Why is Concorde Grounded?

[rjemery]

Despite the Paris crash, I am curious to know why Concorde remains grounded. Is it concern about another tire blowout, wings or wing tanks being punctured by debris kicked up by the tires with or without a blowout, or something else? What has to be fixed, and when will Concorde fly again?

------------------
R. J. Emery

[Tor]

Concorde fix (http://www.pprune.org/ubb/NonCGI/Forum1/HTML/011053.html)

[Genghis the Engineer]

My understanding from reading the CAA's releases is that the problem in their eyes is that the Paris crash was caused by a single failure (the tyre).

It's normally understood that no single (and remotely probably) failure must be able to cause a fatal accident. CAA have I think withdrawn the type certificate until it is clearly shown that no single failure can cause such a disaster again.

For example the Kegworth crash was caused by a combination of an engine failure and a human-factors fault (shutting the wrong engine down). Still tragic, but a double failure case should be much less likely.

G

[rjemery]

G,

Ostensibly then, as soon as a new tyre is designed and certified, the Concorde should be able to fly again?

Or do the wings and tanks also need to be shielded against debris? The first is readily doable, the latter not so easy or cheap.

What else must be done to enable Concorde to fly again?

As an aside, the Kegworth crash was more than ten years ago, and my memory on that is fuzzy. Could you also elaborate on the details and its cause?

------------------
R. J. Emery

[spannersatcx]

rjemery I think you'll find that Concorde has had tyre problems since day one. The only solution I understand acceptable is to do with the fuel tanks, so far the only solution I have heard of is kevlar bag tanks in the wing tanks themselves. This will require testing and certification which will take time.

[Lu Zuckerman]

To: Genghis

I can't speak for the CAA but FAA design guidelines state that all single point failures that can result in death or loss of the aircraft must be designed out of the system. If this is not possible, then the failure can occur no more frequently than 1 10-9 or, one time in a billion hours of fleet operation.

In making this calculation, you can only deal with the inherent failure modes of the system or component under analysis. In the case of the tires (tyres) failing due to a puncture caused by a part falling off of another aircraft, this cannot be considered in calculating the failure rate.

This type of induced failure can be considered in the safety hazards analysis but, it is extremely difficult to assign a rate of ocurrence as it is assumed that the runway is clear of debris.

In the case of the underskin of the wing you can only consider an inherent failure of the skin itself. Normally in any reliability calculation you assume that the structure has a reliability of 1 which means that the structure will not fail which is proven in the structural and flight testing prior to entering service. Of course, structure does fail but due to design redundancy the failure does not effect the overall reliability assuming that the failure is caught in a check and repaired. However, it is well known that tires (tyres) and wheels fail and as a result throw up a great deal of debris with a large ammount of kinetic energy and as a result, the wing skin should have been protected

You can take that one step further and assume that the repair was not done correctly resulting in the ultimate crash of a 747 in Japan.

Many years ago a USAF F-86 was lost when upon landing the nose wheel struck an upturned empty tin that had previously contained some type of adhesive tape. The tin lid hit at just the right angle cutting deeply into the tire (tyre) causing it to fail during roll-out.

------------------
The Cat

[This message has been edited by Lu Zuckerman (edited 18 November 2000).]

[This message has been edited by Lu Zuckerman (edited 18 November 2000).]

[This message has been edited by Lu Zuckerman (edited 18 November 2000).]

[Genghis the Engineer]

Lu, I'm a little rusty on the acceptable failure rates but I do agree with you on the philosophy absolutely. I don't think the FAA and CAA would take any different approach to this. However, I doubt any aircraft tyre has a reliability of 1x10^9, or can given the inevitability of contaminated runways.

Which comes back to RJ's point. No a redesigned tyre almost certainly isn't the sole solution because having established that a tyre failure caused the crash it presumably can again; even if a redesigned tyre reduces the risk, the risk is still there.

In my opinion that's why the tank needs protection too - so that it would take a double failure - tyre+tank protection to cause an accident.

