Newsgroups: sci.aeronautics.airliners
From: rdd@cactus.org (Robert Dorsett)
Subject: Re: 767/restrictions/Atlantic Ocean
Date: 11 Feb 93 22:59:47 PST

In article <airliners.1993.163@ohare.Chicago.COM> you write:

>	The first fatal airline accident at LAX was a 727 that lost
>	all electrical power just after takeoff; its shiny side went
>	directly into Santa Monica Bay.  My recollection is that
>	they departed with one of their three generators inoperative,
>	as was then allowed by their Minimum Equipment List.  On this
>	departure they lost the second generator, the load transferred
>	to the third, and the third went offline because it couldn't
>	handle the load alone.
>
>	The sudden loss of power was fatal problem because they were
>	departing into IMC at night.  This accident prompted immediate
>	attention to MELs, plus some scrutiny of load sensitivity.

I've read a lot about this crash, but have never managed to get my hands
on the crash report.  It was a UAL 727, circa 1966/7/8, LAX.  If anyone
has this, I'd love to see it. :-)  So, caveat: most of this is from memory.

Basic problem, as I understand, was:

1.  Departed with a generator INOP.
2.  F/E screwed up, somehow, took generator 2 offline.
3.  Generator 3 tripped off.

Now, the problem at this point is:

1.  Excessive loads, so they couldn't just reconnect the generator(s).
2.  Essential AC is normally kept in the #3 position.  This allows
    Essential AC, DC, Standby AC, DC, the Battery Bus, Hot Battery Transfer
    Bus, and Battery Transfer Bus to be illuminated.  Normally, Essential
    DC, Standby DC, Battery Bus, the HBB, and Batt. Transfer Bus can *also*
    be powered by Generators 1 and 2, if they were on, but they weren't--
    so this "redundancy" was lost.  When #3 went off, they lost *all* elec-
    trical services, including cockpit lighting.  The airplane went dead.

The Essential Power selector has a "standby" position.  This powers the
Standby AC via an inverter, Standby DC, Battery Bus, Hot Battery Bus, and
the Transfer Battery Bus.  In effect: it provides minimal cockpit lighting,
powers the captain's gyros, and powers a radio bus.  A "get on the ground"
capability, that lasts about 25 minutes.

But.  The first step in managing an electrical failure is controlling loads.
On the old 727's, the galley power switch was RIGHT NEXT to the battery
switch.  The battery switch was unguarded, looked and felt just the same as
the galley power switch.  The F/E pulled the wrong switch.

So, even if he selected Standby Power, everything went dead again.  Doesn't
take too long to lose orientation in the clouds, at night, flying by the
seat of your pants, so they went into the soup.

It was a recoverable incident, EXCEPT for the human factors problem.  True
to its form, NTSB called this a "pilot error," but the real cause was the
dumb-ass battery switch design and location.  FAA mandated changes to the
interface, the battery switch was given a guard, and moved further away,
a couple of inches.  Also, a circuit to the air/ground switch was added that
automagically snaps the essential power selector to Standby whenever the
selected AC Ess Power source dies (in air, this could be generator 1, 2, 3--
no protection on ground).  This means that if this happened today, the F/E
would have a panel that stayed on, and the captain would keep his flight
instruments.

It's an utterly fascinating crash, a classic better-human-factors-could-have-
saved-it snafu.  The 727, otherwise, has a very simple cockpit.

The MEL for the 727 wasn't changed: you can still dispatch with a generator
(maybe 2) inop.  And, of course, the APU still doesn't have an in-flight
capability (it's located in the right main wheel well; the A/G switch
also prohibits the opening of the fuel valve in flight :-)).


>	I presume the same issues have had even more intense examination
>	for FBW aircraft, and would guess that they have reasonably
>	sophisticated controls for automatic load shedding.  Perhaps
>	someone who really knows could comment on this.

I understand that on the 757/767, there is no capability of monitoring of
generator values in-flight (no voltage, frequency, or loading info).  Control
is accomplished by manipulating "smart-switches," which show a schematic-on-
a-panel: close the loop, you can divert power how you want to.  No manual
paralleling capability.  Presumably, the system stops illegal operations.

The A310 and A320 both provided "nice to know" information on generator
operation; I believe the 747-400 does as well.  Don't think there's a manual
paralelling capability, though.

All which goes to say:

1.  Designers have a "hands-off" mentality with regard to pilot operation of
electrical systems, the most extreme manifestation of which is the trendi]
on circuit breakers.

2.  They save a bundle by not having to train pilots in the operation of
this somewhat complex system--more time to spend on the FMS! :-)



---
Robert Dorsett
rdd@cactus.org
...cs.utexas.edu!cactus.org!rdd