13.1 Introduction

When one conducts a search for “functional analysis” on any search engine, a wide range of tools for various uses pops up. Some of these tools involve analyzing behavior in psychological studies (1), some involve computer networks (2), and some involve mathematical analyses (1). Functional analysis techniques can also be used to analyze complex systems to ensure needed components of a system are in place and available for use (3). Once again, when a Web search is conducted for the word “function,” a wide range of definitions come up, along with where a person can buy “function,” whatever that means. Dictionarey.com (4) defines function as follows:

noun 1. the kind of action or activity proper to a person, thing, or institution; the purpose for which something is designed or exists; role.

This is the definition that will be used in this chapter for function. It is the kind of action or activity proper to a person, thing, or institution or the purpose for which something is designed. For instance, a screw driver is designed to be used to tighten screws. There are different types of screw drivers: flat, Phillips, star, hex head, electric, battery operated, and plain old manual ones. However, sometimes screw drivers are used for other purposes, such as a hammer, a pry bar, or a weapon to name a few. However, the function a screw driver was designed to perform is to tighten screws. In a full tool kit, a screw driver has only one function.

The space shuttle Columbia made its first flight on April 12, 1981 (5). There had been several flights of the Space Shuttle Enterprise, but these were test flights and the Orbiter had been carried on or released from a Boeing 747 (5). The last space shuttle flight occurred on July 8, 2011. The space shuttle Atlantis made this flight (5). The major functions of the space shuttle fleet were to carry crews and cargo into Earth orbit. The shuttle was composed of several major components, of which each had a function.

Table 13.1 contains the major components of any of the space shuttles of the now retired fleet and their corresponding functions (6). It is apparent that the Orbiter has many more functions than the boosters, for instance. Within each component of the system, there are many if not hundreds of lower level functions associated with the subcomponents of the system. Table 13.2 lists some of the lower level functions that comprise the crew life support function of the Orbiter.

Table 13.1 Functions of the Major Components of a Space Shuttle

Table 13.2 Lower Level Crew Life Support Functions of Orbiter

Each of the functions listed in Table 13.2 are important. Atmospheric control, temperature control, radiation shielding, and the heat shield are some of the more important functions. The Columbia accident was due to the failure of the heat shield component. The heat shield was damaged during liftoff when a piece of foam insulation from the external tank broke off and hit the leading edge of the wing of the Orbiter (7). If that function would have been maintained, the Orbiter would not have failed.

Nelson and Bagian (8) discuss the concept of critical function approach or analysis (CFA) and the application of this concept to space systems. CFA was developed as an analysis tool after the Three Mile Island nuclear accident (9). The basic concept behind this approach is that within each system, there are a set of critical functions that must be maintained so that the system does not fail. The heat shielding on the space shuttle Columbia is an example of a critical component that maintained a critical function. Once the shielding failed, the space shuttle failed. There was no recovery at that point because there was no backup for that critical function. However, there was a backup for the atmospheric system on the Orbiter. That was the crew space suits. The space suits had a supply of oxygen that could support the crew until the shuttle landed.

Two very dramatic commercial airline accidents demonstrate the importance of functions to safe operation and airworthiness of airplanes. These are as follows:

• United Flight 232;
• Air Canada Flight 143.

13.1.1 United Flight 232

United Airlines Flight 232 was a scheduled flight from Stapleton International Airport in Denver, Colorado, to O'Hare International Airport in Chicago (10–12). The flight was then scheduled into Philadelphia International Airport. On July 19, 1989, the DC-10, with tail registration number N1819U, took off normally at 2:09 PM (14:09). The plane was in a shallow right turn at 3:16 PM (15:16) at 37,000 ft when the fan disk of its tail-mounted General Electric CF6-6 engine failed. The disk disintegrated and the debris was not contained by the engine's nacelle, a housing that protects the engine. The disintegrated disk, along with pieces of nacelle, penetrated the aircraft tail section at numerous places. This included the horizontal stabilizer. Airplanes are designed with redundant systems. One of the problems with the DC-10 design is that components of all three redundant hydraulic systems are positioned closely together in the horizontal stabilizer. The shrapnel from the failed engine punctured the lines of all three hydraulic systems and the hydraulic fluid drained away rapidly (12).

Despite the loss of all three hydraulic systems, the crew was able to attain and then maintain limited control by using the two remaining engines. The crew steered by applying power to one engine over the other, then gained altitude by applying power to both engines, and they decreased altitude by reducing power on both engines. The crew flew the crippled jet to the Sioux Gateway Airport. They lined the airplane up for landing on one of the runways. Without flight controls, they were unable to slow down the airplane for landing. The crew was forced to attempt landing at much too high a speed and rate of descent. On touchdown, the aircraft broke apart, caught fire, and rolled over. The largest section came to rest in a cornfield next to the runway. The crash of the airplane was very intense, but two thirds of the occupants survived. However, 111 people died in the crash. The cause of the engine failure was traced back to a manufacturing defect in the fan disk. Microscopic cracks were found in the parts and there were determined to be impurities in the castings. The cracking was present during maintenance inspections and could possibly have been detected by maintenance personnel (12).

The accident is considered a prime example of successful crew resource management because of the manner in which the flight crew handled the emergency. The flight crew, Captain Al Haynes, a 30,000-h pilot, First Officer William Records, and Flight Engineer Dudley Dvorak became well known as a result of their actions that day, in particular, the captain, Alfred C. Haynes, and a DC-10 instructor on board, who offered his assistance, Dennis E. Fitch (11).

