Sikorsky S-92: From Design to Operations
Join Date: Aug 2007
Location: The moon
Posts: 56
Likes: 0
Received 0 Likes
on
0 Posts
Now that a yellow Sea King is parked in a field what are we going to do....
Chinook airlifts broken chopper from the BBC website under Wales
A Chinook aircraft had to be drafted in to tow an RAF rescue helicopter to base after it broke down during a call-out. The helicopter from RAF Valley on Anglesey had been on a rescue in Snowdonia on Saturday when it was forced to land with difficulties.
Chinook airlifts broken chopper from the BBC website under Wales
A Chinook aircraft had to be drafted in to tow an RAF rescue helicopter to base after it broke down during a call-out. The helicopter from RAF Valley on Anglesey had been on a rescue in Snowdonia on Saturday when it was forced to land with difficulties.
Sox6, thanks - I am reasonably familiar with CS/FAR 29.
This is the clause that allows exemption from demonstrating the 30 minute capability:
Unless such failures are extremely remote, it must be shown by test that any failure which results in loss of lubricant in any normal use lubrication system will not prevent continued safe operation, although not necessarily without damage, at a torque and rotational speed prescribed by the applicant for continued flight, for at least 30 minutes after perception by the flight crew of the lubrication system failure or loss of lubricant.
This is the clause that allows exemption from demonstrating the 30 minute capability:
Unless such failures are extremely remote, it must be shown by test that any failure which results in loss of lubricant in any normal use lubrication system will not prevent continued safe operation, although not necessarily without damage, at a torque and rotational speed prescribed by the applicant for continued flight, for at least 30 minutes after perception by the flight crew of the lubrication system failure or loss of lubricant.
Unless such failures are extremely remote
No manufacturer (hopefully) builds a product that they know is going to be failure-prone. Its the un-anticipated issues that cause the problems. Therefore surely this alleviation from the main body of this para in JAR/FAR29 is just a cop-out? Its no wonder helicopters are so prone to life-endangering serious mechanical failure when the certification rules are so sloppy!
HC
Join Date: Dec 2001
Location: Philadelphia PA
Age: 73
Posts: 1,835
Likes: 0
Received 2 Likes
on
2 Posts
There is an incredibly detailed process for exactly that. Called by various names like failure effects analysis, Fault-Hazard Assessment, Failure Effects Modes Analysis, and so on - each has it's own part to contribute to showing problem areas and ways to improve safety.
A complex system of measuring the failures, their effects and ways to make sure they don't happen.
But, like many things, they are done in advance of the real aircraft, and contain assumptions that may not prove to be true in the real world. Sadly.
Considerable effort goes into making and reviewing them for certification - in fact there's a very large Advisory Circular based on this from Part 25 (transport Airplanes) which is used by everyone, including light helicopters.
A complex system of measuring the failures, their effects and ways to make sure they don't happen.
But, like many things, they are done in advance of the real aircraft, and contain assumptions that may not prove to be true in the real world. Sadly.
Considerable effort goes into making and reviewing them for certification - in fact there's a very large Advisory Circular based on this from Part 25 (transport Airplanes) which is used by everyone, including light helicopters.
Thanks for that explanation Shawn, but my point is that its only the Failures that the designers have thought of that are considered for the FEMA - and if they have already thought of them, the chances are they have designed in redundancy or whatever to cater for the problem.
But its the failures they haven't thought of that cause the problems, and no matter how conscientious the designers are, surely its inevitable in something as complicated as a FAR29 helicopter that there are failure modes they haven't thought of?
In the case of the first S92 oil system problem that nearly caused a ditching in the Norwegian N Sea, the problem was that when one of the oil pumps stopped being driven, it became a turbine and allowed the oil pressure from the good pump to escape back through the failed pump because there were no check valves. The comment from the designers was "we didn't consider this failure mode".
With such a basic oversight as that, its difficult to have confidence in either the designers or the certifying authority!
