Loss in Indian Ocean has applications to commercial operations
With unreliable instruments and no horizon cues in the night sky, the crew ejected, according to an account of the December 2001 crash of a B-1 bomber appearing in the latest issue of Flying Safety. The U.S. Air Force Safety Center publishes the magazine. The article by Maj. Dan Baker recounts a progression of system losses that may bear on commercial aircraft engaged in extended-range operations (ETOPS):
“Shortly after [nighttime] takeoff from Diego Garcia … the aircrew experienced multiple systems failures which resulted in the loss of aircraft control and the aircrew ejecting from the aircraft. According to the Accident Investigation Board … the crew shut down the number one engine due to an oil over-temperature. The associated primary generator fell off-line normally during the engine shutdown. The crew decided to abort the mission and return to Diego Garcia.
“En route, the number two primary generator dropped off line, accompanied by loss of the … aircraft’s computer navigation complex. The pilot switched on the emergency generator, in accordance with the … emergency procedure for single generator operation. Shortly thereafter, the pilots determined [that] their primary and standby aircraft attitude [i.e., level flight, turning, climbing, etc.] information was unreliable.
“Though the weather at the cruise altitude of FL 200 was clear, there was no lunar illumination and neither pilot could discern the horizon. The OSO [offensive systems officer] and DSO [defensive systems officer] noted increasing uncommanded bank angle displays up to 120� accompanied by rapidly decreasing altitude and increasing airspeed, and advised the pilots. Passing 15,000 feet MSL, the OSO determined the aircraft was out of control and, in accordance with TechOrder guidance, ejected, followed quickly by the DSO … Convinced the aircraft was out of control and unrecoverable, the pilots ejected. The aircraft was destroyed upon impact with the water and sank. A U.S. Navy vessel in the area rescued all four crewmembers.
“After lengthy salvage operations, the aircraft was never located, and no parts of the aircraft were recovered.” (Reprinted with permission of Flying Safety magazine.)
To this account, a few interpretive comments may be in order. The cascading nature of the emergency as systems dropped out, culminating in the apparent loss of all attitude instruments left the crew with little choice but to eject. Swissair Flight 111 might have progressed along similar lines into its terminal impact with the water; more on that case when the Transportation Safety Board (TSB) of Canada releases its final report on the accident later this month (see ASW, March 3).
The original oil over-temperature warning may have been bogus, or an early manifestation of burgeoning electrical problems. But how to know? The crew probably was wearing oxygen masks, inhibiting somewhat the smell of smoke. The circumstances as presented suggest electrical arcing/fire in the left wing. It’s possible that the primary and standby attitude instruments were giving conflicting information. If the standby artificial horizon was correct, there is only a finite period in which that could be established. Once the main instruments are tumbling or toppling, they will not agree with the standby. And if the aircraft attitude itself is changing rapidly, so will the standby, leading to pilot confusion as to whether any displayed attitude is valid.
The case illustrates the need for “twinning” the primary and standby attitude systems. Early/immediate awareness of a primary or secondary instrument failure more often than not can help preclude development of an unusual attitude. Given the $300 million cost of the B-1, “twinning” would seem to be a ready solution to “early outs” by pilots confused by the dynamism of unwinding altimeters, spinning horizontal and vertical situation displays, controls at the stops, increasing G and airspeed, audio alarms, urgent intercom calls and the rising noise of rushing air. The sense of urgency would be heightened by the OSO’s precipitate departure.
The loss of this airplane may be an outstanding example of why electrical redundancy matters. In this case, the airplane was lost without loss of life. In similar circumstances an airliner with 200-300 people aboard would have been a total loss. Survivability should not depend on whether there is a pilot’s moon in the night sky.
Another experienced pilot in the Pacific, well familiar with ETOPS, offered a few salient observations. “This B-1 accident should be a ‘wake up’ call to any attempt to water down the present ETOPS maintenance and operational criteria. We already have the situation of the MMEL [master minimum equipment list] being changed for one manufacturer’s aircraft to allow dispatch with an unserviceable APU [auxiliary power unit].”
“It is a misconception to believe that the greatest threat to an ETOPS operation is an engine failure. The loss of a system(s) potentially has a far greater chance of impacting the flight,” he said. “Reliability and redundancy often are mixed up. The systems do not know that statistically they should not fail, and that a failure of one system should not be followed by a subsequent failure.”
“ETOPS has achieved a good record because the initial criteria were based on achieving an equivalent or better level of safety than three and four-engined aircraft at that time. This standard is being eroded,” he said.
As an example, he pointed out that Shemya is cited as a reasonable airport for diversion. “Yet most pilots who fly regularly across the Pacific know that the forecast often runs to many lines and that an approach with both (all) engines operating and normal systems working would be challenging,” he said.
If ETOPS standards continue to suffer from complacency and commercial pressure it may not be just a B-1 that ends up in the sea, he said.
For more on B-1 case, see http://www.zianet.com/tedmorris/dg/b1.html.
Twinning: the philosophy of closely juxtaposing critical flight instruments which are essentially there to back each other up (and so require ongoing cross-checking, since the failure of one to replicate the other’s movement should become the cause for instant concern). Examples include the altimeter and standby altimeter, and also the main attitude display – whether on primary flight director/electronic flight display (PFD/EFD) or not – and its backup/standby attitude instrument. Source: IASA