BA038 (B777) Thread

[NSEU]

1. Why did the QAR lose the last 45 seconds of data?

This has been mentioned before. Apparently it's part of normal QAR ops. It's not a continuous recording system like the CVR and DFDR.
The recording system collates data and dumps it onto the QAR "tape"(PC memory card) at specified times.

Why didn't it complete the recording after the crash?

Nothing would have worked after the crash (QAR, CVR or DFDR).

[Green-dot]

With reference to post #242, posted by Tanimbar:

quote:
"Bsieker, you wrote:
"It is my understanding of the water scavenge jet pumps that they would, while trying to keep the water emulsified in the fuel, would also mix the fuel, preventing stratification."

Thanks for that. Can anyone comment on how these pumps operate and to what 'depth' in the fuel their effect is propogated? Are they designed to fully mix fuel within the total volume of the tanks and so prevent stratification?" unquote

The water scavenge jet pumps take fluid from the lowest points in the tanks (1 in each main wing tank and 2 in the center tank) and send it to the fuel pump inlets. This prevents water from collecting at the bottom of the tanks. The water scavenge pumps are jet pumps and operate automatically when the fuel pumps are on. They use fuel from the fuel pumps as motive fuel. The flow of the motive fuel through the jet pump causes suction that takes fluid from the lowest point in the tanks.

If a water detector finds water in a tank, the fuel quantity processor unit (FQPU) causes the water detection message for a particular tank to show. The main tank water detection messages show at the bottom of maintenance page 1. The center tank water detection messages show at the bottom of maintenance page 2. The amount of water required to show the L MAIN WATER or R MAIN WATER message is approximately 7 gallons. The amount of water for the center tank message is approximately 138 gallons.


Regards,
Green-dot

[SyEng]

Green-dot

The amount of water for the center tank message is approximately 138 gallons.

This seems rather a lot of water. Are you sure?

[grebllaw123d]

You wrote:

What if something was frozen in the system, defrosted and moved to cause an obstruction during the descent ? the aircraft is symmetrical, are the tank layouts ?
Just a thought, as if it was water it would melt and leave no trace.

I have had the same thoughts for a while - expecially after having read the latest report several times.
No discrepancies of serious nature has been found on the aircraft - all systems seem to have been working - all regulations with regard to keeping correct fuel temperatures are adhered to - etc - etc.

But it crashed anyway!

I am afraid that this accident may never be fully explaned:confused::confused::ugh:

[wilyflier]

airfoilmod,
...I still dont follow you.
... Fall in pressure is accompanied by a fall in boiling point and an increase in evaporation (or even gassing) ,I presume youve made tea in the galley at 8000ft cabin alt?
...When you open the soda bottle, pressure drops sharply and the gas expands , temperature goes down, producing sufficient drop in the water to freeze it into ice slush .But dont tell me we suddenly find the freezing point of the water going up
....No ,the bottle temp goes down.Try it with the CO2 bottle ! Or the choke of my Rotax carburetter
Chillyflier

[GordyOZ]

"Further, I note now, having missed the text before, that the AAIB Special Bulletin 1/2008 concludes with:
"In addition, comprehensive examination and analysis is to be conducted on the entire aircraft and engine fuel system; including the modelling of fuel flows taking account of the environmental and aerodynamic effects.""

It seems to me this is the most likely way the AAIB will uncover the cause.

I dont know how much data they have recovered from the flight recorders, but must be enough for some detailed modeling. If the fuel flow is the common mode failure, it was asynchronous by 7 seconds between the engines. Is it not possible the initial response to a demand for thrust was using the fuel in the pipework and any other volumes after the restriction blockage.

So if we know the diameter of the pipework, the speed of the engines, caculated quantity of fuel used in the 3 seconds one engine and 7 seconds the other, cant one calculate the distance back along the fuel lines when the fuel stopped coming? Is there an offcentre pump, tank, point or junction that fits the data?

Just an ideaMartin2116, that is exactly what I was thinking. Furthermore the obstruction was not complete because the engines still had enough fuel to idle after the incident which means the obstruction could have occurred / formed at different times but being the engines were only requiring minimal fuel prior to throttle up it was not noticed. Once more power was requested, the result of the obstruction became noticeable after the excess fuel in the lines downstream of the obstruction was used up.

If both fuel paths are not symmetrical but one has the ability to store more fuel in the lines then it could explain the 4 second difference. If the obstructions happened at different points that would also explain the 4 second difference though not as plausible. A third explanation for the 4 second difference would be that one side's lines downstream of the obstruction weren't as full of fuel as the other, ie. half as full, that would also explain the difference. A final explanation would be that both engines weren't burning the same quantity of fuel per second on throttle up, but I doubt that would be the case.

If 7 seconds calculates to be the point of the fuel intakes at the fuel tanks, then being there are two intakes on each tank is it possible that one of the intakes was completely blocked, meaning the lines associated with that particular intake were dry of fuel, while the other three intakes were only partially blocked, thus allowing about double the fuel in the lines on one side as opposed to the other.

Hopefully the investigation team already has or soon will be doing all the calculations necessary to find these points in the fuel supply as they will be key points to examine for possible causes.

[peebs24]

I used to run the company that made most of the oil/water separators used in a/c refueling. The units are designed to deliver fuel with less than 5ppm water. There is also (supposed to be) a shut off on the delivery side which stops delivery if fuel with more that 5ppm water is detected. Of course, 5ppm of water can accumulate over several refuels but it was always felt that the scavenging pumps would take care of most of the build up and tank draining during routine maintenance would clear the rest. I am now retired so I am not sure if this is still the standard for aviation fuel. I am a PPL so I am not familiar with the details of commercial a/c fuel systems.

[SyEng]

DraggieDriver posted:
Centre tank is the warmest tank, so significant quantities of ice are unlikely to accumulate there.


According to the AAIB special report, the right MLG punctured the centre tank. I infer from this that the CT extends into the wings, outside of the fuselage profile. An empty tank in the wing will very quickly cold soak. On descent, moist incoming air will deposit ice on the tank walls. Where is the outboard CT boundary?



psalm139_9 posted:
...inlets for the center tank pumps are not located at the lowest point of the tank. In fact, there is a substantial amount of residual fuel which they can't touch.


Where are the pickups? Fwd or Aft of cruise attitude lowest point? How high above tank floor?

Mig15 (http://www.pprune.org/forums/member.php?u=31610) posted:
Apart from the contents of the centre tank, which I'm making the assumption would have been used first, have been checked and were found to be in-spec.
(http://www.pprune.org/forums/member.php?u=31610)

From the AAIB special report: "Samples from the
centre tank had been contaminated by fire fighting
foam and hydraulic fluid: this contamination was a
consequence of the rupture of the right rear wall of the
centre tank." So couldn't check to see if in spec.


Green-dot

The amount of water for the center tank message is approximately 138 gallons.

That is an outrageous amount of water. Is that right? What's the system design philosophy there? The unsubstantiated American "leak" stated that a centre tank water warning occurred on the 2 previous departures. How is the water sensed?


I've not seen anything yet that invalidates my theory in post 216, but then I've very little info on the 777 fuel system. If anyone can post or PM system schematics, system description, training notes etc. I could make another late night of it and maybe invalidate it myself. Otherwise I'll just have to wait for the final report, and where's the fun in that?

Couple more things.

Stratification: no chance. (following para is general, not 777-specific) Apart from the scavenge jet pumps (if they're not full of FOD), the boost pumps cause plenty of mixing, through their own bypass/cooling flow discharged back into the tank, through swirling/entrainment near the inlet and through collector cell feed/overflow. There is also often fuel returned to tanks from other systems heat exchangers.

Does the 777 have collector cells?

Does the 777 have capacitative FQI probes ?

[airfoilmod]

At 8,000 feet,the water boils at lower temp.(lower pressure). This system is entropically related, all variables change to accomodate a conservation of energy in the system.
My Bottom Line is that Fuel, Emulsion, whatever is in the Line in the aircraft can Freeze simply by experiencing a sufficient drop in Pressure.
If you can grant me that, the rest isn't germane. Are you saying that Water always freezes at 0 degrees C.? The soda bottle can be below 0 Degrees with no ice, open the cap, instant ice, same low temp. The freezing point has migrated, but not because of Temperature.

[Green-dot]

SyEng,

Quote:

"This seems rather a lot of water. Are you sure?"


Yes, i am sure. G-YMMM is a B777-236 ER with a large center tank. The centertank carries a huge amount of fuel, approx. 176,400 lb (26,100 gallons).

The original B777-200 has small center tanks (near left and right wing root only, not in the fuselage/wing center section). Its capacity is approx. 83,800 lb (12,400 gallons). In the B777-200, the center tank message is shown at approximately 14.5 gallons.

Water detectors are ultrasonic devices. The FQPU sends signals to the water detectors. The water detectors send a puls to the bottom of the tank. If there is water at the bottom of the tank, the pulse reflects off the boundary layer between water and fuel. I think there is a minimum layer of water required before water can be detected. Since the large (ER) center tank has a large relatively flat surface area, it is not surprising there is a larger amount of water present before it can be detected.

[SyEng]

Green-dot: okay, thanks. Not sure what the point of a water-detection system that only triggers at such a high volume is, though.

Airfoilmod: your physics is wrong. You seem to be muddling gas and liquid behaviour. Water freezes at 0°C. The pop-bottle phenomenon which you cite is to do with super-cooling. The release of pressure causes the appearance of finely dispersed CO2 bubbles which act as nucleation sites for crystallisation.

[HotDog]

Airfoldmod, I don't think you paid enough attention during physics lectures. Does altitude alter the freezing point of water?
By itself? If you put the water in a sealed, insulated container
and lofted it in a balloon? No. Altitude by itself is a measure of
how far away from the Earth's center you are, which in turn means how
strong gravity is. Gravity has very little influence on the freezing
point, because water is essentially incompressible.
However, you probably mean freezing in an open container, exposed to
the surrounding atmospheric pressure. In that case the answer is:
yes, for several reasons. First of all, the freezing point of water
increases with a decrease in the pressure applied to it. Hence the
freezing point of water will be less at high altitude and low
pressure. But this effect is small. The freezing point of water
rises a mere hundredth of a degree per atmosphere of decrease in
pressure.
It is also true that water collected at high altitude, for example
water droplets in high-altitude clouds, is exceptionally pure. This
water will not freeze easily, because ordinarily water needs some
``seed'' to grow a crystal of ice around. That seed is commonly a
speck of dirt or the walls of the container, but there isn't either at
high altitude, so liquid water droplets exist up there down to
ridiculous temperatures, -40 or so I believe.

[bill_s]

This poses some questions that I cannot answer, so comments from the qualified would be welcome.

Lets assume that the liquid in the wing tanks is a mixture of fuel and ice crystals. This fuel will be warmer than the top surface of the tank during most of the flight. Presumably, the ice crystals, unless they never reach the surface, will sublimate into some water vapor, which will freeze on the colder surfaces of the tank in the form of frost crystals.

Take this tank into warmer air, and the mat of ice crystals will drop off the now-warmer tank top, putting a bunch of snow into the fuel in a short time, possibly enough to overwhelm the jet pumps and clog the boost pump inlet screens at the wrong moment. This could happen to both port and starboard tanks at roughly the same time.

If this abnormal ice crystal load got past the inlet screens, it might migrate
through the boost pumps to the engine plumbing, making the same trouble.


For a greater stretch, substitute fuel vapor for water vapor. I see the problem that waxed fuel would rapidly melt when it fell into the warmer fuel. The water ice wouldn't melt until fuel temp went above 0 C.

These theories could be tested in a lab, or in a real acft with a camera in the tank. The trick would be to find OATs to match the flight in question.

/bill_s

[woodpecker]

I think we are all amazed by the 138 gallons quoted by Green-dot, thanks for a very informative post.

Could you please explain the working of the centre jet pumps. As operating crew on the aircraft in question the only control of the fuel leaving the centre tank is the two centre tank pumps (via their switches on the overhead fuel panel). As has been quoted before these (due to the attitude during cruise) stop feeding (uncovered) with roughly 900 kgs still remaining in the tank.

This 900kgs remains there until the wing tanks drop below a certain figure where the jet pumps remove it from the centre tank and pump it into the wing tanks. No annunciations on EICAS of the commencement or completion of this fuel transfer.

I think we can assume that the investigators are looking at how often the "water in tank maintenance message" has occurred on other aircraft.

Let us assume for a moment (and there is no reason tho think it was not working properly) that the message was correct having being flagged up on the last two sectors. My thought is, with this 138 gallons settled at the back of the centre tank (cruise attitude) the water would have remained there when the centre tank stopped feeding with 900kgs still in the tank.

In "normal" operation (without any water present) the centre tank (as covered above) is emptied automatically later in the cruise. Perhaps this 138 gallons of water which, sitting at the back of the tank had frozen. Normally it would have thawed during the descent and the jet pumps picked it up (I never in six years saw any "fuel" left in the centre tank on shutdown so the automatic system obviously works well). But, and it is a big but the report suggests the temperatures in Beijing were around minus 7 centigrade (on the ground) so there would have been no melting of any ice prior to arriving at Beijing. Hence it may have still been in the tank in the form of a sheet of ice.

After refuelling the maintenance message reoccurred regarding this 138 gallons of water. Even if it had thawed with the introduction of "warmer" fuel during refuelling (no mention made in the report of the actual fuel temperature available at Beijing but the OAT was minus 7C) this large quantity of water could have either remained frozen, or re-froze during the return sector.

It would have remained frozen until descending into the warm airmass around the UK, but with the attitude during the descent and initial approach being nose down (even during the "one hold" at LAM the report states that the aircraft was descending) the first time the jet pumps may have been able to pick up this water, all 138 gallons, was when following flap extension and speed reduction on the ILS glidepath (the perfect continuous descent) when the attitude increased above zero.

Experts in the layout of the pickup points of the centre jet pumps, and I appeal to the better knowledge of Green-dot, might enlighten us as to whether a thawed amount of water in the centre tank could have been transferred to, and then picked up, by the wing booster pumps then feeding it onto its associated engine once the aircraft attitude increased above zero during the final approach.

[avrflr]

Can the experts also explain how the > 138 gallons of water then chokes the engines, causes the plane to crash and leaves not a trace of water in the wing tanks?

If you dissolved 2 cups full of water in the remaining 10.5 tons of fuel it would fail a water test - i.e. it would no longer conform to spec. I dare say even the slowest of air accident investigators could have found some sign of the mythical "ice blockage" on the morning of the accident.

[GordyOZ]

Regarding woodpecker's post. Would the ice in the centre tank really be able to melt enough to cause enough liquid water to make a problem? Or wouldn't it be more likely that it could only melt enough to create a slush? If slush was pumped from the centre tank to the wing tanks, then could this slush have collected on the intake filters or elsewhere in the fuel delivery system and caused a major restriction in fuel flow? It would only take a relatively small amount of slush to cause a problem which would not be detected compared to the major amount of water required to cause a problem which should have been detected.

[Volume]

I infer from this that the CT extends into the wings, outside of the fuselage profile. An empty tank in the wing will very quickly cold soak. On descent, moist incoming air will deposit ice on the tank walls. Where is the outboard CT boundary?
At rib 8.
Rib 8 meets the front spar approximately at the inner end of the engine nacelle and the rear spar approximately in the center of the inboard spoiler.
CT volume is approximately 50% inside and 50% outside of the fuselage (25% on each side). The CT holds approximately 80 tons, which is 58% of the total fuel capacity.

[NSEU]

This seems rather a lot of water. Are you sure?

This also surprised me when I read it in the Boeing 777 Maintenance Manual. I quoted it in an earlier forum posting, but I was hesitant. I really wanted to get more information from a higher source.

Re the CWT scavenging system. The flow rates were quoted before. It takes a long time to normally scavenge the CWT because of the diameter of the scavenge pipes, but even if all 138 gallons of ice thawed during the descent and was scavenged, would mixing it with over 3000 gallons of remaining wing tank fuel degrade the engine performance so much?

Note that the wing tank water scavenge pumps would also be operating to scavenge water from the wing tanks as it was coming from the CT.

Regards.
NSEU

P.S. BTW, many thanks to the guys suggesting possible solutions to my own engine hesitation/stalling problems. Spent many hours trying to figure out the fuel tank venting system on my car... Long gone are the days when a simple breather pipe was stuck in the air to vent fumes. Now the system is controlled by the engine management system! What a rat's nest! (miles of tubing, wiring, a charcoal filter, check valve, ECU controlled-solenoid valve, (car) rollover valve, etc). When the engine is hot, the fumes are injected into inlet manifold. A faulty venting system can cause poor idling and engine running rich.. or cause excessive fuel fumes.