Your post makes the point that a lot of work is done, but is there any point in that if it can be so flawed?
I have forgotten what "extremely remote" actually means (212 has probably told me before but I am getting old...) but isn't it 1 in 10^8 or thereabouts? How can what is effectively guesswork confirm that such a high reliability will actually be met?
HC
But its the failures they haven't thought of that cause the problems, and no matter how conscientious the designers are, surely its inevitable in something as complicated as a FAR29 helicopter that there are failure modes they haven't thought of?
In the case of the first S92 oil system problem that nearly caused a ditching in the Norwegian N Sea, the problem was that when one of the oil pumps stopped being driven, it became a turbine and allowed the oil pressure from the good pump to escape back through the failed pump because there were no check valves. The comment from the designers was "we didn't consider this failure mode".
With such a basic oversight as that, its difficult to have confidence in either the designers or the certifying authority!
Your post makes the point that a lot of work is done, but is there any point in that if it can be so flawed?
I have forgotten what "extremely remote" actually means (212 has probably told me before but I am getting old...) but isn't it 1 in 10^8 or thereabouts? How can what is effectively guesswork confirm that such a high reliability will actually be met?
HC
Join Date: Jan 2006
Location: Western MA
Posts: 455
Likes: 0
Received 0 Likes
on
0 Posts
Yes, it is hard to believe any OEM these days. Feast your eyes on this classic from Bell when they reported engine compressor stalls were "VERY normal":
V-22 on way to air show lands with engine trouble
Tilt-rotor's compressor stall may not be serious, aircraft experts say
08:40 AM CDT on Tuesday, July 11, 2006
By RICHARD WHITTLE / The Dallas Morning News
WASHINGTON – One of two Marine Corps V-22 Osprey tilt-rotor aircraft on their way to England for international air shows landed in Iceland instead Monday after suffering compressor stalls in an engine.
FILE 2005/AP
The V-22 Osprey, shown here in flight over the North Carolina coast last year, was nearly canceled after two Osprey crashes in 2000 left 23 Marines dead.
The incident was an unwelcome start to a trip the Marine Corps views as a demonstration of the helicopter-airplane hybrid's ability to "self-deploy" overseas by refueling in midair and a chance to prove to an international audience that the Osprey's problems are behind it.
The V-22, built by Bell Helicopter Textron Inc. of Fort Worth and Boeing Co.'s helicopter division, was nearly canceled after two Osprey crashes in 2000 left 23 Marines dead.
On Monday, the Marine Corps crew of three made the precautionary landing at Keflavik about four hours into a scheduled nine-hour flight from Goose Bay, Canada, to Farnborough, England, Marine spokesman Lt. Col. Scott Fazekas said.
A spare Rolls-Royce AE1107C turbofan engine will be flown to Iceland and swapped with the engine that suffered the stalls, he said. The engine was in England with mechanics sent to maintain the V-22s during their appearances at two air shows this weekend and next week.
"They're going to replace the engine there on site," Lt. Col. Fazekas said. "A compressor stall doesn't necessarily require an engine replacement; they just decided to do that in this case."
The V-22s are to perform this weekend at the Royal International Air Tattoo show in Fairford, England, and next week at the Farnborough International Airshow, the year's major aerospace trade fair.
"It's not the way you want to start a deployment tour, but on the other hand, this sounds like a low-tech issue," said aerospace industry analyst Richard Aboulafia of the Teal Group, a Washington-area consulting firm.
Bell spokesman Bob Leder said compressor stalls in such engines were "really nothing."
"These kind of engine problems are very normal, not only within military aircraft, but in commercial aircraft," he said.
Hans Weber, president of the California-based technology management consultancy Tecop International Inc., said compressor stalls "can be harmless, but they can also mean there is internal damage to the engine."
Mr. Weber recalled that the pilot of a British Airways 747 that left Los Angeles last year with a load of passengers shut down one of his four engines because of compressor stalls and flew on to England.
