Why could these aircraft not prevent total hydraulic failure?

Question

Then have been three incidents (UAL232, JAL123 and DHL 00-DLL) where damage to an aircraft resulted in complete loss of hydraulics. Only one of them managed to make it down safely using differential thrust. Each plane was from a different manufacturer. All three aircraft had triple or quadruple redundant systems. This seems like plenty of redundancy, but the Achilles heel is that, regardless of how the systems are piped around the aircraft they all have to converge at each of the control surfaces.

My question is why did damage in one part of each hydraulic system result in loss of the entire system? For example in the DHL incident the left wingtip was damaged with all three lines. Is there not a way to isolate that wing and cut off hydraulic flow to protect the integrity of the rest of the system? You would lose control surfaces on that wing, but still have elevator, rudder and the other wing. Do any aircraft have a way of preventing this?

Answer 1

There is no general answer, but the closest one would be bad luck.

In the DC-10-10, the aircraft of UAL232, all three hydraulic lines went through one hole in the tail bulkhead which was damaged when the engine failed. This is no real redundancy, and it was bad luck that this particular spot had been hit.

In the Lockheed Tristar, the same accident would had damaged probably just one line. There, the three hydraulic lines are separated as much as possible in the tail section (one on top, one on the left side and one of the right side of the fuselage). Lockheed has more experience with military design than Douglas, so the Lockheed engineers were more aware of redundancy issues.

In the A300 involved in the Baghdad attempted shoot-down incident, the same bad luck happened. Normally, each aileron is powered by two out of three hydraulic circuits, so one would remain if the other two are hit. Note that the green and yellow circuits were lost immediately, while the blue circuit failed only 20 seconds later. But in this case the damage extended to the spoilers, so all three circuits were affected in the end. There is only so much damage you can protect against.

Also for JAL123 the damage was just too extensive to not involve all four hydraulic circuits. The rear pressure bulkhead burst and blew most of the vertical tail surface away. It can be argued that the real culprit, however, was the chief pilot's refusal to don his oxygen mask. But the aircraft was only marginally stable and very hard to control.

Hydraulic fluid needs to be pumped continuously to heat it so its viscosity stays low. If you add shutoff valves, this pumping could be impeded. Note that the spoilers of the Baghdad A300 were not sucked open because non-return valves blocked the lines to the spoilers, helping in keeping the aircraft flyable.

If you put shutoff valves along the hydraulic lines, you open up a new avenue for failures. The idea of hydraulics is that you use just one pump and can create the maximum force at any point, since rarely would you need to move several actuators at maximum load in parallel. Splitting up the circuitry to enable the pilot to isolate parts of the airplane will take away this advantage, resulting in a more complex, heavier hydraulic system. And who knows if those added parts would not malfunction or be mishandled, resulting in a new class of entirely avoidable accidents.