Indian Airlines Captain:

DESIGN DEFICIENCY IN A320 ‘ GREEN ’ HYDRAULIC SYSTEM

Some time back, I used to notice the Green Hydraulic System indication of the A320 showing decrement during flight at higher altitudes with time, comparing to the Yellow & Blue system. My wonde for the reason compelled me to accomplish in-depth study of the entire Hydraulic system of the A320 a/c as something inside me, within, was inspiring me to do so, telling me that there is something wrong. I made several workshop / hangar visits, studied the system layout, circuit diagrams and various Maintenance Manuals involving lot of tedious effort & time.
Ultimately, the truth revealed by itself. I found, ( unlike the other two systems ), the Green Hydraulic System Reservoir and its associated circuit so located by design that when it gets subjected to cold- soak, the hydraulic fluid contracts to such an extent that would trigger a SYS LO LVL thereby causing lot of problems for the ignorant pilot. I took up the matter with the DGCA/IAL authorities but my theory was rejected & all efforts were in vain.

My belief was firm, something within me inspired me to go ahead & stop not till the goal is reached. I approached the Airbus Industrie with the problem alongwith all the papers, drawings & my hard-work. The AB carried out detailed investigations / flight tests. This is what was their finding :
Quote : “ After several reviews with different Airbus resources involved in definition and design of the A320 hydraulic and landing gear system we came to the following conclusion :
It has been confirmed that assuming the very specific case of a flight proceeded with abnormal L/G door Config ( Partially or fully open ) in high altitude, it leads to an cold soak effect on the green Hydraulic system that may be followed by the triggering of the ECAM LO LVL warning. Applying the ECAM procedure will lead to a loss of the green hydraulic system.
The loss of the green hydraulic system is considered as major, whereby the a/c is flying in normal law and apart from landing gear gravity extension and multiplying the landing distance per 1.1, no specific crew action is required. When during decent when the cold soak effect disappears, the fluid quantity indication on the system page may return back to normal and when monitored by the flight crew, the lost system could be recovered.”

Unquote : I also gave them the modification proposals in regard to the design in their circuit to overcome this problem which they also accepted. But stated that the expenditure involved was not feasible / due low probability etc.and to let things continue as it is. They also regretted the delay in reply as a number of Airbus departments were involved in the investigation.

What the Airbus gave me in return for my hard work :
‘ THANK YOU FOR YOUR INPUTS ’, Yes, just these five words.



Any takes on this one?

[Dream Land]

I generally fly with the gear doors closed myself, interesting information for what it's worth. :D

[DesiPilot]

Well he further states in the article

During the external pre-flight walk-around we do before each flight, it is very important to ensure the rubber sealing at the wing-root , wheel-well area etc are all well secure /intact / not worn out etc. or in case if there is partial door open during flight as ambient cold air entering the Main Wheel bay could lead to erroneous indication.



I guess this would be the case for 15 odd years old aircraft. I guess I do not have to worry about it as our fleet is virtually brand new :)

[Dream Land]

Well, to keep this thread creep going, has this scenario happened to anyone? I don't really think it's a big one to worry about, all bus pilots are pretty watchful of hydraulic "Faults" to return to the normal condition, losing the GREEN system is a serious problem but easily managed.

[elfinknight]

Thanks PBL for your reply
I'm a mechanic on 737 classics most of the time with very little experience on the A320s.hence my query

[dartagnan]

if you loose G B and Y system on the 320, I assume that as the plane is in a negative equilibrium without his 6-7 computers(ELAC,SEC & FAC);
without hydro, his computers wouldn't be able to keep the plane straight and level, resulting in an engage spiral drive until destruction due to high G)...

[wobble2plank]

Well, at my last check we had a bit of a play with the 'Sioux City' scenario.

Interestingly the aircraft was remarkably flyable with thrust only. Dependant on weight we had an N1 thrust setting (setting the N1 mode helps a little with the Ecam engine indications) of about 'datum 45%'. Applying thrust brought the nose up and decreasing, obviously, dropped the nose. Speed control was attainable using this and turns were achieved using differential thrust.

To sum the whole thing up, as a team, we managed to get the aircraft back to the airfield and achieved a landing, albeit some what 'heavy' but certainly walk away from.

Can it happen? Well anything can happen and an aircraft had a double hydraulic failure during takeoff due to a failure of one system and an overheat of the second system by the PTU. All it needs then is a leak in the third and you are in big trouble!

Enjoy

[hetfield]

@wobble

Is your sim programmed for a no HYD scanario?

Mine isn't.:bored:

[wobble2plank]

The setup was for a triple hydraulic leak resulting in the requested failure.

First the Green, then the yellow then the blue.

Quite easy to do.

[hetfield]

First the Green, then the yellow then the blue.

Quite easy to do.

Yeah, concerning system behaviour, it's easy indeed.

