4
$\begingroup$

Then have been three incidents (UAL232, JAL123 and DHL 00-DLL) where damage to an aircraft resulted in complete loss of hydraulics. Only one of them managed to make it down safely using differential thrust. Each plane was from a different manufacturer. All three aircraft had triple or quadruple redundant systems. This seems like plenty of redundancy, but the Achilles heel is that, regardless of how the systems are piped around the aircraft they all have to converge at each of the control surfaces.

My question is why did damage in one part of each hydraulic system result in loss of the entire system? For example in the DHL incident the left wingtip was damaged with all three lines. Is there not a way to isolate that wing and cut off hydraulic flow to protect the integrity of the rest of the system? You would lose control surfaces on that wing, but still have elevator, rudder and the other wing. Do any aircraft have a way of preventing this?

|improve this question
$\endgroup$
8
$\begingroup$

There is no general answer, but the closest one would be bad luck.

In the DC-10-10, the aircraft of UAL232, all three hydraulic lines went through one hole in the tail bulkhead which was damaged when the engine failed. This is no real redundancy, and it was bad luck that this particular spot had been hit.

In the Lockheed Tristar, the same accident would had damaged probably just one line. There, the three hydraulic lines are separated as much as possible in the tail section (one on top, one on the left side and one of the right side of the fuselage). Lockheed has more experience with military design than Douglas, so the Lockheed engineers were more aware of redundancy issues.

In the A300 involved in the Baghdad attempted shoot-down incident, the same bad luck happened. Normally, each aileron is powered by two out of three hydraulic circuits, so one would remain if the other two are hit. Note that the green and yellow circuits were lost immediately, while the blue circuit failed only 20 seconds later. But in this case the damage extended to the spoilers, so all three circuits were affected in the end. There is only so much damage you can protect against.

Also for JAL123 the damage was just too extensive to not involve all four hydraulic circuits. The rear pressure bulkhead burst and blew most of the vertical tail surface away. It can be argued that the real culprit, however, was the chief pilot's refusal to don his oxygen mask. But the aircraft was only marginally stable and very hard to control.

Hydraulic fluid needs to be pumped continuously to heat it so its viscosity stays low. If you add shutoff valves, this pumping could be impeded. Note that the spoilers of the Baghdad A300 were not sucked open because non-return valves blocked the lines to the spoilers, helping in keeping the aircraft flyable.

If you put shutoff valves along the hydraulic lines, you open up a new avenue for failures. The idea of hydraulics is that you use just one pump and can create the maximum force at any point, since rarely would you need to move several actuators at maximum load in parallel. Splitting up the circuitry to enable the pilot to isolate parts of the airplane will take away this advantage, resulting in a more complex, heavier hydraulic system. And who knows if those added parts would not malfunction or be mishandled, resulting in a new class of entirely avoidable accidents.

|improve this answer
$\endgroup$
  • $\begingroup$ +1 and I think the last sentence is crucial. You increase safety by designing new safety measures only until these new stuff's failure is more problematic than whatever you had before. $\endgroup$ – yo' Oct 1 '15 at 11:39
  • $\begingroup$ <pre>The idea of hydraulics is that you use just one pump<code> does this mean there's only one pump for all lines or one pump for each system (blue, green, yellow)? $\endgroup$ – TomMcW Oct 2 '15 at 18:10
  • $\begingroup$ Would it be possible, especially on 4 system designs, to have one system not go to all control surfaces? For example, say yellow system goes everywhere except the left wing. Green system does not go to the tail section. That way you still have triple redundancy to each area, but if you get damage on the left wing, like DHL, you lose all systems * except* for yellow. You would lose control to the left wing but you would still have one system to the rest of the plane. $\endgroup$ – TomMcW Oct 2 '15 at 18:37
  • $\begingroup$ @TomMcW As a general rule, the flight controls are the most crucial, hydraulically-powered things on the aircraft. So you may have multiple hydraulic systems, powering different things, but ALL of them power the flight controls, in the hopes that losing some systems still leave you with functioning flight controls. The F-16 has two, separate hydraulic systems. Both power the flight controls. Damage to one means the flight controls still work, even if the other systems have problems. Separate pumps, separate lines, routed separately. But some things you just can't plan around, like JAL123 $\endgroup$ – Meower68 Mar 23 '18 at 14:42
  • 1
    $\begingroup$ @Sean: Also in the tail? So far, I thought that there were only three lines leading to the tail surfaces. Please help me with the details! $\endgroup$ – Peter Kämpf Mar 14 '19 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.