| Author |
Topic: NTSB and Rudders |
|
|
PickyPerkins
Still just
another number
|
posted 30th
August 2002 15:05
   
Re: NTSB and Rudders
--------- Start of quotes ----------
Wsherif1, posted 28th July 2002 :... The 200+
mph force of the rotating vortices striking the
FIN, (vertical stabilizer and the rudder),
BROADSIDE resulted in an INSTANTANEOUS left YAW!
…….
Wsherif1, posted 2nd August 2002 NTSB
and Rudders: The F Meter When the vertical
stabilizer and the rudder were struck broadside by
the forces of the 747's clockwise rotating
vortices the resulting instantaneous yaw maneuver
was initiated before the pilot had a chance to
react to what would have been erroneous flight
instrument indications anyway. The pilots were
just along for the ride!
Wsherif1, posted
4th August 2002 …. Dr. AA Wray of NASA affirms
that in smooth air aircraft wake turbulence can
persist for extended periods of time. I had a
severe wake turbulence encounter 45 miles behind
another 707, in smooth air! …
--------- End
quotes ----------
I have been
thinking on and off over the past month about the
above posts and the various responses from Wino,
Stator Vane, and Belgique, and finally got around
to wondering what would happen with a much LOWER
vortex X-wind than 200 mph, like maybe 100 kts.
I should start by saying that I am NOT a
commercial pilot, and have NO training or
qualifications in aerodynamics or aircraft
structures, and that this post is really an
attempt to encourage people who really know their
stuff into following a train of thought and
providing guidance to the rest of us.
The
train of thought goes as follows: AW&ST
published a diagram (on p. 25, AW&ST for Jan
21, 2002) showing the results of their
calculations of how the side forces on the
fin/rudder of an A300-600 varies with sideslip
angle at 250 kts. One of the three curves in that
diagram was for a centered rudder. It showed that
the fin/rudder design strength limit is reached at
a sideslip angle of 10 degrees, and that the
design ultimate limit is reached with a sideslip
angle of 15 degrees. I have plotted these results
in a different form in Fig. 1 below.
Since
the a/c cannot be held in a sideslip on a fixed
heading with the rudder centered, AW&ST
assumed that the sideslip was established using
the rudder and other controls, and then the rudder
was suddenly centered. At a maximum of 39
degrees/sec, this might be done on an A300 rudder
in less than half a second.
Now suppose
instead of sideslipping, you fly along normally on
a fixed heading and with the rudder centered, and
then you suddenly meet a wake vortex which
effectively provides a X-wind. To the a/c this
feels like it was initially flying along normally
and then suddenly it is flying at a yaw angle due
to the vortex X-wind, as shown on the right in
Fig. 2. The relative wind comes at an angle to the
nose and is the vector sum of the speed of the
plane, S, and the speed of the vortex X-wind, X.
In both Figs. 1 and 2, S=250 kts. The calculated
stresses on the a/c for a given sideslip angle are
as shown in Fig.1. While a sideslip is not the
same as a yaw, and neither can be held at a
constant heading with the rudder centered, I am
going to assume for the purposes of this
discussion that that the forces on the fin are
roughly equivalent for similar sideslip/yaw
angles. If this is accepted, then Fig. 1 can be
re-drawn in terms of “Angle of Relative Wind Off
the Nose” and “X-wind” as shown in Fig. 2.
Fig.2 indicates that the fin/rudder design
strength limit is reached at a sudden X-wind speed
of about 44 kts, and the design ultimate limit is
reached at a sudden X-wind speed of about 66 kts.
A lot less than 200 mph.
A possibly
interesting aspect of all this is that a vortex
X-wind speed of 200 mph MIGHT be LESS stressful
because relative wind would then be at an angle of
35 degrees, at which angle-of-attack the
coefficient of lift might be much lower than at
10-15 degrees, and consequently the force might be
LOWER than at a LOWER X-wind speed.
Now
what happens if the a/c is flying along normally
(fixed heading, rudder centered, and no yaw) and
then it suddenly meets a wake vortex X-wind speed
of, say, 60 kts (i.e. where the stresses on the
a/c are more than design but less than ultimate),
and the pilot has NO TIME TO REACT? The a/c is
aerodynamically in a yaw, but the autopilot and
yaw dampers, being gyro-based, think the a/c is
flying straight and level, so they initially do
nothing, and the rudder initially remains
centered. One of the quotes above says that the
X-wind will start a yaw and roll by direct action
on the fin/rudder, which I assume the autopilot
and yaw-damper will then try to counter. The
numbers in the AW&ST diagram referred to above
for cases where the rudder is not centered (not
shown in Figs. 1 or 2) suggest that if the angle
the rudder then turns through is equal to or less
than the angle that the plane turns through (as
might be expected of a gyro-based correction
system), then the net result will be a DECREASE in
the stress on the fin/rudder. So the autopilot/yaw
damper response should NOT be an additional
hazard.
