Saturday, September 05, 2009

Electrical Encore

Here's another data point in the category of resetting breakers. It has a similarity to the NASCAR incident, in that an electrical malfunction deferred after one flight carried over to the next with more severe consequences. This time the incident aircraft is an A319 operating between England and Spain.

About twenty minutes into the outbound leg, a clunk, an overhead warning light and a computer message announced that the the number one electrical generator had gone off line. Checklist actions called for one attempt to reset the generator. (See? The one-reset rule isn't a GA legend, it's a pervasive theme through the industry). That attempt was unsuccessful, so the crew shut down the generator according to the rest of the checklist and fired up the APU (an extra generator normally used for power on the ground) to supply the left electrical network. Company confirmed that the situation was satisfactory to continue to Spain.

After they landed in Spain, an engineer signed off the situation as acceptable for a return flight, with a few provisions. The captain of the return flight knew about the #1 generator problem from a company message, from the deferral in the journey log and in person from the captain of the outbound flight. They complied with all the procedures required for the deferral and brought extra fuel to make up for needing to run the APU for the whole flight. It all sounds safe and normal.

Clunk is rarely a good sound in aviation, but an hour and a half after takeoff there was another one. This one was accompanied by a loss of power to the autopilot, the captain's displays, and most of the overhead panel. The remaining electrical power appears to have been mainly concentrated in the warnings that nothing else was working. They had also lost autothrust, flight director, and all radios, plus the flight control had degraded to alternate law, reducing the smartass quotient of the Airbus.

The first officer's basic flight display was working so he flew while the captain attempted unsuccessfully to restore electrical power. They considered diverting but were concerned that without radios their actions could be interpreted as hostile, plus they already had weather information for Bristol and knew it was good there.

The captain managed to program the landing into the FMS and the airplane followed that profile. They tried to call ATC on two different cellphones, but were unsuccessful. They weren't sure what systems they would have operative for the landing. The flaps worked normally, but the landing gear didn't, until they used the emergency extension procedure, which works by gravity. Gravity is one of the few things in aviation that is always reliable. So it goes.

They landed safely and taxied to parking, where the engines wouldn't shut down using the normal method, so they used the fire switches. The APU continued to run after engine shutdown and the report doesn't mention how they shut it off, just that maintenance were subsequently unable to use the APU for electrical power.

There is plenty of interesting analysis in the report, explaining why things went wrong when there were backups still functioning. For example why didn't the landing gear extend? The Blue hydraulic system was affected by the failure, but the Green hydraulic system that normally operates the landing gear should not have been. However, the A319 cuts off the hydraulic supply to the gear at calibrated airspeeds above 260 knots, as reported by the #1 and #3 ADIRU (Air Data and Inertial Reference Unit) computers. Both were offline. No airspeed data, no gear. That's reasonable. That's the sort of thing manual backups are designed to circumvent.

There are three radio systems onboard, one for the captain, one for the FO and one for the jumpseat. If either pilot's audio control panel fails, there is a switch that allows them to use the jumpseat panel instead. Except that this aircraft had upgraded digital audio management units, and both audio cards in all three AMUs depended on power from the same inoperative bus bar. Oops. Airbus says it is "evaluating" if that power supply needs to be modified. I'll bet.

With all the lights out on the button panel, the captain couldn't tell which buttons were pushed and which were unpushed. Apparently there is a one to two millimetre difference between a button been selected and not selected. I wonder if his inability to restore power may have been related to an incorrect configuration that he couldn't see. That's what I like about old fashioned toggle switches: you don't even have to look at them, just put your finger on them, and you know what is selected.

It's also interesting to read about the incident from the point of view of ATC. The controller working the flight saw the airplane disappear from both his radar screens, as a result of the loss of power to the transponder, and when he couldn't make radio contact, "feared that it might have suffered a catastrophic event." ATC asked another aircplane to call it on company frequency, and then to descend out of its path. Just in time, too, as the other flight reported seeing the missing airplane pass overhead without appearing on TCAS. When the crew of the incident airplane selected 7700 on the second transponder they weren't sure if it was working, but it was, so ATC could see that it was descending on course, and Bristol was cleared of other traffic for their arrival.

There's lots more juicy stuff in this report, especially for you electrical fans, but most of it is readable without an extensive knowledge of aviation. Just note the Airbus abbreviation glossary at the beginning.


Anonymous said...

Link to the report?

Love your blog sure to tell your readers next time you're in YYC!


Aviatrix said...

The link is there. It's on the words "this time" in the first paragraph.

