safety first magazine - issue 3
TRANSCRIPT
Safety FirstThe Airbus Safety Magazine
# 03 December 2006
1
Safety First# 03 December 2006
Safety First is published by Airbus S.A.S1, rond point Maurice Bellonte31707 Blagnac Cedex / France
Editors:Yannick Malinge, Vice President Flight SafetyChristopher Courtenay, Director of Flight Safety
Concept Design byHCSGM 20061317Producted by Quat’coul
Copyright: GSE
Photos copyright Airbus Photos by ExM: Hervé BerengerPhilippe MascletHervé Goussé
Printed in France
© Airbus S.A.S. 2006 – All rights reserved. Confidential and proprietary documents.
By taking delivery of this Brochure (hereafter “Brochure”), you accept on behalf of yourcompany to comply with the following guidelines:
3 No other intellectual property rights are granted by the delivery of this Brochure than theright to read it, for the sole purpose of information.
3 This Brochure and its content shall not be modified and its illustrations and photos shallnot be reproduced without prior written consent of Airbus.
3 This Brochure and the materials it contains shall not, in whole or in part, be sold, rented, or licensed to any third party subject to payment.
This Brochure contains sensitive information that is correct at the time of going to press. This information involves a number of factors that could change over time, effecting thetrue public representation. Airbus assumes no obligation to update any information containedin this document or with respect to the information described herein.
Airbus SAS shall assume no liability for any damage in connection with the use of thisBrochure and of the materials it contains, even if Airbus SAS has been advised of thelikelihood of such damages.
Safety FirstThe Airbus Safety MagazineFor the enhancement of safe flight through increased knowledge and communications.
Safety First is published by the Flight Safety Departmentof Airbus. It is a source of specialist safety informationfor the restricted use of flight and ground crew memberswho fly and maintain Airbus aircraft. It is also distributedto other selected organisations.
Material for publication is obtained from multiple sourcesand includes selected information from the Airbus FlightSafety Confidential Reporting System, incident andaccident investigation reports, system tests and flighttests. Material is also obtained from sources within theairline industry, studies and reports from governmentagencies and other aviation sources.
All articles in Safety First are presented for informationonly and are not intended to replace ICAO guidelines,standards or recommended practices, operator-mandated
requirements or technical orders. The contents do notsupersede any requirements mandated by the State ofRegistry of the Operator’s aircraft or supersede or amendany Airbus type-specific AFM, AMM, FCOM, MELdocumentation or any other approved documentation.
Articles may be reprinted without permission, except wherecopyright source is indicated, but with acknowledgementto Airbus. Where Airbus is not the author, the contents ofthe article do not necessarily reflect the views of Airbus,neither do they indicate Company policy.
Contributions, comment and feedback are welcome. Fortechnical reasons the editors may be required to make editorialchanges to manuscripts, however every effort will be madeto preserve the intended meaning of the original. Enquiriesrelated to this publication should be addressed to:
AirbusFlight Safety Department (GSE)1, rond point Maurice Bellonte31707 Blagnac Cedex - FranceE.mail: [email protected]: +33 (0)5 61 93 44 29
Safety FirstThe Airbus Safety Magazine
# 03 December 2006
Last October we held the 13th Airbus Flight SafetyConference. This was an opportunity to shareinformation for the 125 attendees (out of which about30% attended for the first time) representing 80 Airbusoperators.
The feedback we received was very positive,highlighting in particular the very open and fruitfulexchange of information, not only between Airbusand You, our Operators, but also between Operatorsthemselves. Notably 7 airlines shared their experienceseither on crisis management or on safety relatedevents.
We can consider this as a clear indication that theAirbus Flight Safety Conference became what wehoped for 13 years ago: “our Operators” SafetyConference.
Similarly, the Airbus Safety Magazine, the extensionof our Safety Conference, has to become as well“our Operators” Safety Magazine.
Therefore we hope receiving articles from you thatcan be published in our next Safety First magazineto share Safety experience as we have done togetherduring the last 13th Safety Conferences.
I hope you will enjoy reading this 3rd issue of SafetyFirst and feel free to widely distribute it throughoutyour organisation.
Yours sincerely
Yannick MALINGEVice President Flight Safety
Yannick MALINGE
Vice President Flight Safety
Editorial# 03 December 2006
ContentThe Airbus Safety Magazine . . . . . . . . . 1NewsC. Courtenay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Dual Side Stick InputsF. Combes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Trimmable Horizontal Stabilizer DamageM. Baillon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Pitot Probes ObstructionA. Urdiroz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10A340 Thrust Reverser UnlockedV. Swiderski, O. Guenzel . . . . . . . . . . . . . . . . . 14Residual Cabin PressureM. Palomerque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Cabin Operations Flight OperationsC. Keegan, C. Lemozit . . . . . . . . . . . . . . . . . . . . . 27Hypoxia an Invisible EnemyH. Asshauer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Airbus Flight SafetyContacts/Organisation . . . . . . . . . . . . . . . . . . . 36
13th Flight SafetyConferenceAnother annual Flight Safety Conference has beenvery successfully completed and we hope you allbenefited from the information sharing betweenus all.We have received some requests to use thepresentations internally within some airlines, so ifyou want to do this or you want more informationon the conference content then contact us on thee-mails below.
We are already planning next year’s conferencefrom October 15th to 18th. We will inform everyoneas usual for registration.As always we will be asking for your inputs for theconference. The more operator presentations thebetter so if you have ideas then let us know butalso if there are specific subjects you would liketo see in the conference then also get in touchwith us. As Yannick Malinge says in his editorial this is yourconference.
Airbus Flight SafetyOfficeIn the back of the magazine you will find picturesand information on the Flight Safety Team. Sincethe last issue of the magazine there are two newFlight Safety managers:Frederic COMBES and Nicolas BARDOUBoth are bringing their experience from wide butdifferent backgrounds in Airbus.
Also please note that many of our mobile phonenumbers have changed
News
1 IntroductionOne of the basic task sharing principle for anyaircraft operation is that one pilot is Pilot Flying ata time. Therefore, if the Pilot Not Flying disagreeswith the Pilot Flying inputs, he/she has to verballyrequest corrective actions or, if deemed necessary,to take over the controls by clearly announcing “I have controls”. This will mean that he/she becomes Pilot Flyingfrom that moment and the other Pilot Not Flying. Nevertheless, the feedback gained from lineoperations monitoring indicates that dual inputsstill occur and are also sometimes involved inoperational incidents analyzed by Airbus. This was the case for the below described event,experienced on an A320 during turbulence
2 Summary ofthe event
While climbing to FL 320 at about Mach 0.78, anA320-200 encountered significant turbulence thatled roll to increase up to 40°.The Pilots reacted to this roll departure by variousdual sticks inputs in pitch and roll. The Auto Pilotdisconnected consequently to stick input.
Before the event the aircraft was in climb to FL320. The airplane had a weight of 61,2t. and wasin the following configuration:� Clean with AP 2 engaged (CLIMB / NAV) and
ATHR Engaged & Active in Thrust mode.� Managed Mach target was 0,78� Both ND CPT & FO were selected in ARC Mode
with a range of 160NM
The aircraft began an uncommanded roll to the right,which was initially counteracted by the Auto Pilot.However, at a speed above 250 kts, Auto Pilotorders on ailerons are limited at 8°. Therefore, dueto the high turbulence the roll reached a value of40° to the right.Both pilots reacted with full LH stick orders and10° LH rudder pedals.This induced the disengagement of the Auto Pilot.During the next 20 seconds, the Captain and FirstOfficer applied dual stick inputs, which lead to rollvalues oscillating between 33° to the left and 49°to the right, as well as to a loss of 2400 feet altitude.The Captain then re-engaged the Auto Pilot,selected Flight Level 310, and the flight resumedwithout noticeable event.
Dual Side Stick Inputs
By: Frédéric COMBESFlight Safety Manager
2 3Safety First
The Airbus Safety Magazine
# 03 December 2006
Your articlesAs already said this magazine is a tool to help shareinformation. Therefore we rely on your inputs. Weare still looking for articles from operators that wecan help pass to other operators through themagazine.If you have any inputs then please contact us.
Contact: Chris Courtenay [email protected]: +33 (0) 562110284Mobile: +33 (0) 616036422
DistributionIf you have any questions about the distribution ofthe magazine either electronically or in hard copythen please contact us.