To summarize this (possibly
erroneous) train of thought:
(a) It looks
from the AW&ST calculations that a wake vortex
X-wind of about 66 kts would stress the fin/rudder
to its design ultimate stress (at which level the
fin/rudder might deform permanently, but it should
NOT immediately detach). The AW&ST article
says that the FAA requires that the aircraft must
be able to withstand the ultimate limit stress for
three seconds, permanent distortion being allowed.
However, I assume that a X-wind of 100 kts. might
result in a different outcome.
(b) The
responses of the auto-pilot yaw-damper combination
at X-wind speeds of 66 kts. or less are likely to
immediately lower the stresses on the fin/rudder.
(c) I cannot even guess what a 200 mph
X-wind would do, because that corresponds to a 35
degree yaw, at which angle of attack the
fin/rudder coefficient of lift might be lower than
at 10-15 degrees, and the forces might therefore
be LOWER than at a LOWER X-wind velocity.  And, of course, the
vortex wind might not be a direct X-wind, but come
at an angle other than 90 degrees.
To
repeat my initial note, I am NOT a commercial
pilot, and have NO training or qualifications in
aerodynamics or aircraft structures. This post is
an invitation to people who really know their
stuff to follow a train of thought and respond
with correction, amplification, confirmation, or
whatever they may feel is appropriate.
Meanwhile, I think I will temporarily
retire into my underground bunker ……….. 
[Last
edited by PickyPerkins on 30th August 2002 at
18:13]
 Posts: 31 |
From: 40N, 80W | Registered: Jul
2002 | Status: Offline | IP: Logged
| |
Belgique
Still just
another number
|
posted 30th
August 2002 23:11
Picky
Sort of "responded to" here - rather than
answered.
Bit lengthy as a Pprune thread
(and don't want to upset the moderators) - so it's
elsewhere.
Belgique
Posts: 51 |
From: Obvious | Registered: Mar 2000
| Status: Online! | IP: Logged
| |
|
|
|
|
arcniz
Still just
another number
|
posted 31st
August 2002 18:48
Pehr Hallberg says:
quote:
A computer doing some useful job is obviously
some hardware with some specialized software
together performing the job. I have seen in the
Telecom industry for instance several examples
where the redundancy is on the hardware side but
where you run the same software in both sets of
hardware. This protects against hardware failure
but if the software fails both computers fail in
the same way.
I disagree. A couple of points
here:
a) To achieve any tough degree of
reliability and fail-soft capability with computer
controls, one needs to work them in groups of
three. With only two, any discrepancy leads to an
argument and possible deadlock; with three, they
can take a vote, cut out the oddfellow, and ring
some bells to escalate alarm about the new
condition of degraded redundancy. If three is
good, 'many' sometimes can be better.
b)
Much can be done - in design - to prevent the
problem you point to - where 'everybody is wrong'.
Sometimes the best answer is to 'fail' the system
momentarily and recycle it to a new self-aware
configuration. Also helpful is judicious
allocation of 'gold bars' allocating authority.
c) As we all know, a lot of things can go
wrong in hardware and software. Reliability in
both is most commonly accomplished by detection of
abnormal performance and subsequent
reconfiguration to a (usually) more conservative
operating strategy. This works just as well with
'software' as 'hardware', yet it tends more often
to be omitted or done lightly in software because
the threshold cost for s/w changes is putatively
lower.
You seem to feel that hardware
fault detection is much more reliable than
software fault detection, but I disagree. If
similar design methods are used for software fault
detection and reconfiguration, the results can be
comparable to those of the best hardware, i.e.,
nearly perfect.
We have all seen computers
fail to perform correctly, but anecdotal evidence
is not the same as truth.
If the intent is
to have ultra-reliable systems and then they are
observed to fail, one must say that they have not
been designed / tested with sufficient care. This
is the binary equivalent of 'pilot error'.
Your telcom anecdote highlights a common
failure in 'duty of care'.
Just as it would be
irresponsible for an airline to put an unqualified
and untested pilot in charge of a passenger
transport, it is a management mistake to deploy
inadequately designed and / or inappropriate
technology in any critical application.
