Leave the hydraulic systems on, don't touch stick and rudder, use eng thrust to try it in the sim.

Edited:

Ooops, I'm afraid this doesn't work in the 320 SIM due to the Flight Control Logic, sorry guys and gals.

(Apart from that it works out in the A300 SIM, but that's another story).

hetfield

Re CHORNEDSNORKACK`s post. The DHL A300 did not loose its port wingtip, it lost the outer 2 flaps. The aileron stayed on the wing Cockpit controls effect would have been the same if on an A320 ie zilch.

Ah, so an extended part of wingtip was directly damaged. But the cockpit controls were affected in the sense that, e. g. the structurally intact elevator, rudder and opposite wing were not controllable because of no hydraulic fluids.

Well, let's try some *very* crude estimates to give people an idea of what they can conclude without even leaving the armchair to look up the systems. And let me estimate without leaving *my* armchair to go look anything up.

Malinge told the CPI that the A320 family had accumulated about 60 million flight hours.

There have been dual hydraulic failures. Let's suppose there have been 60 of them to make the arithmetic easy. That makes one dual-failure in 1 million flight hours.

Suppose in each of these cases the two systems failed independently. We can take the posterior reliability of each, the MTBF to be 1,000 hours (1,000 x 1,000 = 1 million).

So what is the expected MTBF for three systems? 1,000 x 1,000 x 1,000 = 10^9 hours. So we can expect another
940 million flight hours to go before seeing one.

60 million under the belt, 940 million to go. How many hours a year does an A320 fly, and how many of them are
there? Well, they have been in service 19 years. Let us assume a constant rate of production, x aircraft per year, and that all of them carry on flying for ever at identical levels, say y hours per year. Then there will be xy hours
flown in the first year, 2xy in the second year, 3xy in the
third year, and so on. And we know
xy + 2xy + 3xy + ..... + 19xy = 60 million.

xy + 2xy + ..... +19xy = xy(1 + 2 + 3 + ... + 19) = xy.190 = 60 million

So xy = about 316,000.

Now we want to know how many years it is going to be before the fleet accumulates 1 billion hours. We want to
solve for n in
316,000(1 + 2 + 3 + .... + n) = 1,000,000,000

That is, (1 + 2 + .... + n) = about 3,165.

Now, (1 + 2 + .... + n) = n.(n+1)/2 so we want to solve for
n where n.(n+1) = 6,330. Now, n.(n+1) is a little over n^2, so let's just take the square root of 6,330, say of 6,400, which is about 80 (since 8^2 = 64). So we are round about 80 years of service life before we expect to see a triple failure, and we have had 20 years already, so we can expect another 60 years without one. Don't explain that plane to be flying in line service in 60 years.

All that without leaving the armchair to get a calculator!

Now, about those dual failures. There are, as has been mentioned, dual failures with common cause, namely concerning the PTU. The third system is independent of this common cause, so assuming all failures (including dual failures) are independent is a conservative assumption.

The only non-conservative assumption I see in this is that A320 family aircraft are not produced at a constant rate per year since service intro, but at an increasing rate. However, look at one of the other assumptions. Is is *really* true that one loses one hydraulic system every one thousand flight hours in an A320? I don't think so, I think it is *much, much* more rarely than this. That more than makes up for any increased production rate.

As NoD and T-t-o have said, don't expect the sim, even the Iron Bird, to accurately portray what's going to happen for real in this scenario, for the reasons they have mentioned.

PBL

How many hours had the 747 be flown until a QUAD HYD LOSS with JAL?

How many hours had the DC 10 flown until the tripple Loss at Sioux?

How was that calculation?

Gee, hetfield, I'd forgotten about that!

you're right. All that math can't help. It's going to happen tomorrow!

PBL

I don't hope so.

But if it happens, YOU are not the person at the controls.