Contact: Mrs Nuria Solere-mail: [email protected]: +33 (0) 561934429
With autopilot (AP) engaged, the sidesticks arekept in the neutral position, with no possibility ofsimultaneous inputs from either pilot.
Indeed, when the A/P is engaged, it is normallydisconnected by pressing the priority P/B (the pilottakes priority over the A/P) or instinctively at anytime by a firm action on the stick: typically 5kg inpitch, 3.6kg in roll.
5 Operationalprocedures
Simultaneous inputs by both PF and PNF on thesidesticks must be avoided. Thus, if the PNF feelshe must intervene, he must do so by pressing thePriority P/B while saying “I have controls”.
These rules are reminded in the Flight Crew TrainingManual 01.020 – Flight Controls and Flight CrewOperating Manual 1.27.40 – Flight Controls:Controls and Indicators”
3 Types of dual stick input
Analysis of reported dual side stick inputs events,reveals that there are three types of occurrences:
The “Spurious” Dual Stick inputsTypically due to an inadvertent movement of thestick by the PNF.For example when grabbing the FCOM or whenpressing the R/T.A spurious dual stick input only marginally affectsthe aircraft behavior due to only time limited & smallinputs.
The “Comfort” Dual Stick inputsTypically due to short interventions from the PNFwho wants to improve the aircraft’s attitude ortrajectory:These are generally experienced in approach,during a capture (altitude localizer), or in flare, andhave minor effects on the aircraft’s altitude/trajectory.However, as the PF is not aware of the PNF’sinterventions, he may be disturbed and maycounteract the PNF’s inputs.
The “Instinctive” Dual Stick InputsTypically due to a “reflex” action on the part of thePNF on the stick. This instinctive reaction maycome about when an unexpected event occurs,like for example an AP disengagement, anoverspeed situation or a dangerous maneuver.Such interventions are more significant in termsof stick deflection and duration. Usually in suchsituations, both pilots push the stick in the samedirection, which may lead to over control, a situationillustrated by the above occurrence.
4 Operation of the sidestick
The two sidesticks are not mechanically linked asthey are on older types of aircraft. This means that both sticks may be operatedindependently one of the other.When one sidestick is operated it sends anelectrical signal to the Fly By Wire computers.When both sticks are moved simultaneously, thesystem adds the signals of both pilots algebraically.
The total is limited to the signal that would resultfrom the maximum deflection of a single sidestick.
To avoid both signals being added by the system,a priority P/B is provided on each stick. By pressingthis button, a pilot may cancel the inputs of theother pilot.
An audio signal will indicate which sidestick haspriority,
4 5Safety First
The Airbus Safety Magazine
# 03 December 2006
A green light will come on in front of the pilotwho has taken control if the other stick is notin neutral position.
Take Over PB
Radio
and a red light comes onin front of the pilot whosestick is deactivated
The visual and audio indications are designed toprovide the crew with a progressive alert.
Experience has shown, that these warnings arevery effective to:� “Educate” the pilots to respect the basic task
sharing principle;� Reduce drastically the number of dual input
occurrences.
The activation of these dual input warnings hasno repercussion in term of : � Crew training;� Mixed fleet flying.
6 Dual Sidestick inputswarning system
In order to warn the crew in case of dual sidestickoperations, Airbus has designed a package of dualinput indicators and audio warning. These operate when both side sticks are deflectedsimultaneously by more than 2°. These visual and aural warnings have proved tobe efficient means to inform the pilot of dual inputs.
Visual indicationWhen a dual input situation is detected, the twogreen priority lights located on the cockpit frontpanel flash simultaneously.
The visual indication is an ADVISORY of a dualinput situation
Aural IndicationAfter the visual indication has been triggered, asynthetic voice “DUAL INPUT” comes up every5 sec, as long as the dual input condition persists.
The synthetic voice is a WARNING of a dual inputsituationNote: This audio has the lowest priority among the syntheticvoice audio alerts.
HOW TO UPGRADE YOUR SA AND LR AIRCRAFT ?
The light and aural indicators are basic, and free of charge on retrofit, on the A320 familyand A330/A340.
It requires FCDC and FWC to be at a givenstandard already available on production line:• A320: FWC E2 Standard - FCDC 53 Standard• A330/A340: FWC K3/L7 Standard - FCDC
M11/L14 Standard
Pin programs are activated on Operatorrequest
6 7Safety First
The Airbus Safety Magazine
# 03 December 2006
CPT F/O
DUALINPUT
1 IntroductionThis article describes an uneventful flight, duringwhich, the aircraft was in an unsafe condition. Asa result of what was erroneously considered as aminor damage, the limit loads of the THS were nomore sustainable. This resulted from a wrongappreciation of composite structure damage.The objective of this article is to highlight theparamount importance of building a goodknowledge of composite structure damage andrepair.Composite structure training is available at Airbustraining center.The Structure Repair Manual’s (SRM) proceduresmust be respected and, if outside SRM limits,Airbus must be contacted to always ensure aircraftstructural integrity.
2 Description of the event
On 21st of August 2004 upon landing, the subjectairplane was found with a torn lower skin of theright hand THS Lateral Box. This damage wasthought to be due to a Foreign Object Damage(FOD) and resulted in a leaking Trim Tank.
A missing water servicing door (164AR) wassuspected to have caused the damage.The damage was inspected externally only.The external cut was measured to be about 330mmlength by 3mm width, in line of flight, located atthe THS bottom skin panel, just behind secondTHS inboard handhole access panel.
The visible damage is shown on the picture:Based on external visual findings, the operatorperformed a temporary repair, by filling the damage
A330-300 Trimmable HorizontalStabilizer Damage
By: Marc BAILLIONFlight Safety Manager
Location of the damage
A
The operator issued then an engineering notefor:� Performing a close visual inspection upon
next aircraft landing, to confirm that therewas no repair deterioration, crack propa-gation or any other adverse findings;
� Ensure that the trim tanks of the horizontalstabilizer were inop as per A330 AMM;
� Repeat close visual inspection at every transit� Perform permanent repair at next B check
(2 months later).
When informed, Airbus requested immediatedamage assessment (including NDT) insidethe THS trim tank before next flight (as perstandard SRM requirement), in order to definea valid repair.
3 DamageDescription
As per the inspection, the monolithic CFRPpanel was found cracked throughout the cutlength, with large delaminations in thesurrounding area.Two stringers located on the THS bottom skinpanel had been severely damaged.
Internal views of the THS are shown opposite.
with adhesive (EA934) and covered with twolayers of Glass Fiber Reinforced Polymer(GFRP) plies. Trim tanks were emptied anda/c was flown back under MEL.
4 Actions LaunchedThe aircraft required immediate appropriate repair,as the temporary repair did not restore the requiredstructural integrity of the THS.
An OIT was issued (reference SE 999.0115/04dated 15th Oct. 2004) for A310/A300-600/A300-600ST/A318/A319/A320/A321/A330/A340.OIT recommendations are as follows:
“In case of damage, composite structure degradesin a different way compared to metallic structure.In the particular case of impact with a foreign objectthe internal damage might be larger than the visibleexternal damage. On monolithic structure, impactdamage will usually result in delamination aroundperforation and damage to structure underneath”
“…AI instructions for inspection and repair ofcomposite structure given in the SRM are to befollowed, to detect damage in its full extent, andto prevent […] inappropriate repair”
Composite structure courses are available at Airbustraining department to provide specific knowledgewith regard to maintenance and repair of compositestructure.
8 9Safety First
The Airbus Safety Magazine
# 03 December 2006
Stringer
See Airbus customer portal, structure trainingcatalogue available:
For more information, please connect to:https://w3.airbus.com/crs/A233_Train/0500_catalogs/Structure_MENU.htm
5 Conclusion� Internal damage might be larger than the visible
external damage on composite structure(monolithic, sandwich, CFRP, GFRP);
� Airbus instructions related to repair of compositestructure given in the SRM are to be followed,to detect damage in its full extent, and to preventinappropriate repair;
� SRM repair procedure to be respected or, ifoutside SRM limits, contact Airbus to alwaysensure aircraft structural integrity;
� Composite structure courses are available atAirbus training department to provide specificknowledge with regard to maintenance and repairof composite structure.
Rib Stringer
Composite structure NDT inspection (XSB2)
Composite repaire for technicians - basic(XSA2)
Advanced composite repari for technicians(XSA3)
And a new course:Structure repair for engineers compositestructures (XSC3)External view of the damage
Resulting internal delamination
3 Systems architectureand response
The following sketch presents the typicalarchitecture valid for all Airbus aircraft.