The only way to achieve true reliability
is .....Very
Carefully.
--------------------
all systems
will eventually fail - so buy an upgrade now and
then
Posts: 94 |
From: 38N | Registered: Sep 2001 |
Status: Offline | IP: Logged
| |
|
|
FDXmech
Just another
number
|
posted 1st
September 2002 01:56
As I work on the A300-600 on a daily basis,
I'm very interested in this topic.
I was
always aware of the design philosophy between the
Boeing ratio changer method of rudder travel
limiting versus Airbus's rudder pedal limiting
philosophy. Yet, until Wino brought to my
attention the potential (and with AA587, possibly
all too real) ramifications of limiting pedal
movement, I assumed the difference to be "six on
one hand, half dozen the other".
Yet the
more I learned of this pedal limiting design, with
its inherent progressive decrease in pedal force
coupled with a very short pedal travel as IAS
rises, I can only ask why was such a system
devised and more importantly, approved? What
benefit does this design bring?
I wanted
to see for myself the overall effect of this
system. This being possible by putting a single
air data computer in the self test mode, (via the
maintenance test panel behind the F/O's seat)
thereby increasing various air data driven
parameters.
I gently cycled the rudder
pedals and to my surprise, the resistance to
movement felt almost nonexistent, especially
noticeable with the short throw. IMO, any
assertion that a pilot would need to be heavy
footed to swing the rudder is a bit overstated.
Belgique: Do you have any opinion on this
system?
Posts: 1 |
From: KEWR | Registered: Nov 2001 |
Status: Offline | IP: Logged
| |
Lu
Zuckerman
Iconoclast
|
 posted 1st September
2002 02:53
Regarding the crash of the AA A-300 in
New York
To: arcniz
I am enclosing the
following in order to shed some light on how
Airbus and their vendors do business. I will state
that the information following deals with theA-310
and the A-320 but since the major players are
basically the same the A-300 can be tarred with
the same brush.
I worked as the senior
Reliability and Maintainability engineer on the
A-310. I worked on a consulting contract at
Liebherr Aerotechnik in Lindenberg, Germany.
Liebherr was the senior contractor in the design
of the secondary flight control system power
drives and actuators. They were also senior
contractor in the design of the flap / slat
computer which was designed and built by Marconi
in the UK. The integrating contractor was MBB-Erno
based in Bremen, Germany. The lead in the wing
design was BAe in Hatfield in the UK. Our
associate contractor in the design of the power
drives and the actuators was Lucas Aerospace in
Wolverhampton in the UK.
The story is
about to unfold and it is broken into several sub
stories.
1) During the tear down of a slat
actuator that had been used in test and
development I discovered a strange erosion
pattern. I referred it to our stress engineer and
he said it was stress corrosion. I placed the unit
under high power magnification and the strange
pattern turned out to be spark erosion. I could
not get the stress engineer to agree. I talked to
a senior design engineer and asked him to verify
the continuity of the installed system on the iron
bird. The check showed that the slat system was
not grounded to the iron bird, which meant that
when installed in the aircraft it would not be
bonded to the airframe. I contacted my counterpart
at Lucas and he found the same to be true for the
flaps. I brought this problem to the attention of
my department manager and he took it to the Vice
President and the senior project engineer. To
support my argument I had referenced an Airbus
technical directive (TDD 20 A 001) which addressed
Electrical Bonding, Lightning Strike Protection
and Electrostatic Discharge. Their argument
against my criticism of the design was two fold.
They stated that the TDD was not fully approved
and therefore did not apply to the A-310 design.
Although Airbus directed in the design
specification that any problems related to
Reliability, Maintainability and Safety had to be
brought to their attention it was Liebherrs’
position that if they brought it to the attention
of Airbus they would have to absorb the cost of
the design modification. They suggested that I
talk to MBB-Erno, which I did. Much to my surprise
they took the Liebherr position of not telling
Airbus as a means of avoiding the redesign costs.
I then took the problem to Bae and they told me
that they were in sympathy with my problem but
they could do nothing about it. This is the
company that designed the wing and was responsible
for flight safety and ultimate certification.
According to the Airbus TDD the two most
frequent points of lightning attachment are the
nose which has strike diverters and a partially
extended slat. Should lightning hit the extended
slat it would arc to the outboard slat actuator
and into the wing structure. The way the A-310
wing is constructed the slat actuator jack screw
is retracted into the wing and it is separated by
a thin Titanium wall. On the other side of the
Titanium wall is the outboard fuel tank, which
will most likely explode when the arc occurs.