[Machaca]

http://img61.imageshack.us/img61/6208/777200erfueltanksvh4.th.jpg (http://img61.imageshack.us/my.php?image=777200erfueltanksvh4.jpg)


http://img57.imageshack.us/img57/5748/777200erfueltanks2dm2.th.jpg (http://img57.imageshack.us/my.php?image=777200erfueltanks2dm2.jpg)


http://img57.imageshack.us/img57/6752/777200erfueltanks5lm6.th.jpg (http://img57.imageshack.us/my.php?image=777200erfueltanks5lm6.jpg)


http://img57.imageshack.us/img57/989/777200erfueltanks3zm6.th.jpg (http://img57.imageshack.us/my.php?image=777200erfueltanks3zm6.jpg)

[PAXboy]

Non-pilot speaking
NSEUeven if all 138 gallons of ice thawed during the descent and was scavenged, would mixing it with over 3000 gallons of remaining wing tank fuel degrade the engine performance so much?From early on in the various threads, we have been told that the CT would have been empty, long before TOD.

We have been told that the CT is used first in it's entirety. Once fuel is below the level of the main pumps and the engines fed from the wing tanks, other pumps (the scavengers?) drain the tank down and put the remaining fuel into the wings. Thus, no great body of water would exist. If I recall correctly, that is a SOP.

I sit to be corrected.

[Machaca]

Are temperatures in the pylon and under the cowling much above OAT during cruise? Descent?

http://img57.imageshack.us/img57/1477/80066bsc7.th.jpg (http://img57.imageshack.us/my.php?image=80066bsc7.jpg)

[swiss_swiss]

for the fan cowl prob not too much after extended periods - why do u have a "theory"?

[tanimbar]

Warning: I'm non-professional; not crew, not engineer - just guest here, thanks.

Interesting posts overnight, many concentrating on the fuel and its state.

Woodpeckers post #280, and others, question whether some 138 gallons of water might have been present in the centre tank and that this, in some form and manner, caused the accident. Problem with this questioning is that the fuel tanks were drained of water at Heathrow before fuelling for the Beijing outboard sector. AAIB Special Bull. 1/2008 states:
"The aircraft's fuel tanks were last checked for water in the fuel on the 15 January 2008 at Heathrow; this was prior to its refuelling for the outboard sector to Beijing."

Additionally, the bulletin states "sump sample taken from the left and right main fuel tanks shortly after the accident revealed no significant quantities of water".

The bulletin further states "Initial results confirm that the fuel conforms to Jet A 1 specifications and that there were no signs of contamination or unusual levels of water content."

We should probably conclude that there was no significant quantity (i.e. something like 138 gallons) of water in the system when it left Heathrow and none when it returned to Heathrow. Even if there had been water in the centre tank before the crash-landing this did not find its way to the wing tanks and then to the engines.

With regard to my earlier posts (195,242), I questioned whether the fuel could stratify due to density and thermal anomalies, in a very cool environment, over an extended period of time, being subjected to high frequency vibration from the engines and so produce layers of liquid that stifle an engine(s) by decreasing the flow rate. Of course, this is a very complex regime, probably one with subtle negative and positive feedbacks, meaning that an initial stratification would progressively mutate into something very different.

Earlier I asked if the water scavenge jet pumps in the wing tanks would destroy stratification. Thanks to Green-dot (#267) for telling us how these pumps operate and for pointing out that detected water causes, "water detection message for a particular tank to show". There was no such message shown during the flight, therefore there was no water, greater than 7 gallons, present in the bottom of the wing tanks and the water scavenge jet pumps did not operate. Any stratification would not have been destroyed by these pumps. Hope I've not missed anything.

However, SyEng (#273) says'
"Stratification: no chance. (following para is general, not 777-specific) Apart from the scavenge jet pumps (if they're not full of FOD), the boost pumps cause plenty of mixing, through their own bypass/cooling flow discharged back into the tank, through swirling/entrainment near the inlet and through collector cell feed/overflow. There is also often fuel returned to tanks from other systems heat exchangers. "

SyEng, you say the paragraph is general, not 777-specific, so is it possible to confirm the destruction of any stratification in the wing tanks by the systems you mention for the 777?

Regards, Tanimbar

[Swedish Steve]

Some observations on the B777 fuel system

The centre tank is a large relatively flat based structure. The centre tank pump inlets are uncovered at about 900kg fuel remaining. The centre tank water scavenge pumps are always running, scavenging liquid from the bottom corners of the tank and delivering it to the booster pump inlets. The centre tank transfer jet pumps are running all the time, but will not deliver fuel to the wing tanks until they have dropped substantially (I posted the figures here a few days ago). There are also water scavenge pumps in the wing tanks that are always running.
Jet pumps have no moving parts. They take motive power from the booster pump outlets and direct it through a nozzle that creates a low pressure and sucks liquid up from the collector pipes. Typically a pump will have about 8 inlet pipes. These pipes are very small, say quarter of an inch dia. I have never been inside a B777 tank, but have good memories of working on Tristar scavenge systems which are very similar. The volume of liquid moved is very small and if all the jet pumps were sucking pure water it would never be enough to affect the flow of fuel to the engines.
Very occasionally an aircraft will land with fuel remaining in the centre tank. This will be because the jet pumps are blocked with debris. Small pieces of tank sealant will clog the nozzles. These are checked on major checks when the tanks are opened up.
Because of the flat bottom of the centre tank, there must be a lot of water in there (138 gallons) before the water sensing system could see it. It is spread over a large surface area. It is the same reason why the centre bank booster pumps stop pumping so early.

Water in tanks does not come from the fuel supplied. In my career I have done thousands of fuel water checks on bowsers, and never had a positive reading. The water comes from moist air that is present in the tanks when they are empty, the moisture condenses on the walls and drops into the bottom of the tank. We sump the tanks regularly to remove this water. Usually a few drops at most comes out of each tank. The reason for so little water is that the water scavenge systems work.
You cannot sump the tanks on the ramp during refuelling. It takes a long time for the water to separate out and accumulate on the bottom of the tank. It is done on layover checks every couple of days.

[HotDog]

My dear God, from aliens to EMI to RMI to running out of fuel, to icebergs in fuel tanks, Gordon Brown elctronic shields. What else can you mob helpfully suggest to the official, professional investigation team to put an end to this stream of absolute nonsense ragarding this accident.:confused:

[NSEU]

My dear God, from aliens to EMI to RMI to running out of fuel, to icebergs in fuel tanks,

From a previous post in another thread on this issue....

Quote:
Many, many years go, when I was a young pilot, there was an incident in where I live, with Airbus A300's. Company was Karair, at that time a charter subsidiary of Finnair, they had two A300's, with highest utilisation of the type then, basically flying non-stop between Finland and the Canary Islands. About 18 hours airborne per day per aircraft, if I recall correctly. At some point, it was discovered that there was a huge chunk of ice floating in the fuel tank of one of the aircraft, as the condenced water never had time to melt, and thus had never been drained from the system between the flights. The aircraft had actually been very close to fuel starvation because of this. Of course, about 20 years have passed, lessons have been learnt, and this could not happen again, couldn't it...?

Now this rings a bell.

I think about 10 years ago Continental had an issue with their early 777s in that during winter ops from NWK the fuel temp never dropped sufficiently to allow any suspended/solid water to thaw and therefore be drained during normal routine checks. Result was a very large, thick sheet of ice in the base of the fuel tanks which would often give erroneous tank qty readings.

I have no idea if this has anything to do with recent events. I just wanted to comment on the above quote.

NSEU
Quote:
even if all 138 gallons of ice thawed during the descent and was scavenged, would mixing it with over 3000 gallons of remaining wing tank fuel degrade the engine performance so much?

From early on in the various threads, we have been told that the CT would have been empty, long before TOD.

We have been told that the CT is used first in it's entirety. Once fuel is below the level of the main pumps and the engines fed from the wing tanks, other pumps (the scavengers?) drain the tank down and put the remaining fuel into the wings. Thus, no great body of water would exist. If I recall correctly, that is a SOP.

I was simply speculating on what would happen if there was ice in the bottom of the tank. You can't scavenge ice.

Rgds.
NSEU

[Bushfiva]

Is there any truth in Private Eye's observations on p29 of issue 1204? Is it normal to have redundant software written by different companies in the commercial aerospace industry?

[Oldlae]

Machaca
Thanks for the drawings, would you have a schematic drawing of the aircraft fuel system from tanks to engine you could show us?

[infrequentflyer789]

I was simply speculating on what would happen if there was ice in the bottom of the tank. You can't scavenge ice.


What would happen is that it would stay in the tank as ice, until it melted when it would stay in the tank as water. It would then be found there (as either ice or water), at the point that the investigators looked at the tanks and, in fact, found "no significant quantities of water".

[Joetom]

One point to mention.......after the first engine lack of power, was a cross feed valve opened before second engine lack of power occured???

[HotDog]

From a previous post in another thread on this issue....


Thanks for that NSEU, glad to say that in 33 years of flying, I never encountered an iceberg. Pity Titanic didn't have wings. Interesting username you have. Neutron Single Event Upset?:ok:

[Yellow Shark]

Is there any truth in Private Eye's observations on p29 of issue 1204? Is it normal to have redundant software written by different companies in the commercial aerospace industry?


It is not the norm at all. In fact it is very much the exception to the norm. Typically, most systems will have more than one channel (think of it as a primary channel and a back up channel) on separate cards. Typically there would be some health checking between the channels with the primary staying in control of the system unless it is "less healthy" than the second channel. In most cases, the software contained in each channel is identical. In rare cases, the software will be different (referred to as Multi Version Dissimilar Software in RTCA/DO-178B - the guidance to which the vast majority of modern aeronautical software is compliant).

[infrequentflyer789]

Is there any truth in Private Eye's observations on p29 of issue 1204? Is it normal to have redundant software written by different companies in the commercial aerospace industry?

On the first, I don't know. Porus chinese walls I could believe, ditching triplex development completely I would find slightly suprising. I don't know the details though.

As to the second question - yes. Although it may be better stated that normal would be separate teams (which may be in same company). Typically the teams would be in different sites / locations etc. (regardless of company). The geographical separation probably doesn't buy you as much these days.

The technique is known as multi-version or N-version development. The assumptions (eg. that separate development reduces common-mode failure risk) that underly it have been questioned - look up Knight Leveson experiment.


All of which, though interesting, is of no relevance to BA38, as the AAIB have already established that flight data shows all the software working correctly right through to opening of the fuel valves. The only possibility for software failure now is if it was a type of failure that caused the engines not to respond as commanded and simultaneously caused all systems to send fake data to QAR and FDR that everything was normal. Simultaneous (or nearly) flying saucer ingestion is more probable.

[grebllaw123d]

Swedish Steve,

You say that the CTR tank water scavenge pumps are ALWAYS running.

But you also state that their "power supply" comes from the tank booster pumps outlets.

My question is then - how can the water scavenge pumps run if there is no fuel in the CTR tank?

I suppose that they will shut down automatically, when booster pumps stop producing pressure due lack of fuel (at approx. 900 kg) - you see what I mean?:confused:

[TheShadow]

My dear God, from aliens to EMI to RMI to running out of fuel, to icebergs in fuel tanks, Gordon Brown electronic shields. What else can you mob helpfully suggest to the official, professional investigation team to put an end to this stream of absolute nonsense regarding this accident.

It would appear that the evidence and opinion is becoming increasingly supportive of the center-tank having been the logical source of the obstruction causing the double-engine stagnation and pump cavitation (as pointed out in detail at post 111) (http://www.pprune.org/forums/showpost.php?p=3922140&postcount=111)
.

It has become a plain and simple Occam's Razor exercise (http://en.wikipedia.org/wiki/Occam's_Razor)

All that would appear necessary to identify now is the exact physics, timing and mechanics of the event.

[scanscanscan]

Correct me again if I am wrong please.....Engine failure drill (or possibly thought engine failure)
The drill is.....after Fuel Control Switch to cut off action (possibly not done) comes....open fuel cross feed...start APU..
Question ...Any evidence on the tapes a crew member did this?
Presently it seems people think a fuel cross feed was open and the APU was in the first stages of starting.
If the engines were giving power above flight idle to impact...why did the APU
start without human assistance.
If it did begin to start automaticly it seems it started with the landing gear
collapsed and one engine fuel cock open.
It also appears the increasing pitch attitude to near stall AOA if that occured was not helpfull to fuel feed problems.
Could a B777 pilot (Hand SOLO maybe) explain the logic of how this all could have occured.

[gas path]

With fuel in the CWT and the (CWT) boost pumps running (this fuel is ALWAYS used first due to the fact that the pump pressure is 36psi as opposed to 12 psi for the wing tank pumps) the motive flow water scavenge pumps draw fluid from the bottom of the tank and pass it into the inlet side of its respective boost pump. As Swedish Steve points out these scavenge 'pumps' are small diameter pipes certainly less than 1/2 inch bore.
Each wing tank boost pump also has a fuel scavenge motive flow pump BUT this line (same or similar diameter!) has a float operated valve in the CWT AND a float operated valve in its respective wing tank. When the fuel is used up (down to about 900kgs) in the CWT the float valve will open and fuel will attempt to move into the wing tanks, BUT at this point because the wing tanks are full the float operated valve cannot open. When the fuel level in the wing tanks has dropped to a predetermined level the float valves open and the fuel is scavenged from the CWT into the wing tanks.

[Swedish Steve]

You say that the CTR tank water scavenge pumps are ALWAYS running.

But you also state that their "power supply" comes from the tank booster pumps outlets.

My question is then - how can the water scavenge pumps run if there is no fuel in the CTR tank?

I suppose that they will shut down automatically, when booster pumps stop producing pressure due lack of fuel (at approx. 900 kg) - you see what I mean?

Yes, took a peek in the AMM. It is not very clear but the Centre tank scavenge pump and the Centre tank Water scavenge pump are linked. It looks as though with the Centre Tank scavenge system running, liquid is sucked through the centre tank water scavenge lines as well. The centre tank scavenge jet pump motive power comes from the wing booster pumps.

[JamesCam]

Re drop in fuel pressure - If there was an obstruction in the fuel supply between the tanks and the HP pump(s) the pressure in the pipework between the obstructon and the HP pump inlet would drop to hugely negative levels due to the suction caused by the HP pumps. Could this not cause rapid freezing of the fuel, especially if it had a higher than normal water content?

I accept that this doesn't explain both engines beinging affected at similar times etc, but I would be interested on peoples views on the possibility of fast freezing as described above.

My first post, so now crouching for the flames! I'm a PPL rotary pilot who has learnt pretty well everything about jetliner fuel systems from reading this facinating thread.

James

[nlarbale]

What would happen is that it would stay in the tank as ice, until it melted when it would stay in the tank as water. It would then be found there (as either ice or water), at the point that the investigators looked at the tanks and, in fact, found "no significant quantities of water".
From my reading of the AAIB report, they tested the wing tanks, but due to contamination with foam, etc, the center tanks were not tested. Also, due to the center tank breach by MLG, does it not seem possible that any ice may have melted and drained from the center tank by the time the AAIB had a look, or any remaining water mixed with foam etc so as to make any analysis difficult at best

[SyEng]

Avrflr
Can the experts also explain how the > 138 gallons of water then chokes the engines, causes the plane to crash and leaves not a trace of water in the wing tanks?


We’re talking about the centre tank, not the wing tanks.


NSEU
but even if all 138 gallons of ice thawed during the descent and was scavenged, would mixing it with over 3000 gallons of remaining wing tank fuel degrade the engine performance so much?

No, it would be fine.

Machaca
Thanks for the pics. Got a system schematic?



Tanimbar
SyEng, you say the paragraph is general, not 777-specific, so is it possible to confirm the destruction of any stratification in the wing tanks by the systems you mention for the 777?

No, but I can’t imagine the 777 tank environment is so different to the types I’ve worked on. Secondly, in many years experience, I’ve never come across a single reference to fuel stratification as an issue for aircraft fuel systems.

First, several folks here seem to be assuming that all the aircraft systems were working as designed and that, e.g. “the CT would have emptied early on” or that the water would have been scavenged into the wing tanks. This approach doesn’t make too much sense. If it did, the corollary is that this aircraft systems were operating as the designers intended, and 777s would be dropping out of the sky every other day. There must have been failures (not necessarily equipment failures).

