Airline Pilot Forums

Airline Pilot Forums was designed to be a community where working airline pilots can share ideas and information about the aviation field. In the forum you will find information about major and regional airline carriers, career training, interview and job seeker help, finance, and living the airline pilot lifestyle.




ptarmigan
11-27-2018, 06:33 AM
An article on this topic. (https://airlinesafety.blog/2018/11/27/why-do-we-accept-hard-limits-on-jet-engines/)


UAL T38 Phlyer
11-27-2018, 07:41 AM
Good article...Interesting analysis.

rickair7777
11-27-2018, 08:02 AM
Good points.

Probably need three "stops"...

1. TOGA
2. Get to use the motor again, maybe need a borescope
3. Might blow the motor immediately, probably need a rebuild but we're going to die anyway

The CRJ 200 (no FADEC) SOP used to be to set a MAX rated power for WS/GPWS.

Then the FAA decided that wasn't good enough, and they eventually required us to use firewall thrust. That provided a little extra thrust, but usually resulted in an overtemp which required a call to MX. Usually they looked up the Temp vs. time and said good-to-go. Occasionally a borescope was required, which grounded the plane.

The firewall was a hard stop, and seemed to be about #2 on the scale above. Since usually no borescope was required, there was obviously some margin left in the motor. That was a good thing, because the automatic WS detector went off a lot, and it would be impractical for each crew to destroy a motor every week or two which was how often we got WS warnings in some hubs.

So stop #2 would be used for "routine" nuisance WS/GPWS events, with little or no economic impact.

Stop #3 would be available if the crew decided that impact was likely. That setting would be as much thrust as the motor could achieve with some non-zero statistical threshold of catastrophic failure.


In my experience, using stop #3 immediately for all WS/GPWS would bankrupt the airline pretty quick.


ptarmigan
11-27-2018, 08:42 AM
Good points.

Probably need three "stops"...

1. TOGA
2. Get to use the motor again, maybe need a borescope
3. Might blow the motor immediately, probably need a rebuild but we're going to die anyway

The CRJ 200 (no FADEC) SOP used to be to set a MAX rated power for WS/GPWS.

Then the FAA decided that wasn't good enough, and they eventually required us to use firewall thrust. That provided a little extra thrust, but usually resulted in an overtemp which required a call to MX. Usually they looked up the Temp vs. time and said good-to-go. Occasionally a borescope was required, which grounded the plane.

The firewall was a hard stop, and seemed to be about #2 on the scale above. Since usually no borescope was required, there was obviously some margin left in the motor. That was a good thing, because the automatic WS detector went off a lot, and it would be impractical for each crew to destroy a motor every week or two which was how often we got WS warnings in some hubs.

So stop #2 would be used for "routine" nuisance WS/GPWS events, with little or no economic impact.

Stop #3 would be available if the crew decided that impact was likely. That setting would be as much thrust as the motor could achieve with some non-zero statistical threshold of catastrophic failure.


In my experience, using stop #3 immediately for all WS/GPWS would bankrupt the airline pretty quick.

I like it! This was the point, to start a discussion.

Excargodog
11-27-2018, 08:55 AM
In the civilian world the likelihood I'll ever need them is so close to zero it might as well be, but I still miss them. :D:D

JohnBurke
11-27-2018, 10:45 AM
I understand the point the article is trying to make, and on the surface it's valid. In actual practice, however, where the rubber meets the runway, it may be another matter.

In 2008 a Kalitta 747-200 departed Bogota for Miami, and experienced an engine failure shortly after takeoff. The engine had an uncontained failure and damaged a second engine. The captain applied emergency thrust; the crews had been taught in every ground school that the engine was good for five minutes. Two engines at night in the Andes at gross in a Classic 747; they had a true emergency in play. Shortly after application of emergency power, both engines failed thermally and the aircraft began an all-engine-out descent at night in the mountains. The crew survived the resulting crash, people in a farmhouse where the crash began, did not. P&W later came back to say that no such five minute allowance existed, but had it, that value would have been used up decades prior.

I flew fire for a time in single engine airplanes that had a turbine conversion; the conversion was a Garrett (now Honeywell) TPE-331-11, originally from a Jetstream, and others of the same type used the P&W PT6A-45R. I was dispatched to a fire in the first turbine conversion of that type, a M18T45R, on a windy day. The fire was located amid rough terrain, and the venturi effect in some areas produced very high winds, later estimated to be up to 70 mph; these were not evident through most of the flight. Dropping across a saddle and onto the back side of a ridge, however, starting at about 25' of altitude, I encountered a severe wind shear (probably in the neighborhood of 70 knots), and the flight thereafter became interesting. I let the nose fall through on the back of the ridge, removed the guard for an overboost switch, and moved the switch as I applied full travel thrust and recovered close to the ground on the bottom of the canon in what would be quite similar to a windshear escape maneuver, except with a thousand feet of altitude loss in the process.