The clincher to this problem is that the
TDD was eventually approved and the problem of
non- electrical bonding would or, should have been
detected during final inspection of the aircraft
prior to flight-testing. The non-bonding of the
flaps is another story. According to Lucas
calculations the flaps would build up a static
charge of 800-1400 volts and as the flaps
retracted the voltage would arc to the wing skin
or the rear of the rear spar.
2) Airbus
and JAR / FAA requirements dictate that an
uncommanded operation of the flaps or slats should
occur no more frequently than 1 10 9 or one time
in a billion hours for the fleet. In performing
the Failure modes Effects Analysis (FMEA) for the
Flap and Slat Power Control Units (PCU) it was
determined that if an internal leak that bypassed
the control solenoids on the PCUs it could cause
an uncommanded operation of the flaps or the slats
depending on which PCU developed the crack. The
problem was that a similar crack could also occur
that would cause faulty operation of the PCU or it
could result in a loss of a single hydraulic
system. The predicted occurrence of this type of
crack is .1 10 6 or, one time in 10 million hours
of fleet operation. We were forced to show that
the crack occurrence was 1 10 9 and not .1 10 6
which is the difference between 10,000,000 hours
and 1,000,000,000 hours which was not realistic.
We ended up doing it over my objections in order
to show we met the safety requirements dictated by
the certification authorities.
During the
life cycle testing of the slat system Liebherr
encountered a runaway slat system and the flap
slat computer was not only unable to detect it was
unable to stop it. This would be a minor problem
on the slat system regarding uncommanded
extension, as the air loads at cruise would keep
them retracted. However if it occurred on the slat
system causing an uncommanded retraction during
takeoff it could cause major or catastrophic
problems. The same is true if it happened on the
flap system. Again Liebherr was required to notify
Airbus about the runaway as well as the computer
being oblivious to the problem. They didn’t notify
Airbus. Instead, they contacted Lufthansa and
Swiss Air, which had 17 Airbus A-310s in service.
Liebherr made a quick fix and told the operators
to notify them when they had an aircraft on ground
over night and Liebherr would install a “more
reliable” designed PCU at no cost. When Liebherr
encountered the problem the accelerated test had
about 1800 hours of operation and the operating
aircraft were fast approaching that number.
3) The flap slat computer was designed and
built by Marconi. I had several encounters with
Marconi on other programs and I found them
extremely difficult to deal with. The same was
true for the A-310 program. Per Airbus program
requirements I directed Marconi to analyze the
failure of every piece part in the computer and
indicate how the failure manifested itself when
the part failed. Marconi replied that it would be
too expensive to do that so instead they just
indicated the failure rate of each part and
combined it in order to show the total failure
rate for the computer. This proved to be totally
insufficient to meet the Airbus requirements, as
it did not reflect a true FMEA.
Marconi
had a running battle with Lucas Aerospace accusing
them of robbing trade secrets and stealing their
top designers. Lucas like Liebherr constructed an
iron bird to test and develop the flap drive
system. Marconi provided Liebherr a complete brass
board of the computer that had the total
capability to control the slat system and diagnose
any system problems. Despite this requirement the
computer was unable to respond to the runaway slat
system on the Liebherr iron bird. Instead of
providing Lucas with a similar brassboard computer
they provide one lane of the computer or 1/4th of
the computer. This allowed the extension and
retraction of the flap system without having any
diagnostic capability. Without this diagnostic
capability Lucas could not adequately test the
system and therefore, they could not certify the
system. The system ultimately received
certification although it was not properly tested.
On the first revenue flight for Lufthansa
they flew from Frankfurt to Cairo. Upon landing
the pilots could not retract the flaps. No one
including the computer was able to diagnose the
problem and the computer did not recognize that a
problem had occurred. The aircraft was returned to
Frankfurt in non-revenue service with the flaps
fully extended. Upon its’ return the same
situation existed. Nobody could figure out what
was wrong. The flaps were mechanically
disconnected and hand cranked in. The system was
reconnected and everything worked OK.
Marconi also stated that on the A-320 when
Lucas was going to be the lead design contractor
Marconi would not work with them and most likely
not bid on the contract. I do not know if they
followed through with their threat.
4) I
concluded that I had done everything possible to
bring the problems to the attention of everyone in
the chain of command with the exception of Airbus
and to do so would place my position in jeopardy.
