Boeing 787 faces new risk: limits on ETOPS
Join Date: Nov 2009
Location: flying by night
Posts: 500
Likes: 0
Received 0 Likes
on
0 Posts
UniFoxOs is right - they had the incredible presence of mind to immediately start the APU.
But even if there had been any power coming from the heavily damaged engines...the relight procedure (which they followed if I remember correctly) will require to set the engine master switch to off for some time, to permit ventilation of the combustion chamber, after an unsuccessful attempt - at that point there definitely can't be any generator power whatsoever.
But even if there had been any power coming from the heavily damaged engines...the relight procedure (which they followed if I remember correctly) will require to set the engine master switch to off for some time, to permit ventilation of the combustion chamber, after an unsuccessful attempt - at that point there definitely can't be any generator power whatsoever.
Last edited by deptrai; 31st Mar 2013 at 09:32. Reason: typo
Join Date: Jan 2008
Location: lancs.UK
Age: 77
Posts: 1,191
Likes: 0
Received 0 Likes
on
0 Posts
My last post, (as some will have realised) 
was deliberately over-dramatised.
The batteries areonly as good as their reliability and state of charge,
To pretend to oneself that they meet their functional requirements, is tobe in denial.. they have caused 50 aircraft to be grounded and god knows how many completed airframes to back-up at the factory out-door.
there have been at least 2 out-of fuel instances, plus the BA incident, plus the "Sully" incident, that i can recall in my lifetime. in commercial Pax-carrying Aviation.
Composite -structures have totally different Thermal properties to Aluminium Alloys... to have blind faith in a bunch of feckwits who designed wings that wouldn't fit. a faulty electrical system that can backfeed and flatten the second battery (if neither becomes incendiary in the interim!)...is naive in the extreme.
IMHO, they haven't had enough operating experience to really know if fuel-freezing /starvation will ever be an issue.
Prudence suggests one plans for a worst-case scenario and the multiple-backups are/ should be predicated on this
IF both main-engines fail to produce enough power (for whatever reason)
It's all in the lap of an unsafe, unreliable battery-system to start the APU
As it stands, that can't be assured, so I stand by my assertion that 2 holes line up. It cannot be denied there is a safety-critical weak link in the design...the American authorities themselves decided that grounding was more important than national pride.
As a matter of National Pride, the US Government will make sure Boeing survive this crisis...but it won't be due to the expertise of the current management of the company.
was deliberately over-dramatised.The batteries areonly as good as their reliability and state of charge,
To pretend to oneself that they meet their functional requirements, is tobe in denial.. they have caused 50 aircraft to be grounded and god knows how many completed airframes to back-up at the factory out-door.
there have been at least 2 out-of fuel instances, plus the BA incident, plus the "Sully" incident, that i can recall in my lifetime. in commercial Pax-carrying Aviation.
Composite -structures have totally different Thermal properties to Aluminium Alloys... to have blind faith in a bunch of feckwits who designed wings that wouldn't fit. a faulty electrical system that can backfeed and flatten the second battery (if neither becomes incendiary in the interim!)...is naive in the extreme.
IMHO, they haven't had enough operating experience to really know if fuel-freezing /starvation will ever be an issue.
Prudence suggests one plans for a worst-case scenario and the multiple-backups are/ should be predicated on this
IF both main-engines fail to produce enough power (for whatever reason)
It's all in the lap of an unsafe, unreliable battery-system to start the APU
As it stands, that can't be assured, so I stand by my assertion that 2 holes line up. It cannot be denied there is a safety-critical weak link in the design...the American authorities themselves decided that grounding was more important than national pride.
As a matter of National Pride, the US Government will make sure Boeing survive this crisis...but it won't be due to the expertise of the current management of the company.
Join Date: Nov 2000
Location: Grobelling through the murk to the sunshine above.
Age: 60
Posts: 562
Likes: 0
Received 0 Likes
on
0 Posts
Yes! We do!....But the "Boeing Bullcrap" implies that the RAT will be the saviour IF all other power-sources fail.
Last edited by Pub User; 31st Mar 2013 at 10:21.
