15
$\begingroup$

The 737 is practically the only civilian jetliner still in production1 to have provisions for flight-control manual reversion; in the event of a total failure of the A and B hydraulic systems, the 737’s elevators and ailerons are controlled by aerodynamic forces generated by servo tabs mechanically connected to the pilots’ control yokes (the input to these tabs is locked if hydraulic pressure is available in the A or B system; the locking mechanism requires hydraulic pressure, and disengages if pressure is lost in both systems, allowing the control tabs to be used to control the elevators and ailerons).

The 737’s rudder is a rather different beast. It has no control tabs, and has no significant manual-reversion capability;2 on the other hand, in addition to the A and B hydraulic systems, the rudder is connected to the standby hydraulic system, which, although not normally pressurised, can be manually activated by the pilots if necessary (and automatically engages in the event of an A or B hydraulic system failure during critical portions of takeoff or landing). Nevertheless, a failure severe enough to disable both the A and B hydraulic systems (such as an uncontained engine failure, major wing fire, or rudder separation) would have a good chance of also taking out the standby hydraulic system, which powers several of the same components as the other two hydraulic systems (namely, the rudder, thrust reversers, and leading-edge high-lift devices), and, thus, would be vulnerable to being disabled by a failure that also ruptured the A and/or B hydraulic lines serving those same components.

Even in the event of a total hydraulic failure, though, the elevators’ and ailerons’ manual-reversion capability would still keep the aircraft perfectly (if tiringly) flyable, since the rudder stands idle in normal flight, being used in the air only for countering the large yawing moments produced by an engine failure (especially at low airspeed)7, and engine failures are very rare nowadays...

...except that a destructive engine failure, combined with the failure of the engine cowling to contain the resulting debris,8 could easily be the cause of a multiple-hydraulic-system failure. For instance, an uncontained turbine rotor burst in the #1 engine would almost certainly rupture at least some part of the A system’s engine-driven hydraulic pump, would likely breach both the A and standby lines in the #1 thrust reverser, and could easily penetrate the B and standby lines powering the left wing’s leading-edge high-lift devices, leaving the aircraft with one engine and no hydraulics.9

In single-engine manual-reversion flight, the only way possible to counter the yawing moment produced by the asymmetric-thrust condition is to bank the aircraft towards the operative engine; the positive bank/yaw coupling12 resulting from the 737’s rear-mounted vertical tail produces a yawing moment in the direction of the bank, countering the yawing moment from the thrust asymmetry. This would likely require a fairly large bank angle13 to produce a sufficiently-powerful restorative yawing moment, and the ailerons would have to maintain this bank without the help of the spoilerons (which are inoperative in manual-reversion flight) and against the considerable rolling moment created by the asymmetric-thrust-induced sideslip angle and the positive slip/roll coupling14 resulting, in part, from the 737’s rearward-swept wings.

Even if the aircraft were controllable in manual-reversion flight with one engine out at high airspeed, it might not be controllable at lower airspeeds (such as one would normally use for landing), as the lateral (roll) control authority of ailerons decreases considerably at low airspeeds due to the higher angles of attack required to maintain flight at a slower airspeed (this is because a given aileron deflection increases the downgoing aileron’s lift coefficient less and less as the AoA of the wing as a whole - and, thus, the starting AoA of the aileron - increases towards the stall angle, causing the ailerons to produce a smaller and smaller proverse rolling moment as the wing’s attack angle increases, while the increase in the downgoing aileron’s drag coefficient for a given aileron deflection gets larger and larger as the wing’s AoA increases, causing the ailerons to produce a larger and larger adverse yawing moment at high attack angles15).16 This would be further aggravated by the unavailability, in manual-reversion flight, of the aircraft’s spoilerons and trailing-edge flaps - the former would assist the ailerons in rolling the aircraft, being especially useful at low speeds (as they are immune to the severe degradation in control authority experienced by ailerons at high attack angles, producing proverse rather than adverse yaw, in addition to proverse roll17), while the latter would increase the wing’s lift coefficient for a given angle of attack, allowing it to support the same weight at a lower AoA, shifting the wing into a more aileron-authority-friendly regime.