After leaving that consulting position I went to
another in Italy on helicopters. While on that
assignment I discovered that the A-310 had been
certificated in the USA. I sent a letter to the
FAA explaining everything. Two months later I
received a letter thanking me and telling me that
they would bring the problem to the attention of
the DGCA. Four months later I received a letter
from the FAA stating that the DGCA had indicated
that the problems were corrected. I contacted a
friend still at Liebherr and he said that nothing
had changed. I sent a more forceful letter to the
FAA stating that I had absolved myself of any
responsibility and if something happened they
could be brought into any litigation resulting
from a crash. They eventually took action and the
Vice President and the senior program manager were
fired but nothing was done to correct the design.
All of the problems I described above are waiting
in the wings (pun intended) and will manifest
themselves sometime in the future. It should be
noted that an A-320 from Air Canada suffered an
uncommanded retraction of the flaps during takeoff
and the computer could not stop it.
4) On
December 17, 1997 Airbus Industrie issued
Airworthiness Directive 90-092-109(B)R3 which
dealt with the inspection of the Vespel Bushes in
the Flap / Slat Transmission-Universal Joint
Assemblies. One of the checks was to determine if
there was electrical continuity in the bushes they
were to be replaced if continuity was discovered.
When the system was designed the bushes which were
called Rose Bushes were impregnated with carbon to
make them electrically conductive. I do not
believe the design was changed to remove the Rose
Bushes. What I do believe is that the English
translation got it wrong. I contacted the DGCA,
the FAA and the Canadian MOT and never got any
feedback on the possibility of a mis-translation.
I contacted both the FAA and the Canadian MOT
telling them that their respective versions of the
Airbus AD were not in agreement and that their
respective translations from the French original
might be wrong. I also contacted the DGCA telling
them that there was a possibility that the two
translations were not correct. I never heard from
any of them regarding this potential conflict.
To: arcniz
I
had to delete this part of my post above in order
to comply with the maximum character requirements
for posts.
I have been banned from
Rotorheads for speaking the truth, which was
interpreted as libel by the moderators. The
following is 100% true and I can back everything
up as being true. You speak of reliability as if
it were some means of assuring that airplanes are
safe. The following will show you how reliability
really works in the aircraft industry. I was going
to disguise the names of the participants but
since my statements are already entered into the
files of the FAA, the DGCA and the LBA and the RAI
I’ll let it stand. I\'ll wait to see if the
moderators agree.
--------------------
Full time
R&M Engineer. Part time Troll
[Last
edited by Lu Zuckerman on 1st September 2002 at
03:18]
Posts: 685 |
From: Pincourt, Quebec | Registered: Sep
2000 | Status: Offline | IP: Logged
| |
Wino
Union
Goon
|
posted 1st
September 2002 05:21
FDXmech
While some other older
aircraft use the blocker system (notably the md80
and the 727) they are used in conjunction with
reducing the hydraulic pressure from 3000 psi to
800 psi. Thereby limiting your ability to do
damage, and making the sensitivity somewhat
constant.
The A300-605R A320 A330 and A340
all use a blocker system and maintain 3000 psi at
all times. Indeed the A300 tail is not mass
balanced and is prevented from fluttering by
constant hydraulic pressure of 3000 psi.
If Sten stepped lightly on one rudder to
assist in roll he would have gone to the floor at
250 knots and not known how he got there. If he
tried to correct he would have almost instantly
hit the other stop. I doubt he would have reversed
again, but then Ed might have tried to put in a
rudder input. very quickly you get 4 throws of the
rudder right there.
The A300-605R rudder
system is DANGEROUS at 250 knots. The tail is
incapable of withstanding the stress, and the
controls are trap for a POI. The A300 B4 with its
ratio rudder load limiter was a much better
design.
The blocker system is much simpler
to implement than a complicated ratio changer
system. However without the additional safety of
de-powering the rudder it is a menace. The
composite design of the rudder and vertical stab
do not allow the rudder to be de-powered as the
hydraulics are used to balance the rudder. So
Airbus cut a corner and 265 people are dead. I
expect that out of this accident there will be a
short term fix of limiting the throw of the rudder
further (probably forcing an engine de-rate as a
result) and a long term fix of requiring rudder
load limiters to be of the ratio type or if a
blocker is used it is used in conjunction with
de-powering the rudder.
Cheers
Wino
[Last
edited by Wino on 1st September 2002 at
05:25]
Posts: 634 |
From: New Jersey, USA | Registered: Feb
2000 | Status: Offline | IP: Logged
| | |
