Chapter 10 Risk Numeracy, Chapter 5 Identification, Chapter 7 Risk Control, Chapter 9 Classifying and Analysing
What light does this occurrence shed on aspects of interest to engineers in general and risk engineers in particular?
Background: The McDonnell Douglas (MD) 11 originated in the 1960s as the Douglas Commercial DC10, then with company ownership change it became the Lockheed L1011 before the same type of change resulted in the MD11.
Overview: The first multi-engined aircraft I became aware of that had suffered engine failure on take off resulting in total loss of roll control was a four piston- engined aircraft in the days before the widespread use of jets. Say in the mid to late 1950s. This was due to a fire in one engine and the good engine being shut down as the fire indications in the cockpit pointed the finger at its companion engine. The fire indicator panel in the cockpit had been cross-wired in manufacture.
The second occurred in 1979 when one engine separated from the wing during take off. As the engine, still attached to its ‘umbilicals’, powered through the wing structure it disabled the wing leading edge slats necessary for high lift and also, I recall, aileron control, resulting in loss of roll control. Curiously, this was a DC10. The problem was, I recall, put down to maintenance practices on engine change.
Light number 1 – Frequency: Say, three such cases in about 70 years. F=0.04 cases per year. Or Mean Time between Failure = 35years. This is not an objective estimate, but a subjective one. As Rowe pointed out in 1971 – subjective estimates are all we may expect. If we were able to estimate the Exposure over this time period, namely the number of multi engined aeroplanes that have taken off per year in the period of interest, we could make a subjective estimate of the Probability of ‘this’ happening i.e. ‘this’ is loss of roll control per take-off.
Light number 2 – Responses: Because there is an international civil aviation body (ICAO) as well as cooperating national ones, such as CASA in Australia, any lessons (control measures) are promulgated to all manufacturers.
(a) Design change on all fire indicator wiring to ensure that cross-wiring could not occur. The lesson has not been lost in history, its message is still active.
(b) Inspection requirement, maintenance practice lessons or modification requirements are able to be communicated to all operators and maintainers through the Aeronautical Directive (AD) system. An AD has the power of law. It does not normally expire with time but is in existence for the life of the aeroplane. As time passes, any active aeroplane must retain an organisation taking responsibility for its engineering oversight.
Light number 3 – risk analysis: Embedded in aeronautical culture is the EFTO (engine failure on take-off) scenario. All pilots are drilled in how to respond and airline and business jet pilots (at the very least) are checked regularly on the ability to respond appropriately. Such an event would find its way into any formal aeronautical risk analysis. But note the limitations of the name given to it – “engine failure”, in place of the more broad meaning – “thrust loss”. The lesson is that a formal risk analysis is only as good as the wording given to each and every part of it.
The take-off circumstance itself involves four possible processes:
- Unable to achieve take-off safety speed in the runway length available – resulting in an emergency stop.
- Unable to climb above ground effect after take-off
- Unable to maintain required angle of climb after take-off
- Unable to maintain roll control after take-off.