Answer |
| Background In a normal aircraft an emergency power configuration would result from a rotary switch selection of just that (with a decal saying "EMERGENCY BUS"). In fact, if I recall correctly, in the old SP2H Neptune it was labelled as that. It provided DC and AC from rotary inverters (vice AC GEN). You had a chart from which to extract remaining batt life in different configurations. As far as I recall, it was impossible to power certain non-essential items off it (such as CWHomer, Tactical displays, sonobuoy Bearing indicators etc). You couldn't crank start the jets but you could open the jet doors and derive enough ergs to windmill light-off. However the jet throttles were electric and weren't to be moved (recommendation). No two aircraft have the same design philosophies. Frequently, in much modified airframes, the design was a flagrant compromise and just developed (or grew like Topsy). Not so with the MD11. It was electronically developed from the DC10 with a specific exclusion of the third crew member in mind. It always stuck in my mind that Hiltebrand, Swissair Chief Pilot, was so horrified at the investigator's suggestion that SR111 had suffered a "total electrics". As you can see from the following outline (see below) of the functions of the Smoke/Elec/Air switch it just swaps around configurations looking for a benign one. It never permanently removes power off circuits because its philosophy was simply to cut out faulty aircon packs, generators and bleed air sources (and their associated circuitry). It never entertained a loss of all generators including the ADG, nor any circumstance in which the wiring would be a common denominator affecting any position selection of that critical switch. Gerden has said as much in one of his Press Releases. I'd doubt very much that it is as you said, i.e. that once down to batt power they are on virgin wire. I would suggest that if all GENS were tripped the BATT is simply left to face the music and assume the load (under the MD11 design philosophy that simply refused to entertain total loss of generating sources). I would also doubt if that circumstance would give rise to any automatic monitoring off of excessive loads - simply because it was never in their remit to design for a circumstance in which the aircraft would suffer manifold (supposedly unrelated?) failures and couldn't continue to fly. i.e. There is an EMERG Bus but there is no selection provision for that bus. I also doubt that it was possible to switch off all GENS. If we look at a few more clues before I come to my conclusion:
a. 10:22:39 The Skipper calmly asked the F/O if he was in the aircon checklist (no real panic at that stage, they'd just turned away from Halifax to dump). At this stage they'd had the oxy masks on for about 6 mins, they'd been smelling the smell for 12 minutes and the F/O had lifted the hatch to check the E/E Bay. The DFDR discloses that they had assumed an airconditioning problem and had spent some time pageing through the aircon schematics on the synoptics screen before running that checklist. b. Shortly after, 10:24:15 smoke worsening, the first Smoke/Elec/Air selection of 3/1 OFF was made (i.e. GEN 3 & AC BUS THREE OFF). This tripped the autopilot (warbler heard in the background of a transmission). However another autopilot selection should be available, even until the IRS fails 15 mins into battery power only. Up to this point, the tail tank is directly feeding the #2 engine via the #2 engine tail-tank pump, powered by Right Emer AC. However, Right Emer AC & DC Bus are also killed by a 3/1 OFF selection and #2 engine fuel is therefore now being fuel-fed only by the transfer pumps (various busses). Because neither smoke nor smell of an active fire dissipates quickly the F/O felt compelled to make another selection (brilliant checklist philosophy and design / brilliant switch design with its multiplicity of connections and lame-brained functions).
c. When the F/O next selected (i.e.2/3 OFF), as I understand it, they were then onto BUSSES One and Three and went from Gens 2 & 1 to Gens 1 & 3. i.e. Because the problem was IFE related on Bus Two he'd thereby effectively quelled the situation for a few moments. However, because neither smoke nor smell dissipates quickly (and fire had taken hold of insulation blankets) he felt compelled to make another selection (brilliant checklist philosophy and design/brilliant switch design with its multiplicity of connections and lame-brained functions). d. By selecting ½ OFF He had reselected the IFE's Bus (AC2 with the rapidly worsening elec fault/fire). The checklist has a NOTE: (not a Caution or WARNING) that: " Emergency power transfer is inhibited with Smk/Elec/Air Selector in the ½ OFF position". Up to this point the #2 tail engine pump was being powered by the transfer pumps but fuel-feed was supposed to switch to #2 Tail pump on Right Emer AC bus. If the #2 Engine flameout occurred at this point (because of the failure to switch back - bus-tie sensing relay again), the result may well have been that Generator 2 couldn't come on line. Because the #2 GEN didn't come on line all loads then automatically transferred (by bus-tie sensing relay) to GEN #1 (which promptly overload/underfreq tripped). The BATT was then being rapidly flattened by the massive Normal and shorting loads (or the BATT CB blew), all electrical and electronic Hell broke loose. The checklist has a warning that "the First Officer must be the Pilot Flying when the Smoke Switch is moved to the 1/2 OFF position." (i.e. Captain's displays will be OFF) However, the copilot next reported his Display Unit (Flight Insts) had failed. In short order everything then failed including the Captain's display, the DFDR and finally the CVR (lower drainage items last). #2 tail jet flamed out as the fuel pump’s power failed. That would have (momentarily until the caution panels and audio failed) Xmas-tree'd the cockpit and increased the pucker factor by tenfold.They would have then been in a darkened cockpit in their smoke-masks and headsets without any means of communicating with each other - because the intercom and radios and ALL lighting would also have failed. They were well on the way to (or instantly into) an unrecoverable unusual attitude (terminal for a heavy jet under 10,000ft) caused by total loss of attitude references.