While that calculation is good, you're assuming that hydraulic system failures are independent events, but they're not. Most (all?) of A320 G&Y failures have been caused by inadventent PTU selection. All total hydraulic failures on commercial aircraft have been caused by structural damage. A strengthened floor would have saved THY981 (along with McDD listening to Convair/General Dynamics' concerns about the floor, not getting the FAA to change their mind about the floor strength, fitting the supporting plate to prevent the torque tube from deforming, not falsifying records &c.) The addition of a fourth hydraulic system probably wouldn't have helped. Four hydraulic systems didn't save JAL123.

Of course, the proliferation of EHAs in new designs means that ship-wide hydraulic failure won't condemn future aircraft (and the A380).

Just out of interest: Can anybody explain to me how exactly the PTU can cause either the G or Y system to fail in case of a hyd low rsvr lvl ?

I don't quite see the logic?

Thanks in advance

@PGA

If you have a GREEN SYS loss due to RSVR LOW LVL the Y PTU shouldn't run. Otherwise you will have YELLOW RSVR OVHT and so a DUAL LOSS.

This happened many times due to wrong switching as well as PB failures.

@ Hetfield,

Thanks I got that bit but I fail to understand why the say Y system would then overheat?

There is no "load" on the PTU cause on the green side no fluid, it speeds up like hell.

Correct. Explicitly. So now we are getting into what the figures can mean. They are a decision guide. In order to let such figures guide one in making decisions, one does indeed need a feel for what such calculations can say, and what they can't. And the independence assumption is the trickiest of the lot.

There are obviously people here who don't know what such calculations can say and what they can't, and I don't see how to give a feel for this which can be packed into a dozen words.

What the figures are good at showing is that, even if you know about or have experienced a simultaneous failure of two systems, that does not necessarily mean you or anyone else needs seriously to worry about a failure of three.

I think you mean that not all hydraulic failures need be caused by independent subsystem failures. Correct. Being hit by a missile might be a common cause failure of all three hydraulic systems. The calculation obviously does not account for failures caused by external events, such as missiles or mid-air collisions or such.

It is also the case that there have been features of certain architectures that slipped through the regulators, such as the common-cause failure near Sioux City. But that was a glaring design error which should have been caught at review time by the hazard analysis. Throwing blades was not exactly an unknown event. And when doing the hazard analysis obviously either nobody had asked what the worst outcome could have been when number 2 throws a blade, or had done so and not answered the question correctly.

Calculations of likelihood don't help when significant design-analysis errors are made

On the other hand, when it comes down to it I don't actually know what hazard analysis techniques were current when that AC was designed.

Note that I took account of that specific common-cause failure, and it played a conservative role in the argument.

[/QUOTE]All total hydraulic failures on commercial aircraft have been caused by structural damage.[/QUOTE]

Right, as far as I know.

PBL

But a 747 DID have the same kind of accident like THY981. A cargo door opened, the floor duly failed and 9 passengers were blown into Pacific Ocean.

Unlike the DC-10 which fell out of the sky, the 747 kept flying and landed happily, minus the nine passengers sucked out. Something must have saved the 747.

Since the PTU comes on when the differential in a 3000psi nominal system is 500 psi, and the direction is automatic, then more has to be wrong for there to be such low pressure on one side such that both the PTU is working and it has low enough load for it to overheat.

What is that "lot more that has to be wrong"?

Obviously if G is leaking, you don't want to be pumping fluid over. But if everything else is OK, it doesn't happen. What else has to fail?

PBL

Do you know the 320 systems?

The flight control lines are routed differently on a B747.

PBL

hetfield,

I'd be glad of a precise answer in one message, if there is one and you are willing to give it. I don't want to go back and forth with one-sentence interactions.

PBL

To my limited knowledge there is no "fluid to pump over" on 320, 340, 330, 300.

Oh yes, FUEL.

But that's not what we are talking about.

Hetfield,

understand you're unwilling to answer the question. Thanks anyway

PBL

Just stick to the last ? (question mark)

Hetfield,

you are quite welcome to misunderstand what I say, build straw men and shoot them down, not answer my questions, anything you want.

PBL

PBL, the PTU transfers hydraulic pressure (via shaft power) between the G and Y systems. There's no fluid transfer.

