Description

On 7 January 2008, a Boeing 747-400 being operated by Qantas on a scheduled passenger flight from London Heathrow to Bangkok was descending through FL100 about 13.5 nm NNW of destination in day VMC when indications of progressive electrical systems failure began to be annunciated. As the aircraft neared the end of the radar downwind leg, only the AC4 bus bar was providing AC power and the aircraft main battery was indicating discharge. A manual approach to a normal landing was subsequently accomplished and the aircraft taxied to the designated gate where passenger disembarkation took place. None of the 365 occupants, who included two heavy crew members who were present in the flight deck throughout the incident, had sustained any injury and the aircraft was undamaged.

Investigation

With the consent of the State of Occurrence, an investigation into this Serious Incident was carried out by the Australian Transport Safety Bureau (ATSB). It was established that earlier in the descent, the cabin crew had advised of a significant water leak in the forward galley area. The aircraft had been radar vectored via the BKK VOR onto a left hand downwind leg towards landing on Runway 01R.

This tracking is shown on the plan below.

Shortly after passing FL110 and the selection of Flap 1 just prior to the turn downwind, AC1 went offline and the auto thrust disconnected. Further loss of AC power, un-commanded autopilot disconnect and loss of various electrically powered systems occurred until, by 4200 ft, and still tracking downwind under radar control, AC1, AC2 and AC3 bus bars were all offline and batteries were discharging. Additional indicated system faults included:

• non operation of some fuel pumps
• an inoperative weather radar
• failure of the automatic control of cabin air conditioning and pressurisation
• blank right hand side EFIS displays
• Engine Indicating and Crew Alerting System (EICAS) lower display blank.

It was reported that between three and five pages of messages had been generated on the EICAS upper display and the cabin crew had advised that the cabin lighting had failed.

The crew had believed the status of AC4 to be normal, but noted main battery and APU battery discharge messages on the EICAS. The Flight Crew Operations Manual (FCOM) did not specify any response to the battery discharge messages which were classified as ‘advisories’. In addition, the QRH did not provide the flight crew with information about the remaining battery life, nor any recommended crew actions to restore services.

The crew reported that, after initially attempting to action all the EICAS fault messages as per the Quick Reference Handbook (QRH), they soon decided to discontinue this because of the constant action required in response to the continuous scrolling of EICAS messages.

They reported that the following instruments and systems had been available:

• the left hand side PFD[1] in degraded mode but with attitude, airspeed, altitude, vertical speed and ILS indications
• the left hand side ND[2] in degraded mode
• the left hand side CDU[3]
• the upper EICAS display including landing gear indication
• all standby instruments, which indicated attitude, airspeed, altitude and the magnetic compass
• EPR[4] readings for the No 4 engine only
• Indications of flap position for the right wing only.
• a single COM system with less than usual signal strength.

During the 10 nm final approach flown manually by the aircraft commander by reference to the Instrument Landing System (ILS) with the runway in sight, there had been automatic height callouts because the radio altimeter had been inoperative. The landing gear extended normally and after touchdown, thrust reversers, spoilers and auto brakes all deployed as expected in the absence of any related system fault indications. Only partial reverse thrust was used to avoid a risk of over-boosting the engines because of awareness that the electronic engine controls had reverted to an alternate mode.

The investigation was advised by the aircraft commander that the non declaration of either ‘PAN’ or ‘MAYDAY’ status was attributable to a concern that “there might be a communication issue with ATC” and took into account that it had been possible to complete the approach in daylight and whilst remaining clear of cloud.

The investigation found that the visible accumulation of water in the forward galley had occurred because of an overflowing drain caused by the blockage of a drain line to overboard by ice that had formed a ‘plug’ in this line at the external drain mast during the flight due to an inoperative drain line heater. The water had then flowed forward and through a decompression panel into the main equipment bay before leaking past ineffective drip shields onto three of the four unsealed generator control units in significant quantity causing them to malfunction and shut down.

At the time the aircraft became dependent on battery power, it was noted by the Investigation that it would have been clear to the crew at the time that the aircraft was within 15 minutes of a first-time landing and so the 30 minute minimum availability had not been an issue. However, the extremely serious circumstances which could have arisen if the electrical systems failure which prevailed had occurred more than 30 minutes flying time from the nearest suitable airport or if there had been a delay prior to landing were noted. Whilst the aircraft engines, hydraulic systems and pneumatic systems were largely unaffected by the electrical failures due to their independent design and there was thus no serious impediment to the flight characteristics of the aircraft, it was noted that many other systems had become inoperative or degraded including:

• communications systems, including radios, interphones, passenger address system, and transponders
• primary flight displays and standby attitude indicator
• warning and caution systems, including those relating to ground proximity, traffic and fire
• instrument illumination
• navigation systems
• engine instrumentation.

