Pilot question - 787 Overweight landing implications?

[RMC]

Just completed my regular simulator check which included severe damage to the engine (loud bang, no N2, high vibration) and the instructor suggested that we should hold for an additional hour to jettison fuel rather than land as soon as the engine and associated securing checks had been completed (after about 20 mins).

I have no idea whether there are more significant consequences to a composite aircraft landing overweight than say an A330...our checklist just uses the standard Boeing phrase...."land at nearest suitable airport"

Interested on your views of this balance of risks / consequences?

Thanks in advance

[olasek]

What does 'composite' has to do with it? The gear is not made of composites.

[Mr @ Spotty M]

Some parts of the gear are, just for your info.

[RMC]

...and it is attached to a composite structure. The damage prediction (including crack propagation) models for Ali have been refined over sixty years.... NDT techniques likewise.

[Genghis the Engineer]

Metal structure, when new, is designed not to suffer a failure until at-least 50% above worst case design loads. When old, it's probably about the same.

Composite structure, when new, is designed to a figure somewhere in the bracket 90 - 125% above worst case design loads. Worst case however, which is end of life in a high temperature environment, you might see that come down to 50% to match metal structures.



A quick bit of theory you won't find in ATPL notes...

Worst case load predicted in service = "Limit Load"

Load that should not cause "catastrophic failure" in the first 3 seconds of loading = "Ultimate load"

Reserve Factor = Ultimate load / limit load.



All aircraft structure should be designed with RF>1.5, but composite structure RF>>1.5 because of the life and environment dependency of composite materials strength.


The relationship between weight and undercarriage load is non-linear and complex, because it's dependent upon the design of the undercarriage shock absorption mechanism. However, I'd be surprised if it was worse than a square law rule.

So, if we take the (likely) weakest components - the metal parts - SQRT(1.5) = 1.22.

So if you are at a weight below 122% of MLW, then the odds are you will not suffer catastrophic failure of the undercarriage or any supporting structure, and quite probably the same is true at higher weights. That doesn't mean you won't damage the aeroplane - because that is entirely possible, indeed probably quite likely. But I would not expect it to be sufficiently damaged as to prevent a normal landing and taxi to park.

Just do expect your employer to see a seriously high inspection and possibly repair bill, so if it is reasonable to burn off fuel and do a normal landing, that would be the better option.

G

[RMC]

G,
Every time I see a post from you it is high calibre!

That answers the question nicely about the implications on the structure and it would not be unusual after take off to be 30% over Max Landing Weight....so my sim instructors concern is clearly a valid one.

My other half of the question concerns the risk associated with staying in the air on one engine dumping 50 tonnes of fuel. I heard recently (cant remember the source) that certification requirements of key components are 10 to the power of 9 (assuming this is accurate and relates to engine certification) then I guess the minimal chance of a second engine failure (in the extra half hour you were airbourne) could be offset against the seriously high chance of structural airframe damage.....what do you think?

[Genghis the Engineer]

Thanks for the compliment.

Yeah, 30% over MLW, I'd say that the risk of breaking something significant during landing were significant. Not certain, but high enough I'd not want to try it given any reasonable alternative.


The 10^9 is a difficult concept to define explain simply, because there's a certain amount of creative analysis which goes on to achieve that. However, it's not a description of the standards required of any single system - generally it's a per flying hour risk of an airframe loss.

You can't, for example, reasonably expect a hydraulic system to go totally tits up only once every 10^9 hours. On the other hand, no less often than every 10,000 hours is perfectly reasonable.

Put three hydraulic systems in the aeroplane - each with 1:10^4 risk per hour of going totally wrong. The risk of all three going wrong in the same hour becomes 1: ( 10^4 ^ 3) = 10^12. That's much better than 10^9, and it can be accepted. Pretty much every safety critical system on the aeroplane is certified on that basis - hence multiple electrical, hydraulic, avionic systems on the basis of known minimum reliabilities and a bit of maths.


