A350 engine shutdown incidents linked to cockpit drink spills

[Lord Farringdon]

Originally Posted by Electronics Pro

Hello all,

As an experienced electronics engineer I have to say the there are many electronics design errors when interfacing modern digital electronics, especially with the digital inputs....

..... The control inputs should not change the state with coffee or other liquid spilled on/in the the switches. This applies to all reliable electronics design.


Best Regards,
A concerned electronics engineer/private pilot in Finland

Thanks Electronics Pro. You reinforced my thoughts about this but I am still perplexed. I don't believe any manufacturer in the aerospace industry (even Boeing) is unaware of the possibility of moisture reaching critical and even non critical electrical and electronic systems while in flight. Condensation leaking from above during descent, liquid spills down the centre pedestal, and even the unexpected leak of 700 gals of potable water that rained down on passengers on a Qantas A380 LAX to MEL flight. The in-flight entertainment system was switched off just in case! (ATSB report attached for interest). So, leaks happen and even the automotive industry have proven water resistant connections.Notice how headlights often still work even when cars are mostly submerged in floods.

I am still gobsmacked that in a state of the art aerospace endeavor such as the A350, engine state can be permanently altered in-flight by something so basic. I am still hanging out for an updated report that might state the crew carried out a precautionary shutdown, although even that sounds a bit silly for a drinks spill!!.

[Twitter]

Originally Posted by Lord Farringdon

Thanks Electronics Pro. You reinforced my thoughts about this but I am still perplexed. I don't believe any manufacturer in the aerospace industry (even Boeing) is unaware of the possibility of moisture reaching critical and even non critical electrical and electronic systems while in flight. Condensation leaking from above during descent, liquid spills down the centre pedestal, and even the unexpected leak of 700 gals of potable water that rained down on passengers on a Qantas A380 LAX to MEL flight. The in-flight entertainment system was switched off just in case! (ATSB report attached for interest). So, leaks happen and even the automotive industry have proven water resistant connections.Notice how headlights often still work even when cars are mostly submerged in floods.

I am still gobsmacked that in a state of the art aerospace endeavor such as the A350, engine state can be permanently altered in-flight by something so basic. I am still hanging out for an updated report that might state the crew carried out a precautionary shutdown, although even that sounds a bit silly for a drinks spill!!.

Suggest a big fat locking General Post Office relay in parallel to the soft switch - or better, a British Railways signal-box cable, operated hydro-mechanical control outboard.

It seems the cleverer we get, the further away from the basics we get.

[Lord Bracken]

When a sub £1k consumer smartphone can survive 30 minutes submerged entirely in water, is it too much to ask for a splash resistant cockpit?

[Lord Farringdon]

Originally Posted by Lord Bracken

When a sub £1k consumer smartphone can survive 30 minutes submerged entirely in water, is it too much to ask for a splash resistant cockpit?

Agree entirely my fellow Lord.

It seems like the Integrated control panel and EEC took a bath and keeping with the design functionality of the FADEC system, the following disadvantages of the system were demonstrated to full effect:
(Apologies to all you guys who actually flick these switches every day but for others this may be of interest)

"Full authority digital engine controls have no form of manual override available, placing full authority over the operating parameters of the engine in the hands of the computer.

• If a total FADEC failure occurs, the engine fails.
• Upon total FADEC failure, pilots have no manual controls for engine restart, throttle, or other functions."

Source: skybrary.aero

[lomapaseo]

Originally Posted by Lord Bracken

When a sub £1k consumer smartphone can survive 30 minutes submerged entirely in water, is it too much to ask for a splash resistant cockpit?

Did you actually make calls from the phone while submerged?

[lomapaseo]

Originally Posted by Lord Farringdon

Agree entirely my fellow Lord.

It seems like the Integrated control panel and EEC took a bath and keeping with the design functionality of the FADEC system, the following disadvantages of the system were demonstrated to full effect:
(Apologies to all you guys who actually flick these switches every day but for others this may be of interest)

"Full authority digital engine controls have no form of manual override available, placing full authority over the operating parameters of the engine in the hands of the computer.

• If a total FADEC failure occurs, the engine fails.
• Upon total FADEC failure, pilots have no manual controls for engine restart, throttle, or other functions."