Join Date: Aug 2004
Location: up up up
Posts: 384
Likes: 0
Received 0 Likes
on
0 Posts
"It's all in the lap of an unsafe, unreliable battery-system to start the APU"
I assume you've followed the changes made to the batteries?
Before the aircraft has actually been cleared (or not) to fly, you've already decided the new proposed solution is unreliable and unsafe?
How do you know it's unsafe?
I assume you've followed the changes made to the batteries?
Before the aircraft has actually been cleared (or not) to fly, you've already decided the new proposed solution is unreliable and unsafe?
How do you know it's unsafe?
Whatsthisbuttondo.
Its a regulation requirement to have an independent backup brakes source.
On a hydraulic dependent a/c the RAT will not supply enough energy to supply the brakes. Whether it has a hydraulic pump or a generator driving a pump etc.
The 787 requires an independent backup power source for its braking system. The battery is it.
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of.
Its a regulation requirement to have an independent backup brakes source.
On a hydraulic dependent a/c the RAT will not supply enough energy to supply the brakes. Whether it has a hydraulic pump or a generator driving a pump etc.
The 787 requires an independent backup power source for its braking system. The battery is it.
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of.
Join Date: Aug 2004
Location: up up up
Posts: 384
Likes: 0
Received 0 Likes
on
0 Posts
"The 787 requires an independent backup power source for its braking system. The battery is it.
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of."
Yet the "regs" (the MEL) allow a 787 to dispatch without a functioning battery?
It matters not a jot whether you or I calculate the odds of it being needed as 10 milllion to 1 or evens.
The regs say it needs to be there. End of."
Yet the "regs" (the MEL) allow a 787 to dispatch without a functioning battery?
Join Date: Nov 2000
Location: Grobelling through the murk to the sunshine above.
Age: 60
Posts: 562
Likes: 0
Received 0 Likes
on
0 Posts
No, the MEL allows dispatch without a functioning APU battery; it's the main battery that supplies back-up power to the brakes.
Join Date: Aug 2004
Location: up up up
Posts: 384
Likes: 0
Received 0 Likes
on
0 Posts
The point is, if the 787 gets cleared to operated again, it will be because the FAA/NTSB/whoever decide the battery solution is safe and reliable enough.
Thus the main battery will be the back up to the brakes. Why are people suggesting or assuming the 787 will be flying around without a battery or in a perilous condition as there might be a double engine failure, then for some reason the APU won't start and THEN the (new safer more reliable) main battery will also fail?
The 787 when cleared to fly will have a backup source for the brakes as the new battery and it's associated systems will have been certified as being safe and reliable. As I ever, I expect some people have ulterior motives to scare monger but there seems to be a lot of unfounded sensationalism on this thread.
Thus the main battery will be the back up to the brakes. Why are people suggesting or assuming the 787 will be flying around without a battery or in a perilous condition as there might be a double engine failure, then for some reason the APU won't start and THEN the (new safer more reliable) main battery will also fail?
The 787 when cleared to fly will have a backup source for the brakes as the new battery and it's associated systems will have been certified as being safe and reliable. As I ever, I expect some people have ulterior motives to scare monger but there seems to be a lot of unfounded sensationalism on this thread.
Join Date: Jan 2006
Location: Cyprus
Age: 76
Posts: 270
Likes: 0
Received 0 Likes
on
0 Posts
I have just looked at the Jackx 123 (posting 36) which I find very disturbing. I suggest all to give it a look. Cutting edge technology always has risks but not to learn, follow up & fix problems is unforgivable.
The 787 is cutting edge in so many ways. But I now feel that there have been so many other safety issues (not just the batteries) that the general airworthyness needs to be looked at carefully.
The 787 is cutting edge in so many ways. But I now feel that there have been so many other safety issues (not just the batteries) that the general airworthyness needs to be looked at carefully.
Join Date: Mar 2008
Location: England
Age: 65
Posts: 303
Likes: 0
Received 0 Likes
on
0 Posts
Re: Experts
Perrin,
Going to call you on your statement "No manufacturer will ever ask you guys to fly in in a unsafe A/C if they knew it had a fault."