There's a second principle that's fundamental to part 25 aircraft certification, and comes into play here as well - also involving our old chum James Reason and his famous Swiss Cheese. The principle is that it's totally unacceptable for any single event to cause an airframe loss. If you think back for example to the fleet grounding of Concorde after the Paris crash - the reason for that was that once it was identified that a single fault (lump of metal on the runway) had demonstrated the ability to cause an airframe loss, the type immediately had its Type Certificate suspended.

I'm no expert on the 787, but exactly the same principle will have been applied by FAA and EASA here. Taking the engine failure as a single event, it's totally unacceptable for that to be able to cause an airframe loss. There must be a second failure, totally independently, for that to be able to occur. By independently, I mean that it can't have been caused by the engine failure mode, or by your entirely predictable action of dumping fuel.

A great many people in Seattle, and their computers, will have spent hundreds of man-years modelling and heading off all such events well before even the flight test programme. So, if you've only had that single event, staying airborne to dump fuel should - within the parameters of certification - be a reasonable act.

If something else fails, then you need to apply some thought to the consequences of the double failure - I'm sure there are sim instructors who can create scenarios where you might want to consider landing over MLW at that point, although hopefully the real aviation gods will be kinder than the ground based ones.

G

[RMC]

Interesting, this has propmted me to look at the 180 ETOPS requirements (one shutdown every 50,000 hours) so I guess the extra half an hour would make it a one in 100,000 chance of a second failure as you jetisson fuel VS a high probability of structural damage landing overweight?

[Genghis the Engineer]

Basically, yes, so long as what caused the first failure isn't there to create a second, that's how it should work.

G

[Kengineer-130]

I suppose if you don't know what caused that engine failure then it becomes a game of risk vs reward, if it has gone bang as you rotated (ala Thomson 757 out of Manchester with a bird strike) then who is to know if the second engine has potentially been fodded or suffered a less immediately catastrophic amount of damage that could get worse as the flight progresses? Can you positively determine the second engine is fine?

If you do consider an overweight landing, what are the performance implications for a single engine go around 30% overweight? I am taking the guess that there is plenty of go in reserve, but still far less margin than normal? Do the landing speeds increase?

An interesting topic :ok:

[Genghis the Engineer]

Approach speed should increase near as dammit with the square root of weight. So a 30% overweight aeroplane would want a 14% increase in speeds. That'll obviously also increase LDR somewhat.

G

[Coriolis]

If i's not to sycophantic I'd like to echo RMC's praise for Genghis, who I've read and been educated by for many years now....

And the replies here are (I'm sure) equally well thought out and based on good science.

Let's also remember that what the aircraft is made of doesn't change the fact that the OEM will specify what level of inspection is required after undesirable encounter (turbulence, heavy landing, whatever) so the detail of whether composite or metal construction can endure is interesting but must not induce the Technician to make his own allowances based on that argument.

From a flight crew pov, please do everything reasonable and safe to minimise overweight landings, (and PLEASE report them if they occur, for whatever reason, for your safety on subsequent flights) as it will have a direct effect on the level (cost) of inspection/repairs, but from a maintenance pov, just do what the OEM tells you - don't try to second guess the designers unless you are one, and authorised to certify the inspection regime (I'd guess most Maintenance Technicians aren't both).

Humble two-penn'orth, offered after being bitten both ways in the past...

[Genghis the Engineer]

Thank you, I'm glad somebody finds my ramblings useful. :ok:

Interesting aside, I graduated in 1992 with a degree in aeronautical engineering - there were 63 on my course. I think that two of us are still in the industry (interestingly, the other one has my old job that I left 10 years ago). It's good to use all that education, but I do wonder about the other 61 sometimes. I still think that learning (and sharing and using that knowledge) about the most complex and fascinating machines the human race has ever produced has been a great way to spend the last quarter century.

Eventually I'll even understand how an aeroplane flies as well, but that may need another 25 years or so. That I've still got chalked up to magic.

G

[RMC]

Thanks for the replies guys :-)