Deduction 11
The failure to be able to shut down the #1 engine on the stricken Qantas A388 was unforseen.
..a big lesson that i am sure has been properly thought over.I do not know the results but from the discassion over here it is not a simple problem.
11. A lesson learned on the A-340 that hit the wall on the ground in which they couldn't shut off the engine for 5 hours was thought to be a not repeatable incident.
It’s quite discomforting and significant to know, without any doubt whatsoever, that the QF32 crew would have had absolutely no control (except fire bottles- if they would have worked) over a fuel fed engine/pylon fire at #1 at any point after the #2 burst....The truth is, though (I believe), no cmcl jets have redundancy in this area.
..in what should be an “infallible” engine/pylon fuel cut-off system should be addressed by Airbus (Boeing, etc.) ASAP. Redundancy in hydraulics, electrics, tank plumbing? Why not in fuel shut-off, too?
I think some are getting too hung up on this. There is "redundancy" in the engine shut off, AFIAK there are 2 physically separated electrical circuits to do this, and in this event, both got cut.
To create "a tragedy", seems therefore to require 4 very unlikely specific events:
- A failure that is uncontained (as here, unusual and has to be addressed)
- >1 fragment that causes damage elsewhere (I saw somewhere design assumes 1 fragment)
- These 2 (or more) fragments fortuitously cutting the separate redundant paths of an important system
- That system's failure then leading to a signifcantly increased safety problem.
If you over-concentrate on "shutting" an engine down, you end up with engines shutting themselves down of no accord - a far greater, IMHO, safety issue
We had 3 of 4 "unlikely" events, P of the 4th is small?
Or look at it another way, if you over-emphasise the need to shut engines down, then maybe Airbus could have designed the shut off curcuits to "self monitor", and if both circuits were cut, to shut down the engine. Sound a good design? Maybe, but in this case it would have given them a double engine failure
A manual shut off valve? (in the pylon?) - OK, maybe a good idea, but really enhancing flight safety? In both the quoted cases, once an engineer is in place to operate it, everybody was, or could be off, and well clear anyway.
I suspect the ATSB will look at it, but I disagree they will place
strong recommendations on addressing it. As an airline pilot, I am wary of too many "safety systems" being too cleaver - they usually cause more problems than they solve. I am "nervous" of the software in the Trent that can "shut the engine down" without warning / pilot control.