I should qualify this by saying that all of my evidence is from press reports, I have never (sadly) worked on Concorde.

Kegworth was a (737?) inbound to East Midlands. An engine caught fire and the captain chose to shut it down. Unfortunately a very poorly designed engine display, no visibility of the engines + presumably a fair degree of stress caused him to identify the wrong engine, and he shut-down the good engine. Result was a crash just next to the M1, until about 5 years ago you could still see the marks on the bank, left side of the northbound carriageway just before the bridge at Junction (25?).

G

[Lu Zuckerman]

To: Genghis

Along the lines you described about the pilot shutting down the wrong engine I would suggest you go down to your local video rental center and pick up a copy of Fate is the hunter. Disregard the love and personality parts as the technical aspect of the movie is quite good. The special effects however are not too good. I use this video as a teaching tool whenever I conduct a course on Reliability and Maintainability.

Regarding the tire (tyre) having a reliability of 1 10-6 I wasn't implying that that was the design reliability. It is true that tires (tyres) have a limited life expectancy that is why they are replaced on a periodic basis which restores the reliability to an acceptable level.

In the performance of the Failure Mode Effects Analysis relative to tires (English spelling) the analyst would indicate that the reliability was very low relative to the structural elements of the landing gear. He would include as a compensating provision that there are redundant wheel assemblies and that the rubber parts of the wheels are replaced on a periodic basis.

The rules governing the preparation of the FMEA prohibits the reference to secondary damage to a non related system. Although the rules were established in the USA the MOD has adapted them for applications to equipments built in the UK. This material is covered in DEF STAN 00-41

------------------
The Cat

[JB007]

The CAA are not responsible for the withdrawn C of A.
The C of A for Concorde is held by the French rather like the Americans holding the C of A for any Boeings, so BA/CAA had no choice in grounding the A/c.

I belive a few more things have come to light since the initial investigation....watch this space.

Cheers
007

------------------
Hear All...See All...Say Now't.

[The Nr Fairy]

G :

As well as a badly designed engine vibration meter display, there was also the apparently correct sequence of events when shutting down the apparently dud engine, a type and model of engine which had already failed once on another airline in a similar manner, the failure mode that hadn't been revealed in design testing, and lack of full crew resource management ( the cabin crew had been told by pax which engine had a problem, and that fact wasn't reported to the flight deck ) I'm not sure what else there was.

A full UK AAIB report about Kegworth is available at http://www.open.gov.uk/aaib/gobme/gobmerep.htm

------------------
I got bored with "WhoNeedsRunways"

[Genghis the Engineer]

NRF - glad you're still with us, I only raised the Kegworth accident as an example of there being multiple contributary factors. Your extra detail only really re-inforces the point.

I've checked on the Type Certificate, I think that because of the multi-national nature of Concorde, DGAC holds the TC for the Air-France jets, and CAA for the BA jets. DGAC acted first (unsurprisingly), then CAA did the same a few weeks later. I don't think legally the CAA were bound to act, but morally and technically they were.

Lu, I don't quite agree with your statement of the certifying philosophy. Nominally unrelated events do have to be taken into account - such as multiple bridstrikes or airframe and system damage due to a fan or propeller desintegration. I don't see why airframe damage due to a tyre failure should be treated differently to airframe damage due to a compressor disk exploding?

G

[Zeke]

G: I would have to agree with your statement regarding certifying philosophy. I also concur with your sentiments regarding acceptable failure rates.

Where the operating environments factors are known (i.e in fatigue life extensions or engine life extensions) and a statistical base has been established one could be confident in the statistical probability of failure, and hence have the ability to build a margin on safety into it. However, no one could suggest any accurate information is kept on FOD to tires, tire wear, manufacturing defects, or stress levels as they are seen as consumable items and rudimentary maintenance that could be performed by a pilot, without a sound statistical base, acceptable failure rates would be impossible calculate.

