The Aircraft Accident Investigation Bureau's damage inventory records cracked ceiling panels across at least a dozen rows, two overhead bin doors dislodged from their hinges, broken handrails, a broken emergency exit handle, a bent crew seat and a lavatory commode uprooted from its mounting.
A 664-foot change in height is not unusual. An aircraft descending can lose that much altitude in under a minute. What made the AI2379 incident different was the speed of the change and the fact that the aircraft climbed before descending. Passengers who were not strapped in were lifted from their seats and then thrown into the ceiling.
While that was Panicker's reading, the AAIB's preliminary report, released on Friday, describes what the recorders captured. At 04:02:43 UTC, the flight-control system detected the loss of the green hydraulic system. Four seconds later, it detected the loss of the blue and yellow systems. The autopilot disconnected one second after that. The blue system returned at 04:02:52, with yellow and green following within seconds.
A hydraulic system uses pressurised fluid to multiply force. A small movement of the pilot's controls is converted into enough power to move heavy components that resist being moved. On an aircraft in cruise, the airflow over the wings and tail is far too strong for a person to push a control surface against.
Fluid held at about 3,000 pounds per square inch is pumped through sealed circuits to jacks that provide that force. On the Airbus A320, the systems also drive the landing gear, brakes and wing flaps. Without hydraulic pressure, none of them can be moved.
An Airbus A320 has three hydraulic systems, and that number is how the manufacturer meets certification rules.
Airworthiness rules in Europe and the United States require that a failure severe enough to be catastrophic must be, in the regulator's phrase, extremely improbable. The US Federal Aviation Administration puts that probability at roughly one in a billion per flight hour. Such a failure must also not be capable of arising from any single failure.
No component is that reliable. The number is reached through multiplication. If one hydraulic system might fail once in a thousand flight hours, three of them failing together works out to one in a billion, but only if the three failures are unrelated to one another.
The A320's three systems are therefore kept apart by design. Each has its own reservoir, and hydraulic fluid is never transferred between them. Green is pressurised by a pump on the left engine, yellow by a pump on the right engine, and blue by an electric pump.
Each elevator and each aileron is driven by two jacks fed from different systems, so that losing one circuit still leaves the surface powered. The design is based on the expectation that no single problem can reach all three systems.
That expectation has been breached before, in cases that are among the most closely studied in aviation.
In July 1989, a fan disc on the tail-mounted engine of a United Airlines DC-10 came apart over Iowa. The debris cut all three hydraulic lines where they converged in the tail. The crew flew the aircraft to Sioux City using engine thrust alone.
In August 1985, a Japan Air Lines Boeing 747's rear pressure bulkhead ruptured, taking much of the vertical fin with it and severing all four hydraulic systems.
In November 2003, a missile struck the wing of a DHL A300 climbing out of Baghdad, and fire and damage cost the crew all three systems. They landed on differential thrust with no injuries.
Each of these incidents defeated redundancy through the same mechanism. A single physical event reached lines that were separate by design but close together in the airframe. Investigators could point to the disc, the bulkhead and the missile, and in each case the systems remained lost.
Manufacturers and regulators responded. Hydraulic routing was separated further and fitted with fuses. Later aircraft were designed so that no single uncontained engine failure could sever more than one system.
No such physical event occurred to VT-EXO. Nothing broke apart, ruptured or struck the airframe. The AAIB records that neither the crew nor air traffic control reported adverse weather. The aircraft continued to Delhi under its own power and taxied to the bay.
The blue system returned within nine seconds of the first indication, while the other two followed within seconds. Hydraulic fluid that has been lost does not return.
The absence of a physical cause, combined with full recovery within seconds, makes the event difficult to place. On the publicly available record of accident investigations, there does not appear to be a close precedent on the A320 family or on any comparable modern airliner. Several pilots have described it as extremely rare. Whether it is unprecedented is not known because a manufacturer's own service history is not public.
Airbus's own early assessment of the event, reported by Reuters on August 14, is more specific.
During the sequence, according to that assessment, the pilots were unable to use the elevators and ailerons for about four seconds, while the co-pilot's full nose-down input drew no direct response. Airbus asked Air India to test the hydraulic systems and the pressure sensors and switches that monitor them, to remove some sensors for inspection, and said further checks of the wiring might be needed.
Sensors, switches and wiring are therefore among the components being examined alongside the hydraulic systems. On a fly-by-wire aircraft, a hydraulic system includes the chain of instruments that tells the flight-control computers what the pressure is, and those computers reconfigure the aircraft's handling based on what they are told.
A fly-by-wire aircraft is one in which the pilot's sidestick sends an electrical signal to a computer, which then decides how far to move the control surfaces, rather than being connected to them by cables.
Whether pressure was actually lost or only registered as lost is a distinction the investigation will have to settle. The autopilot disconnected one second after the second and third hydraulic systems were flagged, leaving the cause of the rapid altitude upset and simultaneous hydraulic indications at the centre of the investigation.
About The Author
.jpg)
Comment List