IIRC, PTU logic is based on p/b, the delta p between G and Y being >500psi and a few other things mainly related to engine start, cargo door operation, flt etc. Reservoir low quantity plays no part, so if either the G or Y system has a leak the PTU will start once the pressure in the leaking system is below 2500PSI and won't stop until the PTU p/b is pressed.

I think you might find there is actually some path whereby fluid might pass between G and Y or vice versa. And certainly if there is low or no fluid in the G system, there has been a transfer of fluid from G to somewhere. Where?

I could probably carry on all day like this, but I am not interested in playing language games. I was hoping that somebody who knew of a specific scenario might care to share it here.

PBL

It's not a language game at all.

BTW I'm very dissapointed about your system knowledge.

@Giggey

Obviously you asked a very good question. Maybe exceeding some scientists cababilities and making some drivers to have a look in the manuals.

Happy New Year

hetfield
Wouldn't work, mate.. the FBW system compensates for thrust changes and keeps you the right way up - even with one at TOGA and one at Idle. Failing all three hydraulic systems might at least give some spoiler or aileron upfloat to make it interesting..
TP

If you look a little more closely, you will find that I have given you no information about my system knowledge at all.

.................... I am here because I had hoped that on this forum of experienced aviators there might be some people who could tell me things I don't know, and some who might like to learn things which I could tell them.

[Edit: material on the discomfort I feel with what is, to me, the often puerile level of interaction on this forum, that I am surprised to find coming from people who self-describe as technical professionals.]

Hetfield, despite your reticence, I would still be grateful if you would share with me your personal knowledge of how both primary A320 hydraulic systems fail together in line service.

PBL

I have not read the entire thread so apologies if I am covering what has already been said but...

Airbus have warned of a situation that could indeed lead to a 'Dual HYD Failure'. The circumstances were a leak in the Green system after start that was not picked up all the way to Take-Off. On T/O the leak rate increased and total GRN system loss ensued but the warnings are inhibited because of flight phase. As has been pointed out before, the Yellow system began to drive the PTU, but with no fluid to drive in the GRN system it spins at an almighty rate and very quickly overheats the Yellow system. The aircraft now climbs above 1500' and lo and behold a Green system failure and Yellow 'Failure'! Of course the Ylw is actually an overheat that could be reinstated once cooled, but from memory the crew didn't bother with that they just went straight back to land.

In similar circumstances once the Ylw fluid had cooled and the PTU selected off the yellow could have been re-instated.

Oh yes another thing...

An Airbus rep told me of instances of Green to Yellow transfer but it is not 'intentional'. It occurs in the brake shuttle valves (Green / Yellow system) perhaps when seals fail internally? Sorry can't remember the exact details now.
Happy New Year to all.

Thank you, idg. I wonder whether he was talking about known instances, or merely about what he knows about the hazard analysis in the certification basis?

Let me give some indication for those who might be interested but do not know, how a hazard analyst might go about analysing such systems.

First, heshe might look at the crude system diagram in 1.29 and observe that there are at least two devices which connect between the G and Y hydraulic systems. (idg is reporting a third, which I don't believe is indicated in those diagrams, but I can't be bothered to go check.) Now, for each of those devices the certification basis for the AC will include documents, amongst them one assigning the level of criticality of the device, and another giving an argument in detail as to how the device satisfies the assigned level of criticality.

Now, I don't know the detailed design of those devices; I have never seen such engineering documents. And I doubt anybody else here who is willing to say something has either, because those documents are prima facie proprietary and the people seeing them form an restricted group bound by non-disclosure agreement, and nobody who takes their code of practice seriously (i.e. all engineers except for the occasional crackpot) is going to violate non-disclosure for the sake of some guy asking questions on an anonymous web forum, unless there is something seriously, seriously wrong (which I doubt).

So my question to violator was a "leading question". In other words I already know that (as a hazard analyst interprets these words) there are paths between G & Y through which fluid can theoretically travel. Any, say, HAZOP-like analysis will explicitly consider such a scenario and its consequences, but as I said I do not know what techniques are used in the certification basis.