The engine survived, and it may be due to the available overboost that I had adequate power at the time, and the fact that I was able to eject more than 50% of my gross weight, in fire retardant. The engine suffered no undue effect.

A few years later in a similar aircraft but with a Garrett engine, I experienced a complete power loss on a fire and put the airplane on a hillside; the engine ran, but all oil was lost due to a seal failure. It's my opinion that those engines on those airplanes, which lacked overboost protection and which could be made to exceed limits simply by pushing the power too far, had been thermally beaten down too many times.

The US Dept of State, International Narcotics and Law Enorcement Air Wing, operated T-65 thrush's and Air Tractor AT-802's. The thrush, a single engine ag airplane, was heavily armored, had self sealing fuel cells, thick canopies, armored pilot seats, and instead of the smaller PT6A-34 motor, had a PT6A-64 (almost 1400 horsepower). It was used to spray coca in the low lands of colombia and other locations, and also the poppies at higher altitudes, as part of Plan Colombia (and other operations).

The original thrust was to use US pilots, but transition the program to Colombian pilots from the CNP (Colombian National Police) in counternarcotic operations. It was found, however, that the CNP and other foreign pilots tended to overboost the aircraft on a regular basis, greatly increasing the potential for an engine failure then, or somewhere down the line. The point there is that when faced with a perceived (and real) threat, the pilots took every advantage of additional thrust, as the limit on the PT6 installation was the pilot. Lacking FADEC, RPM governing was an engine function, but the safety was the pilot, and the pilots routinely went over the line.

I point this out because limitations are there for a reason. It sounds great on paper to be have a reserve of power in the event one needs it. Turbine acceleration in RPM and temperature is not linear; it's a steep curve that accelerates at the upper end. With FADEC and other similar systems, limitations can be placed to prevent exceedances, but in most turbine engines without those, even mechanical stops cannot prevent overtemp and overboost, and in some cases, overspeed. When trimming turbine engines from a maintenance perspective, efforts are made to align thrust levers, but without electronic limiting, the actual limits are in the pilots hands, and this has proven unreliable far too often.

The MD-11 alternate mode mentioned in the article is still a protected regime; it's still a hard limit, and it's still governed, but using historical data saved in the computer. It's not a removal of a "hard limit," but simply a switching from normal max thrust to emergency thrust, still within limits.

Aircraft can be broken while within the known limitations; a good example is American Airlines 587 with a separation of the vertical stabilizer due to pilot input in wake turbulence. Pilots, taught from the earliest flight training, expected that the airplane couldn't be broken by control input at low speeds, that it would "stall first," and that wasn't true. Even inside known limitations, damage can occur; to remove the stops, or the hard limits and go for broke outside of those limitations is to court disaster.

I get the rationale behind the article. When faced with dire circumstances, we want all the pitch authority, thrust, and control we can get: screw the limitations. That's exactly what drove the Kalitta crew to push the engines to destruction in Bogota, and the DoS pilots to exceed engine limitations on a regular basis in Colombia, as well. I'm no better, having used everything I could get to recover the SEAT (single engine air tanker) just southwest of the Tooele chemical weapons depot on a July afternoon. If we feel we need it, we feel we should have it. The rationale falls short, however, when the structure, engine, or component is driven to destruction by the exceedance. Then, instead of a little extra thrust, we have no thrust, and end up in a ball of twisted metal in a Colombian field outside Bogota at night.

We're pilots, not engineers (most of us, anyway). We didn't design the aircraft and we aren't privy in most cases to the rationale and data that went into that design, or for the limitations applied thereto. When we exceed them, we're not acting on science, but desperation. I submit that before we push for the removal of "hard limits," we look more closely at avoiding the situations that require the use of those limits in the first place.

ptarmigan
11-27-2018, 01:45 PM
All good points, however, we are not eliminating FADEC here. If there are points where it would fail we could have those as hard limits. I am not advocating removing all limits, but just the rated limit, much like the rated g-limitations but keep the AoA (which are not negotiable) limit. The idea that we have a tiered system is a good one, the first for 99% of scenarios, the last because we are "going to die anyway", even if the engines blow we might buy a little altitude before they do and be in control of the situation.