This would seem to require the aircraft to attempt a landing at very high speed while maintaining a fairly steep bank angle until just before touchdown, and I don’t see how it would be possible to go around without the increases in engine thrust and vehicle angle of attack causing a loss of lateral/directional control, or to avoid a high-speed excursion from the side of the runway immediately following touchdown.

The controllability issues in single-engine manual-reversion flight would presumably vary between different 737 models. All else being equal, one would expect that the variants with lower engine thrust would be easier to control than those with more powerful engines, due to the lesser thrust differential with one engine out (so an Original would be more controllable in this state than a Classic, which would itself be more controllable than an NG, which would still be more controllable than a MAX); that variants with higher wing loadings would be harder to control, due to their need to fly at higher attack angles (and, thus, in less-aileron-friendly regimes of flight); and that longer-bodied variants would be easier to control, due to the stronger bank-yaw coupling resulting from the vertical tail’s longer moment arm.

How controllable are the various 737s, actually, in manual-reversion flight with one engine out? Are any of them easily (or at all!) controllable attempting a landing or go-around in this condition? Are there other differences between the variants in this regard that I missed?


1: At least, if we overlook the (update: no-longer-) current pause in 737 production.

2: If you want to get really pedantically technical, a small amount of rudder deflection is attainable even without any hydraulic pressure, due to the design of the 737’s rudder system3; however, this requires the application of an extreme amount of force to the rudder pedals (approximately 300 pounds4 per inch of rudder pedal deflection after the first inch, in addition to the additional force required to push the rudder pedals the initial inch required to take up slack in the rudder control system), and the small amount of rudder deflection available isn’t enough to generally be useful.

3: The gory details, straight from one of the metaphorical horses’ mouths:

During normal operation of the rudder in flight, if a pilot applied between 9 and 70 pounds of force to a rudder pedal, the rudder would move in response until it reached its blowdown limit (when the aerodynamic forces acting on the rudder surface equal the hydraulic actuator force). According to Boeing engineers, if the pilot were to then apply additional force to the rudder pedal, the pedal would move about 1 inch farther, with no corresponding movement of the rudder, as the slack in the rudder linkage system is removed and the external input crank contacts the external stop. Any additional pilot application of force to the rudder pedal would result in rudder pedal movement of about 1 inch for each 300 pounds of rudder pedal force, which in turn would move the rudder surface slightly beyond the maximum deflection possible from the hydraulic actuator force. [NTSB AAR-99/01, page 26 (page 50 of the PDF file of the report), and NTSB AAR-01/01, pages 16-17 (34-35); the exact same text is present in both (these two AARs deal with a pair of very similar accidents). Although the quoted text describes the response of the rudder system to a sufficiently-forceful pedal input when the rudder is under full hydraulic power and at its aerodynamic blowdown limit, the same mechanism is applicable when the rudder is completely without hydraulics; the only difference is that the small directly-pilot-induced rudder deflection is relative to the rudder’s neutral position rather than its blowdown limit.5]

4: For reference, the maximum force that an average pilot is physically capable of applying to an aircraft’s rudder pedals is generally around 500 pounds (according to ergonomic studies cited by the NTSB in AAR-99/01 and AAR-01/01).

5: If you want to get really really pedantic, this deflection is still relative to the blowdown limit, even with fully-depressurised hydraulics; it’s just that, with no hydraulic pressure available, the rudder’s blowdown limit is 0° (the neutral position).6

6: Note that the calculation of the rudder’s blowdown limit takes into account only the rudder-deflection force provided by the rudder’s hydraulic actuators - the additional force available directly from the pilots’ feet if they press really hard on the rudder pedals (and the only force available for moving the rudder in the event of a total hydraulic failure) is not accounted for.