In the event referred to above, no reconfigurationto ADR3 was reported, and the information displayedon the standby indicator was the sole reliable.
3.1. Systems behavior during the event
The behavior of the systems described in paragraph2 resulted from the AFS (Auto Flight Systems) andEFCS detecting the discrepancy between the 3airspeeds. Since the monitoring is based on acomparison of the different speeds, and since all3 were different, the systems could not recognizeCAS3 as being the reliable speed. CAS3 beingthe odd among the 3 airspeeds, it was rejectedat first. In this case, however, all 3 data were rapidlyrejected by EFCS for computation till the end ofthe flight.
CAS3 being accurate during subject event, andover speed warning being computed on the basisof an «OR» condition of CAS1, 2 & 3 versusVMO/MMO, the over speed situation indicated bythe Flight Warning System was actual.
3.2. The particular case where 2 airspeedsare identically affected
A particular situation would arise if 2 pitot probeswere identically affected, which would result in 2of the 3 airspeeds being equally low to the detrimentof the 3rd and sole accurate one. This hypothesisis not unrealistic, and was encountered in servicewhen probes were clogged by dust or insects'nets. Besides, the above event was close to thissituation, since CAS1 and CAS2 were "only"deviating of about 20 knots, while CAS3 was inthe range of 80 knots higher.
For the sake of this demonstration, we will considerthat CAS1 and CAS2 are identical and too low.
AFS and EFCS airspeed monitoring relies on acomparison of airspeeds. In our example, CAS3would then be rejected, and computers would usethe erroneous airspeeds from CAS1 & CAS2.
10 11Safety First
The Airbus Safety Magazine
# 03 December 2006
Pitot ProbesObstructionon Ground
By Albert URDIROZFlight Safety Manager
1 IntroductionAirspeed is such a key parameter in aerodynamics,that the systems and indicators of Airbus aircraftuse 3 independent airspeeds as inputs to the pilots’displays as well as to the standby indicator. Aircraftsystems also use these 3 data.
At the source of the information chain are the pitotprobes. Feedback from in-service experienceindicates that:� Incorrect maintenance of these probes is the
most common cause for unreliable airspeedinformation;
� Take-offs are sometimes pursued in spite of oneor two airspeed indications being unreliable.
Consequently, this article aims at reminding groundstaffs of the efforts to be made in order to protectpitot probes on ground, and at recommendingcrews to accurately check the condition of pitotprobes before flight, and to abort their take-offswhen airspeed indication is detected unreliable.
2 Investigation of an in-service occurrence
For the purpose of this review we will refer to anevent that was recently experienced on an A330.However, this type of event could have happenedon any other Airbus aircraft.
Prior to the flight, the aircraft spent a few hours onthe stand. Storm conditions prevailed during theground time. Pitot probes were not protected withcovers and became obstructed. This was notnoticed before take-off.
During the take-off run, CAS1 (Computed Air Speed)and CAS2 were indicating too low speed. However,the take-off was continued.
Later investigation of the flight data recordings andcrew report resulted in the following informationabout the lift-off speeds:
� Ground speed was above 160kt;� CAS1 was about 60kt;� CAS2 was estimated to be below 80kt;� CAS 3 was reportedly reliable.Note: V1 and Vr of the flight are unknown to Airbus.
After lift-off, the following cockpit effects occurred:
� «NAV ADR DISAGREE» warning triggered;� EFCS (Electrical Flight Control Systems) reverted
to alternate law;� Auto-thrust disengaged;� Flight directors became unavailable;� Later in flight, with slats and flaps still extended,
VFE was exceeded, so that OVERSPEED warningtriggered.
Eventually, an in-flight turn back was initiated andan uneventful landing completed.
ADR2ADR3ADR1
Normal Display
Probe 2Probe 3Probe 1
Reconfigurations
ADR2ADR3ADR1
Normal Display
Probe 2Probe 3Probe 1
ADR2ADR3ADR1 ADR2ADR3ADR1
Normal DisplayNormal Display
Probe 2Probe 3Probe 1 Probe 2Probe 3Probe 1
ReconfigurationsReconfigurations
Low speedCAS1CAS2CAS3
FWC
Low speed
Overspeed
Low speedCAS1CAS1CAS2CAS3
FWC
Low speed
Overspeed
EFCS & AFSCAS1 consistent with CAS2CAS1 much lower than CAS3CAS2 much lower than CAS3
CAS3 => considered
unreliable}
� Adhering to improved pitot maintenance program;� Checking pitot reliable condition during the pre-
flight walk around check;� Aborting take-off when unreliable airspeed
condition is detected before V1.
To complete the subject of pitot probes obstruction,we will address the unreliable airspeed conditionin flight in a future article.
Flight controls surfaces gainefficiency with speed. Forinstance, the roll rate achievedwith 5 degrees of ailerondeflection will be much higherif aircraft flies at VMO/MMO thanat low speed. This implies that,when AFS and EFCS use a toolow airspeed:� Orders to the flight controls
would be too strong and maycause over-reaction, either inmanual or automatic flight;
� Limitation of rudder deflectionwill not be adapted toairspeed (Refer to sketch).
Possible consequences in thisextreme situation are loss ofcontrol or exceedance of designloads. Given these risks, allefforts should be made tomaintain reliable operation ofairspeed indication systems, orflight should be cancelled assoon as unreliable airspeedcondition is detected.
4 Maintenance and operationalrecommendations
4.1. Maintenance
Protecting pitot probes with covers any time foreignobjects are likely to penetrate is the main precautionto be taken. As indicated in the introduction, themost recurrent reasons for obstruction of probesis accumulation of dust, animal’s remains, insects’nets etc. This recommendation should not onlybe adhered to in case of long time parking. In sandstorm conditions, for instance, covers should beplaced even when parking for a few minutes.
In addition, Airbus has improvedthe maintenance program withthe reduction of the intervalfrom 2C to 1C-check fordraining and flushing the pitotpressure lines.
These recommendations arehighlighted in a ServiceInformation Letter (SIL 34-084)that Airbus has issued andwhich is regularly updatedin order to optimize themaintenance of pitot probes.
4.2. Operations
Precautions during operationsstart with the pre-flight exteriorcheck, when pitot probesinspection is requested. Crewsshould pay particular attentionto them, bewaring of any signsof obstructions.
Then, after take-off thrustsetting, both crewmembersshould scan airspeedindications. In case of detectionof an unreliable condition ofone of the airspeeds beforeV1, take-off should be aborted.
5 ConclusionAirbus recommends that ground and flight crewsbe reminded of the possible consequences of flightwith pitot probes obstructed:� Loss of control;� Exceedance of design loads.
Consequently, all efforts should be made to avoidflying in such conditions by:� Protecting pitot probes with covers as soon as
necessary;
12 13Safety First
The Airbus Safety Magazine
# 03 December 2006
Max. deflection
Airspeed
0
Full
Max. deflection
Airspeed
0
Full
10
1
16
17
6
7 8
9
12
13
14
15
18
19 20
3
4
5
21
2
11
2
A319/A320/A321
FLIGHT CREW OPERATING MANUAL
STANDARD OPERATING PROCEDURES
EXTERIOR INSPECTION
NOSE SECTION
* - Pitot probes…………………………………………………………… CONDITION
SEQ 001 REV 24
3.03.05 P 2
A340 Thrust ReverserUnlocked
By: Vincent SWIDERSKIA340 Propulsion System Engineer CFM56-5CPer-Oliver GUENZELA330/A340 Flight Safety Coordinator
1 IntroductionThe CFM56-5C engine (fitted on A340-200 and300) has a Thrust Reverser with 4 pivoting doors.As soon as one incorrectly locked thrust reverserdoor is detected, an “ENG X REV UNLOCKED”warning comes up on the ECAM warning display.
In the past, most “ENG X REV UNLOCKED”warnings were spurious. This is not the case anymore, as this phenomenon has been understoodand cured.
Today, most of the events are actual ones and therepetitive occurrences are due to a lack oftroubleshooting as detailed hereafter.
2 HistorySince Entry Into Service, various operators areimpacted by Rev Unlocked warnings. Airbus, CFM,Goodrich and Aircelle are carrying out a continuousimprovement of the system. It began in August1996 with issuance of the “ATO package” ServiceBulletin (Ref A). This SB provided a first answer tothe Rev Unlock phenomenon knowledge at thattime. It has been followed by several other SB andled to decrease the Rev Unlock rate to under 0.05events per 1000 Engine Flight Cycles.