JohnBurke
11-27-2018, 08:00 PM
The idea that we have a tiered system is a good one, the first for 99% of scenarios, the last because we are "going to die anyway", even if the engines blow we might buy a little altitude before they do and be in control of the situation.

That's pretty much what the Kalitta crew thought, too.

ptarmigan
11-28-2018, 04:05 AM
That's pretty much what the Kalitta crew thought, too.

That does not make the concept invalid.

rickair7777
11-28-2018, 06:15 AM
That's pretty much what the Kalitta crew thought, too.

The final stop would need to gradually change over the life of the engine (software can do that) to keep the odds of catastrophic failure at whatever low threshold is appropriate.

Find the fine line between a rebuild after arriving at the gate and an airborne explosion.

I don't think the crews should have the ability to insert unlimited amounts of fuel into the combustion section, but should have the option to ruin the motor if needed (medium rare, not well done, still need to use it long enough to get back to the airport). They wouldn't do that lightly, because they'd have to 'splain it to the boss.

I've flown turboprops which had power lever angle authority waaaaay beyond the torque and temp limits, you could definitely ruin a motor with the flick of your wrist, and most likely could cause it to come apart instantly. Panic power was a number you set on a steam gauge, not the firewall. Would have been nice to have a hard stop for panic situations, short of the firewall.

2StgTurbine
11-30-2018, 01:48 PM
Find the fine line between a rebuild after arriving at the gate and an airborne explosion.

Easier said than done. Even with modern manufacturing it is impossible to produce identical turbine engines. Microscopic defects (caused either during the manufacturing process or routine maintenance) will affect the true failure point of an engine.

rickair7777
11-30-2018, 08:58 PM
Easier said than done. Even with modern manufacturing it is impossible to produce identical turbine engines. Microscopic defects (caused either during the manufacturing process or routine maintenance) will affect the true failure point of an engine.

Not expecting an absolute guarantee, just an informed, calculated risk.

JohnBurke
11-30-2018, 11:35 PM
I've flown turboprops which had power lever angle authority waaaaay beyond the torque and temp limits, you could definitely ruin a motor with the flick of your wrist, and most likely could cause it to come apart instantly. Panic power was a number you set on a steam gauge, not the firewall. Would have been nice to have a hard stop for panic situations, short of the firewall.

Again, with the exception of those engines that contain electronic limiting (eg, FADEC, etc), you can't trim the top. end of a turbine, and the acceleration isn't linear; it becomes a very steep upward curve to destruction when at the upper end of the power spectrum, which is why we do derated takeoffs and why it's important to respect the numbers.

Kalitta's engines in Bogota had no margin in them; Kalitta cobbled them together out of red tagged parts bought from various airlines and they were already beyond the margins of safety and legal tolerance. That they came apart when pushed was no surprise.

There's a military mentality that one would like to have military power available in a non-military aircraft, but the limitations, design, and criteria for the aircraft are quite different. Many platforms already have an excess of thrust, up through aircraft that are already 1+1, etc, and the ability to derate and still have adequate thrust available to call "military" is an option. This is not the case on most transport category aircraft, and unlike the tactical taxis, transport category aircraft lack bang seats. There is no returning it to the taxpayer.

There are also no taxpayers. Only shareholders.

MaxQ
12-01-2018, 10:51 AM
Hi John
Thanks for the informative post. Kudos.
I would add the additional that from very early on pilots are taught that “there is a huge safety margin built in”.
Needless to say some routinely go a little beyond because..well this huge safety margin that has been taught. I suspect 100% of those that want “a little bit more” are positive no harm will come of it.
Your post is an excellent reminder of the reality of component fatigue.

ptarmigan
12-10-2018, 06:40 AM
All of these are real considerations, however it really does not change the premise. I am close enough to the cert part of the industry to have a little insight into it...

takingmessages
12-30-2018, 09:07 AM
Years ago I witnessed the aftermath of a midair collision between a Navajo and a Turbocommander 1000. Both aircraft sustained substantial damage, but both landed safely with the pilot of the Navajo sustaining minor (rather minute) injuries. A four-stitches cut in his neck...

I was a fairly close friend of the Turbocommander's pilot and had the opportunity to inspect both aircraft at my leisure shortly after the event. I was a private pilot at the time and had been wandering around airplanes for years, although I wasn't (and I am not) a mechanic.