Turkish DC-10 1974
McDonnell Douglas knew that the door latch system was flawed back in 1969, Convair's Dan Applegate documented this in 1972 (Convair were fuselage sub-contractors).
McD ignored this and only made changes when the NTSB made them do so after two incidents, even then McD cosied up with the FAA who waived some of the NTSB requirements.
After the Turkish crash, McD implemented all the changes and re-designed the latch mechanism, did they know the system was unsafe, YES they damn well did.
FAA/NTSB disagreeing over the extent of fixes sound eerily familiar?
Going to call you on your statement "No manufacturer will ever ask you guys to fly in in a unsafe A/C if they knew it had a fault."
Turkish DC-10 1974
McDonnell Douglas knew that the door latch system was flawed back in 1969, Convair's Dan Applegate documented this in 1972 (Convair were fuselage sub-contractors).
McD ignored this and only made changes when the NTSB made them do so after two incidents, even then McD cosied up with the FAA who waived some of the NTSB requirements.
After the Turkish crash, McD implemented all the changes and re-designed the latch mechanism, did they know the system was unsafe, YES they damn well did.
FAA/NTSB disagreeing over the extent of fixes sound eerily familiar?
Join Date: May 2010
Location: London
Age: 59
Posts: 27
Likes: 0
Received 0 Likes
on
0 Posts
The 787 when cleared to fly will have a backup source for the brakes as the new battery and it's associated systems will have been certified as being safe and reliable.
The fireproof box and containment system appears to based on solid and proven engineering priciples, however will need to demonstrate its ability to contain the same failure scenario as on the ANA flight before it will be certified.
There are two ways to demonstrate reliability: The first is to deterministically ascertain and then eliminate the root cause of whatever caused the device to not meet the previous reliabilty certification criteria (i.e. 1 fire in 10 million hours).
The second way is to create a new device with moderate reliability claims based on engineering design, then to demonstrate higher reliability through accumulated service hours without incident.
The first method CANNOT yet be applied to the 787 battery as the root cause has not yet been determined. Most aspects of the new design such a separated/insulated individual battery cells, are containment improvements to offer better protection in the case of failure - they do not reduce the risk of the failure and thus do not increase reliability. Production changes such as tighter tolerances may help reliability, but there is no way of knowing without a deterministic confirmation of what the root cause failure mode is.
The 2nd method is what is commonly used for ETOPS certification. A new model aircraft/engine will typically have a moderate ETOPS rating based on the number of incident free test hours during certification. A case can then be made to increase the duration of the ETOPS certification as the number of incident free hours increases.
The problem for Boeing is that they don't have the luxury of time to go through thousands of hours of inflight testing of the "new" battery to demonstrate reliabilty using this method.
As such, I would expect the 787 to resume flights with a reduced ETOPS limit and stricter MEL (e.g. APU must be functional) until the reliability (or otherwise) of the "new" battery solution can be proven. I wouldn't be surprised to see additional operational requirements such as having the APU ON during takeoff, approaches and landings.
Join Date: Oct 2012
Location: toofaraway
Posts: 224
Likes: 0
Received 0 Likes
on
0 Posts
... other startups that can't say the same (Comet, A320)
Perrin, I don't see the link between Comet and A320. Comets crashed and killed people because of engineering failures.
The A320 hasn't done that, unless my memory has faded.
The A320 hasn't done that, unless my memory has faded.
Join Date: Mar 2008
Location: England
Age: 65
Posts: 303
Likes: 0
Received 0 Likes
on
0 Posts
Toffeez,
If you believe that the Habsheim A320 recorders weren't switched, then no.
Personally, I believe that at a crucial stage of the A320 implementation, the facts were massaged to present a more palatable truth.
If you believe that the Habsheim A320 recorders weren't switched, then no.
Personally, I believe that at a crucial stage of the A320 implementation, the facts were massaged to present a more palatable truth.