Frank Van Haste said...

Dear Trix:

Quote: "Clunk is rarely a good sound in aviation..."

May I use that? Truly a wonderful line. I look forward to digesting the report...thanks for providing the link.

The more complex the elec(trical/tronic) systems, the worse idea it is to release an a/c for dispatch without thoroughly understanding any and all squawks.

Stay safe, Trix.


SwL_Wildcat said...

IMHO "Clunk" is not quite as bad as "BANG". My last "BANG" caused the big fan to stop blowing cool air, and boy did I sweat! (Last July I dropped the #3 exhaust valve on my lycosaur, did a forced on a gravel road about 20 NM west of Villenuve...)

Aluwings said...

They could probably have killed the APU with the fire handle just like with the engines.

Good point about the push-button on-off switches vs. toggles. Airbus PBs latch electronically and the only way to tell if they're ON or not is by the internal light and/or the ECAM schematic. Which are not supposed to fail at the same time.

Sounds like a "congrats" is in order for this crew for successfully handling one of Those Events that is not covered in the books because it's Not Supposed to Happen.

Me said...

Yay. You've answered something I've been wondering about for some time. The EFB that I'm working on has hydraulic fluid labels of L,C,R or 1,2,3 or G,B,Y - depending on what aircraft it is for. Left, Centre, Right is easy enough to figure out, but we were never sure about GBY and wondered if it was Green, Blue, Yellow. Looks like our guess was right.


Vincent, from said...

It's may be not so bad to look at the good old switches when you want to know their position... just to be sure you're checking the correct one.

The fact that the aircraft disappeared from radar displays raises an old question: shall ATC maintain primary radar coverage to ensure continuity in case of loss of transponder ? The situation is not the same from one country to another. Given the cost of primary radar, it's a tricky one.

industrial equipment said...

Complex control systems using valves requires an automatic control based input of an actuator. The actuator strokes the valve allowing the valve to be positioned accurately and allowing control over a variety of requirements.

Richard Bendaris said...

before taking any flight off..we should check the ATc system, as I guess as student of "electrical courses" from

Wayne Farmer said...

What's the current status of this problem? The EASA and the FAA seem to disagree on the proper solution.

Here's what I found doing Google searches:

(1) On 29 June 2009, EASA did issue a PAD 09-086, "Notification of a Proposal to issue an Airworthiness Directive", that would require:

"Within 36 months after the effective date of this AD, modify the Electrical Power Distribution System in accordance with the instructions of AIRBUS Service Bulletin (SB) A320-24-1120 Revision 2."


and the PDF it links to.

That service bulletin installs an function that will automatically switch in replacement power following an AC BUS1 failure, rather than require the pilots to switch it in manually.

(2) On 23 January 2009, the FAA issued an Airworthiness Directive that took a more conservative approach, requiring that:

"Unless already done, within 42 months after the effective date of this AD: Modify the electrical supply logic of the under glare shield flood lighting in accordance with the instructions given in Airbus Mandatory Service Bulletin A320-33-1057, Revision 01, dated January 31, 2008."


(The EASA had already required the above in an earlier Airworthiness Directive, AD 2007-0286.)

In the FAA reference, you can see that NWA requested to be allowed to do the EASA's A320-24-1120 fix instead, but was denied that by the FAA, which stated, in part:

"We agree that accomplishing the modification specified in Airbus Service Bulletin A320-33-1057, dated May 11, 2007; or Airbus Mandatory Service Bulletin A320-33-1057, Revision 01, dated January 31, 2008; does not address the root cause of the problem or alleviate all other operational problems related to the AC BUS 1 failures. We have not determined the root cause for loss of first officer displays following failure of AC BUS 1, but we know the root cause of this failure condition is not addressed by accomplishing Airbus Service Bulletin A320-24-1120, Revision 01, dated December 19, 2007. [,,,] In light of these factors, we may consider further rulemaking related to Airbus Service Bulletin A320-24-1120, Revision 01, dated December 19, 2007, in the future. We have made no change to the AD in this regard."

So, the EASA action will have all jets modified in 36 months to do an automatic power switchover, but the FAA action will have all jets modified in 42 months to not do an automatic power switchover, but just ensure the standby instruments are illuminated.

For passengers traveling within the US on carriers that also fly to Europe, does the EASA action affect aircraft that don't fly overseas? (e.g. NWA A319 aircract)

Wayne Farmer said...

Just found out that with its 3600 nm range, an A319 can fly from the US to Europe. Didn't expect that.