d. I'm pretty sure that, if you allow a battery to flatten entirely (or trip its CB), you will not be able to reset a tripped generator. So, even if the F/O had gone on to another selection he would probably not have had any joy. I'm not sure about the MD11 ADG deployment (whether it's an electrical selection or, as per the DC10, mechanical via a lanyard).If the McDD designers are true to form it will have been electrical. However, once again I'm not sure whether, in the absence of any amps from a flat (shorted or BATT CB tripped) battery, the ADG gen would come on line. Modern generators, even though capable of self-excitation, are normally electronically monitored as they come on line because they have to be PROVEN to be socially acceptable before their output can soil the pure electricity required by modern avionics. If there's no batt power there's no monitoring and no on-line acceptance (IMHO). I'd be very interested as to whether the ADG was stowed or deployed when SR111 hit the water. I'd guess "stowed". Unfortunately, with electrics (in an electric jet), once things stop playing the game according to Hoyle you are in a world of hurt (and total confusion because it's literally beyond your experience and training). The MD11 was simply not designed for electrical cataclysms - yet that is precisely what happened. The failures were outside the parameters for which it was designed. That occurred courtesy of Kapton wiring, metallized mylar insulation, cost-cutting the third crewman, commercial pressure to incorporate the IFE, poorly designed smoke-masks and goggles and a critical smk/elec switch designed by Nero. Of course the smoke checklist design philosophy should get a mention - but at the end of the day the battle was lost because of an initial human failure setting off a chain of seemingly distinct (but actually concerted) events. A singular failure of a bus-tie relay switch provoked a very safety conscious airline into replacing all in the fleet. Perhaps "if it ain't broke don't fix it" has a lot to be said for it.
The raison d'etre of the bus-tie sensing relay is for it to be the auto-switching terminus for all the power, - so obviously it would be the first port of call for any misdirected shorting volts. Conversely if its installation is "murphied" and a short happens after "power on" to the newly installed item, the resulting damage is simply a function of whimsy (i.e. a madman can depart a bus terminus in any direction). In similar fashion, a bus-tie sensing relay is so epicentric to the whole system (and the smoke/elec switch) that any fault with it should have given rise to a major maintenance checkout of the whole electrical system. As we now know, it didn't - and it was probably the beginning of the rot (good old "ground-checked serviceable" - I wonder if all engines and systems were turned up for that particular write-up). Without all systems and Gens operating I don't see how anybody can write up something such as a bus-tie sensing relay as serviceable. The deadly clincher was probably a full first and business class all turning on their IFE's about an hour out (as boredom struck).
It may well be that I'm way off beam here. There may well be a load protection device in circuit that stops excessive loads being placed upon the batteries. However those devices are also liable to disruption by being shorted out and BATT CB's can blow. It may be that AC Generators can come on line irregardless of BATT health. It may well prove to be the chafing damage to the wiring caused by the in-ceiling movements of both port and starboard front doors that started the electrical fire. One is really whistling in the dark, not being privy to the actual circuitry design and specs. You can only surmise that, if 15 minutes of essentialities were supposed to be available, they were and something else (such as a worsening fire) caused the rapid conclusion. However, in that case I'm sure a few further words would have been said on R/T. The evidence of the CVR/DFDR and transponder cutting out points to a massive crash of the electrical system and that would tend to support my theory. Melting aluminium takes a lot out of a battery. If any-one would like to pick holes in my latest version of likely events, feel free. |