My inferred design philosophy for the CT transfer system is:
-CT boost pumps operate until the inlets uncover. Inlets are positioned forward in the tank to avoid picking up large quantities of water in climb/cruise attitude.
-Wing tank boost pumps now take over supply to engine feed.
-CT (fuel) scavenge jet pumps with motive flow from wing tank boost pumps empty the CT at a leisurely pace. Any water picked up is safely mixed with wing tank fuel before being fed to the engines.
-CT water scavenge jet pumps get motive flow from the CT boost pumps, so only operated when CT boost pumps do.

Now, here are the 2 functional failures necessary to support my theory (post 216):

1) Failure to scavenge effectively CT water.
2) Engine feed source switches from wings to CT during approach.

Failure 1) possible contributory factors:
1a) Water remains frozen during turnarounds precluding effective drains operation (See NSEU post 292).
1b) Water remains frozen during most of flight precluding effective water scavenge operation.
1c) FOD

Failure 2) possible contributory factors:
1a) The most nose-down attitude of the whole flight (including descent) occurs when landing flaps are selected. This I think is likely true of many civil types. Perhaps someone can confirm for 777. So any residual liquid in the CT moves forward at this point.
1b) CT boost pumps remain running throughout flight (I imagine this should generate a warning).
1b) CT boost pumps switch back on uncommanded when pick-ups become covered (is there any way (including failures) that this can happen in the 777 system?).
1c CT boost pumps switch back on by crew action.

Please remember that the CT was breached and contaminated by firefighter’s foam and hydraulic fluid after the landing. It is not clear from the AAIB report that they even tested for water in the CT. It sounds like it may have been a pointless exercise.

It is conceivable that in the final seconds of the approach, with the increase in pitch, the CT boost pump inlets uncovered again allowing engine feed to resume from the wings, helpfully flushing evidence from the feed lines but not in time for the engines to spool up enough to make a great difference to the outcome.

Like I said before, I’ve not seen anything here or from the AAIB that rules out this theory. I’m open to offers, though.

[steamchicken]

In the B777-200, the center tank message is shown at approximately 14.5 gallons.

14 *decimal* 5. Does anyone else think the "138 gallons H20" thing is a missing decimal point? Otherwise the difference between the -200 and the -200ER is just shy a factor of 10; and I doubt the -200ER's centre tank is 10 times as big as the -200's.

[borghha]

1b) CT boost pumps switch back on uncommanded when pick-ups become covered (is there any way (including failures) that this can happen in the 777 system?).

If this were to produce any effect, the fuel scavenge valves in the wing tanks would have to open or to be open, as an earlier poster said. But at what wing tank fuel level do these valves open? would the amount left in the tanks of this flight come anywhere near that level?

and where are the fuel scavenge line outlets in the wing tanks? is there any chance of ice or slush coming from them partially obstructing the boost pump inlet screens in the wings?

[SyEng]

Borghha
If this were to produce any effect...

The effect of CT boost pumps switching on with inlets covered is to feed CT fuel (or water) direct to the engines. (as I understand the system... in the absence of schematics etc.)

[borghha]

Yes sorry SyEng, I was thinking of the CT fuel scavenge pumps being triggered... but I understood this to happen only if the main tanks are low on fuel, triggering an EICAS message too and leaving a trace on the FDR. I was trying to understand how low on fuel they have to be and to compare this to the actual fuel on board.

[SyEng]

Borgha,

See Swedish Steve's post 304 above. I imagine the function of the wing tank float valve on the CT fuel scavenge outlet is to prevent transfer into a full tank, i.e. prevent transfer causing wing tank overflow. If that is so, then the float valve coud be set fairly high up in the tank.

[Chris Scott]

Quote from SyEng [Today, 17:04]:
The most nose-down attitude of the whole flight (including descent) occurs when landing flaps are selected. This I think is likely true of many civil types. Perhaps someone can confirm for 777. So any residual liquid in the CT moves forward at this point.


Haven't flown the B777, but doubt that would be the case. In the absence of a B777 pilot on the forum at the moment (?) I'm going to stick my neck out. :}

The lowest pitch attitude is likely to have been in the early part of the descent from FL380, when still at or near the cruise Mach, when it is likely to have been zero or less. If you think about it, passenger and trolley-dolly comfort in the cruise dictate a deck angle of something between zero and 3 degrees nose-up.

To descend at idle thrust and maintain speed (the standard technique on jets), the [U]change of pitch angle is going to be about 3 - 5 degrees down, initially. This suggests a pitch attitude of minus-something in the descent, i.e., below the horizon.

With the aeroplane fully configured for landing, and at final approach speed, the attitude is definitely nose-up, even with full flap selected. Prior to that, on the glide-slope with intermediate flap, the speed is usually higher, resulting in a similar pitch attitude. There is, admittedly, a short-term pitch-down as each increase in flap is made, before the speed decays to the new value; but at no time would the actual pitch be below zero on the approach on a large modern jet.

Hope this helps.

[SyEng]

Thanks Chris,

In the "large amount of water in the tank" scenario, it would still be frozen at TOD. Agree it would be interesting to hear from 777 pilots on pitch attitudes. The answers to the pitch attitude question will be on the FDR of course.

[Chris Scott]

Okay SyEng, I like the way you argue your hypotheses.

There is another point worth mentioning, perhaps, again quoting the AAIB:
During the descent, from FL400, the A/C entered the hold at Lambourne at FL110; it remained in the hold for approximately 5 minutes, during which time it descended to FL90.

Entering the hold at FL110 is a completely different regime from the early part of the descent that I was dealing with above. The aeroplane will be on speeds now, not Mach. Entering the hold, the IAS would be back to about 210 - 240 kts, to comply with holding-pattern rules.

Also, although they continued to descend, they only averaged 400 ft/min during those 5 minutes. This is minimal - not much different from level flight. The pitch attitude to fly at (say) 220 kts would have been of the order of 5 - 8 degrees nose-up. This is as much or more than on final approach.

Additionally, there is every probability that significant thrust would have been used, unless they entered the hold at a higher speed than optimum, and were slowing down.

I wish the AAIB had told us whether thrust above idle was used in the hold, or later on the intermediate approach. It normally is at LHR.

You will draw your own inferences. A B777 pilot could tell us how much fuel-temperature rise normally takes place between FL400 and FL90 in a typical descent, with about 12 tonnes of fuel remaining in the wing tanks. Would it have risen from the -34C quoted to above 0C?

But as for your postulated large block of ice in the centre tank, who can tell?

[r011ingthunder]

SyEng said:
My inferred design philosophy for the CT transfer system is:
...
Now this is the best thought out argument I've seen, looking forward to seeing how this develops.

[infrequentflyer789]

From my reading of the AAIB report, they tested the wing tanks, but due to contamination with foam, etc, the center tanks were not tested. Also, due to the center tank breach by MLG, does it not seem possible that any ice may have melted and drained from the center tank by the time the AAIB had a look, or any remaining water mixed with foam etc so as to make any analysis difficult at best

Also CWT would have been empty by landing anyway...

If there was enough something (fuel or water) in CWT for the boost pumps to still be running (or they started up again) then I think that would be a serious anomaly that would be in the data and would have been jumped at by the investigation.

If not, then the only way (at least as I understand the fuel system) anything is getting from CWT to the engines is via fuel scavenge into the wing tanks. So you would find evidence of it in the wing tanks.

So, let's say there is a big lump of ice in CWT, so it doesn't therefore get scavenged earlier on, and it gets slushy during the descent, then the slush would end up in the wing tanks via fuel scavenge, where it might then perhaps make it's way to the engines in a big enough lump to cause a problem. Then afterwards you'd find water in the main tanks - and they didn't...

[grebllaw123d]

I am still reading your interesting post #306!:)

A few questions/comments:

You state: "CT water scavenge jet pumps get motive flow from the CT boost pumps, so only operated when CT boost pumps do"

Are you 100% sure that is the case? Info from the AMM?

I agree with the info re pitch attitudes given by Chris Scott.

You suggest that the crew might have left the CTR pumps running for the whole flight. I do not think they did!

I have not flown the 777, but the 767 with a much similar fuel system.
If you do not switch the pumps to OFF acc. SOP, you will get an EICAS message + caution lights in the pump push buttons on the overhead panel.
It is VERY unlikely that any crew would sit for hours without taking action.

BRGDS

[NARVAL]

I am new to this forum and would like to tell you that although french (no, do not hit me on the head) I am very impressed by the great honesty and technical knowledge of all concerned. I am now retired but have flown a bit for fourty years (pilot flight engineer and pilot again...).
I do not know the 777 and will certainly not play the Sherlock Homes role...
But your remarks lead me to state that to my knowledge, center fuel pumps should not be at work on finals. After emptying the central tank (well...nearly) they will only come alive again if the tail trim tank (when it exists) sends its fuel to the center fuel tank. To my knowledge, the fuel in the tail trim tank is never checked for water, as it is "put" there by transferring fuel from other tanks. But condensation might occur and lead, flight after flight, to some quantity of water resting there.The fuel in the main tanks was checked for water by BA on the very morning of the flight.
And on modern aircrafts (Airbus at least) there are inhibition phases for the central fuel pumps which prevent them from working on finals if there is fuel in the other wing tanks (pumps ON).
As for the aircraft attitude on finals, the pitch must have increased slowly as the speed decreased, to stay on the glideslope, but not much more than in the hold at FL90...so that should not explain a sudden rush of sump water to the pumps...
For a few years I flew the Fokker 100 and we had a lot of water in the tanks, and probably due to this, some cases of fuel contamination by fungus. This was apparently due to the size and ventilation of the tanks, but we checked them every morning for water and drained it. This certainly does not seem to be the case for the 777.
So: serious operator,competent investigation, and nothing yet...Should we not focus on this "wear" of the high pressure pumps due to cavitation? And it would certainly be helpful to know if this is found on other 777s or if it is the sole case to date? An important quantity of air mixing with the fuel seems incredible on both engines fuel systems, but that might explain the fuel partial starvation on finals? Not very proud of this explanation, but that plane certainly behaved in a very baffling way...

[Joetom]

A few points of interest.
.
1. CWT tanks are switched off at say 900KG to avoid a TWA 747 event.
2. Different fuel source to engines during T/O and Landing to avoid a single event causing problems to more than one engine.
3. I thought CWT 900KG is removed via the motive force of wing boost pumps.
4. Fuel temp in CWT can change very quick when not much fuel in the tank and the air con packs operating.
.
One question still not answered, after the first engine lack of thrust, did any of the cross feed valves open before the other engine suffered from a lack of thrust, can anybody answer this question- please-
.
After reading the last few posts, does anybody have the 777 MEL item about wing boost pumps inop, should have some good info on fuel figs required and pitch angles, seem to remember on the 747 landing with lots of extra fuel due to inop pumps and making sure fuel pipes never get uncovered. the 747 MEL on this item was often misunderstood and aircraft landed with less than required fuel in tank/tanks. sorry for the drift......

[manrow]

NARVAL

Your input is valued especially when achieved in English, when most of us on here could not do so in your language!

I understand the points you have made but my knowledge is insufficient to respond to you. Someone will, I am sure!

[TyroPicard]

bushfiva
Is there any truth in Private Eye's observations on p29 of issue 1204? Is it normal to have redundant software written by different companies in the commercial aerospace industry?

AFAIK when Airbus went FBW they used at least two software houses - from rusty memory Boeing's 777 design timetable was compromised by going down the same route, so they switched and just used the one company. But we are talking Flight Controls not Powerplant, so I suspect it has little relevance to this accident.
TP

[SeenItAll]

Let me add another analogy to this morass of speculation with respect to fuel freezing, pressure changes, etc.

If memory serves me correctly, there was a Discovery Channel show some years back concerning problems with the "dancing" fountains installed in front of the Bellagio Hotel in Las Vegas.

These fountains consisted of numerous jets that would spew out high pressure streams of water as commanded by a set of computer-controlled solenoid valves. To create their "dancing" effects in concert with music programs, the solenoids would very rapidly switch the individual jets on and off.

Almost immediately, this system began to have problems as the solenoids would cycle, but water would only intermittantly spew out of the fountain jet. When technicians would examine the valves, which were located at the bottom of the fountain pool, they would find no problem. Finally, someone had the wit to speculate that the rapid pressure drop from an opening of the solenoid valve was causing water to freeze in the line. But by the time the technician reached the valve to inspect it, Las Vegas' >40 degree C. summer heat had caused the ice plug to thaw and disappear.

I can't recall exactly the fix -- whether to slow down the solenoid actuation speed -- or something else. But the problem was eliminated and the fountains have become a major tourist attraction.

[grebllaw123d]

According the AAIB report:


"The fuel crossfeed valves indicated that they were closed and they had not been operated during the flight."

[infrequentflyer789]

Now, here are the 2 functional failures necessary to support my theory (post 216):

1) Failure to scavenge effectively CT water.
2) Engine feed source switches from wings to CT during approach.

Failure 1) possible contributory factors:
1a) Water remains frozen during turnarounds precluding effective drains operation (See NSEU post 292).
1b) Water remains frozen during most of flight precluding effective water scavenge operation.
1c) FOD

Failure 2) possible contributory factors:
1a) The most nose-down attitude of the whole flight (including descent) occurs when landing flaps are selected. This I think is likely true of many civil types. Perhaps someone can confirm for 777. So any residual liquid in the CT moves forward at this point.
1b) CT boost pumps remain running throughout flight (I imagine this should generate a warning).
1b) CT boost pumps switch back on uncommanded when pick-ups become covered (is there any way (including failures) that this can happen in the 777 system?).
1c CT boost pumps switch back on by crew action.

Please remember that the CT was breached and contaminated by firefighter’s foam and hydraulic fluid after the landing. It is not clear from the AAIB report that they even tested for water in the CT. It sounds like it may have been a pointless exercise.

It is conceivable that in the final seconds of the approach, with the increase in pitch, the CT boost pump inlets uncovered again allowing engine feed to resume from the wings, helpfully flushing evidence from the feed lines but not in time for the engines to spool up enough to make a great difference to the outcome.

Like I said before, I’ve not seen anything here or from the AAIB that rules out this theory. I’m open to offers, though.


I see some problems with it (maybe not fatal):

1. CWT boost pumps stop at 900kg - which is a fair bit of "something" to be in the tank.
2a. Given that CWT empty is the expected state (late in flight), CWT reading 900kg+ would be a serious anomaly that they would have picked up on by now.
or
2b. If theres 900kg of something (ice) in CWT but it is reading empty, then you've got a ton less fuel than expected in your wing tanks after fuel scavenge - which doesn't seem to fit the data either.

3a. If CWT boost pump operation is recorded, then having them switch on unexpectedly would be a serious anomaly that they would have picked up on by now.
or
3b. Even if CWT boost pump operation is not recorded directly, I would expect the CWT low pressure advisory (when they turn off) to be. By your theory, they turn off again close to landing (when it goes nose-up, as we know it did), which would generate this warning, which would have been spotted.


Overall, I can't see CWT feeding the engines direct at the end of flight without it showing one way or another in the recorded data, and I think this would have been flagged by now if it was the case. Contamination of some sort (at least water based) from CWT via fuel scavenge would go via wing tanks, where they would have found evidence of it.

I don't have an answer, but I'm struggling to see, with the info we have now, how the center tank could be involved.:confused:

[5LY]

The center tank pumps are manually turned off when the tank reaches 2000 pounds (900Kg.). The scavange system then operates automatically to draw out the remaining fuel when the total fuel remaining reaches 29,000 pounds (do your own conversion). By the time you're on approach your center tank is empty and no pumps are running. I get that there may be some unusable fuel, but it isn't going anywhere.

[Joetom]

--------------------------------------------------------------------------------

According the AAIB report:


"The fuel crossfeed valves indicated that they were closed and they had not been operated during the flight."
............................................................ ..................
............................................................ ..................
.
The report says the above up to the point of 780feet on the APP.
.
I thought I read in the distant past that post landing the valve switches were found in the open position, one valve was open and one valve was closed.
.
My thinking is about the 7 or 8 seconds between lack of thrust events, if one of the fuel manifolds had its problems and cross feed valve/s were opened then just may be the problem was allowed to move about.
.
Am sure some posters will know where the comments about the cross feed valves are...please post if found......thanks.......

[Green-dot]

Quoting Steamchicken:

"In the B777-200, the center tank message is shown at approximately 14.5 gallons.

14 *decimal* 5. Does anyone else think the "138 gallons H20" thing is a missing decimal point? Otherwise the difference between the -200 and the -200ER is just shy a factor of 10; and I doubt the -200ER's centre tank is 10 times as big as the -200's."