13.1.2 Air Canada Flight 143

On July 23, 1983, Air Canada Flight 143, a Boeing 767-200 jet, registration C-GAUN, c/n 22520/47, ran out of fuel at 41,000 ft (12,500 m) mean sea level (MSL) altitude (11, 13, 14). The flight was approximately halfway through its flight from Montreal, Quebec, to Edmonton, Alberta, via a stop at Ottawa, Ontario. The airplane was flown from Toronto, Ontario, to Edmonton on July 22, 1983, where it underwent routine checks. The next day, it was flown to Montreal. It departed Montreal, following a crew change, as Flight 143 for the return trip to Edmonton via Ottawa. The Captain for this flight was Robert (Bob) Pearson and First Officer Maurice Quintal at the controls.

At 41,000 ft (12,500 m), over Red Lake, Ontario, the aircraft's cockpit warning system sounded, indicating a fuel pressure problem on the aircraft's left side. The pilots turned it off assuming it was a fuel pump failure (10). The crew knew that gravity would still feed fuel to the aircraft's two engines, even though the pump had failed. At this point, the aircraft's fuel gauges were inoperative. However, the flight management computer (FMC) indicated that there was still sufficient fuel for the flight. The pilots subsequently realized the fuel entry calculation into the FMC was incorrect. A few moments later, a second fuel pressure alarm sounded. At this point, the pilots decided to divert to Winnipeg, Manitoba. Within seconds, the left engine failed and the crew began preparing for a single-engine landing (10).

They tried to restart the left engine and began communicating their intentions to controllers in Winnipeg. The cockpit warning system sounded again, this time with a long “bong” that no one in the cockpit could recall having heard before (10). This was the “all engines out” sound, an event that had never been simulated during training. Within seconds, most of the instrument panels in the cockpit went dark, in addition, the right-hand side engine stopped and the 767 lost all power.

This 767-200 was one of the first commercial airliners to include an electronic flight instrument system (EFIS). This system required the electricity generated by the aircraft's jet engines to operate. The system went dead without electrical power. The auxiliary power unit (APU) is a small jet engine in the tail section of large jet aircraft and its purpose is to supply electricity, hydraulic power, and pneumatic air for starting the other jet engines (15). Since there was no fuel, this engine failed as well. The airplane was left with only a few basic battery-powered emergency flight instruments. These provided basic information with which to land the aircraft. However, there was not a working vertical speed indicator that would be needed to land the aircraft.

The main engines and APU also supply power for the hydraulic systems without which the aircraft cannot be controlled. Commercial aircraft need to have redundant systems to help in the event of this kind of power failure. Boeing aircraft, such as the 767-200, usually achieve this through the automated deployment of a ram air turbine (RAT) (16). This is a small generator driven by a small propeller that is driven by the forward motion of the aircraft. The higher the airspeed, the more power the RAT generates. The lower the airplane's airspeed, the lower amount of power generated (16).

As the pilots were descending through 35,000 ft (11,000 m), the second engine shut down. The crew immediately searched their emergency checklist for the section on flying the aircraft with both engines out. There was no such section to be found. Fortunately, Captain Pearson was an experienced glider pilot. This gave him familiarity with some flying techniques almost never used by commercial pilots. To have the maximum range and therefore the largest choice of possible landing sites, he needed to fly the 767 at the “best glide ratio speed.” Making his best educated guess as to this airspeed for the 767, he flew the aircraft at 220 knots (410 km/h; 250 mph). First Officer Maurice Quintal began making calculations to see if they could reach Winnipeg. He used the altitude from one of the mechanical backup instruments. The distance traveled was supplied by the air traffic controllers in Winnipeg. From this he calculated the aircraft had lost 5000 ft (1500 m) in 10 nautical miles (19 km; 12 mi), giving a glide ratio of approximately 12:1 for the airplane. The controllers and Quintal both calculated that Flight 143 would not make it to Winnipeg (13).

First Officer Quintal proposed landing at the former RCAF Station Gimli. This was a closed air force base where he had once served as a Canadian Air Force pilot. However, to complicate matters, the airstrip had been converted to a race track complex that was in use that day (13). Without power, the pilots had to try lowering the aircraft's main landing gear via a gravity drop but, due to the airflow, the nose wheel failed to lock into position. The decreasing forward motion of the aircraft also reduced the effectiveness of the RAT, making the aircraft increasingly difficult to control because of the reduced power being generated (13).

It became apparent as the flight approached the runway that the aircraft was too high and too fast. This raised the danger of running off the runway before the aircraft could be stopped safely. The lack of adequate hydraulic pressure prevented flap/slat extension. These devices are used under normal landing conditions to reduce the stall speed of the aircraft for a safe landing. The pilots considered executing a 360° turn to reduce speed and altitude. However, they decided that they did not have enough altitude for this maneuver. Pearson decided to execute a forward slip to increase drag and lose altitude. This maneuver is commonly used with gliders and light aircraft to descend more quickly without gaining forward speed.

When the wheels touched the runway, Pearson “stood on the brakes,” blowing out two of the aircraft's tires (13). The unlocked nose wheel collapsed and was forced back into its well, causing the aircraft's nose to scrape along the ground. The plane also slammed into the guard rail now separating the strip, which helped slow it down (13). Because there was no fuel onboard, there was little chance of a major fire. A minor fire in the nose area was extinguished by racers and course workers armed with fire extinguishers. None of the 61 passengers were seriously hurt, but there were some minor injuries when passengers exited the aircraft via the rear slides. The accident has been nicknamed the “Gimli Glider” in recognition of the flight crew's handling of the situation (11, 13).