However, this rate has been rising again in the last2 years, as highlighted on Figure 1.
3 Thrust Reversersystem description
The CFM56-5C Thrust Reverser is hydraulicallycommanded. Each pivoting door is motioned byan actuator and secured in closed position by alocking system. The selection of the Thrust Reverse mode sendshydraulic pressure, which opens the locking systemand deploys the pivoting doors actuators.
The locking system is composed of 2 mechanicalretention means (Fig 2):
The primary lockIt is the main locking element. It consists of a rotatingcam located on the Thrust Reverser’s forwardframe, which hooks on a roller fitting fixed on thepivoting door.
The secondary lockIt ensures that the door stays closed in case theprimary lock fails.It is composed of 4 integrated “locking fingers”located in the pivoting door actuator body.
14 15Safety First
The Airbus Safety Magazine
# 03 December 2006
0
0.05
0.1
0.15
0.2
0.25
0.3
Rat
e p
er 1
000
EF
C
A340 CFM56-5C Reverser Unlocked Event Rate Trend
Jun-93Jun-94
Jun-95Jun-96
Jun-97Jun-98
Jun-99Jun-00
Jun-01Jun-02
Jun-03Jun-04
Jun-05
Fig 2: Actuation and locking systems of a CFM56-5C Thrust Reverser pivoting door
Fig 1: Trend of the “Rev Unlock” event rate since Entry Into ServiceSecondaryLock
Pivoting Door
Roller Fitting
Primary Lockand Stow Switch
Actuator
4 “ENG X RevUnlocked” root causes
When the locking system is not pressurized, thesecondary lock is engaged, ready to retain theactuator in its almost full-retracted position.If the primary lock fails, the door will extend slightlyabove the flush position before the secondary lockengages. In that case, the stow switch sensor isreleased (Fig 3), which leads to the generation ofan “ENG X REV UNLOCKED” warning on theECAM.
16 17Safety First
The Airbus Safety Magazine
# 03 December 2006
Fig 3: Release of the stow switch with Primary lock open
If the need to operate the aircraft does not allowany troubleshooting, the Thrust Reverser shouldbe deactivated as per the MEL (Ref F).
6 Preventivemaintenance andpermanent solution
The various investigations emphasized theimportance of adhering to several maintenancepractices in order to prevent the “Rev Unlocked”events.CFM/Goodrich have released the Best PracticesManual (BPM) in January 2005. It has proven to be very effective when applied atevery C-check, but it was only applied by 25% ofthe operators.To ensure a fleet-wide application, the BPM hasbeen included in a Service Bulletin (Ref C) that isreferenced as a scheduled maintenance task ateach ‘C’ in the MPD (ref. H).
In addition to those practices, a final solution willintroduce a set of improvements to the lockingsystem by addressing the above root causes. Seealso ref. G for further information.
7 ConclusionAirbus permanent effort on the “Rev Unlocked”warning has eliminated the spurious triggeringknown from the early days of the A340-300.
Today, the majority of the events are due to actualThrust Reverser door unlocks. Therefore:� Adhere strictly to the ECAM procedure, which
instructs to select idle on the affected engine,even if that engine has already been automaticallyreduced to idle by the FADEC;
� Apply proper troubleshooting before the nextflight to avoid re-occurrence, or deactivate theThrust Reverser if you can not complete thetroubleshooting;
� Perform preventive maintenance, in the form ofa MPD task every ‘C’ check, to minimize theoperational interruptions due to “Rev Unlocked”events.
The continuous feedback from the operatorsallowed identifying that the primary lock rotatingcam can fail to hook the roller-fitting due to:
� An insufficient actuator stroke;� An incorrect rigging of the roller fitting;� A primary lock contamination, which can prevent
the rotating cam from moving freely;� An undesirable hydraulic pressure spike in the
actuation system, which can prevent the primarylock from hooking completely.
5 Operational impactand maintenanceactions
The above-described root causes usually lead toan unstable position of the primary lock betweenopen and closed position. This unstable positionswitches to the open position (secondary lockactivated) during the following flight due to engineacceleration/vibration. In most cases this happensduring the takeoff run. An “ENG X REV UNLOCKED”warning is triggered and the crew performs aRejected Take Off.
Maintenance will find a pivoting door ajar on theaffected engine. Pushing the door back in its closedposition will engage the primary lock and clear theissue for the next takeoff. But as the root causehas not been addressed it is likely that an “ENGX REV UNLOCKED” will appear after some thrustreverser actuations.This is why troubleshooting has to be done inaccordance with Ref. D or E in order to find theroot cause and to apply the appropriate correctiveaction.
REFERENCES
A) SB RA34078-27B) SB RA340A78-56C) SB RA34078-88D) TSM tasks 78-31-00-810-
967/968/969/970E) Goodrich AOL A340/CFM56-04-047
REVISION 1F) MEL 78-30-01G) TFU 78.30.00.052H) MPD task 783241-C4-1
Stow switch
Stow switch release
FANAIRFLOW
FANAIRFLOW
PrimaryLock
Roller fitting
Thrust ReverserPivoting Door
3 Cabin pressurereview
3.1. RPWS (Residual Pressure WarningSystem)
In case of cabin residual pressure differential, awarning light flashes red at each door, as long asDp > 2.5 hPa, provided that one engine (two onA340) is stopped and the slide is not armed at thisdoor.
This Residual Pressure Warning System (red light)is basic on A320 Family & A330/A340.
RPWS does not cover all the scenarii; it remainsinhibited if:� The slides are still armed (emergency evacuation)
or� Engines are running.
In addition, the RPWS is only a passive protection;it also relies on cabin crew compliance to procedures.
3.2. Cabin pressure system
The following generic principles apply to allAIRBUS A/C :
a) Control and regulationof the cabin altitude:The cabin altitude is managed and controlled bya semi or fully automatic system, which ensuresseamless and rate-limited changes of the cabinaltitude as the A/C climbs or descends, with anabsolute limitation at 8000 ft maximum cabinaltitude. This system performs the managementand control of the internal cabin (in fact, cabin,cockpit, cargo) air pressure by tuning at each
moment the position of outflow valves(OFV), which let air escape from the cabin.In case of failure of the automatic systems,the crew must ensure the cabin pressuremanagement manually, thanks to directcontrol of the outflow valves at slow closingor opening speeds, by means of an UP /DN control switch: UP for cabin altitudeup (open OFV), DN for cabin altitude down(close OFV).
Should the cabin altitude exceed limits: positive: about + 8.8 PSI above externalambient pressure,negative: about - 1 PSIbelow external ambient pressure, safetyvalves will open to protect A/C structureand passengers/crew.
18 19Safety First
The Airbus Safety Magazine
# 03 December 2006
Residual Cabin Pressure
By: Michel PALOMEQUEFlight Safety AdvisorA318/A319/A320/A321 program
1 IntroductionThis document intends to describe the experienceregarding the in service residual cabin pressure,the consequences and the different scenarios forthis residual cabin pressure.For that purpose, a short review of the system ispresented.It will further describe the procedures and actionsalready in place to cover these scenarios from theoperational point of view (FCOM) and training.Then, it will introduce the new safety enhancements,which have been developed to allow the automaticrelease of this residual cabin pressure when inmanual pressure mode by an automatic openingof the outflow valve and also the logics for a newred ECAM warning in case of residual cabinpressure.
2 In service experienceIn service experience shows that several eventsof residual cabin pressure have been reported andled to violent door opening with potential for seriousinjuries.Most of the cases have been reported on A300and were related to ground tests or ground air cartsupplying the aircraft, where ground mechanicsopened a cabin door while the aircraft was stillpressurized.Nevertheless, the latest events resulted frommisapplication of the Manual mode procedure afterlanding:These events have driven the safety enhancements,which have been developed for the Flight By Wire(FBW) aircraft.