The 138 gallons is correct. There is no decimal point missing. As mentioned on previous posts, the 14.5 gallons applies to the -200 center wing tank which is located in the inboard wingbox of the left and right wing. The center wing dry bay divides the center tank in two parts. Two interconnect tubes connect the two halves. The center tank bottom surface has a slope where water can easily collect at the lowest point near the wing root (basically identical to the main wing tanks). This is where the water detector is located for the -200 configuration.

On the -200 ER, the center tank is in the wing center section and in the inboard wingbox of the left and right wings. The bottom surface of the tank in the wing center section is a much larger, flat, horizontal surface, measured from left to right side of the tank. The water detector is located on the right side of the center wing. This is why the alert level is set at 138 gallons because at that value the entire bottom surface (from left to right) will be covered with water and reach the detector.


Quoting Tanimbar, post #289:

"water detection message for a particular tank to show". There was no such message shown during the flight, therefore there was no water, greater than 7 gallons, present in the bottom of the wing tanks and the water scavenge jet pumps did not operate."

Tanimbar, the messages show up on the maintenance pages, which are not directly visible to the pilots. Only if the crew had reason to select a maintenance page they would have seen such a message. I am not suggesting these messages showed up during the subject flight. From what i have read from the AAIB report sofar is that the water content in any of the tanks never came close to a level for the messages to display.

The water scavenge pumps operate continuously (fuel scavenge pumps do not).

Below i have copied a post of mine from another thread (now closed) regarding the scavenge system:

There are four water scavenge jet pumps and two center tank fuel scavenge jet pumps.

Main tanks:
Each main tank has one water scavenge jet pump.

Center tank:
Each side of the center tank has a water scavenge jet pump and a fuel scavenge jet pump.

Fuel scavenge:
The fuel scavenge jet pumps take fuel from the low points in the center tank and send it to the main tanks. Float-operated shutoff valves prevent fuel scavenge when the main tanks are full. Inlet float-operated shutoff valves prevent motive flow to the jet pump until the center tank is almost empty. This prevents the fuel from flowing to the main tank too early if the outlet float-operated shutoff valve fails. A check valve in the jet pump prevents fuel movement from the main tank to the center tank.

Water scavenge:
The water scavenge jet pumps (continuously) take fluid from the low points in the tanks and send it to the fuel pump inlets. This prevents water from collecting in the bottom of the tanks.

Operation:
The scavenge pumps (both fuel and water) operate automatically when the fuel pumps are on. They use fuel from the fuel pumps as motive fuel. The flow of the motive fuel through the jet pump causes suction that takes fluid from the low point in the tanks.

Regards,
Green-dot

[CONF iture]

I thought I read in the distant past that post landing the valve switches were found in the open position, one valve was open and one valve was closed ...
... Am sure some posters will know where the comments about the cross feed valves are...please post if found......thanks.......
And that's the problem ...
Many things mentioned in this thread are NOT from AAIB reports ... but from here ! (http://www.pilotsofamerica.com/forum/showthread.php?t=19056)

Either we think this leak is pure BS ...
Either will we have to presume AAIB retains some valuable info ?

Just to make you think harder, on February 15th, Troy W has somehow edited his first paragraph:

January 30th version:
This is an update to the original thread on the Heathrow 777 that landed short. Special thanks to an industry insider friend of mine for sharing this VERY DETAILED information and PICTURES with us!

February 15th version:
This is an update to the original thread on the Heathrow 777 that landed short.

[avrflr]

Now, here are the 2 functional failures necessary to support my theory (post 216):

1) Failure to scavenge effectively CT water.
2) Engine feed source switches from wings to CT during approach.You forgot number 3: number 2 happens without it being logged by any on board systems. We'll call that miracle number 1It is conceivable that in the final seconds of the approach, with the increase in pitch, the CT boost pump inlets uncovered again allowing engine feed to resume from the wings, helpfully flushing evidence from the feed lines but not in time for the engines to spool up enough to make a great difference to the outcome.So, miracle number 2 is that the last drop of water passes through the injectors on both engines at the precise moment that the engines hit the ground? Come on.

[GordyOZ]

It is being repeatedly mentioned that no significant water/ice was found in the fuel. However ice melts, water evaporates, and a significant amount of fuel leaked out before the investigation began. Could this possibly explain the lack of evidence? Whatever was the cause it seems to be very illusive with no obvious evidence left behind. Water/ice seems to be the most obvious explanation for such a lack of remaining evidence. It is only natural then that a lot of suggestions as to possible causes involve the most likely culprits.

[psalm139_9]

narval: There is no tail trim tank on the 777.

[avrflr]

1. Ice melts leaving water at the bottom of whatever fuel it is in, making it difficult for it to evaporate.
2. I don't believe all of the water is going to get out of the engines' fuel systems. They are not open to the air so again, this makes evaporation difficult. The pipework in the engines was pressure and vacuum tested, so no leaks for the "miracle water" to escape from.
3. Jet fuel is hygroscopic. If you have free water in jet fuel, you also have dissolved water, which takes a while to get rid of and is easily detected down to very low concentrations.

There can be no escape for the saboteur water droplets. To believe it was water that brought down BA38 you have to believe that the AAIB, being suspicious of the quality of the fuel and aware of the forensic importance of the contents of the fuel systems, botched the examination of the engines very badly indeed.

[enicalyth]

I think the unexpectedly high cavitation must be looked at in detail. We do not seem to know what the kinematic viscosity [kv] actually was at the critical moment. "Pumpability" if there is such a word requires a certain kv which if we ever look it up at all is usually on a table of such viscosity versus temperature. But it is for clean uncontaminated kerosenes. The other impact on kv besides pumpability and cavitation is its effect on atomisation. In my second college year we used to do lab experiments in which a readily disassembled glass pump body could have various bronze impellers fitted. The working fluid was glycerine I think on one run and the last of the day to clean out the gunge was white spirit. We used to adulterate the working fluid with powdered chalk or packets of "Drummer's Dye", a cold-water dyestuff. You could visibly determine when conditions within the pump body became ape and the flowmeter assembly in parallel with the pump allowed you to determine kv quite accurately up to the onset of cavitation. The effects of density variation are very striking. The powdered dye being very gritty was not used often but it did allow us to to take a sample when the pump conditions broke down. This was then sprayed through a jet onto a piece of filter paper and subjected to electrophoresis for an hour or two to draw out lines where the dye had landed. It was very hit and miss, basically all you could tell was that kv had a first order effect of both cavitation and atomisation. Previously prepared papers of good atomisation could be contrasted with yours. Gycerine showed up what particulate matter did and aerated white spirit showed the effects of frothing to good advantage but of course you couldn't replicate aeration in a jet beyond using brute force. We mustn't overconcentrate on the effects of fuel temperature but maybe have a think. Dynamic viscosity is easily worked out in the lab and is predictable but kinematic viscosity is dynamic divided by density and at the instant pumpability, atomisation and metering all go to pot may have a fleeting cause that vanishes quickly post incident. However if conditions have been building up over a while the cause may have "evaporated" but the evidence of wear and tear remains. Rather than being the dog that didn't bark in the night it has maybe been yelping for ages. I don't have a copy any more but Walsh and Fletcher of Rolls-Royce did publish about ten years ago. My only thought then was it was all down to the filters plus a bit of heat and agitation and thought no more about it.

[swiss_swiss]

have not read thru every post but most of them and with all the theories about ice blocking the screens of the jet pumps etc no one has mentioned( i stand to be corrected) if this were to happen then you would get a fuel low pressure warning. i didnt read anything in the report about this.

[PBL]

Tyropicard responds to bushfiva's query Is there any truth in Private Eye's observations on p29 of issue 1204? Is it normal to have redundant software written by different companies in the commercial aerospace industry?

TP says when Airbus went FBW they used at least two software houses - from rusty memory Boeing's 777 design timetable was compromised by going down the same route, so they switched and just used the one company.

I addressed some of Private Eye's suggestions cursorily in Post #184 (http://www.pprune.org/forums/showpost.php?p=3924378&postcount=184)

Maybe now is the time to be a little more specific. The most accessible short reference to the A320-type architecture is pp131-5 of Cary Spitzer's Digital Avionics Systems (Second Edition, McGraw-Hill 1993).

There are actually 7 computers involved in primary flight control, falling into three different functional types of two ELACs, three SECs, and two FACs, with overlapping functional responsibilities. Each ELAC contains a pair of MC 68000 processors, a "command" (or "hot") and a "monitor" (as a check), which run the same inputs in parallel. The SW running on these two processors is "dissimilar", meaning each is written by a different team.

There is no formal criterion for "dissimilarity"; this is done in the hope that elementary bugs will be avoided, but the (in)famous Knight-Leveson work showed that important errors might well be correlated nevertheless. Bugs may also be avoided by using "correct by construction" (CbC) methods and very close inspection. Some like one; some like another. The very best *demonstrated* quality control in critical software to date uses CbC methods and close inspection.

The SECs also have dual processors, in "command" and "monitor" configuration, with similarly "dissimilar" SW.
They also have different processors: Intel 80186. The FACs have a similar dual structure to the ELACs and SECs.

The FACs, ELACs and SECs run in parallel on the inputs. The outputs cannot be determined by voting (you can't vote with only two processors!) but I don't know how the checks work.

The ELACs and SECs are also manufactured by different divisions of the same company, Sextant Avionique.

It may be that in later versions of the A320 the HW has changed. It is certain that the SW has changed over ops lifetime.

The B777 AIMS uses "common" SW across its multiply-redundant HW platforms, which are also of common design (so-called "line-replaceable units", LRUs). Spitzer is also good on AIMS (I have been on a mailing list for a long time with the primary AIMS designers, Ken Hoyme and Kevin Driscoll). The only reference I have to the PFC is a paper by Bob Yeh of Boeing (Bob has a few papers on it, but they all cost money which I haven't yet forked out). The PFC is triple-redundant *in HW*, but they went with one SW; Yeh cites Knight-Leveson as well as some work by Avizienis at UCLA. But the reason why the PFC is single-source SW is as follows: The development of the PFC software during the 7J7 program confirmed that the three separate teams, in order to code their logic from the requiremnets, were having to ask Boeing so many questions for clarification of the requirements that the independence of the teams was irreparably compromised. This is the reason why Boeing elected to revert to the usual and customary method of creating and certifying flight critical source code. It was determined that there is a net gain in total system integrity with the single software design approach.

There it is in print from the horse's mouth. Note that Yeh also answers bushfiva's question whether it is "normal" to have redundant SW written by different companies by suggesting it was at time of writing "usual and customary" to have single-source, well-inspected code. With A320-type architectures occupying airspace all over the globe in their thousands, and B777 architectures occupying it in their hundreds, it is probably moot to ask what is "normal" or "usual and customary".

I hope this helps answer some questions about duplication and redundancy in the architecture of the digital avionics of common 4th-gen transports. If anybody wants to know more and thinks I may be able to help, please feel free to PM or email me.

PBL

[tanimbar]

Warning: I'm non-professional; not crew, not engineer - just guest here, thanks.

Green-dot,your post #328, thanks for the clarification regarding the visibility of maintenance pages to the flight crew. And, we agree with each other, there is no indication in the AAIB bulletins to suggest that water content in any of the tanks triggered a warning message. I also think the AAIB statements of fuel testing rule out gross water contamination of the fuel. This does not mean that H20 did not contribute to the cause of the accident, but then, neither does it mean H20 did contribute.

I seem to have reached a point where my lack of understanding of the 777 systems, coupled to some contradictory statements on how the systems work on this thread, has convinced me that I should now stop scribbling.

I'll leave the fuel stratification idea hanging mute and await the final AAIB report.

Thanks to the moderator(s) for allowing me to participate on this professional forum and for the forbearance of the professionals.

Last words - the flight crew performed truely wonderfully. I wonder how much additional revenue BA will earn over the coming years from that display of pure professionalism.

Regards, Tanimbar

PS. I reserve the right to return :ok:

[borghha]

.... My only thought then was it was all down to the filters plus a bit of heat and agitation and thought no more about it.


Very interesting post Enicalyth, thanks!

That bit of heat might just not have been there. Could the temperature of the fuel at the boost pump inlets have been significantly lower than the recorded total fuel temperature according to you (due to suction, ie pressure drop when more thrust was commanded) could this in turn have influenced viscosity enough to cause a restriction and hence cavitation? No water or ice involved in this scenario, nor any post-incident evidence after a certain time.

[Jetdoc]

I am not sure if it has been mentioned before, but in addition to the 2 fuel pumps in each main tank, there is a pump bypass valve in the left and right tanks that allow the engine driven fuel pump to suction fuel from the tanks in the event the boost pumps are not working. I believe that this situation would be highlighted by a level B ENG FUEL PRESSURE warning which includes an audio warning.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.
Even if the crew had no time to deal these warnings, these should have been recorded and the data should have been correlated with system faults in the central maintenance computers. I am sure that these computers have been interrogated already and we would have heard about these problems.

[Green-dot]

Quoting hotdog:

". . .from aliens to EMI to RMI. . . ."

May i remind you that a bad connection in aircraft wiring can result in EMI?

Neither the electronics nor the well shielded wiring itself but the wiring connections seem to have been problematic on occasions.

Sometimes the cause has been traced to such bad connection by disconnecting and reconnecting LRUs, solving the problem.

For example on one such incident (i stress, a different time, different plane), a MCP (mode control panel) was doing strange things intemittently like letting both pitch and autothrottle fight each other to maintain speed. Nearly all LRUs involved were changed before it was discovered that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved the problem.

From examples like this the industry has learned over the years.

There is also a difference between a factory fresh airplane and an airplane being in service for several years subjected to the elements, and wear and tear. Good maintenance keeps things in check but EMI can be something intermittent which can only be addressed if it exists at the time of an inspection or an operational check.

Not to mention if it is a combination of signals mixing in like multiple signals from PEDs or from outside sources. PEDs also have specs but what happens to those specs if the user has dropped his PED once or twice on occasion, perhaps damaging it but is still functioning?

Now (and this is just theory) to go back to the aircraft in question and its engine feed system. What if EMI in some way had gotten hold of both spar valve control relays or open-close actuators on the valve control, mounted on the rear spar (outside of the fuselage / Faraday cage) and were temporarily closed and re-opened as the EMI appeared and disappeared. This would have restricted fuel flow to the engine pumps. What effect would that have had on pump cavitation . . . . .?


Also, i am aware that fuel "run" to "cut-off" switching would have appeared on the DFDR recording but would the DFDR also record uncommanded closure of the spar valves with the cut-off switches still in "run" position?


Regards,
Green-dot

[FrequentSLF]

For example on one such incident (i stress, a different time, different plane), a MCP (mode control panel) was doing strange things intemittently like letting both pitch and autothrottle fight each other to maintain speed. Nearly all LRUs involved were changed before it was discovered that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved the problem.

Based on my knowledge such kind of problem is not EMI. A badly grounded windshield heat cannot generate radio frequency which is the cause of EMI. Grounding issues are not related to EMI.

[SyEng]

Avrflr,

“We'll call that miracle number 1 “
“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.

Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “

Are “centre tank pump1, 2 running normally” recorded FDR parameters?
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?
Note that some things can’t be recorded as they are not signalled e.g. jet-pump induced water scavenge flow.
Can anyone out there help with an applicable list of FDR parameters?
While I'm asking, can anyone help with a schematic?



“So, miracle number 2 is that the last drop of water passes through the injectors on both engines at the precise moment that the engines hit the ground? Come on.”
That’s not what I said. So, what I did say is very unlikely. The accident was unlikely too. It had unlikely causes. Dismissing possibilities on the grounds that they are unlikely is not helpful. I’ve never noticed blinkers in the kit of any of the air accident investigators that I’ve met.

The key to this accident is that there was a common-mode failure. The same thing happened to both engines at the same time. One common failure mode could originate from the engine control system/software. This has been ruled out by the AAIB. The engines themselves also got a posthumous clean bill of health. Another source of a common-mode failure might be the fuel quality. The AAIB have found no fault with it. Likewise temperature: the aircraft was operating within its environmental design envelope.

As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank. If anyone can think of any others, please post them.

[forget]

FrequentSLF. Based on my knowledge such kind of problem is not EMI. A badly grounded windshield heat cannot generate radio frequency which is the cause of EMI. Grounding issues are not related to EMI.

Disagree. Arcing across a bad electrical connection can cause, and is called, Electro Magnetic Interference. Isn't that what Marconi used to send his first radio signals? :)

A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.

[Swedish Steve]

Are “centre tank pump1, 2 running normally” recorded FDR parameters?
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?


Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.
I.e. Pump switch ON or OFF command
and pressure switch Pressure or NO Pressure.
Failure of sensors is not recorded, has to be determined by logic.(not computor logic but human logic!)

[FrequentSLF]

Disagree. Arcing across a bad electrical connection can cause, and is called, Electro Magnetic Interference. Isn't that what Marconi used to send his first radio signals? :)

A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.

Agreed.
However here we are talking about grounding. There should be no arching on the ground connection.

[forget]

There should be no arcing on the ground connection. :confused::confused:

If the ground connection is the 'bad' connection that's where you get arcing. Where else?

[IcePack]

When using the ctre tank do they on the 777 switch off the pumps with 500kg remaining in the tank as is done on 75/76's due the alleged problems with fuel pumps. On the 76 this amount gets scavenged when the wing tanks are down to approx 7 tons each side. Mmm! just wondering?

[Swedish Steve]

When using the ctre tank do they on the 777 switch off the pumps with 500kg remaining in the tank as is done on 75/76's due the alleged problems with fuel pumps. On the 76 this amount gets scavenged when the wing tanks are down to approx 7 tons each side. Mmm! just wondering?

you get an EICAS msg when the centre tanks pumps are on, and the qty is around 900kg. You then turn off the centre tank pumps for the remainder of the flight. Later on as the Wing tank qty decreases, two transfer jet pumps transfer this 900kg to the wing tanks. This procedure is completed well before landing.

[THICKO]

............ at least all that garbage about EMI can be buried.....

Why?:confused:

[MU3001A]

SyEng

As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank. If anyone can think of any others, please post them.Normal procedure would appear to be that the centre tank pumps are switched off in response to the 900kgs EICAS message, meaning they wouldn't re-start manually or automatically unless they were 1st switched back on. System logic has the centre tank pump switches serving as annunciators for low pump pressure when the switches are on but this function is inhibited when the switches are off and I don't believe system logic would allow the centre tank pumps to operate automatically with the pumps switched off and this feature inhibited.

As I understand it, the only way the engines get fuel directly from the common source centre tank is when those pumps are operating and there is sufficient fuel in the tank. I expect the position of those switches will be a recorded parameter and thus known to investigators, who will therefore also know what source was feeding the engines at the time of the accident. If the engines were receiving fuel from the centre tank and not their respective wing tanks this would constitute an anomaly which I am sure the AAIB would have mentioned in their report. Therefore it seems reasonable to assume that at the time of the accident the centre tank switches were off and the engines were receiving fuel from their respective wing tanks. Any contaminated fuel scavenged from the centre tank would logically therefore be still present in some quantity in the wing tanks, but according to the AAIB they didn't find any.

The only remaining common mode failure in respect to the fuel system would appear to be the fuel itself.

Curiouser and curiouser.

[barrymung]

Quote: "Based on my knowledge such kind of problem is not EMI. A badly grounded windshield heat cannot generate radio frequency which is the cause of EMI. Grounding issues are not related to EMI."

Correct grounding is extremely important if EMI/EMC problems are to be minimised, especially if there are sensitive instruments nearby.

(I'm not saying this caused the problem)

[barrymung]

Can anyone tell me what happens if the AAIB/Boeing fail to find the cause of the crash?

Will they keep plodding on until they find something? Will they admit defeat and say "We don't know"? Will they do something else.

Obviously the effect of a non-result on the flying public can only be imagined but I suspect they'll lose faith in the 777 and possibly more..

[grebllaw123d]

You write:

"As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank."

I fully understand that you are searching for a common-mode failure - so am I!

But I have a big problem finding a scenario in which your CTR tank theory fits.:ugh:

If the SOP was followed, and I have no reason to believe otherwise, the CTR tank became empty LONG before arriving LHR (as already mentioned in many posts).
Any fuel left would imply double scavenge pump failure - very unlikely!

In any case the AAIB report states that there was an indicated fuel load of 10500 kg upon arrival - distributed between the 2 wing tanks (5100 kg and 5400 kg). Nothing is mentioned about fuel in the CTR tank.

Also "the flight was uneventful until the later stages of the approach"

With the information we have received (so far), I cannot see that the CTR tank played any part in the accident.

[SyEng]

Swedish Steve
“Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.”

Thanks for that. If this is the case and the FDR shows no switch selected on and no pump outlet pressure at the end of the flight, then I reckon this rules out my centre tank feed theory. Do you have a full list of ATA28 FDR parameters? How about a schematic? Training notes?

PAXboy

“We learnt that 777 standard procedure is to use the Centre tank fuel first and it it's entirety. Any fuel remaining in CT is then scavenged out to the wing tanks. The rest of the flight is supplied from each wing tank to it's respective engine. (Presumably for better trim?)”
It’s not SOP, it’s system design. The SOP is to select all tank pumps on before engine start, I expect. With all pumps on, the system feeds from the centre tank first by design. The reason for using centre tank fuel before wing tank fuel is for wing bending moment relief.

[barrymung]

"The key to this accident is that there was a common-mode failure"


Hmmmm. Does anyone know if any fuel related devices share any of the electronics, eg data bus, earth wires or whatever..?

My car uses a system called VANBus (Vehicle Area Network Bus) which is designed to save on cabling and thus cost...basically, all devices in the car are connected to this bus system and can talk to each other. It enables things like the speedo to talk to the radio so the volume gets adjusted as the speed increases...the wipers speed up and slow down automagically as well, depending on rain levels/road speed. The heater can talk to the headlights if it wants and the interior light to the engine management system if it wanted to. Well, you get the idea.

The major disadvantages is that a fault on the VANBus can cause all sorts of odd problems. One dodgy wire and the whole lot goes boof!

Aditionally, if a device on the VANBus starts sending out spurious data it can cause another device to mis-behave despite it being fully functional and apparently not related...

[avrflr]

Avrflr,


“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.

Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “A miracle: the odds of it happening within the lifetime of the Universe is indistinguishable from zero.
Probability that I may be proven to be totally wrong: 1 in 4:)

I accept that the accident was unlikely and therefore had an unlikely cause. I don't believe that gives one carte blanche to suggest miraculously improbable coincidences as the cause of the failure.Can anyone out there help with an applicable list of FDR parameters?That might be a useful exercise. We can agree that something did happen, and it appears to have gone unnoticed by the FDR. Perhaps a gap can be found where no data is collected that could provide a place for the problem to "hide".

The trouble with playing this game is that we are working with only partial information. If we knew exactly what the AAIB had tested and how they had tested it, we could come up with better theories, and for that matter, better arguments against theories. I may very well be making false assumptions as to what has been established as fact, based only on the very brief reports I have read. I don't believe any of the theories I have read are credible, based on the evidence in front of me. It seems that this is the conclusion the AAAIB have come to (with much more evidence), hence the continuing investigation.

[Milt]

The longer the puzzle persists the more we PPRuNers learn about airliner fuel systems and many interesting associated sub systems.

Pity we are not getting some inputs from the two pilots and Boeing who seem to be all overcome with secrecy. No doubt the investigation board sifts through this thread for ideas and what ifs.

Another thread has just addressed the complexity of the Joint Strike Fighter fuel system which has been subject to successful? exhaustive ground testing. As a TP I hope I can get access to the items which are planned for flight testing. It is likely that fuel will be used as a convenient cooling medium and there may be a problem with heated fuel which has elevated vapour pressures. The FADEC, FBW and software will need to be 'state of the art'.

[Oldlae]

Anyone is not going to beat the AAIB on this if there is an answer/cause they are going to find it. I have always said that that the FDR/QAR may not have the answers that might explain the loss of thrust of both engines durng a routine landing which might have been repeated many times before from the same airfields in the far east. Almost all of the aircraft operating from China are from the western world and the Chinese are most unlikely to supply contaminated fuel.

[SyEng]

MU3001A
Thanks for the info. See above, and below.

grebllaw123d

If the SOP was followed, and I have no reason to believe otherwise, the CTR tank became empty LONG before arriving LHR (as already mentioned in many posts).
Forgive me, but I would re-write this as “If the system functioned as per design intent the CTR tank became empty of fuel…”.

BTW, anyone who has worked in tanks will be aware that there is no such thing as an empty tank in operational aircraft. Those who have been involved in fuel systems design or support will be aware that there is always an unpumpable volume and there is always an undrainable volume.

Any fuel left would imply double scavenge pump failure - very unlikely!The causes of this accident were very unlikely. The water scavenge systems and the fuel scavenge systems may have been compromised by FOD or ice. Failure of unsignalled systems is dormant i.e. they may have been failed for years with no indication, unless there is a secondary effect e.g. uncommanded tank transfers. Ice in the CT would have thawed only during the later part of descent, starting with that in the sections of the CT exposed to external temperatures.

In any case the AAIB report states that there was an indicated fuel load of 10500 kg upon arrival - distributed between the 2 wing tanks (5100 kg and 5400 kg). Nothing is mentioned about fuel in the CTR tank.Correct.

Also "the flight was uneventful until the later stages of the approach" Agreed. So it’s a reasonable assumption that there were no failure warnings.

With the information we have received (so far), I cannot see that the CTR tank played any part in the accident.
Agreed. Also, with the information we have received (so far), I cannot see that the CTR tank did not play any part in the accident.


Here’s a process.

1) Understand the system
2) Find all possible ways in which combinations of failures could have the potential to cause the observed failure effect (regardless of your opinion as to their probability).
3) For each postulated failure mode, work out what evidence it would leave behind.
4) Look for evidence.
5) Rule out (and if you’re lucky, rule in) failure modes based on evidence.

It looks like my centre tank feed theory can probably be ruled out (as posted above) as the AAIB would have almost certainly seen indication of CT pumps running from the FDR.

So, my analysis is running on fumes and unless someone gets me a system schematic, FDR parameter list, system description or training notes soon, I’m off to bed.

[the bald eagle]

As Milt states, does seem a bit strange why the pilots and Boeing are still keeping quiet? which makes you think that the crew made a bit of a hash of it, does anyone know if they are suspended from duty or still flying?

[NSEU]

Swedish Steve said:

Yes, took a peek in the AMM. It is not very clear but the Centre tank scavenge pump and the Centre tank Water scavenge pump are linked. It looks as though with the Centre Tank scavenge system running, liquid is sucked through the centre tank water scavenge lines as well. The centre tank scavenge jet pump motive power comes from the wing booster pumps.

Steve....
I think I'm looking at the same blurry picture from the AMM, but enlarging it, I don't see the CT water scavenge system hooked up to wing tank pumps. So, with the CT O/J pumps OFF, I don't see the CT water scavenge system operating.

However, the scavenge pickups for fuel and water in the CT appear to be very close together on the schematic. If they are at the same height... what liquid the CT fuel scavenge system will be pumping would depend on what's in the CT (water, fuel, melted ice/slush) :)

Rgds.
NSEU

[Chris Scott]

Quote from PBL [Feb23/0913], re. A320 FBW architecture:
The FACs, ELACs and SECs run in parallel on the inputs. The outputs cannot be determined by voting (you can't vote with only two processors!) but I don't know how the checks work.
[Unquote]

Although some of your post went over my head, as an ex-A320 driver (from airline launch), found it fascinating and succinct. For a given computer type, we always wondered how genuinely independent the "command" SW programmer-team could be from the "monitor" team. After all, they presumably each have the same basic mission? One is minded of a murder trial, where the jury has to be isolated from outside information sources while reaching its verdict.

To suggest an answer to your question, my simplistic understanding was that, in the event of an anomaly between the command channel and the monitor channel, the computer concerned merely shut itself down. If it was an ELAC or SEC, not much of a problem for us: there were 4 more remaining. And we were allowed an attempt at reset. If it was a FAC, that was 50% of the flight-data calculation gone, but I don't think it was particularly serious. [I write in the absence of my FCOM, which is now way out of date anyway.]

Notwithstanding my second paragraph, and the gloomy predictions that were banded about with such relish when we put it into service 20 years ago, the A320 is now a mature design, and - so far - the worst scenarios expected have been conspicuous by their absence.
Let's hope the same can be said for the B777 in 10-years' time, despite the radically different philosophy adopted by Boeing.

PS: Isn't it remarkable that, 20 years on, the SECs may still be employing an Intel 80186 chip, now ancient history in the home-PC world? We were all buying PCs with 80286/80386 chips, even as the A320s were first going into service.

[NSEU]

Originally Posted by SyEng
Now, here are the 2 functional failures necessary to support my theory (post 216):

1) Failure to scavenge effectively CT water.
2) Engine feed source switches from wings to CT during approach.

Re 2).... This scenario seems very unlikely. Remember that with the crossfeed valves closed, each (L/R) CT pump feeds its respective engine. the control of the CT pumps would have to fail almost simultaneously to make both engines receive the contents of the CT.

Each CT pump is controlled by an independent ELCU (electronic load control unit). I haven't yet seen an internal diagram of the ELCU, but the control relay in the ELCU probably needs to see "inhibit circuit" deactivated AND the pump switched ON (by the pilots) before it will switch on: The pilot has to have the ability to turn OFF the pump in the air by deslecting the switch, irrespective of automatics.

Note that the ELCU control relay needs to be energised to turn on the pump. If the coil of the relay failed, relay would relax, turning OFF the pump. If relay contacts had fused ON (earlier), the CT pump would run out of fuel and the crew would have several indications of this.

The inhibit signal comes from ELMS. The inhibit is only for loadshedding under certain circumstances. As far as I can see, the pump doesn't switch itself off if pump pressure is low. Normally, the pilot responds to an EICAS message to turn off the pump during normal ops.
Note that low pump pressure turns on the overhead PRESS light for the pump, but unfortunately, the Boeing Maintenance Manual D&O section doesn't offer any insight into what turns on the EICAS message (low pump pressure and/or fuel quantity). We know that 900Kg is the trigger point, but whether this is how high the fuel pump pickup is in the CT or whether this is FQUIS generated, I don't yet know. Swedish Steve?

Note that fuel jettison system cannot turn on the CT pumps automatically if they have been manually turned off.

Rgds.
NSEU

[soem dood]

"...does seem a bit strange why the pilots and Boeing are still keeping quiet? which makes you think that the crew made a bit of a hash of it..."

Perhaps they have nothing of value to add at this point, while the investigation continues?

(Some people do remain silent when that is the case.)

I certainly can't agree that silence equates to any sort of probable fault. Even the fire-handles/fuel switch order of precedence issue looks to be more about allowing ambiguous (by process) timing of two independent activities by two actors, rather than a unique human error by this specific crew. In addition, the quirky wiring (prior to the directive to rewire the switch power) is a contributing factor to that (minor, in this instance) issue.

[ve3id]

Chris Scott said:

"PS: Isn't it remarkable that, 20 years on, the SECs may still be employing an Intel 80186 chip, now ancient history in the home-PC world? We were all buying PCs with 80286/80386 chips, even as the A320s were first going into service."

I couldn't let this go! NO, It is not remarkable, it is just good engineering. If a chip performs the designed task within spec it should stay in the design forever. The engineering world is not motivated by specsmanship and marketing like the consumer electronics world is. If you put a more modern chip in there, what benefit is it going to give you? Absolutely none, but what about the risk of mask errors introducing bugs that the original programmers did not test for because the new chip has circuits that were not even known back then? Very probable.

If you re-design with a new chip, you have to re-test all system components, and that costs a lot of money.

I used to make a lot of money keeping old PDP-11s going in Candu nuclear reactors, because they were reliable and every path through the program had been documented and tested for safety.

It's not a matter of keeping up with the Joneses!

[UNCTUOUS]

Looking at the Center Tank componentry that controls the automatic fuel transfer of CT fuel and pump inhibiting due to low pressure/contents etc, what components in the center-tank could conceivably be PREVENTED from operating (and possibly also from supplying warnings or inhibiting or switching off pumps) - by being iced (up or OVER)? Thinking float switches, flow switches, pressure switches or any combo of intermediating transducers or relays that could become iced (and later thaw and operate - creating the "on approach" situation of water-contaminated fuel supply).
.
Center section tank-mounted components that are low in the tank and would be covered by sheet ice are possible candidates - but also some components may have a lower temperature non-functioning trigger threshold that has so far not shown up.
.
Electronics can be prone to hibernation at extremely low temperatures and many components have moving parts, however small, that can be prone to immobilization due freezing/ice-over.

[glob99]

http://www.flightsimaviation.com/data/FARS/part_121-appM.html

I found this document that shows the 88 parameters required by the FAA to be recorded by the FDR. The BA 777 is probably recording many more parameters than this minimum set.

[BobT]

At one time, I also made my living engineering safety-critical systems.