Given the V-22's troubled history, "We're all very sensitized to worry about problems with the Osprey, sure," Mr. Weber said. "But this might not be something to worry about. We have to see what ultimately they find out about what caused it."
V-22 on way to air show lands with engine trouble
Tilt-rotor's compressor stall may not be serious, aircraft experts say
08:40 AM CDT on Tuesday, July 11, 2006
By RICHARD WHITTLE / The Dallas Morning News
WASHINGTON – One of two Marine Corps V-22 Osprey tilt-rotor aircraft on their way to England for international air shows landed in Iceland instead Monday after suffering compressor stalls in an engine.
FILE 2005/AP The V-22 Osprey, shown here in flight over the North Carolina coast last year, was nearly canceled after two Osprey crashes in 2000 left 23 Marines dead.
The incident was an unwelcome start to a trip the Marine Corps views as a demonstration of the helicopter-airplane hybrid's ability to "self-deploy" overseas by refueling in midair and a chance to prove to an international audience that the Osprey's problems are behind it.
The V-22, built by Bell Helicopter Textron Inc. of Fort Worth and Boeing Co.'s helicopter division, was nearly canceled after two Osprey crashes in 2000 left 23 Marines dead.
On Monday, the Marine Corps crew of three made the precautionary landing at Keflavik about four hours into a scheduled nine-hour flight from Goose Bay, Canada, to Farnborough, England, Marine spokesman Lt. Col. Scott Fazekas said.
A spare Rolls-Royce AE1107C turbofan engine will be flown to Iceland and swapped with the engine that suffered the stalls, he said. The engine was in England with mechanics sent to maintain the V-22s during their appearances at two air shows this weekend and next week.
"They're going to replace the engine there on site," Lt. Col. Fazekas said. "A compressor stall doesn't necessarily require an engine replacement; they just decided to do that in this case."
The V-22s are to perform this weekend at the Royal International Air Tattoo show in Fairford, England, and next week at the Farnborough International Airshow, the year's major aerospace trade fair.
"It's not the way you want to start a deployment tour, but on the other hand, this sounds like a low-tech issue," said aerospace industry analyst Richard Aboulafia of the Teal Group, a Washington-area consulting firm.
Bell spokesman Bob Leder said compressor stalls in such engines were "really nothing."
"These kind of engine problems are very normal, not only within military aircraft, but in commercial aircraft," he said.
Hans Weber, president of the California-based technology management consultancy Tecop International Inc., said compressor stalls "can be harmless, but they can also mean there is internal damage to the engine."
Mr. Weber recalled that the pilot of a British Airways 747 that left Los Angeles last year with a load of passengers shut down one of his four engines because of compressor stalls and flew on to England.
Given the V-22's troubled history, "We're all very sensitized to worry about problems with the Osprey, sure," Mr. Weber said. "But this might not be something to worry about. We have to see what ultimately they find out about what caused it."
Join Date: Mar 2002
Location: Canada
Posts: 690
Likes: 0
Received 0 Likes
on
0 Posts
failure modes they dont anticipate
exemplary safety record
CEFOSKEY
With due respect to you, I think you make my point quite well when you say
- that's just the point, they can't be, so how can they be reasonably sure that there predicitions that a critical failure will be less than 10^-8?
Yes I do consider fatigue calculations to at least have an element of guesswork - at a simple level because a certain flight profile (in terms of power settings, manoeuvring and gust loads, number of takeoffs/landings, weight, C of G etc) is assumed for the life of the component. But in fact the actual profile spectrum is at the discretion of the pilots operating the aircraft long after the designer has moved on to another project.
And at a more complicated level because its not possible to exactly model the entire aircraft and its environment. Approximations and simplifications are made (I am not a fatigue engineer but I would suspect that eg some kind of finite element analysis is used?). And as you say, defects and oversights can (I would say will) occur.