Failure9%
MAN mode11%
Throttle pushed11%
unknown23%
Ground air supply14%
Test or T/S32%
3.3. Operational cases where a residualcabin pressure may develop
- RTO followed by an emergency evacuation:the A/C is still pressurized (for instance, 15 hPaon WB, and 7 hPa on SA & LR). The level ofresidual ∆P at A/C stop will depend on severalfactors:� Whether or not the CPCS is still electrically
supplied and functioning with necessary inputs(like landing gear signals which may be lost)to send the OFVs opening control signals;
� Wwhether or not the system integrity is sufficient(possible OFV damage, loss of elec power, …)and if yes, whether or not enough time is leftfor the control ( x sec. after touch down) of aneffective full OFV opening.
Notes:* If the crew is not disabled, as said earlier, they can open
the cockpit sliding windows for A/C depressurization, butthis is possible only if ∆P is < 0.2 PSI.
* In an emergency evacuation situation, the door slides willbe kept armed, so the local warnings at each door (RPWS),signalling a residual cabin pressure > 2.5 hPa, will not begiven.
- At landing, in case of runway overrun orlateral excursion followed by an emergencyevacuation:the ground depressurization sequence may notbe complete, (or even not performed in case oflanding gear damage with flight / ground signalslost), or, if the outflow valves remain closed
because of A/C damage, a slight ∆P may bekept (if the CPCS was in auto mode, ~10 hPaor less). Obviously, if the erroneous landing fieldelevation selector was not in auto, and anerroneous selection was set, a larger ∆P mayexist and a significant amount of time may benecessary for A/C depressurization.
Notes: same as above for RTOs.
- After use of the MAN mode:(i.e. emergency descent or CPCS failure), bad orincomplete application of the ECAM or QRHprocedure during landing / A/C return to gate onA/C not yet having the automatic outflow valveopening on the ground in MAN mode.(in the same conditions as above, on A/C equippedwith automatic outflow valve opening on the groundin MAN mode, failure of this function).
- Non deliberate selection of the DITCHINGfunction:� Untimely DITCHING control signal;� DITCHING mode used (e.g. for AEVC reset on
the A320) then not de-selected after use.A cabin ∆P will build up if valves are fully orpartially closed, doors are closed, and airflowenters the cabin.
- A/C operation under MEL condition: the aft valve must be closed, and more time isneeded for the A/C depressurization on theground, particularly if the operational procedureis not followed (sel. one pack OFF immediatelyafter A/C touch down).
b) Typical cabin pressurizationschedule on the ground and in flight:This chart identifies the characteristic phases ofthe automatic A/C cabin pressurization schedule,in particular those which may participate to aresidual cabin pressure build-up on the ground:
� Pre-pressurization on the ground at TO (to avoidslight pressure bump at A/C rotation, due to thehigh angle of attack and air cushion effect onthe aft OFV, which would cause reverse airflowentering the cabin through the OFV);
� Slight over-pressurization before landing (for thesame reason as above);
� De-pressurization after A/C touchdown;� Automatic control of the complete opening of
the outflow valves x seconds after A/Ctouchdown.
c) Cockpit sliding windows:Each AIRBUS A/C has cockpit-sliding windows,which may be opened to cope with someemergency situations (for instance, smoke removal).They may be used to depressurize the A/C, buttheir opening is possible only if Delta P is below acertain value (typically, 0.2 PSI at 180 kt), due tothe force exerted on them because of the Delta P.
d) Cabin fuselage drain valves :A number (approximately 15) of piston-type drainvalves are fitted along the bottom line of thefuselage, to drain condensation water or other fluidleaks. They close when ∆P between the cabinpressure and the outside ambient air pressureexceeds a certain value (between 1 and 2 PSI,i.e. 70 to 140 hPa). But their effective section issmall (about 50 mm2 each).
21Safety First
The Airbus Safety Magazine
# 03 December 2006
20
Actual A/C altitude
CRUISE
Cabin altitude
Pre-pressurizationon the ground at TO
Slight over-pressurization before landing
De-pressurization after landing
Automatic completopening of the OFVsec. after touchdow
5 Safety enhancement:modificationdescription
2 modifications have been launched, both for A320family and A330/A340, to cope with cases ofinappropriate compliance of the procedures inmanual mode after landing.
5.1. Automatic outflow valve opening in manual mode
This ground logic unit is an electronic box containinghardwired-programmed logic
It will be supplied from the DC ESS bus, and will forcethe automatic opening of the outflow valves on theground in cabin pressure manual mode, or in failurecases. It drives 2 relays, one per outflow valve, toprovide electrical power directly to their manual modeelectrical motor, taking over their control.So this new function will mitigate against the hazardof flight crew using the MAN pressure mode inflight and then not following the FCOM procedureafter landing, i.e. fully open the OFVs. It will takeover the control of the OFV automatically by meansof providing electrical power directly to their manualmotors using external relays.It will also mitigate against the hazard ofmaintenance personnel being interrupted in theaccomplishment of a pressurization test on theground, or CPCS failure / power supply cut-off.
The logic for the RPCU is as follows:Briefly, each outflow valve will fully open if:� Landing gear shock absorbers compressed or
parking brake applied;� Thrust levers is in TO position;� No engine is running above idle and no ADIRS
delivers Vc > 70 kt;� The valve is in MAN control and both CPCs are
in stby;� The valve angle is < 100°
Before Mod.
22 23Safety First
The Airbus Safety Magazine
# 03 December 2006
4 Review of the FCOMprocedures inmanual mode
In case of dual system failures, an ECAM warningis triggered and a procedure requests to controlmanually the cabin pressure.In addition, the system page will show that thesystem 1 & 2 are inoperative.This manual control is done through the MAN V/SCTL.
Depending on the failure mode, it is possible thatthis procedure may not allow the depressurization.In any case, it is clearly requested through a cautionto check that delta P is zero before opening doors.
If for any reason, there is still significant cabinpressurization, it is possible to refer to the cabinoverpressure procedure. (Only on the A320 family,due to single outflow valve configuration - paperprocedure)
During flight crew training concerning an emergencyevacuation, the accent is put particularly on theaborted takeoff following an engine fire or an APUfire. The check of the delta P is highlighted: Thedelta P should be at zero before the evacuationorder is given to the cabin crew
Cabin crew training:The training for cabin crew highlights that beforeopening any passenger door, the cabin crew hasto check the cabin pressure indicator.He/she must inform the cockpit crew if the redlight flashes.Before any opening of the door, he/she musthold the door assist handle.
If, on ground, in auto mode, few minutes afterlanding (3 minutes on A330/A340) the outflowvalve is not fully open, ”CAB PRESS OUTFLOWVALVE NOT OPEN” ECAM warning is displayed:It requests to open it in manual mode, or to switchoff the packs if unsuccessful.
This new device is installed onA320 family aircraft through modification
34673 / SB 21-1154 and
on A330/A340 through modification 53145:SB 21-3113 for A330
SB 21-4122 for A340 basicSB 21-5021 for A3456
Wiring: SB 21-3112 for A330SB 21-4121 for A340SB 21-5020 for A3456
CockpitPanel
CPC 2(Auto)
CPCS ATA21
CPC 1(Auto)
AFTOFV
FWDOFV
ManMode
CockpitPanel
ElectricATA24
NavigationATA34
LandingGear
ATA32
DoorsATA52
ENGINESATA73
CPC 2(Auto)
CPCS ATA21
CPC 1(Auto)
AFTOFV
FWDOFV
RPCU
ManMode
After Mod.
This new red ECAM warning is available for
� A320 family with FWC H2F3 (A318 PWcertification)through modification- Modification 35220/ SB 31-1267
� A330/A340 with FWC through modification - Mod 52306/ SB 31-4083 for A340/ 200-300- Mod 51973 / SB 31-5015 for A340/ 500-600- Mod 51790 / SB 31-3066 for A330
24 25Safety First
The Airbus Safety Magazine
# 03 December 2006
5.2. New red ECAM warning in case ofresidual cabin pressure independent of the pressurization system
In addition to this hardware device, a new redECAM warning has been created in case ofimpossibility to release the cabin pressure (blanket,manual motor jam, misapplication of the manualprocedure…):
CAB PR EXCES RESIDUAL PR
In case of excessive cabin residual pressure afterengines OFF, on ground for more than 7 seconds,CAB PR EXCES RESIDUAL PR red warning willbe activated after a time delay of 5 seconds.The ∆P sensor used for this new warning isthat of the RPWS.The tables here below show the ECAMprocedures without and with this new redECAM procedure.
The first table shows the existing procedure in case of residual cabin pressure.
The second table shows the ECAM procedure with the FWC logic in case of residual cabin pressure.