The airfield involved was this half-and-half military-civilian airport where you ONLY operated eastbound. Unless, well...
Unless you hit another aircraft mid-air.
The Navajo was inbound from the South about to cross the extended centerline to initiate a left downwind, when it hit the Turbocommander that had just taken off and turning right to head South. Although I never heard the radio transmission, rumor has it that the conversation between the Navajo and the tower went something like this:

TOWER!!!
I HIT SOMETHING!!!
I AM LANDING WESTBOUND!!!

Did you hit a bird?
Can you circle to the other runway?

NOOOOOO!!!
I DON’T KNOW WHAT I HIT!!!
I AM LANDING!!!
ROLL THE FIRETRUCKS!!!

And he landed...
Not the best thing he could have done, but the ONLY survivable option he had.
We saw the airplane land westbound and wondered, oh boy, somebody had an emergency. The airplane slowed down and did a 180 in the runway. That's when we saw the gaping hole in the right side of the airplane. It looked like someone grabbed a gigantic can opener and ripped the roof open from the copilot windshield all the way to the first window over the wing. The right prop had one blade smashed and out of sync with the other two. The vertical stabilizer was all bent and smashed up. The rudder was gone.
What a mess...

The guy then taxied to the fire department building.
How convenient, work from home... :)
Some firefighters pulled the pilot bleeding from the cockpit while another one pulled out the winglet of the Turbocommander from inside the fuselage.
Nobody knew where (or whom) the other aircraft was.

The Turbocommander landed shortly thereafter on another airport some 50 miles to the South. A couple of hours after the Navajo landed, the pilot was back in the cockpit picking up his stuff (with a white medical patch in his neck) when this little car came to a screeching halt in the parking lot, and my friend Jorge Paredes came out very obfuscated asking where the pilot of the Navajo was. The guy answered from the inside that he was it and Jorge told him "I am the pilot of the other aircraft!".
And that's how they met and shook hands for the first time:
with their arms reaching each other out through the hole in the fuselage of the Navajo.
How surreal...

After hours walking around both aircraft, I could reconstruct the obvious impact sequence. The airplanes hit each other head on. The right wing of the Turbocommander scratched the top of the nose of the Navajo until it hit the windshield right next to the mid-pilar. It blew up the right windshield, the instrument panel, the copilot seat and ripped apart the fuselage up to the first 2 passenger seats. Then the right prop of the Navajo severed the wing of the Turbocommander leaving approximately a couple of feet of the right aileron hanging attached to the wing. There was a small 1-by-2 inches triangle surgically cut from the trailing edge at the wingtip of the Navajo. That was cut by the blade of the Turbocommander on the way out.
And severely damaged the right turbine...

When the right engine of the Navajo severed the right wing of the Turbocommander, the big chunk of wing hit the vertical stabilizer of the Navajo significantly deforming it and detaching the ruder. The Navajo pilot survived because immediately after the collision he pulled the power from both engines and made a 90-degree left turn within gliding distance to the runway. I guess that I don't have to elaborate on control issues with a dead engine and no ruder. Never mind a broken windshield, a destroyed instrument panel and a gapping hole in the fuselage...
The Navajo glided back to Earth just like a paper airplane would have...

I don't remember how big the chunk of missing wing from the Turbocommander was, but feel free to fit it from mid inside fuselage of the Navajo all the way to the right engine. It was big enough to severely unbalance the Turbocommander.
And this is where this story fits this thread...

A few days later I got to talk to Jorge and hear the harrowing story first hand. His account went somewhat like this:
"I had just completed the right southbound turn and changed frequencies when I heard a 'tud', the aircraft shuddered and initiated an uncommanded turn to the right. I didn't' know what was happening (he could not see the right wing beyond the engine from the cockpit, so he didn’t know he was missing a big chunk of wing), so I applied full left aileron and rudder and reached for the engines to cut the left one and set the right to full power. That's when I saw all the temperatures in the right engine going off the charts, and I knew that it was going to blow up (remember the little triangle?). From that point on I flew with the left engine idle and praying that the right engine would hold until we landed, because I knew that if that engine quit we were dead. The engine died a few minutes later right at touch down."

Both aircraft were repaired and flew again.

The moral of the story is that Jorge and his passengers survived because he abused his engine unmercifully.

Finally, I am neither advocating nor discouraging one thing or another, I wrote this story here because I think it relates and it is such an unusual memory that I think it deserves to be preserved.

Thanks for reading and I hope that you enjoyed it... :)



Search Engine Optimization by vBSEO 3.6.1