Now, I have never seen any hazard analysis on any piece of complex equipment which was completely correct, without exception. It may be beyond the bounds of current human capability to devise one for such a thing as a commercial aircraft that was exceptionlessly correct. Most of them have faults. Some of them, occasionally, have glaring holes. And I know, for certain specific aircraft that interest us, that there are hazards whose severity (technical term) is catastrophic (also a technical term) that have not been mitigated, because we have reverse-engineered and identified them.

I thank idg also for explaining the PTU-overheat scenario in a little more detail. My next question if I were to follow that line would be of course what the consequences are of that abnormal state that the PTU gets into, but as I said, I doubt anybody here with either the detailed engineering design or the certification basis documentation sitting in front of himher would be inclined to answer.

Sorry for the length of this note. I'm just trying another writing technique to try to avoid this pointless, and to my mind rather silly, one-sentence repartee. I do hope I can get back to brevity; I'd rather just ask a simple question and hope for a sensible answer.

PBL

@TyroPicard

HAPPY NEW YEAR

You were a little faster than me and absolutely correct about simulating a total HYD loss 320 family in the SIM. Like you said the Flight Control Logic is still aktiv.

Sorry for that.:)

Did it in the A300 SIM and there it works, cause switching all pumps off screws the SIM up.

@idg

Yes, fully correct. Beside that scanario there have been incidents of DUAL LOSS due to PB failures. The crew handled the situation very well, but the PTU PB even switched to OFF kept the PTU running.

Replace "such calculations" with "FCOM" :}

IFixPlanes,

well, there are obviously people here who don't know the FCOM in detail either. But what has this issue to do with knowing or not knowing the FCOM? As people have pointed out, losing three hydraulic systems is not considered operationally.

PBL

@IFixPlanes

Thx for your input;)

This thread has shown clearly that also a scientist should take a look to the system description before talking :mad:.

It is my understanding that this would only occur when the brakes are applied or pressure is sent to the shuttle valve from the Brake control unit. Normally not pressurised. Transfer would stop when brake pressure released.

Also, I'm not sure if the brake hydraulic fuses are before or after the shuttle valves. It's been a while. If they are before they will stop the flow when it gets beyond a normal rate.

In regards to the green system loss. If the warning is inhibited due to flight phase screening to 1500'. The plane does not fly around long below 1500' agl. (maybe a pilot type might tell us how long from takeoff to 1500') I'm tipping it's not long.

Your yellow system might get to an overheat but it still takes time. Depending of course on the amount of work it does in the PTU and other controls. It also depends on the rate of loss of fluid from the green system. It's generally going to keep tyring to make pressure until the reservoir is empty. A small leak will take some time to dissipate the fluid. The Engine pump will continue to make pressure though. The PTU will not come into play.

Is there not a flow restrictor fitted to the PTU to limit the maximum RPM? What would generate more heat, the flow a fluid through the motor side of the PTU or the friction in the dry pump side?

@Toqueman

I know personaly about an incident where G Loss occured during TO run and due to ECAM logic warning was was inhibited until 1.500. Immediatly thereafter Y SYS OVHT. This means about 3 minutes.

The Airbus warning was from an actual event when the 'dual failure' occurred. I'll try and get some more info but it actually happened, and happened quickly enough to be present when the a/c climbed above 1500'. Probably about 1min 30 secs.

I'll also try and get a tech diagram of the shuttle valve.

A so called "brake shuttle valves" between green and yellow system does not exist in the A320 braking system. ;)

Last G+Y loss scenario which I know hapens at BA PRG-LHR (A320-100)flight one or two months ago.. Succesfull landing at PRG with full emergecy, one tyre blown-out due temperature. Airbus solution is inhibiton PTU operation below 1500´, probably on new planes only...

IFP

Well my manuals talk of 'Dual Shuttle Valves' so I assume Airbus know they exist! However your inference that I'm barking up the wrong 'valve tree' is correct !! :ouch:

The valve that has had most problems in this area is the Parking Brake Operated Valve.

I have a magnificent diagram with cross sections of all the valves but no way of posting it!

Will PM to anyone that requests it!