What about an aerodynamic modell in your Sim with total loss of flight controls ?

[wobble2plank]

Having never, obviously, been in that scenario for real I cannot judge the sims modelling.

It felt very real. An extremely light touch is required on the thrust levers and a datum power to give speed stable flight with an 'acceptable' rate of descent needs to be found. That is all weather/weight dependent etc.

Once that datum has been established the aircraft can be 'steered' using aysemetric thrust and climbed and descended using thrust. It gets out of hand and therefore control very quickly though.

We managed to establish ourselves on a rough 'airfield' finals with 800fpm ROD descent and speed stable. That, our simulator thought, was acceptable for a rather heavy but survivable landing. Thoroughly recommend having a go if you get the time as it is an excellent handling/communication exercise if nothing else.

[Mad (Flt) Scientist]

What about an aerodynamic modell in your Sim with total loss of flight controls ?

That is in theory the easy bit. If the sim has been qualified to the relevant standards then the flight model accuracy will have been checked, and whether the controls are moving or not shouldn't be an issue. I might have some doubts about very long period motion, since most sim checks are on a 30second scale or so, but frankly that applies to the normal configuration too.

I'd be much more wary of the system simulation, personally. It's much harder to get that right for the sim builder, because they are usually working with just technical descriptions for any simulated kit, and dependent on ICDs for any stimulated stuff. Are you sure there wasn't some part of the system working that shouldn't have been. Do the unpowered controls lock or float? Which did they do in the sim? And so on.

[john_tullamarine]

[translation ... a sim is a computer .... not an aeroplane]

[idg]

Whilst I agree completely with what MFS and JT have said about the authenticity of the sim modelling, I too have tried the triple hydraulic failure in the sim and it is really quite flyable.

Airbus TPs who have flown our sim, and have had the chance to fly this in the a/c for real, said that the modelling is pretty good. There might be upfloat on the ailerons and spoilers with total hydraulic loss but it would depend on the failure mode and where the control surfaces were at the time of failure. From memory our sim gives aileron upfloat.

As W2P has said the 'Sioux City' scenario is a little more tricky but still flyable once the datums have been established.

The reality is that the redundancy built into the system is such that, while a triple hydraulic failure is of course possible, it is statistically very unlikely. The flight control computers all going off line at once ( or being unable to work due to the appropriate system loss) is also very unlikely and the a/c was always intended to be flown with rudder and stabiliser control available until a FCC was reset.

During very early flight test I understand that the a/c was indeed flown to landing on stabiliser and rudder alone, and while the aircraft hasn't read the FCOM, I still feel that any exposure to the worst case scenarios is of benefit and would at least give one a fighting chance of adopting the correct technique even if the numbers were slightly off.

[j_swift]

The A380 has a unique way of reducing the odds of a triple hyd loss-- there is only 2 engine driven hydraulic systems with the backup provided by electro-hydrostatic actuators and electrical backup hydraulic actuators. The latter 2 backup sytems have their own electrical motors and independant hydraulic fluid source which is refilled on the ground via the Green and Yellow systems. Seems like full proof when you consider that the systems are independant of each other. The primary reason for such a design is to save weight.:ok:

[David36]

Just a personal curiosity to wake up this old thread.

In case of total hyd loss, do flight surfaces lock in place or they will freefloat into wind?

As far as I know, being a FBW (irreversible) flight control system, they are not mass-balanced. In that case, they might be prone to flutter.. just asking, don't know.

[David36]

Just a personal curiosity to wake up this old thread.

In case of total hyd loss, do flight surfaces lock in place or they will freefloat into wind?

As far as I know, being a FBW (irreversible) flight control system, they are not mass-balanced. In that case, they might be prone to flutter.. just asking, don't know.

Are irreversible desgined if there is no hyd pressure the surface would be locked?

[David36]

I wonder in case of total hyd loss,

[john_tullamarine]

test test test test

[737Jock]

Indeed, green system developed a leak which increased during T/O roll. PTU activated, but ECAM is inhibited until 1500ft, which led to Yellow overheat.

Airbus modified the PTU and ECAM logic:
The HYD G(Y) RSVR LO LVL alert is inhibited for the first 15*s of flight phase 5.
The HYD B RSVR LO LVL alert is inhibited for the entire flight phase 5.

So any RSVR LO LVL that can affect PTU operation and thus the other system, will now display much sooner than 1500ft. Suspect around 400ft where ECAM can be initiated.

[john_tullamarine]

Please be aware that posts on page 5 may not be accessible. Problem being worked on by the techo gurus.

[David36]

Just a personal curiosity to wake up this old thread.

In case of total hyd loss, do flight surfaces lock in place or they will freefloat into wind?

As far as I know, being a FBW (irreversible) flight control system, they are not mass-balanced. In that case, they might be prone to flutter.. just asking, don't know.

Are irreversible desgined if there is no hyd pressure the surface would be locked?