7: The rudder has three additional major functions in large aircraft (aligning the aircraft with the runway immediately following touchdown during a crosswind landing, to keep the tyres from being destroyed by the crab angle - sometimes quite large - that needs to be held until touchdown to keep the aircraft from being blown downwind of the runway; keeping the aircraft on the runway during a crosswind takeoff; and taking evasive action to avoid a collision at high speed during takeoff or landing roll), but these are purely ground phenomena.

8: Virtually guaranteed if the destructive engine failure takes the form of a full fan, compressor, or turbine rotor burst (due to the extreme amounts of kinetic energy released in these types of failures); less common for a simple blade-out (although even these can sometimes result in uncontained failures).

9: As for the other hydraulically-powered components on a 737, here’s a quick rundown of their statuses with the A and B systems both failed, or with the A and B systems plus the standby system all nonfunctional:

  • Landing gear: Can be extended by means of gravity, but cannot be retracted.
  • Nosewheel steering: Inoperative - the nosewheel casters freely.
  • Wheelbrakes: Powered by the brake accumulator for six full applications or equivalent (which should be enough to get the aircraft stopped on the runway).10
  • Spoilerons: Inoperative - lateral control is by ailerons alone.
  • Thrust reversers: Both operative if standby hydraulic system functional; otherwise, both inoperative.
  • Horizontal-stabiliser trim: Operative using the manual-pitch-trim wheel on the cockpit center console, but this may require an extreme amount of force at higher airspeeds and/or more-adverse longitudinal center-of-mass positions.11
  • Ground spoilers: Inoperative.
  • Autopilots: Both inoperative.
  • Trailing-edge flaps: Inoperative Operative at reduced rate using the backup electrical flap drive system.
  • Leading-edge high-lift devices: Operative if standby system functional; otherwise inoperative.
  • Autoslats: Inoperative.
  • Yaw damper: Inoperative.

10: In theory, one could use differential braking (applying wheelbrakes only, or more strongly, on the side with the operative engine) to at least attempt to maintain directional control after touchdown; however, this would further increase the already-greatly-lengthened (due to the need to maintain a very high airspeed in order to maintain lateral/directional control before touchdown in single-engine manual-reversion flight, plus the inoperability of the spoilers and thrust reversers in the event of a total hydraulic failure) rollout distance needed, and would risk depleting the stored brake-accumulator pressure (as keeping the aircraft on the runway throughout rollout using differential braking alone would likely require at least a few changes in braking force, or even momentary brake reversals, which would quickly eat through the six full applications' worth of pressure in the accumulator).

11: The potential need to apply a very great deal of force to move the manual-pitch-trim wheel is especially severe on the 737 NG and MAX, which have a smaller manual-pitch-trim wheel (and, thus, provide the pilots with less of a mechanical advantage when trying to turn said wheel) than the 737 Original and Classic; for the NG and MAX at high airspeeds and/or adverse CoM locations, it may be physically impossible to trim the aircraft in pitch without the electrohydraulic trim system.

12: I.e., banking the aircraft to the right makes it want to yaw to the right, and vice versa.

13: Yes, I am aware that all non-centerline-thrust multiengine airplanes are required (at least in the U.S.) to demonstrate the ability to maintain lateral/directional control with one engine out without requiring a bank angle of greater than 15° away from the failed engine; however, this is with the rudder producing its own yawing moment to assist (quite potently) that produced by the aileron-induced bank. With the rudder down for the count, and the entire burden of resisting the asymmetric-thrust-induced yawing moment falling on the aircraft’s bank angle and bank/yaw coupling, the bank angle necessary to maintain lateral/directional control would be considerably greater.

14: I.e., placing the aircraft in a nose-right sideslip makes it want to roll to the right, and vice versa.

15: This is why aircraft have a crossover airspeed - a speed below which the rolling and yawing moment from a full-scale rudder deflection cannot be countered using the aircraft’s lateral controls alone.

16: More advanced aileron designs can reduce or even eliminate adverse yaw, mostly by generating enough extra drag on the upgoing aileron to balance out the extra lift-induced drag on the downgoing aileron (such as the differential aileron, which deflects the upgoing aileron much more than the downgoing aileron, and the Frise aileron, which has the lower front edge of the upgoing aileron protrude into the airflow below the wing), but these are less and less effective at higher and higher angles of attack.