As accidents and service history are usually the impetus for change of the regulations regarding certification of new aircraft, has the CAA, DGAC, or FAA made any changes to the certification regs to make manufactures demonstrate or test that this will not happen again?

The proposed fixes .... are they going to be in the form of a STC, AD, or are we going to see a new type with a new TC ?

Does anyone know how many pax will have to be left behind to compensate for the additional load of the proposed fixes?

Has anyone thought of cooling the tires so they have a higher margin of safety during the time when they are under maximum loads (long taxi at high weights before takeoff)?

Z

[rjemery]

Genghis, regarding the Kegworth crash, I have learned the a/c involved was a 737-400. An interesting review can be found on the BBC (http://newswww.bbc.net.uk/low/english/uk/newsid_250000/250959.stm) website. The referenced article suggests the engine problem became known at FL 280, but that the wrong engine shutoff occurred at less than FL 10. Was that the altitude at which the engine shutoff truly occurred?

And just out of curiosity for this non-pilot, how much altitude (and time) would be required to comfortably restart an engine on a jumbo jet in flight?

------------------
R. J. Emery

[This message has been edited by rjemery (edited 20 November 2000).]

[The Nr Fairy]

R :

I've had a quick scan through the accident report - see my post above. The problem was first noticed at about FL230. The wrong engine was shut down, due to various factors, and only failed at about 900' on the approach. That was insufficent time to get the now shut down but apparently wholesome donk going again.

From recollections of jumpseat rides, it's in the order of 30 seconds from the moment the first action is taken until the engine has stabilised at idle. Note this is IDLE - not producing power enough to sustain flight - so you might need to add some more time on, but it's possible that the forward airspeed will help reduce start up time because the mass flow of air required is at least partially present.

There are Jumbo drivers here, they'll be able to tell you how long it takes to get an engine that size going. Maybe Eric Moody might enlighten us ?

------------------
I got bored with "WhoNeedsRunways"

[Lu Zuckerman]

To: Genghis

What you said is true. You can account for an exploding tire or the fracture of a fan disc or compressor. But this is only done in the Safety Hazards Analysis (Fault Tree) but these element can't be quantified unless the manufacturer of the engine or tire has provided that information. In the case of the tires the manufacturer will specify how frequently or under what conditions the tires muust be changed in order to maintain reliability. In the case of the engine manufacturer he is allowed to demonstrate the reliability of his engine by test or anaslysis. One manufacturer used analysis and his engine exploded and caused loss of life and property in Manchester, England.

Regarding accounting for bird strikes this is demonstrated in test both for the wind shield and the engines. In the case of the bird strike they normally use one dead chicken but on larger engines I have seen tests where they shot several geese directly into the spinning fan. This type of multiple bird strikes can't be numerically quantified and as such would be difficult to include in the hazard analysis. It could be included but only in combination with other contributing factors that can be quantified. The same is true for the tires.

The failure mode effects analysis EFFECTS THE DESIGN, but only if the manufacturers engineering staff agrees with the analysis.

The Fault Tree REFLECTS THE DESIGN but only after the numbers crunches use their magic Boolean Algebra to prove that the failure would occur no more frequently than 1 10-X hours for the fleet.

In no way does the predicted safety reflect the actual safety or reliability of the actual machine. This is true for a design made under FAA,CAA,DGCA. LBA or any other certification authorities as they all use the same analytical guide lines.

[This message has been edited by Lu Zuckerman (edited 20 November 2000).]

[This message has been edited by Lu Zuckerman (edited 20 November 2000).]

[Genghis the Engineer]

If I read you correctly Lu, what you are saying is that no amount of analysis replaces test results, where the tests were constructed from real operating experience.

BCAR Section A (the "philosophy and approval guidelines") requires a second opinion on all analysis. It is commonly accepted that the second opinion is test results - an approach I find thoroughly wholesome. It isn't mind you a compulsory approach, but not many experienced engineers are truly comfortable with analysis alone, no matter how many people have checked it.

G

"One test result is worth a thousand expert opinions" - Werner Von Braun.