In summary, the holes in Swiss cheese (contributory factors) seem to me currently to be that within certified flight envelope:
1. Operational environment
- Long cold-soak sector.
- Back-to-back with another long cold-soak sector.
- Low fuel flow from main tanks at all stages of flight (never more than 30% or so of max certified flow).
2. Design
- Centre tank prone to accumulation of water and ice.
- Centre tank fuel scavenge which does not time-out.
- Introduction of centre tank water into very cold main tank fuel.
- Perhaps, areas such as suction feed prone to blockage by undissolved air.
- Fuel feed lines and/or FOHE prone to restriction by ice (whether accreted at site of blockage or not).
Swedish Steve, I agree but am guessing that the powers that be prefer not to keep much warmer centre tank fuel for landing:
- to ensure efficient wing loading in rest of flight;
- to make sure "independent" fuel supply to each engine in case supply to both is compromised on short finals (how unlikely is that!) not necessarily as a result of running out of fuel but perhaps using up dregs undiluted by main tank fuel and
- dependence on switching to main tanks close to landing (even automatically) and/or switching off OJ pumps (for TWA 800 reasons) is perceived to increase risk at time of potentially heavy workload?