What a fascinating interim report - illuminating and in plain English. I would like to highlight a few points which might be good to see addressed (or dismissed) in more detail in due course:
1. Cold soaked main tank fuel from previous sector
Figure 1 seems to indicate that just prior to the uplift of fuel in Beijing the temperature of the 4 tons or so of fuel in the left hand main tank which was left over from the previous sector was -20˚C. Even after the uplift of warmer 5˚C fuel in Beijing the left main tank temperature never appears to rise above -1˚C. If temperature is as relevant as suggested, then a body of fuel from the previous sector remaining at -20˚C seems noteworthy as a possible contributory factor leading to the potential subsistence and continued development of accretions of ice in at least those parts of the main tank fuel system which remained at or below 0˚C.
2. Prolonged fuel scavenge operation
The interim report currently seems relatively silent on a key design feature of the 200ER as compared to certain other Boeings - namely, the relative size of the centre tank and the prolonged operation of the fuel scavenge.
The data (in Figure 1) shows that the remaining 800kg of centre tank fuel to be scavenged once the main tanks contained less than 12.5 tons started a little under 3 hours before landing and was finished within 30 minutes.
Given the apparent ability of each of the two centre tank fuel scavenge pumps in G-YYYM to suction fuel at a rate of some 0.8 tons per hour into each main tank, could there be any unintended consequence (which would normally have no bearing on safe flight absent some of the other contributory factors present that day) as a result of them running “dry” for over 2 hours once the remaining 800 kg was indicated to have been scavenged (and similarly on previous sector)?
After remaining 800 kg of fuel was scavenged, would not the fuel scavenge pump, being a jet pump, scavenge air? What volume of air would be entrained/dissolved into fuel in each main tank over remaining 2.5 hours of flight given powerful nature of scavenge pump? The centre tank is open to the atmosphere so any air sucked out would be immediately replaced. Presumably entrained/dissolved air in main tank fuel would be subsequently released as part of dynamic process given low pressure at height? Could this entrained/dissolved air end up in the fuel manifold and be released in a manner which would cause the potential failure of the suction feed or the override/jettison pump valves to open? As the suction feed in the climb at least seems to have a known failure mode from vapour lock (see previous posts) arguably the interim report’s understandable assumptions as to the location of a restriction might need to be reconsidered slightly if it could be shown that the suction feed might be vapour locked and/or (even more speculatively but for a similar reason to the suction feed) air might not be drawn in from the centre tank. Fuel testing after the event would not be able to establish the existence (or absence I accept!) of any air saturation dynamic and any vapour lock would be long gone. NB: my point is limited to expanding the possible locations of the icing restriction as I note the comments about aeration not being the cause of the cavitation in the HP pump.
As regards the 800 kg remaining shallow layer of fuel in the centre tank, is there any temperature or other information as to potential stratification in the 5 hours or so that it sat in a largely empty, cold still tank after OJ pumps selected OFF? Does the 0.14 max litres of water from condensation reflect turnover (if any) of atmosphere in the centre tank as a result of the operation of the fuel scavenge pumps in the last 3 hours of the flight (or the earlier sector)? Might there be any concentrations of water from accreted ice melting in the later stages of flight? Would slugs of water scavenged from centre tank be more likely to result in any particular form or size of ice crystal more susceptible to accretion when swept into main tanks? If ice had also previously accumulated and not melted on previous sector into Beijing could this be a contributory factor? The AAIB’s comment re unknown fluid dynamics seems spot on and not easily resolved given the complexities of the many different variables (eg Jet A1, ice, temperature, pressure, airframe, geometry, timing etc). Testing showing only 40ppm of water makes explaining the degree of icing sufficient to cause a restriction (sorry two restrictions), but not subsisting in any quantity in the main tank fuel, the mother of all tortuous theories though.
One relatively simple precautionary safety recommendation might be (eg as per certain other Boeings) to require the motive flow to the centre tank fuel scavenge pumps in 200ERs to be cut off after 30/40 minutes of renewed operation. Continued scavenging is unnecessary and might be a necessary contributory factor in lining up the holes in the two swiss cheeses (two cheeses, given must be at least one restriction on each side of the fuel system).
Alternatively, the fuel system test rig should perhaps also attempt to take account of what effect each fuel scavenge pump might have on fuel in the main tanks and the fuel supply system leading out of them?
3. Statistical significance of duplicated restriction in two independent fuel systems
The comment on page 19 of the interim report that "This is the first such event in 6.5 million flight hours and places the failure as being 'remote' as defined in EASA CS 25.1309" perhaps does not do justice to the statistical significance of what happened. While the statement may be correct, it could be seen as overstating the remoteness of the "event" - in particular, given the sharpened awareness from the data-mining that the particular environmental factors relevant to this event have occurred in but a few of those many flight hours and the fact that the current strawman is dependent on there being two separate duplicated events, i.e. one restriction in each independent fuel system, with assumed common contributory factors.
Also, if I may quibble with what may have been unintentionally implied by the word “remote” in the context of EASA CS 25.1309, when is a double engine rollback on a twin engine aircraft at very low altitude over a highly populated area caused by a restriction to the fuel supply to each engine limiting effective supply to about 15% or so of the certified maximum just a “major failure condition” for which “remote” is the relevant test, rather than a “hazardous failure condition” or a “catastrophic failure condition” which have to meet stricter standards? It would seem extraordinary to play down the significance of this demonstrated and duplicated failure condition, even if the improbability of its recurrence is in question.
4. Indications, annunciations and corrective actions
Also in the context of that same EASA CS 25.1309, which states in paragraph (c) (just read it at
http://www.aaib.gov.uk/sites/aaib/cm...pendix%20B.pdf) that:
“Information concerning unsafe system operating conditions must be provided to the
crew to enable them to take appropriate corrective action. A warning indication must
be provided if immediate corrective action is required. Systems and controls, including
indications and annunciations must be designed to minimise crew errors, which could
create additional hazards.”
would it not be helpful and practical (and perhaps necessary) to introduce an immediate warning and annunciation of the discrepancy between the Actual EPR and the Commanded EPR as soon as the more normal 2-3 second lag becomes a clear discrepancy as at about second 154[95] (in figure 2), rather than requiring crew to observe the discrepancy and establish if it is “just” a glide slope, autothrottle or other issue – even more so by second 160[95] when both engines are rolling back.
Needless to say, the crew did the most remarkable job – and this seems more apparent as the background unfolds and you look at how little time and room they had to act.