It was noted that in the ‘more than 30 minutes case’:

“The loss of these systems would have placed the aircraft at considerable risk, as the flight crew would have been flying by hand with only visual and tactile references, a standby airspeed indicator, a standby magnetic compass and a standby altimeter with degraded reliability to guide them. Communications would have been limited to the use of personal mobile telephones, if available. Additionally, the risk of spatial disorientation would have been particularly acute in IMC”

In respect of aircraft certification requirements, it was noted that:

“The investigation found that there was no detailed regulatory mechanism by which internal liquid hazards to electrical systems units could be considered or monitored throughout the design, operation and maintenance of the aircraft. The United States (US) Federal Aviation Regulations (FAR), and associated design advice provided by relevant Advisory Circulars, specifically addressed the protection of wiring between electrical systems units but not the units themselves. As a result, there was an increased risk of inadequate protection of electrical systems units.”

Safety Factors

The Investigation concluded that there had been four ‘Contributory Safety Factors’ to the event:

1. Electrical power to the aircraft‘s alternating and direct current buses 1, 2, and 3 and associated electrical equipment was lost during the flight after generator control units 1, 2, and 3 malfunctioned as a result of past and present waste water ingress.
2. Waste water leaked through a decompression panel in the cabin floor, then through drip shields and into electrical equipment after the forward drain line was blocked with ice that formed due to an inoperable drain line heater.
3. Maintenance processes did not identify or correct the:
   • deterioration of the drip shield [Significant safety issue]
   • corrosion in the generator control units [Minor safety issue]
   • inoperability of the forward drain line heater. [Significant safety issue]
4. The location of the decompression panel and absence of cabin floor sealing above the main equipment centre increased the risk of liquid ingress into the aircraft‘s electrical systems. [Significant safety issue]

Ten 'Other Safety Factors' were also identified during the course of the Investigation:

1. The galley drain operation and maintenance processes did not adequately prevent blockage and overflow of the aircraft‘s drain lines. [Minor safety issue]
2. The aircraft operator‘s forward drain mast modification increased the risk of a blockage in the aircraft‘s forward drain lines.
3. The floor sealing around the forward galley was not of sufficient extent to prevent liquids from passing through to the under floor area. [Minor safety issue]
4. Maintenance processes did not identify or correct the deterioration of the galley floor sealing. [Minor safety issue]
5. The aircraft operator‘s documented design objectives did not explicitly require the protection of non-structural systems from liquid contact or ingress. [Minor safety issue]
6. The United States Federal Aviation Administration regulations and associated guidance material did not fully address the potential harm to flight safety posed by liquid contamination of electrical system units in transport category aircraft. [Significant safety issue]
7. The priority level of the battery discharge messages that were provided by the engine indicating and crew alerting system did not accurately reflect the risk presented by the battery discharge status. [Significant safety issue]
8. The flight crew quick reference handbook did not include sufficient information for the flight crew to appropriately manage operations on standby power. [Significant safety issue]
9. The flight crew did not declare the aircraft‘s situation to air traffic control or to the cabin crew, which would have enabled them to more effectively prepare for and manage any adverse change in the aircraft‘s situation.
10. The flight crew did not review the aircraft status prior to taxiing to the terminal.

Safety Actions

The ATSB noted various Safety Actions resulting from the findings of the Investigation including those relating to the following:

• The development of drip shield modifications and drain system inspection procedures.
• A review of the installation, extent and maintenance of galley floor sealing.
• Drain line operation and maintenance.
• The identification of faulty drain line heaters.
• Improved maintenance processes to identify and correct corrosion in generator control units.
• The absence in the QRH of sufficient information for flight crew to appropriately manage operations on standby electrical power.
• A review of the failure of the EICAS battery discharge messages to accurately reflect the risk presented by battery discharge status.

Safety Recommendations

Two Safety Recommendations were made as a result of the Investigation that:

1. Boeing undertake further work to address (the absence in the QRH of sufficient information for flight crew to appropriately manage operations on standby electrical power). AO-2008-003-SR-108
2. The US FAA take safety action to address (the potential harm to flight safety posed by liquid contamination of electrical system units in transport category aircraft). AO-2008-003-SR-109

The Final Report of the Investigation was released on 13 December 2010.

Related Articles

• Airworthiness
• Electrical Problems: Guidance for Controllers

Notes

1. ^ PFD: Primary Flight Display
2. ^ ND: Navigation Display
3. ^ CDU: Control Display Unit
4. ^ EPR: Engine Pressure Ratio