Perhaps I should make my point clearer - I am not saying that design engineers are stupid, rather that the certification rules assume they can do something that in fact they cannot.
Yes the 92 hasn't killed anyone yet but it does seem to have had more than its fair share of serious events in its short life so far, at least 4 major transmission lubrication events, one or two engine failures (caused by the engine installation, not the engine itself), problems with tail rotor control and probably some others I can't immediately recall.
But I am drifting - really my point was to question the robustness of the certification procedure, and perhaps to wonder how an aircraft whose certification was based on certain failures being extremely remote, can continue to be considered airworthy when those failures are demonstrated to be much more frequent.
HC
With due respect to you, I think you make my point quite well when you say
... seems to be under the belief that designers should be aware of failure modes they dont anticipate!
Yes I do consider fatigue calculations to at least have an element of guesswork - at a simple level because a certain flight profile (in terms of power settings, manoeuvring and gust loads, number of takeoffs/landings, weight, C of G etc) is assumed for the life of the component. But in fact the actual profile spectrum is at the discretion of the pilots operating the aircraft long after the designer has moved on to another project.
And at a more complicated level because its not possible to exactly model the entire aircraft and its environment. Approximations and simplifications are made (I am not a fatigue engineer but I would suspect that eg some kind of finite element analysis is used?). And as you say, defects and oversights can (I would say will) occur.
Perhaps I should make my point clearer - I am not saying that design engineers are stupid, rather that the certification rules assume they can do something that in fact they cannot.
Yes the 92 hasn't killed anyone yet but it does seem to have had more than its fair share of serious events in its short life so far, at least 4 major transmission lubrication events, one or two engine failures (caused by the engine installation, not the engine itself), problems with tail rotor control and probably some others I can't immediately recall.
But I am drifting - really my point was to question the robustness of the certification procedure, and perhaps to wonder how an aircraft whose certification was based on certain failures being extremely remote, can continue to be considered airworthy when those failures are demonstrated to be much more frequent.
HC
Mr Coyle's commentary was spot on. FMEA (actually failure mode and effects analysis) is a very complicated animal
"Failure Mode number one - MGP pump failure. Let's analyse...."
I see that was an effective meeting...........
If "design engineers" are so smart, why do we have service bulletins?
There is another perspective on most things and you would be surprised at the items that get fielded that maintenance guys will just look at in disbelief.
There is another perspective on most things and you would be surprised at the items that get fielded that maintenance guys will just look at in disbelief.
Join Date: Dec 2001
Location: Philadelphia PA
Age: 73
Posts: 1,835
Likes: 0
Received 2 Likes
on
2 Posts
It's interesting that in the helicopter world there are no pre-certification Maintenance Review Boards. Standard practice in the FW world - Everything to do with maintenance is considered, and is part of the certification process. We ignore it.
And the FW world won't accept pre-flight checks of systems as a way to ensure that a system is working correctly. They don't do hydraulic changeover checks, emergency bus system checks and so on. We accept them as the way things are.
Service Difficulty Reports that are submitted never seem to get reviewed by either the certification agency or the manufacturer, and if they do get reviewed, not much seems to get done to fix common problems.
How many unexplained engine rundowns have happened on the RR250 series engines over the years - engine failed, helicopter crashed, engine runs fine on the test stand....
We do have a long way to go till we get airline level of safety, but we need to start somewhere!
And the FW world won't accept pre-flight checks of systems as a way to ensure that a system is working correctly. They don't do hydraulic changeover checks, emergency bus system checks and so on. We accept them as the way things are.
Service Difficulty Reports that are submitted never seem to get reviewed by either the certification agency or the manufacturer, and if they do get reviewed, not much seems to get done to fix common problems.
How many unexplained engine rundowns have happened on the RR250 series engines over the years - engine failed, helicopter crashed, engine runs fine on the test stand....
We do have a long way to go till we get airline level of safety, but we need to start somewhere!