1 Introducing the FlightOperations BriefingNotes Concept
The Flight Operations Briefing Notes (FOBN) havebeen designed to allow an eye-opening and self-correcting accident-prevention strategy.Since 2004, the effort has aimed at covering theentire flight profile and at addressing the mainthreats and hazards to flight operations safety:
� Standard operating procedures(e.g.: Conducting effective briefings, …),
� Human Performance(e.g.: Error management, …),
� Operating environment(e.g.: Bird strike threat awareness, …),
� Adverse weather operations(e.g.: Optimum Use of Weather Radar, …),
� Runway and surface operations(e.g.: Preventing runway incursions, …),
� Supplementary techniques(e.g.: Preventing altitude deviations, …),
� Takeoff and departure operations(e.g.: Revisiting the stop or go decision, …),
� Descent management(e.g.: Energy Management, …),
� Approach techniques(e.g.: Flying stabilized approaches, …),
� Landing techniques(e.g.: Crosswind landings, …),
In 2006, the very first Flight Operations BriefingNotes addressing threat and hazards to cabinoperations safety have been released.
26
6 Conclusion In service experience shows that several eventsof residual cabin pressure have been reported andled to violent door opening with potential for seriousinjuries.Most of the cases have been reported on A300and were related to ground tests or ground air cartsupplying the aircraft, where ground mechanicsopened a cabin door while the aircraft was stillpressurized.
The latest events resulted from misapplication ofthe Manual mode procedure after landing:
In case of dual pressure system failures, an ECAMwarning is triggered and a procedure requests tocontrol manually the cabin pressure.In addition, the system page will show that thesystem 1 & 2 are inoperative.This manual control is done through the MAN V/SCTL.
In any case, several procedures are in place inorder to allow the release of the residual cabinpressure, if any. In addition, it is clearly requestedthrough a caution to check that delta P is zerobefore opening doors.In case of cabin pressure double failure, theprocedures must be followed up to the end (manualopening of the outflow valve and control of thecabin pressure on ground).
To cope with non compliance with the abovemanual procedures, 2 new modifications havebeen developed for FBW aircraft: the outflow valveopens automatically on ground, and an ECAMwarning warns of residual cabin pressure.Both modifications are installed and activated onproduction aircraft.
Even if it is always possible for a customer to askfor the non-embodiment of these safety enhan-cements on a brand new aircraft, in particular theinstallation of the RPCU, it is Airbus position thatboth modifications will bring an additional safetynet.Consequently, Airbus highly recommends theinstallation of the RPCU and of the relevant FWC,as described here below:
Automatic opening of the outflow valve evenin manual mode when on ground.It will be supplied from the DC ESS bus, and willforce the automatic opening of the outflow valveson the ground in cabin pressure manual mode, orin failure casesThis new device is installed on � A320 family aircraft through modification 34673
/ SB 21-1154 and � A330/A340 through modification 53145:
SB 21-3113 for A330, SB 21-4122 for A340basic, SB 21-5021 for A3456
New red ECAM warning in case of residualcabin pressureIn case of excessive cabin residual pressure onground 7 seconds after engines OFF, CAB PREXCES RESIDUAL PR red warning will be activated.The ∆P sensor used for this new warning is thatof the RPWS.
This new red ECAM warning is available for � A320 family with FWC H2F3 (A318 PW
certification)through modification. Modification 35220/ SB 31-1267
� A330/A340 with FWC through modification Mod 52306/ SB 31-4083 for A340/ 200-300,Mod 51973 / SB 31-5015 for A340/ 500-600,Mod 51790 / SB 31-3066 for A330
27Safety First
The Airbus Safety Magazine
# 03 December 2006
Cabin OperationsFlight OperationsBriefing NotesA Tool For Cabin Operations Safety Enhancement
Caroline KEEGANCabin Operational Standards, Customer Servicesand Christophe LEMOZITManager Flight Operations Safety Enhancement, Customer Services
Line cabin crew should review and compare therecommendations, guidelines and awarenessinformation with their current practices and enhancetheir techniques and awareness level, as required.
The cabin operations domain is an idealcomplement of the Getting to Grips with CabinSafety brochure released in 2005.
Such safety awareness references provide operatorswith guidance to implement their own cabin safetyprogram.
Where to consult/download them?
The Flight Operations Briefing Notes and all othersafety and operational expertise publications(e.g. Getting to Grips with …) are regularlyreleased on the Flight Operations Portal,which can be found in the secure area ofwww.airbusworld.com.
If you have access rights, go to «Secure area» (topleft of home page) / «Customer login» / «FlightOperations (Home)» (on left). To obtain accessrights, contact your IT administrator or refer to«Registration information» (top left).
The Flight Operations Briefing Notes are alsoreleased on the Safety Library room of the AirbusSafety First websitehttp://www.airbus.com/en/corporate/ethics/safety_lib/
28 29Safety First
The Airbus Safety Magazine
# 03 December 2006
2 Cabin OperationsDomain
This new Cabin Operations domain of the FlightOperations Briefing Notes has been created tomeet the respective needs of cabin crewmembersfirst, then of flight crewmembers and of other flightoperations personnel.
The cabin operations domain provides an overviewof the following aspects that need to be understoodand mastered in order to enhance cabin operationssafety:
� Effective Briefings for Cabin Operations� Crew Communication� Dangerous Goods� Ground Operations Safety� Cabin Smoke Awareness� Managing In-Flight Fires� Ditching� Decompression� Turbulence� Planned Ground Evacuation� Unplanned Ground Evacuation� Precautionary Evacuation
Cabin crew managers and training instructorsshould review, customize (as required) andimplement the recommendations, guidelines andawareness information, in the following domains:
� Cabin operational documentation� Training� Information (Cabin crew bulletins, Airline’s safety
magazine articles, Classroom lectures; and/orStand-alone reading).
CONTACT DETAILS
AIRBUS
Caroline KEEGANCabin Operational Standards
Customer Services, Flight Operations Support & Services
Tel:+33 (0)5 67 19 03 59Fax: +33 (0)5 61 93 29 68
Christophe LEMOZITManager Flight Operations Safety
EnhancementCustomer Services,
Flight Operations Support & Services
Tel.:+33 (0)5 62 11 82 90Fax: +33 (0)5 61 93 29 68
the situation, he donned his oxygen mask. Thecaptain, who had been talking with a passengerwho was visiting the flight deck, attempted to donhis oxygen mask too, but in doing so he knockedhis glasses to the floor. When trying to retrievethem he lost consciousness and slumped forward.The first officer attempted to help the captain butwas unable to do this, so initiated a descent to25,000ft. A short time later the first officer askedthe senior flight attendant to assist the captain. Toenter the flight deck the flight attendant had toremove her oxygen mask connected to the fixedcabin oxygen system. She decided not to use theportable oxygen equipment and went straight tothe flight deck. Before being able to assist thecaptain she collapsed onto the floor. Once again,the first officer attempted to put on the oxygenmask for the captain, this time successfully. Soonafterward, the captain regained consciousnessand was unaware he had been unconscious, whichis a typical reaction from a victim of hypoxia.’
2 The hypoxia effects of a quick cabindepressurization
During a quick depressurization the partial pressureof oxygen in the lungs/alveolae reduces rapidlywith the effect of reverse diffusion. This means thatonce the oxygen partial pressure in the alveolaehas reached a level that is below the level in theblood, the blood oxygen moves out of the bodyback into the ambient air. This effect of reversediffusion unfortunately further reduces the alreadyvery limited oxygen storing capability of blood andsupports hypoxia effects. Holding of breath cannotstop the reverse flow since the pulmonary gasexpansion would lead to serious lung injury.
30 31Safety First
The Airbus Safety Magazine
# 03 December 2006
Hypoxia an Invisible EnemyCabin depressurization effectson human physiology
Hartwig AsshauerCertification ManagerHydro-Mechanical & Air SystemsAirbus Engineering
1 IntroductionOperating at high altitude without adequateunderstanding, training or equipment protectioncan be dangerous as shown by the followingextracts from two accident reports:
‘One of the first encounters with the dangers ofhigh altitude flight was reported in 1862 when aballoon flight was made to study the effects of lowambient pressure. The balloon ascended toapproximately 29,000ft and during the flight a seriesof “strange” symptoms, notably loss of visual andhearing capability, paralysis of arms and legs, andfinally, unconsciousness occurred. The team couldhave been lost, but was saved by one memberpulling the balloon valve rope with his teeth (hisarms were already paralysed), to descend theballoon. The team recovered as the balloondescended, but this marked for the first time therisk of low ambient pressure.’