17: As a result, one would expect that aircraft rolled solely by spoilerons and completely lacking traditional ailerons (such as the B-52G/H or the MU-2) would be immune to the crossover-airspeed phenomenon, although my question to that effect has yet to attract a useful answer.

$\endgroup$
17
  • 2
    $\begingroup$ That's a triple failure. I wouldn't be surprised if it's beyond 1e-9 (i.e. no need for consideration). $\endgroup$
    – JZYL
    Jul 8 '20 at 0:17
  • 1
    $\begingroup$ The A systems are 2 EDPs, and the B systems are two EMDPs, plus the standby. The Y/D runs off the B system and you can have another Y/D running off the STBY. You do need the rudder in both-engines flight for Y/D function to counteract adverse yaw and to suppress dutch roll. But in any case, an uncontained engine failure is only going to take out that side's A plumbing. There is enough redundancy to exceed 1e-9 for any single point failure I would say which is what the cert requirements are. Generally, double simultaneous failures need not be accounted for in risk analysis. $\endgroup$
    – John K
    Jul 8 '20 at 2:42
  • 10
    $\begingroup$ Footnotes with footnotes? It's gotta be a Sean question! Some of the most researched questions I've seen on any stack! $\endgroup$
    – FreeMan
    Jul 8 '20 at 18:54
  • 1
    $\begingroup$ @JohnK: No, each of the A and B systems runs to systems on both wings, allowing a single failure to take out both systems - and the standby system, for that matter, which also runs to systems on both wings. $\endgroup$
    – Vikki
    Jul 8 '20 at 20:43
  • 3
    $\begingroup$ @JohnK: All three hydraulic systems (the A, B, and standby systems) service components either directly attached to the engines and surrounding the turbines (thrust reversers) or near them and in line with the plane of a bursting turbine rotor (leading-edge high-lift devices), and, thus, can presumably be breached by a single turbine rotor burst. $\endgroup$
    – Vikki
    Jul 8 '20 at 23:24
6
$\begingroup$

Our 737 scenario

  1. One engine inoperative (OEI)
  2. HYD A+B failure
  3. Standby HYD failure

Only roll/pitch remain and rudder is lost, and the asymmetric thrust compounds the situation.

Prior to the digital crosstie on the Boeing 777, Boeing sized its tails so that only roll is sufficient for an in-flight one engine inoperative (OEI). And given the big magnitude of lift, a huge steep bank is not really necessary. The typical ailerons-only bank of 8–10° is more realistic.

However, without the rudder the Vmca speed becomes faster.

Similar situation that happened

During an engine-failure training on a Boeing 707 (TWA Flight 5787), the rudder lost its hydraulics and failed to switch to manual control (an option not on the 737 but nonetheless the rudder function was lost).

The idled engine simulating the engine failure was left in idle, and with the higher Vmca (180 knots), the plane tragically crashed on approach.

The Board determines that the probable cause of this accident was a loss of directional control, which resulted from the intentional shutdown of the pumps supplying hydraulic pressure to the rudder without a concurrent restoration of power on the No. 4 engine. A contributing factor was the inadequacy of the hydraulic fluid loss emergency procedure when applied against the operating configuration of the aircraft. (Accident report.)

Given enough time to plan – a steeper and faster approach can be attempted for the faster Vmca and to be able to idle the remaining engine, but can the outcome of an "extremely improbable" situation be guaranteed or certified for? (See next section.)

Probability

This is what the current certification calls for (see my bold emphasis):

14 CFR Control Systems (§§ 25.671 - 25.703)
14 CFR § 25.671 - General [...]

(c) The airplane must be shown by analysis, tests, or both, to be capable of continued safe flight and landing after any of the following failures or jamming in the flight control system and surfaces (including trim, lift, drag, and feel systems), within the normal flight envelope, without requiring exceptional piloting skill or strength. Probable malfunctions must have only minor effects on control system operation and must be capable of being readily counteracted by the pilot [...]