CEFOSKEY,
Too true, and I can tell you they are thankfully not the same and some are better than others. Certification standards are the minimum standards and don't infer quality.
Quote Helicomparator
As Mr Einstein said:
Because I work with helicopters
Quote Helicomparator
In the case of the first S92 oil system problem that nearly caused a ditching in the Norwegian N Sea, the problem was that when one of the oil pumps stopped being driven, it became a turbine and allowed the oil pressure from the good pump to escape back through the failed pump because there were no check valves. The comment from the designers was "we didn't consider this failure mode".
Many of the things you can count, don't count. Many of the things you can't count, really count.
You can never solve a problem on the level on which it was created.
Everything should be made as simple as possible, but not simpler.
CEFOSKEY
Apart from the natural tendancy for pilots to trivialise design engineers jobs and vice versa
, I can't really disagree with anything you say, but I continue to think you make my point (which at the risk of being boring, I'll rephrase):
A few years ago JAR/FAR 29 was modified to include a requirement for continued operation following complete loss of lubrication. This was because, although fairly unlikely, a complete loss of lubrication is a reasonably forseeable event. Whereas a CAT A aircraft flying over a hostile environment should be able to maintain flight for some time following a reasonably forseeable event (with the expectation of being able to make a safe landing). But by including the phrase "Unless such failures are extremely remote" - something which IMHO cannot feasibly be proven in a new type - an escape route from the requirement was created so reluctant manufacturers could avoid the requirement, whilst other more conscientious manufacturers stopped wriggling and just complied with the spirit of the reg. Fortunately I fly an aircraft made by the latter type of manufacturer!
HC
Apart from the natural tendancy for pilots to trivialise design engineers jobs and vice versa
, I can't really disagree with anything you say, but I continue to think you make my point (which at the risk of being boring, I'll rephrase):A few years ago JAR/FAR 29 was modified to include a requirement for continued operation following complete loss of lubrication. This was because, although fairly unlikely, a complete loss of lubrication is a reasonably forseeable event. Whereas a CAT A aircraft flying over a hostile environment should be able to maintain flight for some time following a reasonably forseeable event (with the expectation of being able to make a safe landing). But by including the phrase "Unless such failures are extremely remote" - something which IMHO cannot feasibly be proven in a new type - an escape route from the requirement was created so reluctant manufacturers could avoid the requirement, whilst other more conscientious manufacturers stopped wriggling and just complied with the spirit of the reg. Fortunately I fly an aircraft made by the latter type of manufacturer!
HC
CEFOSKEY - there is no run-dry capability and no emergency lube system - where is the plan b when the oil pump fails? That is either supreme arrogance on the part of the designers or incompetence.
You can gloss it over as much as you like but designing a modern helicopter that can be brought down by one simple pump failure is poor engineering design.
The reason you get so many end-user comments is because we are the ones who will find ourselves ditching 100s of mile out to sea because someone didn't think about the consequences of a component failure properly. "Hey I know, shall we give the crew some backup in case the MRGB pump fails - hell no they'll just land if that happens"
You can gloss it over as much as you like but designing a modern helicopter that can be brought down by one simple pump failure is poor engineering design.
The reason you get so many end-user comments is because we are the ones who will find ourselves ditching 100s of mile out to sea because someone didn't think about the consequences of a component failure properly. "Hey I know, shall we give the crew some backup in case the MRGB pump fails - hell no they'll just land if that happens"
Join Date: Feb 2003
Location: Somerset
Posts: 282
Likes: 0
Received 0 Likes
on
0 Posts
for clarification
ther have been no 'fatal' instances with 101 hub cracking, just 1 crash with no fatalities at Culdrose
other aircraft losses were not caused by that phenomenon.
DM
other aircraft losses were not caused by that phenomenon.