Selection of last generation or older components for newer applications (like 186s for 777s) is effectively required to certify some systems. It's one of those small win-wins - it's typically a lower-cost component, but its maturity provides reliable failure rate figures and any (ahem) weaknesses in the component are known and can be engineered-around. It can be a feature, not a bug.

Regards redundant software written by different teams, I participated in one such effort that used diverse hardware and software. It's an immensely expensive proposition, with little practical advantage (Leveson's et al fine work notwithstanding).

A little thread drift, but I'll go no further.

Fascinating threads on this subject - I'm learning much.

[PBL]

Chris Scott said of the two channels in the ELAC/SEC/FAC boxes:

my ...... understanding was that, in the event of an anomaly between the command channel and the monitor channel, the computer concerned merely shut itself down.

I'm sorry, Chris, what I wrote was ambiguous.

What you say is of course correct when considering "command" and "monitor" channels inside one of the boxes.
My comment was addressed to discrepancies *between* two (or more) of the ELACs; or SECs; or FACs, and I didn't make that clear.

There are three SECs: they could presumably vote. But there are only two ELACs (FACs are less critical). What happens when they disagree? I don't know.

But I do know of one case in which they should have disagreed: the March 2001 incident to Lufthansa at Frankfurt, when the captain's sidestick was reverse-wired in roll. Since only one ELAC had been rewired (all plugs), then the two ELACs should have been getting exactly opposite inputs in roll (one ELAC the commanded roll; the other the exact opposite of what was commanded). So what happened, and how was it dealt with? The report is absolutely silent on this. (As well as being on the BFU WWW site, the report is in our compendium computer-Related Incidents with Commercial Aircraft (http://www.rvs.uni-bielefeld.de/publications/compendium/) ) I wonder why?

For a given computer type, we always wondered how genuinely independent the "command" SW programmer-team could be from the "monitor" team. After all, they presumably each have the same basic mission?

The big question is which faults are likely to be correlated, and which not. Mismatches between requirements and actual operational environment, which I call "requirements faults", account by some studies into aerospace critical digital systems for well over 95% of failures (Lutz, NASA/JPL, early '90's. The UK HSE looked at all types of critical systems from simple to complex, digital and non-digital, and got a figure of over 70% in the late 90's). So if 19 of 20 failures are due to requirements faults, then N-version programming is only going to avoid at most 1 out of 20 failures. That doesn't seem to me like a huge win.

A classic example of a failure of this sort in aviation is the 1983 Lufthansa overrun at Warsaw (also in the compendium, with commentary, including some by the former chief aerodynamicist of Concorde, Clive Leyman).

Another possibility for correlation amongst teams performing N-version programming is dependencies caused by mode of presentation of requirements (one description might tend to lead all teams "along certain paths"; another description along other paths). A third possibility is common types of errors occurring in the most likely places in both.

Isn't it remarkable that, 20 years on, the SECs may still be employing an Intel 80186 chip, now ancient history in the home-PC world? We were all buying PCs with 80286/80386 chips, even as the A320s were first going into service.

ve3id and BobT hit the nail on the head. Evolution in desktop computers is driven by evolution in requirements (the need to process video streaming from the network, for example, which did not exist when the 80186 was designed). The requirements for digital kit on the A320 are more or less stable as of certification; why change something which does a demonstrably adequate job? Especially when you have put all that effort into the demonstration!

The PFCs on the Space Shuttle are even older! There are five of them. Four of them are identical, running identical but very highly inspected SW of a few thousand lines of code (LOC). The fifth is a fall back: extremely limited functionality, but different HW and SW from different organisations.

This is all a bit of a Tech-Loggie diversion, but it does make a change from the continuing catalog of attempts to (mis)understand the B777 fuel system :)

While I am at it, I might as well stick my neck out on this one. I am with avrflr: I am guessing that something lies in the cracks between what is recorded and what went on; either something was not recorded or something wrote it was "X" on the recorders when it was really "Y"; for example, the command signal was sensed and recorded but not the true state of the component. Such things can take months to years to sort out.

BTW, bsieker has prepared both a Causal Control Flow Diagram (CCFD) of the EEC signal paths, and a similar diagram (but where what flows is fuel, not signals; maybe we should call it a CFFD) of the fuel paths in the Trent-powered B777. We have them out for review at the moment and will make them generally available after initial feedback. A CCFD is like a functional block diagram of a control system, except for three points:

* signal magnitudes are omitted (we sometimes use signs ± indicating monotone-increasing and monotone-decreasing influence where necessary, but it is not necessary here);

* equipment duplication (usually there to provide redundant pathways) may be omitted, and in this case only one instance of each duplicated device is shown;

* it will include the human operator as a control-system component if heshe is one

It shows the signal paths (or in the case of the fuel, the liquid-flow path) between all the various devices.

The CCFD (resp CFFD) is quite complicated. We find them indispensable for any reasonable understanding of how a moderately-complex system works; a necessary supplement to text-based description. They might well aid discussion here.

PBL

[hunterboy]

Most big companies would suspend the crew/employee until an investigation has been completed. It "removes" them from the situation.

[FullWings]

NSEU,

From Boeing AFM:

The design provides indication of low fuel quantity in the center tank based on input from the Fuel Quantity Processor Unit (FQPU) for a crew controlled wet-shutoff. If the crew fails to respond, or there is an error in the fuel gauging system, the ELMS system will de-power each center tank pump after 15 seconds of continuous low pressure based on input from the pump pressure switch.

So it looks like the pumps will shut themselves off and not run 'dry', based on pump outlet pressure. The FUEL LOW CENTER EICAS appears once the centre tank is <=900Kg.

[Swedish Steve]

NSEU
Steve....
I think I'm looking at the same blurry picture from the AMM, but enlarging it, I don't see the CT water scavenge system hooked up to wing tank pumps. So, with the CT O/J pumps OFF, I don't see the CT water scavenge system operating.

Yes I agree with you now. The centre tank water scavenge pump motive flow comes from the centre tank pump, so with the pump off it will be disabled.

From Boeing AFM:


Quote:
The design provides indication of low fuel quantity in the center tank based on input from the Fuel Quantity Processor Unit (FQPU) for a crew controlled wet-shutoff. If the crew fails to respond, or there is an error in the fuel gauging system, the ELMS system will de-power each center tank pump after 15 seconds of continuous low pressure based on input from the pump pressure switch.

So it looks like the pumps will shut themselves off and not run 'dry', based on pump outlet pressure. The FUEL LOW CENTER EICAS appears once the centre tank is <=900Kg.

I have been studying the manuals for the last two hours. I have found a statement in the Schematics manual that shows the Fuel Low Centre message coming from the FQPU, so I agree that it is quantity derived.
I cannot see any reference to a 15 sec T/D or ELMS auto shut off. There is an ELMS driven Centre pump inhibit that shuts down the centre tanks, but this is mainly to do with lack of power on the aircraft. It is a load shed device.
In the ELMS there is a 30sec T/D. With centre pump selected ON, and low output pressure, it will set the message FUEL PUMP CENTRE L/R Advisory/status.
I do not doubt your manual, just cannot prove it from the maint manuals that we have.
Shows how difficult the B777 is for engineers. All the signals are shown entering an ARINC 629 bus, and on the next page coming off into AIMS. Impossible to say if they go ellsewhere!
Perhaps we poor engineers need an AFM to find out how it works.

[gas path]

You beat me to it Steve :{
I cannot find a reference to the shutdown either only the load shedding.:8
Shows how difficult the B777 is for engineers.
Except the fuel system is really quite simple.....mechanically!

[jafa]

I know where yr coming from spotty m Mr, but if there really is a lot of water it will show up a lot sooner than that.

[FullWings]

I cannot see any reference to a 15 sec T/D or ELMS auto shut off.
I've had a further browse through the manuals and this appears to have come about through an update in 2006 (ELMS software?), so may not have found its way into all the documentation yet? Service bulletin was 777-28A0040.

[cribble]

I bet I am not alone in this as a 777 driver:

It is outstanding to read the considered opinions of those who seem to know what they are talking about; to read posts of folks who are not afraid to say "yes, good point. How about.....?"

Outstanding. You may not get the answer, but are shedding more light than noise on the question.

[Swedish Steve]

Fullwings
Quote:
I cannot see any reference to a 15 sec T/D or ELMS auto shut off.

I've had a further browse through the manuals and this appears to have come about through an update in 2006 (ELMS software?), so may not have found its way into all the documentation yet? Service bulletin was 777-28A0040.

Thats why I don't know about it. It is not listed as an SB in the BA B777 AMM.

[Jetdoc]

I just wanted to repost my comment that i made yesterday. It seemed to have been buried under a bunch of posts on EMI and computers that are not even installed on B777s. I just wanted to add a couple of comments regarding the fuel system.
I am not sure if it has been mentioned before, but in addition to the 2 fuel pumps in each main tank, there is a pump bypass valve in the left and right tanks that allow the engine driven fuel pump to suction fuel from the tanks in the event the boost pumps are not working. I believe that this situation would be highlighted by a level B ENG FUEL PRESSURE warning which includes an audio warning.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.
Even if the crew had no time to deal these warnings, these should have been recorded and the data should have been correlated with system faults in the central maintenance computers. I am sure that these computers have been interrogated already and we would have heard about these problems.
I have not heard of anything along these lines and I was wondering if any B777 guys had any comments.

[3db]

Green-dot.
"PEDs also have specs but what happens to those specs if the user has dropped his PED once or twice on occasion, perhaps damaging it but is still functioning? "

In my experience PED are normally built to a price, not a spec; as such. A/C, are generally still built to a spec and that includes all the electronics. If that spec is adequate, is a different question. However, the B777 is a very safe A/C.

In a different field, I once had to investigate a problem of a little old lady with voices coming from her kettle! Yes, its was true, voices were coming from her kettle. Quickly traced to a unusual combination of resistance/capacitance/inductance in the kettle was de-coding "our" radio transmissions. We provided a new kettle, end of problem. Just to illustrate PED are built to a price, any spec (unless it adds "bells/whistles") is secondary.


Barrymung.
I concur!
Previous AAIB investigations seem to indicate 3 or more items are required to fail before an accident results. Perhaps, only perhaps, EMI was 1 of the 3?

[sispanys ria]

Correct me where I'm wrong:

During the cruise, the CT pumps are switched of when reaching 900 kgs. Untill the wing tanks are 50 % empty, these 900 kgs remains in the CT, cooling down much faster than in the wings. Some of this fuel might freeze, and not be transfered by the scavenge pumps. During the descent, the remaining untransfered frozen fuel melts in a kind of slush. If for some reason the CT right pump was on, then this mix would have been transfered to both engines (via the X-feed that was supposed to be open according to the previous report and statements of the crew). This would explain the similar reaction of both engines, provided with slush coming from the same location. The 7s delay might be explained by the longer distance to reach the left engine than the right from the CT right pump.
Question, how can this CT right pump be operating during the approach ?

[Roseland]

The AAIB report states:

The aircraft was serviceable on departure from Beijing
and there were no relevant reported defects. It departed
with 79,000 kg of Jet A-1 fuel on board, and the planned
arrival fuel at London (Heathrow) was 6,900 kg.

My understanding is that the centre tank can hold 80,000 kg of fuel, and each wing tank can hold 29,000 kg.

Doesn't this suggest the aircraft could have completed this flight using just fuel from the centre tank!

Does anyone know how the fuel was distributed between these tanks?

[gas path]

Full wings first and the rest in the belly!

[bsieker]

What you say is of course correct when considering "command" and "monitor" channels inside one of the boxes.
My comment was addressed to discrepancies *between* two (or more) of the ELACs; or SECs; or FACs, and I didn't make that clear.

There are three SECs: they could presumably vote. But there are only two ELACs (FACs are less critical). What happens when they disagree? I don't know.

I can answer that at least partially.

The FACs, SECs and ELACs in the A320 do not in all cases control exactly the same control surfaces, and they never control the same surfaces at the same time through the same hydraulic system. There are three different strategies for dealing with failures:

1/ One computer only controls a fixed set of surfaces, with no overlaps:

- SEC 1 controls spoiler surfaces 3 and 4, SEC 2 control spoiler surface 5 and SEC 3 controls spoiler surfaces 1 and 2, on each side.

If one SEC fails, the respective spoiler surfaces can no longer be controlled and are retracted.

2/ One computer controls the surfaces, and there is a reversion priority if that fails. Different hydraulic systems are also used:

- ELAC 1 normally controls the ailerons, if it fails, ELAC 2 controls the ailerons. If both fail, the ailerons revert to damping mode.

- The reversion priority for the elevators is: ELAC 2, ELAC 1, SEC 2, SEC 1.

- for the rudder it is: FAC 1 -> FAC 2.

3/ multiple computers control the same surfaces, but through different hydraulic systems:

- SFCC 1 controls the slats through Blue hydraulic and flaps through Green hydraulic system, SFCC 2 controls slats through Green and flaps through Yellow hydraulic system.

(Source: FCOM 1.27.10, P 5, SEQ 100, REV 24)

So, for the infamous Lufthansa flight with wrongly wired sidestick, only ELAC 1 will control the ailerons with the wrong sese, and although the spoiler-roll-function will work in the correct sense, at low speeds, the ailerons are more effective than the spoilers, and roll-effect will be reversed.


Bernd

[dxzh]

Given the mundane nature of the flight and reliability of 777s, the set of circumstances leading to BA038 accident must be very rare.

My favourite, most unlikely alignment (of the Swiss cheeses) would be:

1. Outbound, centre tank fuel used first and remaining centre tank fuel later scavenged to main tanks.
2. Condensation froze on large inner surfaces of centre tank outbound.
3. Freezing surface temperature in Beijing so ice remained as ice on centre tank surfaces.
4. Refuelling melted some ice triggering water alert (138+ gallons) when taxiing but fuel cold and centre tank only 25% full so most ice remained frozen on centre tank surfaces.
5. Inbound, centre tank fuel used first and remaining centre tank fuel later scavenged to main tanks.
6. More condensation froze on large inner surfaces of centre tank inbound.
7. Ice on inner surfaces of centre tank only started to melt late on descent inbound.
8. Newly melted, very cold water scavenged (perhaps after change of attitude from flaps moved water between baffles closer to scavenge suction point) from centre tank to each of main tanks.
9. Main tank fuel well above Jet A1 freezing temp, but well below OAT and water freezing temp.
10. On entry to cold Jet A1, concentration of scavenged water froze forming ice particles suspended in or falling to bottom of each of main tanks.
11. Increased demand on finals sucked (and/or change of attitude from flaps moved) ice particles to inlets causing partial blockage to fuel line inlets from main tanks, exacerbated on right hand main tank by foreign object (scraper).
12. Fuel lines, heat exchangers, bypass, pumps, metering unit and engines continued to work but with a lot less fuel flow than desired.
13. Ice remained trapped in main tanks due to size of particles.
14. No water found in main tank sumps as did not settle there.
15. Only minute % of water found in each main tank as over 5+ tons of fuel in each.

First post – guess I will be on probation for a long time now.

[Green-dot]

Quoting 3db:

"In my experience PED are normally built to a price, not a spec; as such. A/C, are generally still built to a spec and that includes all the electronics. If that spec is adequate, is a different question. However, the B777 is a very safe A/C."

I agree, the B777 is a very safe A/C. If PEDs are only built to a price and not to a spec, does that mean there is no quality control? To my knowledge, a spec defines what a device is made of and what it should comply with (e.i. items or details included in a description of requirements or plans of a design).

3db:
"In a different field, I once had to investigate a problem of a little old lady with voices coming from her kettle! Yes, its was true, voices were coming from her kettle. Quickly traced to a unusual combination of resistance/capacitance/inductance in the kettle was de-coding "our" radio transmissions. We provided a new kettle, end of problem. Just to illustrate PED are built to a price, any spec (unless it adds "bells/whistles") is secondary."

Same as above, no quality control? Surely there must be procedures in place defining the allowable limits regarding transmitted radiation of PEDs before they are put on the market (and permitted to be used on a plane).

3db:
"Previous AAIB investigations seem to indicate 3 or more items are required to fail before an accident results. Perhaps, only perhaps, EMI was 1 of the 3?"

I agree, perhaps EMI could have been a contributing factor. I am also convinced that the B777 is a very reliable aircraft design.

Therefore, EMI seems highly unlikely. That said, so is a dual engine rollback on a design such as the B777.