Join Date: Apr 2008
Location: Paris
Age: 74
Posts: 275
Likes: 0
Received 0 Likes
on
0 Posts
There is a design problem in the 787 which won't go away - an APU battery failure makes the APU shutdown, so the APU is only as reliable as the battery - these two holes in the swiss cheese are aligned by design. Worse, deep discharge puts the battery at risk, but such discharge would likely occur exactly when starting the APU.
IN OTHER WORDS, THE FIREBOX PROTECTION OF THE APU BATTERY MAY PREVENT A THERMAL RISK, BUT BATTERY FAILURE DUE TO DEEP DISCHARGE DUE TO IN-FLIGHT STARTING OF THE APU WILL ANYWAY TAKE DOWN THE APU EXACTLY WHEN IT IS NEEDED.
The risk is that in case of a double engine malfunction the APU start process would deep discharge the battery, causing battery failure, and then the battery would be taken offline by its safety mechanisms which would take the APU offline and leave the plane reliant on the RAT, and possibly incapable of an engine restart.
I don't think the FAA should have certified this design logic, nor do I think they should certify it now. And yes, I may be an idiot but I'm an idiot with an electronic engineering degree and a PhdD.
IN OTHER WORDS, THE FIREBOX PROTECTION OF THE APU BATTERY MAY PREVENT A THERMAL RISK, BUT BATTERY FAILURE DUE TO DEEP DISCHARGE DUE TO IN-FLIGHT STARTING OF THE APU WILL ANYWAY TAKE DOWN THE APU EXACTLY WHEN IT IS NEEDED.
The risk is that in case of a double engine malfunction the APU start process would deep discharge the battery, causing battery failure, and then the battery would be taken offline by its safety mechanisms which would take the APU offline and leave the plane reliant on the RAT, and possibly incapable of an engine restart.
I don't think the FAA should have certified this design logic, nor do I think they should certify it now. And yes, I may be an idiot but I'm an idiot with an electronic engineering degree and a PhdD.
Last edited by edmundronald; 31st Mar 2013 at 20:48.
Join Date: Feb 2013
Location: Seattle, WA
Posts: 78
Likes: 0
Received 0 Likes
on
0 Posts
edmundronald
The APU on the 777 operates the same way - if the APU battery becomes inoperative, the APU shuts down. Other Boeing Commercial Aircraft families may operate similarly.
A double-engine failure is going to happen from one of two causes - FOD ingestion or fuel exhaustion. And both are pretty rare. Still, if such a scenario did happen, normal operation is for the Ship's Battery and APU Battery together start the APU, so the load is shared. However the APU battery can start the APU on it's own and I believe it can do so three times before the APU - not the APU battery - needs a "rest" before a fourth attempt can be made.
It is most certainly not a "one or done" situation in terms of starting attempts.
There is a design problem in the 787 which won't go away - an APU battery failure makes the APU shutdown, so the APU is only as reliable as the battery - these two holes in the swiss cheese are aligned by design. Worse, deep discharge puts the battery at risk, but such discharge would likely occur exactly when starting the APU.
I don't think the FAA should have certified this design logic, nor do I think they should certify it now.
I don't think the FAA should have certified this design logic, nor do I think they should certify it now.
The risk is that in case of a double engine malfunction the APU start process would deep discharge the battery, causing battery failure, and then the battery would be taken offline by its safety mechanisms which would take the APU offline and leave the plane reliant on the RAT, and possibly incapable of an engine restart.
It is most certainly not a "one or done" situation in terms of starting attempts.
Last edited by Kiskaloo; 1st Apr 2013 at 00:11.
Join Date: Mar 2008
Location: England
Age: 65
Posts: 303
Likes: 0
Received 0 Likes
on
0 Posts
Point taken regarding commonality of procedure between 777 and 787, however the 777's battery is not in question.
I make it at least 6, BA09 and KLM867 (Volcanic ash), ALM980 fuel exhaustion, RYR4109 is a strong contender for 7 (Written off after emergency landing following multiple bird strikes).
I make it at least 6, BA09 and KLM867 (Volcanic ash), ALM980 fuel exhaustion, RYR4109 is a strong contender for 7 (Written off after emergency landing following multiple bird strikes).