‘In 1998 a decompression incident occurred onan aircraft at 35,000ft. Both the captain and thefirst officer had received altitude-chamber trainingduring their previous military careers and knewabout the effects of low cabin pressure. The firstofficer attempted to control the cabin rate of climbby switching to the standby pressurization system.When use of the standby system failed to improve
DEFINITIONS OF HYPOXIA
Hypoxia is separated into four types:• Hypoxic hypoxia is a condition caused by reduced
barometric pressure, affecting the body's ability totransfer oxygen from the lungs to the bloodstream.
• Histotoxic hypoxia can be induced by the introductionof substances like alcohol or drugs into tissue,reducing its ability to accept oxygen from thebloodstream.
• Hypaemic hypoxia (or anaemic hypoxia) is a resultof the blood being unable to carry oxygen, e.g. causedby exposure to carbon monoxide.
• Stagnant hypoxia results from the body's inability to carry oxygen to the brain, which can resultfrom high gravity-forces causing blood to pool in thelower extremities of the body.
Human physiologyWithin the lungs the alveola provide the interface between air and blood.The blood which is returned from the body tissue into the alveolae hasgiven away most of its oxygen so that the oxygen partial pressure inthe lungs is higher than in the arriving blood. A process of diffusionthen drives oxygen through the thin alveolar wall into the blood.
The most important parameters for the oxygen diffusion process arethe oxygen percentage and barometric ambient pressure. Changingthese parameters changes immediately the oxygen saturation levelin blood and with it the oxygen supply to the body tissue.Unfortunately,there is no significant storage of oxygen in the human body, unlikemany other chemical substances necessary to maintain life. Theblood is the only storehouse for oxygen, and its capacity is verylimited. Hence, the human body lives only a hand-to-mouth existencewith its oxygen supply.
As the pressure of air in the atmosphere decreases with increasingaltitude, the partial pressure of oxygen in the air reduces and withit the diffusion of oxygen into the body. Reduction of oxygenavailability in the body results in loss of functions ranging fromslight impairment up to death. It is the nervous system, in particularin the higher centres of the brain, and the eyes which have a highmetabolism with no oxygen reserve. These are most sensitive tooxygen depletion and therefore are the first to be affected by areduced oxygen supply.
For healthy persons altitude exposure up to 15,000ft is usually nothazardous since cardiovascular and respiratory compensatorymechanisms (faster breathing and increased pulse rate/blood circulation)act to maintain adequate oxygenation at the cellular level.
The effects of reduced oxygen supply to the body (hypoxia) varybetween persons, depending on health, physical fitness, age, activitylevel and statistical scatter with the population. Pilots and flightattendants usually require more oxygen during an emergency thanhealthy, seated passengers and might therefore suffer earlier fromhypoxia effects.
GENERAL BLOOD CIRCULATION
This article first appeared inissue 38
When public air transportation first becamecommonly available, flights did not reachaltitudes that represented a significant risk ofreduced oxygen supply - called hypoxia - toeither passengers or crew. However, in thelate 1940s and 1950s aircraft were developedthat allowed safe transport of the flying publicat altitudes around 40,000ft, which haveremained relatively constant since then.
pressure breathing is able to increase additionallythe oxygen partial pressure by around 20 to 30mbar provided that the overpressure condition is limitedto some minutes only. This means that at 40,000ftit requires 100% oxygen concentration of thebreathing gas combined with positive pressurebreathing to achieve sea level equivalent conditions.Positive pressure breathing requires some trainingand is tiring and inconvenient, which is the rationalefor having so far provided this protection featureto flight crew only (for short time use only).
4 Time of UsefulConsciousness
In the 'World of Hypoxia' the Time of UsefulConsciousness (TUC) is a very important parameter.For low ambient pressure conditions it indicatesthe time available to perform purposeful activities,such as oxygen mask donning or aircraft control.Beyond this time frame mental and physicalcapabilities are dangerously impaired and finallyresult in unconsciousness and potentially death.
As shown in the table on the right, TUC is negativelycorrelated with altitude. It is important to note thateven if activities are performed within the TUC timeframe there is a significant deterioration of workrate and mental capability, which is correlated withthe time spent at low pressure conditions (at theend of the TUC time frame, performance is muchlower than at the beginning).The TUC is the 'Window of Opportunity' for donningan oxygen mask and can be very limited so musttake overriding precedence over any other activities.
5 Time of SafeUnconsciousness
Some experts believe that for passengers - incontradiction to the flight crew - a short period ofunconsciousness during cabin depressurizationcan be tolerated since they are not performing anoperational task. Unconsciousness is a clear signof insufficient oxygen supply to the brain and it isobvious that this time can only be very short beforepermanent brain damage occurs. So far, it has notbeen possible to associate a specific time framefor the safe time of unconsciousness.
The uncertainties in extrapolation of animal dataand the wide variability in individual tolerances haveso far prevented determination of a commonlyagreed value for Time of Safe Unconsciousness(TSU) among human physiology experts. It isbelieved that a safe time of unconsciousness issomewhere between 90 seconds and 4 minutes.
32Safety First
The Airbus Safety Magazine
# 03 December 2006
Severe hypoxia caused by a significant reductionin cabin pressure is very dangerous for flight crewbecause:� The victims of hypoxia rarely notice that they are
about to pass out.� Usually there is quickly a loss of critical judgment � Most victims often experience a mildly euphoric
state � Thinking is slowed, muscular coordination is
impaired
The only effective means of protection is thequick donning of oxygen masks as the firstaction - before troubleshooting!
3 Oxygen partialpressure
The concentration of oxygen in the atmosphere isconstant at 20.95% at altitudes up to 100,000ft,which means that according to Dalton's Law* theoxygen partial pressure at sea level is 212mbar(20.95% of 1013mbar where 1013mbar is thestandard atmospheric pressure at sea level).
As altitude increases above sea level the partialpressure of the component gases decreasesconsistent with the decrease in total atmosphericpressure. For example, the partial pressure ofoxygen at 40,000ft is reduced to 39mbar only,which is far too inadequate to support humanmetabolism.
One means to increase oxygen partial pressure isto increase the oxygen concentration in breathingair. At 40,000ft cabin altitude an oxygen partialpressure of maximum 188mbar can be achievedby breathing pure oxygen (100% oxygenconcentration without overpressure).
Another additional means for hypoxia protectionis positive pressure breathing, which is usuallyfound in modern crew oxygen masks and meansthe delivery of pure oxygen under pressure intothe respiratory tract. For civil applications positive
TIME OF USEFULCONSCIOUSNESS
20,000ft All unacclimatized persons loseuseful consciousness within10 minutes
25,000ft Useful consciousness is lost after 2.5 minutes or less
30,000ft TUC: approx. 30 seconds
37,000ft TUC: approx. 18 seconds
45,000ft TUC: approx.15 seconds
These data on TUC are averaged valuesbased on tests withhealthy individuals whenbreathing ambient air (no supplemental oxygenprovided).A large individual variation in the effects of hypoxia has beenfound. There is evidencethat TUC is shorter forpeople exposed to stressconditions.
Current oxygen mask for passengers
Early type of shaped oxygen mask for passengers
Mask straps inflated Mask in place
Flight crew oxygen mask *
* Dalton’s Law(1766 -1844)In 1801, the Englishastronomer and chemist, JohnDalton, discovered thepressure relationship amonggases in a mixture. Dalton'sLaw states that the pressureexerted by a mixture of gasesis equal to the sum of thepressures that each wouldexert if it alone occupied thespace filled by the mixture.
* Manufacturer EROS
33
7 Airworthinessrequirements
The Airworthiness authorities have identified therisk of hypoxia and have created requirements (seetable on the left).Also, after an accident in the USA the FAA initiateda Special Certification Review (SCR) on pressuri-zation systems. The SCR recommends that theaircraft flight manual (for aircraft certified for flightsabove 25,000ft) require in the emergencyprocedures the donning of oxygen masks as thefirst crew action after a cabin altitude warning.
This highlights again the importance of immediatedonning of oxygen masks when cabin depres-surization occurs.