The reason i address the EMI issue is that i have had first hand experience with unscheduled closing of fuel shutoff valves in the past due to EMI. This was on another type of aircraft (not any of the Boeing types). I dug up my fuel system manuals for that particular A/C type and checked the wiring diagram which includes the original valve (before EMI became an issue) and the improved valve with an EMI filter installed (lifting restrictions after the original valves were replaced with the improved valves).

I am aware that on the B777 the engine fuel control switching interfaces with ELMS, ARINC 629, AIMS, OPAS and fire switches which are all well shielded systems. The aircraft i refer to (also a FBW design) has none of the above mentioned interfaces. But when comparing the basic electrical control circuit from the fuel control switches to the spar valve actuators, they are functually similar.

Both are fed by 28V dc and with fuel control switch position in "run" or "cutoff", depending on switch position, either the open or close coil in the control relay is energized which controls the valve actuator. Power on the open or close coil moves the actuator motor to the selected position until limit switches are reached which remove power from the actuator.

There is one physical difference between the valves i refer to and the B777 spar valves. The valve i refer to has the control relay (which was sensitive to EMI, hence the filter) integrated in the shutoff valve. In the B777 the control relay and spar valve are separate components. The spar valve control relays (together with the APU fuel shutoff valve relay) are grouped together on a single panel. However, i do not see any EMI filters on the B777 spar valve schematics. Perhaps not required due to other measures taken, making the system imune for such effects, i don't know. Location of other equipment in the vicinity of the relays or valves (or absence of it) is also a factor determining system sensitivity, which obviously varies between aircraft types.

Another point that may be of interest is that (theoretically assuming EMI was a factor) if the spar valve control relays were switched unscheduled from "run" to "cutoff" for a certain period of time, the APU fuel shutoff valve control relay could have switched from "closed" to "open" during the same unscheduled event due to its close proximity to the former control relays. This may perhaps explain why the APU inlet door was observed in the open position?

Since EMI has occurred sporadically in the past as i have explained, why couldn't it happen again on other aircraft designs?

Summarizing, i have factual information that action has been taken to prevent EMI on fuel shutoff valve control relays in the past on another aircraft type. But regarding this B777 incident, evidence (of a source) pointing in that direction would have to be found in order to determine it as a possible cause for a dual engine rollback.

Regards,
Green-dot

[NSEU]

So it looks like the pumps will shut themselves off and not run 'dry', based on pump outlet pressure. The FUEL LOW CENTER EICAS appears once the centre tank is <=900Kg.

Many thanks to FullWings and Swedish Steve...

Again, this shows us that we are only as good as the (blurry) manuals available to us ;)

Cheers.
NSEU

(Edit) P.S. Does anyone find it kind of worrying that fuel pumps can turn themselves off? :uhoh: Won't the crew get an EICAS message anyway if the pumps go low pressure?... and I'm sure the crew alertness monitor will wake them if they are asleep :}

[overthewing]

Coming at this from an IT perspective, can anyone tell me what the FDR actually records?

Specifically, if it records something that was commanded to happen, would it necessarily know that the 'something' didn't actually happen, if there was no failure signal?

I'm thinking that the fuel valves apparently tried to open to allow maximum fuel throughput. Would it be possible for the FDR to record the open-valve event, but have no knowledge of the valve's failure to do so?

I realise that it's very unlikely that this would happen on both engines at the same time, but then it looks like the cause of this accident was something very unlikely.

[PAXboy]

RoselandDoesn't this suggest the aircraft could have completed this flight using just fuel from the centre tank!No. Because we have heard in this thread that standard operating procedures on the 777 (for all operators) is use the centre tank FIRST and then the wing tanks.

In these threads we have heard more than once that the centre tank would have been empty by about half way through the sector.

Please correct this statement, if you know better.

[M.Mouse]

It is standard procedure for all the applicable Boeings which I have flown. Wing tanks are filled then the centre tank. Fuel is then used first from the centre tank and then the wing tanks. I believe it is a structural reason for doing so.

[FullWings]

...standard operating procedures on the 777 (for all operators) is use the centre tank FIRST and then the wing tanks.
Correct. I think one of the reasons is wing bending relief. If you have u/s centre tank fuel pumps and still have fuel in there, on most types it is a) limited to a certain amount and b) has to included as payload, not fuel (and not for the obvious reason!)

Coming at this from an IT perspective, can anyone tell me what the FDR actually records?

Specifically, if it records something that was commanded to happen, would it necessarily know that the 'something' didn't actually happen, if there was no failure signal?
Most of the important valves/actuators, etc. have some sort of feedback as to the actual position or on/off open/shut, so that the operating systems can flag up a problem. Many, many maintenance messages that are generated read "XXX not in commanded position"; they often clear but are a sign of possible future problems. If there are no sensors to show success or failure, then this might be able to be logically inferred from other parameters; don't know how much of this goes on as I didn't design it...

Would it be possible for the FDR to record the open-valve event, but have no knowledge of the valve's failure to do so?
Given the importance of this particular variable, I would wager a serious sum that this information would have been recorded on the FDR, QAR & non-volatile memory in the EECs, to name but a few.

Many thanks to FullWings and Swedish Steve...

Again, this shows us that we are only as good as the (blurry) manuals available to us

Cheers.
NSEU
Glad to be of service :)

[wilyflier]

As I remember the first AAIB report was said to have stated that the Captain after his initial debrief "Thought he had selected crossfeeds open" after the lack of engine response.
This would imply that Xfeeds OPEN would not be initiators of the problem.But also as I remember it was added that one Xfeed was open, but the other was not,(fully open) This led me to wonder out loud if the Xfeed had for some reason been like that the whole time

[NSEU]

11. Increased demand on finals sucked (and/or change of attitude from flaps moved) ice particles to inlets causing partial blockage to fuel line inlets from main tanks, exacerbated on right hand main tank by foreign object (scraper).

I mentioned a similar scenario a few days ago, but was shot down in flames....

As mentioned previously:
The scavenge plumbing tubing isn't large. It takes a long time for fuel to be scavenged. I don't think you're going to get a lot of slush through those pipes. Water, maybe, but someone said that even *water* in that quantity is still not enough to affect the engines that much.

To stop (wing) fuel reaching an engine, you'd have to block off both wing boost pump inlets AND the suction feed inlet.

Additional info: Note that the CT fuel scavenge system dumps liquid (fuel or water) well away from wing tank pump inlets (unlike the water scavenge system). If it's dumping slush.. .it's dumping it well away from the pump inlets.

Regards.
NSEU.

[Mad (Flt) Scientist]

Re the discussion of FDR parameters.

Without knowledge of the specific parameters recorded for this FDR, it's very dangerous to assume that "parameter X is important therefore would be recorded".

The FDR parameter list which is REQUIRED for certification, per the FARs and the equivalent other regulations is very much a minimum list. You may be surprised at just what can be missing. For example .... glob99 posted this list (http://www.pprune.org/forums/showpost.php?p=3933877&postcount=367). Check item 42, "Throttle/Power Lever Position". There is a Note to that requirement, which states that it only applies to airplanes with "non-mechanically linked cockpit engine controls". Which means that on any non-FADEC aircraft, where the engine is controlled hydro-mechanically, there is no recording of one of the main control inputs by the crew. Logically, throttle is quite important; you'd think an accident investigation would like to know it. But it's not required on some aircraft at all.

Bluntly, if it's not on the regulatory list, it's safer to assume it ISNT there, unless you have the actual spec to hand.

[dxzh]

Even if slush is only transferred into each main tank at rate of 200 kg per hour, then in 10 minutes that is 33 kg in each main tank.

If all, or even only part, of it freezes on contact with fuel that is a lot of potentially clogging debris in each main tank relative to the number and size of inlets. In context, the AAIB have highlighted for consideration four or so foreign objects in whole fuel system which are minute in comparison. I wholly agree that if it does NOT freeze in each main tank and remains as water then it becomes an irrelevance.

I have no idea which main tank inlet would be affected first in this most unlikely scenario which as you say requires the blockage of all inlets at least partially. I expect that eddies particularly from the operation of the the water scavenge pumps might push debris around unless/until it became trapped. Also I expect that the suction feed inlet might be blocked earlier without any noticeable effect - particularly on the right hand side given the foreign object.

[Wornout Rubber]

It was an interesting decision by the crew to leave the autopilot engaged as the speed decayed.
Perhaps there was a good reason for this. Perhaps they were understandably so preoccupied with trying to work out why there was no response from the thrust levers, that the speed decay went unnoticed.
However, the reason why the autopilot allowed the speed to decay was not because it was attempting to fly at the best speed for the situation presented to the crew. It was because it was attempting to maintain a glideslope that it was commanded to follow. Unfortunately, a decaying speed from about 140 knots at 750 feet to 108 knots at 200 feet, resulted in a severely degraded flight path angle.
If the autopilot/authorottle is not performing what it is commanded to do, (in this case maintaining the commanded speed), then it is best to disconnect, and correct the situation manually.
In this instance, as the speed started to decay, an autopilot disconnect followed by flying at a speed of between VREF and VREF minus 10 would, quite probably, have resulted in a different outcome, and a more controlled landing.

[Milt]

dxzh post #384

Not a bad scenario with commendable contemplation of many inter-relating aspects to line up the holes in your Swiss cheese BUT

Approximately how much water condensation do you contemplate will occur during the venting of an emptying CTank at heights where the vented air has very low specific humidity and which empty volume will be offset to a large extent by almost fully saturated fuel vapour. There will be extra venting with air during descents but my guess is that the most water you might get from the vented volume would be much less than enough to fill a tea cup.

Now there is a challenge to our meteorological boffins. Is my reasonably well educated guess better than yours?

And while you are about it how close might it be to a vacuum when jet fuel at sub zero temperatures C starts boiling? This is significant to the onset of cavitation at the HPressure fuel pump inlets.

[PBL]

overthewing asks
can anyone tell me what the FDR actually records?

Modern FDRs record a few hundred parameters. However, as Mad (Flt) Scientist points out, the parameters *required* to be recorded are comparatively few. In other words, you need to know the specific FDR installation to know what's on it.

if it records something that was commanded to happen, would it necessarily know that the 'something' didn't actually happen, if there was no failure signal?

One interpretation of the question: if the FDR records a command signal, does it necessarily record the reaction, if there is no equivalent sensor or other similar feedback?

The answer: obviously it doesn't.

Next interpretation: Are there command signals recorded, such that the reaction of the kit to that signal is not recorded?

Answer: Undoubtedly so.

... the fuel valves apparently tried to open to allow maximum fuel throughput. Would it be possible for the FDR to record the open-valve event, but have no knowledge of the valve's failure to do so?

Rephrase: is it possible for the FDR to record an open-valve command signal without recording the sensed position of the valve?

Answer: sure it's *possible*, but whether anything like that happened is something that I would think the AAIB knows already.

As FullWings notes, actual fuel flow is so fundamental a flight parameter that one assumes that both command and reaction are recorded. However, one does needs to know how something is sensed and what the failure modes of sensing are in order to judge whether record is a reliable indication of reality.

PBL

[snanceki]

Re: dxzh post #384

IMHO I believe that it would be extremely unlikely that both engines could have rolled back within 8 secs of each other resulting from an independent (ice or whatever) blockage in each wing tank pick up.
However I believe that you may not be far off target.

Before posting an alternative I would appreciate an answer to the following question.

How does fuel get from the CWT to the engines?

a. Via the wing tanks (i.e.pumped from CWT into the wing tanks then out again using the wing tank pumps) OR
b. direct from the CWT to a rail / manifold etc common with the output from the wing tanks, with the higher boost pressure from the CWT pump giving it priority to supply the engines?

Anybody got a pic?

How many boost pumps (not water scavenge) are there in the CWT. 1 or 2 (1 LH and 1 RH)?

JFI is this a 777 specific or standard approach to engine fuel supply management?

[sandbank]

Post #395 from Worn Out Rubber is very interesting -as is Topslides's post 101.

Presumably the AP just disconnected itself at some point - maybe at an altitude of around 40 feet - when it felt it could render no further assistance?

[borghha]

The AAIB reports states clearly that there was no fuel contamination or water present in the fuel from the main tanks. This however does not exclude waxing, since it was likely to be gone at the time the examination started at a ground temp of + 10°C.

The cold soak this a/c went through was extreme and prolonged. Pilots on the earlier thread said they descended to lower FL. On the BA38 flight, TAT dropped to -45° and fuel temp -35°. But that is, fuel temp as senses by he fuel temp probe in one of the main tanks. It seems possible that somewhere down the fuel path, the actual fuel temp might have dropped further, as there it would not be protected by the inertia of the large volumes in the tanks. Pressure drops caused by suction at pump inlets would have made the temp drop even further. (Temp directly proportionate to pressure)

All of this could have caused local waxing and restriction, until an equilibrium was created during the cruise between fuel flow and temp drop somewhere along the path. at TOD, the thrust decreased and so did the flow, thereby increasing the restriction until a new equilibrium was created.

When more thrust was demanded, this was at first supplied to a certain extent thanks to the fuel volume in the lines between the restriction and the throttle valves, this creating a vacuum in the rest of the line, with possibly a very turbulent flow or even a shock wave and cavitation as a consequence. As the restriction prevented a higher flow than the one created by the last thrust reduction, thrust went back to that equilibrium, somewhat above flight idle. The time differential between engine 1 and 2 returning to idle could be explained by the difference in distance between the restriction and the valves.

Once on the ground, temp there would rapidly make the fuel in the restriction return to its non waxed state, leaving no trace? or would it leave a trace in the composition of the fuel??

It seems to me that serious thought should be given to prolonged 777 operations in very cold temperatures and the effects it has on the fuel temp along its path.

[wilyflier]

Was the autopilot an automatic disconnect, or did the pilot disconnect?

[FullWings]

It was an interesting decision by the crew to leave the autopilot engaged as the speed decayed.
Think about how long there was between the onset of the problem and touchdown; then take away the time for overcoming the initial shock and coming to some understanding of what has happened... Not much left, really.

We'll have to wait for a more detailed report to come out but, IMHO, having the AP engaged down to 200' or so (whether by decision or omission) may prove to have been beneficial.

Unfortunately, a decaying speed from about 140 knots at 750 feet to 108 knots at 200 feet, resulted in a severely degraded glide angle.
That's an interesting assertion. I believe most people think about gliding performance with the aeroplane in a 'clean' configuration, where max. L/D and the stall speed are usually quite widely separated. This is not the case when using drag flap (30 in this scenario) combined with extended gear; you will find the best speed to fly is much closer to Vs than might be apparent on first inspection.

In this instance, as the speed started to decay, a disconnect followed by flying at a speed of between VREF and VREF minus 10 would, quite probably, have resulted in a different outcome, and a more controlled landing.
Vref is calculated using a fixed multiplier and checked against limits (Vmca, etc.) - it doesn't necessarily have anything to do with glide performance. Without access to the exact residual power settings and a simulator/modelling program to try it out on, I don't think it's possible to make a call on this one. Could have been better, could have been worse...

I've flown aircraft with best glide ratios ranging from about 6:1 to 60+:1. The common factor has been that the *usable* speed range has shrunk with reducing performance, to the point that an attempt to increase speed results in a higher rate of descent and not much else.

Presumably the AP just disconnected itself at some point - maybe at an altitude of around 40 feet - when it felt it could render no further assistance?
From the AAIB report:

The autopilot disconnected at approximately 175 ft
I take it to mean that it disconnected itself, as opposed to "was disconnected", although I don't like to question the semantics of interim reports too closely as you can end up going round in circles over the exact meaning of a single word. Could easily have been taken out by the pilot.

Remember the 777 is a FBW aircraft and so the distinction between 'automatic' and 'manual' flight is subtly blurred. With the autopilot out, the envelope protection would have still been active (airspeed, angle of bank, etc.) and the automatics (even though nominally disconnected) would still be capable of making control inputs. The handling pilot would have been able to override these, albeit using higher-than-normal forces.

[woodpecker]

Was the autopilot an automatic disconnect, or did the pilot disconnect?

I seem to remember that the autopilot will continue to remain engaged with a reduction in speed (whether in say Alt Hold or in this case locked onto the glidepath) and continuing to trim the stabiliser for this new speed until the stall is approached when it stops trimming. No-one explained on the course whether the autopilot cuts out as a function of speed or due to the "out of trim situation".

Flying manually is exactly the same, the stabiliser can be trimmed until approaching the stall when further trimming is inhibited. Thereafter the fly by wire restricts (but can be overridden with excessive force) further rearward movement of the control column.

With regard to the fuel system and the possibility of any ice in the centre tank melting during the descent (and being scavenged to the wing tanks) my question to the fuel/liquid property experts is....