  1. Any combination of failures not shown to be extremely improbable, excluding jamming (for example, dual electrical or hydraulic system failures, or any single failure in combination with any probable hydraulic or electrical failure) [...]

"Dual" does not equal total (some Part 25 planes have 3+ systems), or encompass the backup/standby systems, which are there for precisely that reason.

So, how controllable is it? From the 707 accident and subsequent tests and the expected similar effects, combined with the higher Vmca and the regulations quoted above: this does not fall under the regulatory "minor effects" on controllability. (I'm not being insincere.) It will be tough.

How such leakage is mitigated on a 737

(The section is based on the 737's flight manual and its non-normal procedures.)

Standby system

Despite indeed reaching systems near the engines, the standby system does not automatically operate the pump leading there unless, among other things, the flaps are already down.

Also, the already pulled fire handle of the affected engine when damage is suspected will stop any leak related to the reverser when the pump is operated, and the leading edge alternate extension requires the opening of a valve by holding down a switch, which is released when the extension is not as expected.

Therefore, no fluid loss should affect the rudder system upstream, making our scenario really, really, improbable. The standby system operation is worthy of its own topic, but suffice to say those are big points in favor of the design of the 737's redundancy.

A and B reservoirs

On the Classic and NG, the reservoir design prevents a complete A system fluid depletion when the leakage comes from the engine-driven pump or its associated hydraulic lines. The same also applies to the B system on the Classic (but not the NG).

For both the Classic and NG, enough B system fluid is retained for operating the power transfer unit regardless where the leak has developed.

$\endgroup$
6
  • $\begingroup$ Kudos for the extensive analysis! Conceivably, could a scenario happen where an engine burst takes out hydraulic systems A and B, and ruptures the (as-yet-unpressurised-and-isolated) standby lines in the wing with the burst engine, leaving the rudder controllable with the standby system, only for the flightcrew to select alternate flaps prior to landing to get the LEDs down, resulting in pressure being applied to the breached standby lines, resulting in loss of standby hydraulic fluid and pressure through said breached lines, resulting in the failure of the standby hydraulic system? $\endgroup$
    – Vikki
    Sep 21 at 2:21
  • $\begingroup$ (I.e., are there any sort of precautions to keep standby-hydraulic-system integrity [and, thereby, rudder control] from being endangered by flightcrew actions in an A-and-B-dry scenario where the nature of the failure raises the possibility of damage to normally-isolated wing-mounted standby-hydraulic lines [such as an engine rotor burst]?) $\endgroup$
    – Vikki
    Sep 21 at 2:23
  • 1
    $\begingroup$ @Vikki: That footnote was a last moment addition, but I think it brought attention to more interesting aspects. I've expanded it to be an independent section, and tried to trim the overall size with more emphasis on the 737. Overall it's going to be tough still applies, even though it's extremely improbable; the new section should hopefully explain why and also address your two comments. $\endgroup$
    – ymb1
    Sep 21 at 17:46
  • 1
    $\begingroup$ @Vikki: b737.org.uk, which is a reliable source, does not mention any hydraulics differences on the MAX. As for the original, they have the standpipe information marked with "?". I have neither manual. As I was writing this answer, I also couldn't find any Boeing papers on the 737's hydraulics. 1/2 $\endgroup$
    – ymb1
    Sep 22 at 1:08
  • 2
    $\begingroup$ @Vikki: Also as a real world example, the 2018 uncontained engine failure of SWA1380 did not result in complete fluid leakage. The report does not even mention the hydraulics, and I only know this from the CVR recorded cell phone call the F/O made after landing: "we lost an engine and ha- and hydraulics. yes. yes. yes. ah I think that's right, yeah. ah no we had some quantity. yeah. yeah we had about. right now we have fifty six percent." (Fire handle was pulled for the expected damage per the CVR also.) $\endgroup$
    – ymb1
    Sep 22 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.