8 ConclusionThe first step for any flight crew member facedwith cabin depressurization should be the immediatedonning of an oxygen mask. Any delay in donninga mask will significantly increase the risk of losingconsciousness before cabin pressure is regained.Severe hypoxia leads usually to the loss of criticaljudgement combined with a mildly euphoric state,
which makes hypoxia very dangerous for flightcrew. This is highlighted also in the FAA SpecialCertification Review that was issued some yearsago on the effects of cabin depressurization.
Moreover, in case of rapid cabin depressurizationa quickly accomplished emergency descent is oftenthe only means of fast re-oxygenation of passengersthat were unable to protect themselves againsthypoxia by using the passenger oxygen masksprovided. Severe hypoxia is very dangerous forunprotected passengers and requires a quick returnto an adequate cabin pressure or where not possible(above high terrain), it requires a check by the flightattendants that the passenger oxygen masks arecorrectly used.
For a long time transport aircraft have beenequipped with oxygen systems for flight crew andpassengers that provide an adequate protectionagainst hypoxia. As long as these oxygen systemsare used according to their simple procedures theinvisible enemy hypoxia poses little danger to flightcrews and passengers.
34Safety First
The Airbus Safety Magazine
# 03 December 2006
6 Oxygen equipment on civil aircraft
On modern aircraft oxygen equipment is installedto provide adequate protection against thedamaging effects of hypoxia in case of cabindepressurization:
For flight crew there are usually quick donningoxygen masks installed, which can be donned withone hand in less than 5 seconds. The mask strapsare combined with elastic tubes that inflate andstiffen when the mask is taken from its stowage,allowing the mask to be easily put over the headwith one hand. Once the grip on the mask isreleased, the tubes deflate and their elasticcharacteristics ensure a perfect fit. The requiredoxygen concentration of the breathing air isautomatically adapted to the cabin pressure.
For the passenger oxygen supplythe continuous flow concept is usedon all Airbus aircraft. Oxygen isdelivered continuously to anexpandable oxygen bag where itis conserved during exhalation, soit is available during the nextinhalation to supplement the steadyoxygen flow.
It was decided at an early stagein passenger oxygen maskdevelopment that the untrainedcivilian population should not beexpected to recognize the correctorientation for a shaped mask, andit was required that a mask shouldbe operable in any position in whichit might be donned by the user. A second basic requirement wasa universal size, which finally definedthe well-known cylindrical maskbody.
CONTACT DETAILS
Hartwig AsshauerCertification Manager
Hydro-Mechanical & Air Systems
Airbus EngineeringTel: +33 (0)5 62 11 04 98Fax: +33 (0)5 61 93 31 55
Effect on human physiology of moderate cabin altitude
Very large numbers of aircrew and passengers have been exposed tobreathing air at cabin altitudes up to 8,000ft over the last 60 years without significant deleterious effects.Although exposure to this altitude reduces the oxygen partial pressurein the pulmonary tract the tissues of the body are maintained wellabove the required level.
Some airlines still allow smoking in the aircraft cabin, which resultsin carbon monoxide inhalation with the smoke. Carbon monoxide hasa 240-times greater tendency than oxygen to attach to red bloodhaemoglobin, thus inactivating a large amount of haemoglobin as anoxygen carrier. It has been found that the hypoxia effects from carbonmonoxide and altitude are additive; hence chronic smokers are at ahigher equivalent altitude than non-smokers in terms of blood oxygensupply.
Also, alcohol poisons body tissues in such a manner that they cannotuse oxygen properly. Usually, it is noticed by passengers that thephysiological effect of alcohol consumed during flight is more intensethan at sea level, which is due to the additive hypoxia effects of alcoholand altitude.
GENERAL• CS/FAR 25.841 (a): Maximum cabin pressure altitude under normal operation: 8,000ft• CS/FAR 25.841 (a): Maximum cabin pressure altitude after any probable failure condition in the
pressurization system: 15,000ft• FAR 25.841 (a) (2) (i): Maximum exposure time to cabin pressure altitude exceeding 25,000ft:
2 minutes• FAR 25.841 (a) (2) (ii): Exposure to cabin pressure altitude that exceeds 40,000ft: Not allowed
CABIN OCCUPANTS• CS/FAR 25.1443 (c): Provides oxygen system performance data on oxygen flow and required
partial pressure of oxygen• CS/FAR 25.1447 (c) (1): The total number of masks in the cabin must exceed the number
of seats by at least 10%• CS/FAR 25.1443 (d): Defines oxygen flow for first-aid oxygen equipment (for cabin
depressurization treatment)• JAR OPS 1.760/FAR 121.333 (e) (3): Requires first-aid oxygen for at least 2% of passengers • JAR OPS 1.770 (b) (2) (i)/FAR 121.329 (c): Defines the percentage of passengers that need
to be provided with supplemental oxygen (cabin pressure altitude dependent)
FLIGHT CREW• CS/FAR 25.1443 (a) & (b): Provides oxygen system performance data on oxygen flow and
required partial pressure of oxygen • CS/FAR 25.1447 (c) (2) (i): For aircraft operating above 25,000ft quick donning oxygen masks
are required for the flight crew which can be donned with one hand within 5 seconds• FAR 121.333 (c) (2) (i) (A): One flight crew member needs to wear permanently his oxygen
mask when the aircraft is operated above FL410• FAR 121.333 (c) (3): In case one flight crew member leaves the controls the remaining pilot
needs to use his oxygen mask when the aircraft is operated above 25,000ft
35
Extract of the prime requirements
Yannick MALINGEVice-President Flight SafetyPhone + 33 (0)5 61 93 43 60Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 29 80 86 52
The Airbus Flight Safety Team
Thierry THOREAUDeputy Vice President Flight SafetyHead of International CooperationPhone + 33 (0)5 61 93 49 54Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 16 93 87 24
Albert URDIROZFlight Safety ManagerPhone + 33 (0)5 62 11 01 20Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 23 98 01 13
Nuria SOLERAssistant to Flight Safety Dept.Phone + 33 (0)5 61 93 45 19Fax + 33 (0)5 61 93 44 29E-mail [email protected]
Armand JACOBTest PilotOperational Advisor to the Vice-President Flight SafetyPhone + 33 (0)5 61 93 47 92Fax + 33 (0)5 61 93 29 34E-mail [email protected] +33(0)6 22 10 36 09
Jean DANEYDirector of Flight SafetyHead of In-Service Safety & Incident InvestigationPhone + 33 (0)5 61 93 35 71Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 23 98 01 16
Marc BAILLIONFlight Safety ManagerPhone + 33 (0)5 67 19 14 75Fax + 33 (0)5 61 93 44 29E-mail [email protected] Mobile +33 (0)6 23 98 01 10
Christopher COURTENAYDirector of Flight SafetyHead of Safety InformationDisseminationPhone + 33 (0)5 62 11 02 84Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 16 03 64 22
Frederic COMBESFlight Safety ManagerPhone + 33 (0)5 62 11 97 42Fax + 33 (0)5 61 93 44 29E-mail [email protected] Mobile +33 (0)6 16 93 87 37
Panxika CHARALAMBIDESFlight Safety ManagerPhone + 33 (0)5 62 11 80 99Fax + 33 (0)5 61 93 44 29E-mail [email protected] +33 (0)6 23 98 01 63
Nicolas BARDOUFlight Safety ManagerPhone + 33 (0)5 67 19 02 60Fax + 33 (0)5 61 93 44 29E-mail [email protected] Mobile +33 (0)6 23 98 01 71
Armand GASTELLUCrisis Logistic Support ManagerPhone + 33 (0)5 61 93 41 79 Fax + 33 (0)5 67 19 12 26 E-mail [email protected] +33(0)6 23 98 00 86
36
Fligth Safety Advisors to Chief Engineers
Jacques KUHLFlight Safety AdvisorTo Wide Body Chief EngineerPhone + 33 (0)5 62 11 03 90Fax + 33 (0)5 61 93 48 28E-mail [email protected] +33(0)6 20 61 35 21
Michel PALOMEQUEFlight Safety AdvisorTo Single Aisle Chief EngineerPhone + 33 (0)5 62 11 02 85Fax + 33(0)5 61 93 44 29E.Mail - [email protected] +33(0)6 23 08 06 38
Jérôme PAULHETFlight Safety AdvisorTo Long Range Chief EngineerPhone + 33 (0)5 62 11 01 91Fax + 33 (0)5 61 93 27 60E-mail [email protected] +33(0)6 23 08 06 26
37Safety First
The Airbus Safety Magazine
# 03 December 2006
Flight Safety hotline06 29 80 86 66