Source: skybrary.aero

as always, one needs to define what is meant by "fails". Of course it loses function, but doesn't it still stay lit with air still being compressed? while locked in a synthesized mode

[DaveReidUK]

Interesting thread here, from 10 years ago: PPRuNe: FADEC failure

[Fursty Ferret]

I believe that A350 engine control digital inputs have too high impedance. The control inputs should not change the state with coffee or other liquid spilled on/in the the switches. This applies to all reliable electronics design.

I agree, this is more complex than a couple of electrical contacts shorting out. The switch panel is likely quite complex and contains a number of processors of its own (engine fire light, fault light triggers, lighting, BITE etc). You wouldn't replace the switch if there was a fault, you'd swap out the whole thing. It's possible that the liquid is upsetting whatever microprocessor is responsible for interrogating switch position and firing it out onto the ARINC bus.

I'm surprised that there isn't backup physical cabling to the engine HP valve, but it could be that Airbus was more concerned about not being able to shut an engine down than the other way around, and implemented it through the fire pushbuttons. Certain DC bus faults on the A320 series can disable the engine master switches.

[cats_five]

Originally Posted by Lord Bracken

When a sub £1k consumer smartphone can survive 30 minutes submerged entirely in water, is it too much to ask for a splash resistant cockpit?

Your phone didn't have to be certified by whatever the body is. It wouldn't be a sub £1k phone if it was.

[tdracer]

First off, the FADEC isn't in the aisle stand, or even the electronics bay - it's on the engine fan case - and yes the FADEC is certified not to be affected by liquids, temperatures/pressures (within certified limits - obviously there are upper temp limits that the FADEC electronics can survive), HIRF, Lightning, etc.
Talking Boeing installations here, but I have no reason to believe the A350 is any different:
The FADEC has the capability to turn the fuel ON and OFF - it's used during autostart, and on many engines (including the Trent) the overspeed protection system. HOWEVER, fuel ON needs to be enabled from the aircraft first - there is a hard wire signal from the flight deck to the engine that controls the fuel ON/OFF solenoid on the fuel control - the aircraft OFF signal overrides the FADEC ON signal. In short, OFF always wins, be it from the aircraft or the FADEC.
The last aircraft I'm familiar with that used a cable to control fuel ON/OFF was the 737-100/200. Everything since then uses a hardwired electronic signal that actuates a solenoid (or on a few engines, motor driven actuator) right on the fuel control to control ON/OFF. Once enabled ON, then the FADEC can use the fuel metering valve to control the fuel, including taking it to zero fuel flow if needed.
No first hand knowledge of the A350, but I suspect Electronics Pro pretty much nailed it - Airbus isn't using the appropriate impedance for the flight deck ON/OFF signal - and as a result it can be compromised by liquid contamination. Sloppy design.

[Electronics Pro]

Originally Posted by tdracer

The last aircraft I'm familiar with that used a cable to control fuel ON/OFF was the 737-100/200. Everything since then uses a hardwired electronic signal that actuates a solenoid (or on a few engines, motor driven actuator) right on the fuel control to control ON/OFF. Once enabled ON, then the FADEC can use the fuel metering valve to control the fuel, including taking it to zero fuel flow if needed.
No first hand knowledge of the A350, but I suspect Electronics Pro pretty much nailed it - Airbus isn't using the appropriate impedance for the flight deck ON/OFF signal - and as a result it can be compromised by liquid contamination. Sloppy design.

Thanks tdracer. You are right, a solenoid can't be activated with a liquid because the impedance is so low (typically few tens of ohms). But if a pull-up design is used the the pull-up resistor should supply at least 10mA. In a 5 volt logic the resistor value should be 500 ohms or even as low as 100 ohms.

[Twitter]

Good job cockpit doors are kept locked. The weapon of choice might just be a bottle of Coke in the future - easier for threatening than a grenade...

[pilot9250]

Originally Posted by lomapaseo

Did you actually make calls from the phone while submerged?

I have taken a call on my $499 phone straight after retrieving it from the kahzee. It was in my back pocket and fell in.

I admit I hadn't enriched it with anything.

i retrieved it and took the call.

It worked.

Why shouldn't it?