DM
Join Date: Oct 2003
Location: UK
Posts: 510
Likes: 0
Received 0 Likes
on
0 Posts
My understanding is this (and those of you that know feel free to correct me):
When engineers design something, they have to work out/guess what loads the component is going to be subjected to. The magnitude of the safety factor is dependant on the confidence of the accuracy of the load cases and the level of modelling. So in effect I would expect the SF in the S61 to be higher than that in the S92 (through better computing power if nothing else).
If my point above is generally true (ie that modern designs have smaller safety factors due greater experience) and that FMEA use history to determine probabilities of failure, am I the one to see the flaw in this? If the historical data is based on older components with larger SF, the probabilities cannot be applied to newer components.
I am way out of my depth here and hope that a proper designer would put me right.
But please don't forget it is not always easy sitting in the middle of the north sea on a dark night thinking that we are driving a prototype (ie a newish machine) where the design philosophy is based on potentially shaky probabilities.
When engineers design something, they have to work out/guess what loads the component is going to be subjected to. The magnitude of the safety factor is dependant on the confidence of the accuracy of the load cases and the level of modelling. So in effect I would expect the SF in the S61 to be higher than that in the S92 (through better computing power if nothing else).
If my point above is generally true (ie that modern designs have smaller safety factors due greater experience) and that FMEA use history to determine probabilities of failure, am I the one to see the flaw in this? If the historical data is based on older components with larger SF, the probabilities cannot be applied to newer components.
I am way out of my depth here and hope that a proper designer would put me right.
But please don't forget it is not always easy sitting in the middle of the north sea on a dark night thinking that we are driving a prototype (ie a newish machine) where the design philosophy is based on potentially shaky probabilities.
CEFOSKEY
Do we have to go there again?
This thread is supposed to be about the S92...
The difference is that the 225 tcds, which is public domain, clearly shows that there are a few elements of the 225 that are grandfathered from the Super Puma family and therefore comply only with earlier versions of 29. Therefore with a 10 minute bit of research on the internet, you know exactly what you are getting.
With the 92, although it crows that it complies fully with 29 (revision early 2000s I think), its not until the repeated major failures occur that we realise its all a bit of a con.
HC
Do we have to go there again?
This thread is supposed to be about the S92...The difference is that the 225 tcds, which is public domain, clearly shows that there are a few elements of the 225 that are grandfathered from the Super Puma family and therefore comply only with earlier versions of 29. Therefore with a 10 minute bit of research on the internet, you know exactly what you are getting.
With the 92, although it crows that it complies fully with 29 (revision early 2000s I think), its not until the repeated major failures occur that we realise its all a bit of a con.
HC
Personally I would have thought a non return valve would have been a must. Any one who builds a linked twin pump design & does not think what happens IF!!! is not even a fitter.
CEFOSKEY
The most recent event was a partial detachment of the oil filter housing in Australia. The event I was referring to was some time ago in the Norwegian sector of the N Sea. In that incident, the aircraft was within a very few minutes (about 3 I think) of an offshore platform and made a sucessful landing there. This was in contravention of the Flight Manual procedure for the indications they had - it required immediate ditching. With hindsight, it was a good if risky call!
HC
The most recent event was a partial detachment of the oil filter housing in Australia. The event I was referring to was some time ago in the Norwegian sector of the N Sea. In that incident, the aircraft was within a very few minutes (about 3 I think) of an offshore platform and made a sucessful landing there. This was in contravention of the Flight Manual procedure for the indications they had - it required immediate ditching. With hindsight, it was a good if risky call!
HC
"Unless such failures are extremely remote"
This reminds me of the US airlines arguing Boeing 727 flights from New York to Miami did not require life rafts and other "over water" safety items as the probability of a ditching being required was "quite remote". The wonderful FAA agreed.
Less than two weeks later at the most inopportune location.....some halfwit FE managed to flame out all three engines by mis-managing the fuel system. The crew very fortunately were able to cure the problem and get the engines back on line but came very close to the water while doing so.
The rafts, jackets, etc......were re-installed shortly thereafter.