How would a small amount of water (now just above zero centigrade) react with being introduced into a wing tank containing about 6000kgs of fuel still well below zero. Could/would it form small ice pellets.

[Wornout Rubber]

Fullwings

See Post #115 from Misd-agin:

Best Glide Speed
Can anybody comment as to the best lift/drag speed (best glide speed), with Flaps 30 on a B.777?

The AAIB stated that the speed decayed to 108 Kts.

-----------------------------------------------------------------------

I asked this question to a flight test engineer. He stated for line pilots we could consider approach speed (Vref +5) to be close enough to L/D speed.

Holding speed on my a/c is 1.4 Vsi. Approach speed at Vref + 10 is approx. 1.4 Vsi(typical landing weight). Vref is 1.3 Vso.

Based on his comments, and the relationship of holding speed to Vsi, I'd think L/D is very close to Vref + 5.

We all know that L/D is not at, or even near, 1.0 Vso or 1.0 Vsi.

[nearport]

While not saying it is the cause and with all due respect "cavitation" IS fuel disruption to pumps, at least introduction of vapour or air. The report stated suction damage to pumps. http://en.wikipedia.org/wiki/Cavitation

So perhaps get off pilots' backs about flap settings and other procedures and think about the engineering/fluid dynamics issues that evidence of cavitation on pumps in the report suggests.

Cheers
Mike


"I think the previous poster who suggested fuel starvation is reading something into the report that isn't there. There's nothing I can see in this report that gives an indication of the cause"

[Swedish Steve]

Snanceki..
How does fuel get from the CWT to the engines?

a. Via the wing tanks (i.e.pumped from CWT into the wing tanks then out again using the wing tank pumps) OR
b. direct from the CWT to a rail / manifold etc common with the output from the wing tanks, with the higher boost pressure from the CWT pump giving it priority to supply the engines?

Anybody got a pic?

How many boost pumps (not water scavenge) are there in the CWT. 1 or 2 (1 LH and 1 RH)?

JFI is this a 777 specific or standard approach to engine fuel supply management?

The engine fuel feed line is split into two. Left and Right. These are connected by Crossfeed valves, two in parallel, normally closed.
There are two CWT Boost pumps. They feed into this line,one each side of the crossfeed valves. These pumps have a higher supply pressure than the wing tank boost pumps and so are the preferred supplier of engine fuel when they are running.

This system of fuel supply is normal in twin engined jet aircraft. The B737 B757 and B767 are basically identical. The A320 in nearly the same.

[FullWings]

WR,

I asked this question to a flight test engineer. He stated for line pilots we could consider approach speed (Vref +5) to be close enough to L/D speed.
He might not have wanted to recommend anything lower to line pilots. I'm sure the laws of physics change depending on who's sat in the seat. ;)

I don't know what the figures are - I would be interested to know. What I am saying is that with all the LE & TE flap deployed (plus flaperon deflection), the wing profile becomes much more like the high-lift sections of old, where best performance occurs much closer to Vs. Given the amount of (deliberate) drag from the flap and the unavoidable bits from the gear, you may find that max. L/D occurs at a speed slower than 1.3/1.4Vs (or not... This is just a suggestion based on my experience with other aircraft.)

Also there was some thrust being produced by the engines: "above flight idle but below the commanded thrust" which complicates the situation somewhat. If you can get rid of a bit of drag by flying more slowly, that residual thrust will have more of an effect on the outcome. Food for thought...

[Roybucket]

Not a pilot - just an interested pax,

Could cavitation in pumps be caused by another source, say an ultrasonic presence or vaporised fuel due to abnormally fast pump speed rotation? Would this initially encourage spool up before starvation (witness on the ground did comment on excessive engine noise)

Go easy on me - very limited knowledge

Rgds

[Chris Scott]

Quote from ve3id [Feb24/03:30]:
Chris Scott said:
"PS: Isn't it remarkable that, 20 years on, the SECs may still be employing an Intel 80186 chip, now ancient history in the home-PC world? We were all buying PCs with 80286/80386 chips, even as the A320s were first going into service."
I couldn't let this go! NO, It is not remarkable, it is just good engineering. If a chip performs the designed task within spec it should stay in the design forever. The engineering world is not motivated by specsmanship and marketing like the consumer electronics world is. If you put a more modern chip in there, what benefit is it going to give you? Absolutely none, but what about the risk of mask errors introducing bugs that the original programmers did not test for because the new chip has circuits that were not even known back then? Very probable.
If you re-design with a new chip, you have to re-test all system components, and that costs a lot of money.

I'm just an ex-driver, so thank you for confirming my sentiment from an engineering perspective. "Remarkable" was not written in the pejorative sense of the word; more in admiration.

In the A320, the mother of civil digital FBW, the designers took a deliberate decision to go for well-proven COMMERCIAL chips, which were already being used in large numbers in a wide range of applications. For the SECs (spoiler-elevator computers), they chose the 80186. This, I am now told, was a close derivative of the 8086, which had brought PCs to offices and homes across the world, and whose bugs were well understood. Airbus and Sextant Avionique had the option of developing what they called "mathematically correct" micro-processors. Without wishing to sound complacent, their decision not to do so has so far stood the test of 20 years' service and (presumably) well over a million flight cycles.

If the missions of the SECs and ELACs (elevator-aileron computers) are not much more demanding in 2008 than in 1988, and replacement chips are still available, why indeed go for a more complex chip? As you put it, ...... It's not a matter of keeping up with the Joneses!

Despite all their differences, I expect the "Joneses" themselves would be in broad agreement.

[snanceki]

Thanks Sweedish Steve.
So the answer is b). In one sense I hoped as much.

I don't have time to explain my full proposed theory at the moment but I will ask another question if I may.

What prevents the CWT pumps from restarting due to aircraft attitude change once they have initially shut down due to the 9000kg limit being reached. Presumably the answer is nothing.
In which case a "slug" of "bad" fuel could be sent down the lines impacting both engines at a critical time the slight time difference being due to small differences in the LH to RH installation of pickups etc.
The key difference to dxzh post is that the fuel in the CWT is common to both engines. All we need to show is that this fuel was contaminated by high water content. Since the water scavenge pumps presumably shut down with the boost pumps water would have separated out and may well have been liquid due to the heat from the ambient as the aircraft descends, the A/C packs + of course reduced volume left in the tank.
Evidence of such an event may have been removed by a further attitude change causing the CWT pumps to shut down again and purge "good" fuel through the lines from the wing tanks...but too late to save the day. I believe somebody has already posted something similar a long way back in this thread.

Evidence of water in the CWT cannot be validated due to accident damage and contamination.

I'll try to write up the full sequence later today unless somebody shoots me down at this point.

Such a mechanism brings issues like the "spurious" maintenance water warnings, the extra cold temps, low ground temps etc into play and maybe explains why only this aircraft suffered such an event.

I wonder how long an engine takes (at idle) to use the fuel present in the lines from tank to engine? 5 secs, 10 secs, 30 secs, min before starting to spool down?

I'd still love to know if other 777's have shown evidence of cavitation. I suspect they have and that this is a red herring from the point of view of the accident.

[FullWings]

As I said earlier in the thread, i'm not being critical as these guys had a matter of seconds to sort this out, but I was wondering from a pure interest point of view if there would be a logical reason to leave the automatics in, on a 777 in particular.
I suppose it's a question of alternatives. With the autopilot engaged, it will carry on down the LOC and GS, slowly losing speed; this is not necessarily a bad thing (as a temporary measure) and it frees up a bit of mental processing power to be used on something else. No need to try to explain what you're doing with the controls to the other pilots as they know how the AP will function in these circumstances.

If the first reaction to the problem is taking out the AP, what does the HP do? Lower the nose to point at the houses? Fly at what speed? At that point I think mental models would start diverging and the sight of an aiming point that is obviously a crash into buildings/roads would introduce unneeded fear/consternation into the scenario.

Another factor is that these guys had been woken up in another country some 15hrs before. I know from experience that I'm not the freshest flower in the bunch at the end of a long duty; all your skills/reaction times/thought processes are degraded and there is precious little you can do about it.

[sispanys ria]

To contaminate both engines with center tank fuel you will need to have either one pump running and an opened X-feed, or the 2 CT pumps running.
In case the crew didn't switch off those pumps, they are supposed to switch off automatically in low press situation. Would it be possible for those pumps to restart in case liquid fuel would become available ?

[FullWings]

What prevents the CWT pumps from restarting due to aircraft attitude change once they have initially shut down due to the 9000kg limit being reached. Presumably the answer is nothing.
Apart from the fact that they would have been physically turned off on the overhead panel about 1/3 the way into the flight. The scavenge pumps would have run later on to leave the CWT empty some time before TOD. Nice theory otherwise! ;)

[Swedish Steve]

snanceki
What prevents the CWT pumps from restarting due to aircraft attitude change once they have initially shut down due to the 9000kg limit being reached. Presumably the answer is nothing.

When the 900kg message is shown to the pilots, they turn off the CWT pumps by operating the switches on the overhead. They will not restart with these switched off.

I wonder how long an engine takes (at idle) to use the fuel present in the lines from tank to engine? 5 secs, 10 secs, 30 secs, min before starting to spool down?

A lot longer. When you shut an engine down using the spar valves it runs for 30-50secs on the fuel in the pylon, so from the boost pimps it will probably run for about 2 minutes.

[FullWings]

When you shut an engine down using the spar valves it runs for 30-50secs on the fuel in the pylon, so from the boost pimps it will probably run for about 2 minutes.
These are optional, according to Boeing, and are currently fitted by some Far-East airlines. ;)

[PAXboy]

To assist those who are still asking about fuel in the centre tank and how/when the autopilot disconnected ... I quote from the:
AAIB Bulletin S1/2008 SPECIAL
Published February 2008
I know that everyone participating in this thread has already read it but here are two items.

At 1,000 ft the aircraft was fully configured for the landing, with the landing gear down and flap 30 selected. The total fuel on board was indicating 10,500 kg, which was distributed almost equally between the left and right main fuel tanks, with a minor imbalance of about 300 kg. The fuel crossfeed valves indicated that they were closed and they had not been operated during the flight.
[edit]

The airspeed reduced as the autopilot attempted to maintain the ILS glide slope and by 200 ft the airspeed had reduced to about 108 kt. The autopilot disconnected at approximately 175 ft ...
[edit]

The recorded data indicates that there were no anomalies in the major aircraft systems. The autopilot and the autothrottle systems behaved correctly and the engine control systems were providing the correct commands prior to, during, and after, the reduction in thrust.

[snanceki]

What prevents the CWT pumps from restarting due to aircraft attitude change once they have initially shut down due to the 900kg limit being reached. Presumably the answer is nothing.

Thanks for your reply Swedish Steve which of course totally destroys my argument.
However, elsewhere I have read that the CWT pumps are controlled automatically by a "float" valve. Maybe the float just initiates the warning.
Not wishing to doubt your input (I'm sure you are more informed than I) BUT...are you sure!
Why wouldn't such an operation occur automatically even if some form of optional manual override exists for emergency management.
Hmm!!

[bsieker]

snanceki,

The scavenge pumps have float-operated shutoff valves, to keep them from pumping (a) out of a full centre tank and (b) into a full wing tank.

The boost pumps have no such valve.

[tanimbar]

Warning: I'm non-professional; not crew, not engineer - just guest here, thanks.

I'm back, not to bang-on about fuel stratification, but to ask a question of those who know.

An article on smartcockpit, written by an Airbus employee, on Low Fuel Temperatures has a table listing the Minimum Inlet Temperatures for engines from various manufacturers. RR has temp of 3C (This figure seems generalised for RR).

The question, for those that really do know the answer, is what happens next if the fuel heat exchange systems cannot raise the fuel temperature to, or above, 3C?

Thanks in advance.

Regards, Tanimbar

[jackharr]

Has the AAIB indicated when the next interim report will be published? Are Boeing saying anything?

As someone said recently in this thread, unless there is some satisfactory explanation in the near future, the public's confidence in Boeing equipment and/or British Airways will be seriously eroded. Maybe little will happen until the share prices fall significantly and only then will the shareholders ask the real questions.

Jack Harrison

[Jetdoc]

Quote:
When you shut an engine down using the spar valves it runs for 30-50secs on the fuel in the pylon, so from the boost pimps it will probably run for about 2 minutes.


I fully disagree with this. As I stated previously in my post 378, the main tanks have fuel pump bypass valves which you will find on any Boeing aircraft if anyone has access to schematics. The engine driven pumps are capable of suctioning fuel out of the tanks. Shutting off the fuel tank pumps will not shutdown the engines. Furthermore, the scavenge pumps take forever to move the fuel. They hardly would have created a problem of flooding the tanks with water and not only that, jet engines are capable of operating with a certain percentage of water in the fuel at the optimum icing conditions. The airframe side of the fuel system must supply 100% of the required fuel flow(vapour free) to a gas turbine engine under all normal operating attitudes. These are legal requirements in the engine and aircraft design. Additionally, as I stated before, there would have been several cockpit warnings related to the fuel system that may have given the crew notice that there was a fuel problem. Surely these faults would have appeared in the central maintenance computers but not necessarily the DFDR or QAR.

[wilyflier]

So if they might run on a pipe full of fuel for up to 2 minutes, what cockpit actions were taking place 2 mins before touchdown?Say around 1500ft?

Add ref post 422

[Jetdoc]

This is from a previous post I made:

I am not sure if it has been mentioned before, but in addition to the 2 fuel pumps in each main tank, there is a pump bypass valve in the left and right tanks that allow the engine driven fuel pump to suction fuel from the tanks in the event the boost pumps are not working. I believe that this situation would be highlighted by a level B ENG FUEL PRESSURE warning which includes an audio warning.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.

I can't imagine anything else going on in the cockpit prior to touchdown under normal conditions. The aircraft would be already configured for tank to engine feed (legal requirements) long before the approach and the crossfeed valves would or should be shut. The crossfeed valves are not normally operated on the B777 other than to correct an inflight fuel imbalance.

[Baron rouge]

I seem to remember that the autopilot will continue to remain engaged with a reduction in speed (whether in say Alt Hold or in this case locked onto the glidepath) and continuing to trim the stabiliser for this new speed until the stall is approached when it stops trimming. No-one explained on the course whether the autopilot cuts out as a function of speed or due to the "out of trim situation

more probably because the autopilot coul not anymore follow the glide path, the A/C beeing fully trimmed.

[avrflr]

From the report:
"On examination, both of the engine spar valves were
found to be OPEN, allowing the fuel leak evident at the
accident site."

Can someone please explain how a fuel leak occurs if the spar valves are open? What path does the fuel take and where does it exit?

Perhaps this could help advance the theories involving water in the fuel, as it may help to explain how the fuel system was "purged" of water.

[taufupok]

If the fuel boost pumps were still running , the fuel control switches were still in the run positions and also if the engine fire switches were not pulled, pressurised fuel in the fuel manifold and lines can leak through when these were punctured or severed in the crash. If the passenger evacuation drills were accomplished with power still available, the spar valves would close but fuel could still leak from the manifold prior to the spar valves.

[wilyflier]

Jetdoc,
You say you"cant imagine anything going on prior to touchdown" before landing .I cant believe you fly.I`m talking about all the check list items ,many of which are done without a physical cross check by the other pilot.
Ive seen enough errors and ommissions to know they can happen with familiarity, tiredness or stress or even lack of knowledge* .We know for a fact that one such error took place the during the close down checks* .( no criticism implied here)
I dont know the standard 777 check lists and SOP, but sure as hell some change which occurred took place on this flight ,either in technical or flight conditions or in standard actions which triggered the whole sequence of double failure .
Think of ALL the things that happened in the whole flight and before. We can only pick them out a few at a time, there must be thousands.

[NSEU]

the spar valves would close but fuel could still leak from the manifold prior to the spar valves.

The spar valves are contained within the wing tanks ;) Any leaks prior to the spar valve would possibly see fuel flow back into the wing tanks.

The leakage would have occured after the spar valves, perhaps in the strut area, prior to the fuel pumps and FMU: The FMU has a high pressure shut off valve, so if this was closed, the leakage would have to be between the spar valve and the HP shutoff. Even if the FMU HPSOV was open, the fuel would have a bit of a stuggle to get throught the engine pumps, especially with the tank pumps off and the engines not turning.

Rgds.
NSEU.

[Jetdoc]

Quote:
Jetdoc,
You say you"cant imagine anything going on prior to touchdown" before landing .I cant believe you fly.

Actually, you are right. I do not fly. I am an aircraft maintenance instructor. When I mentioned that I can't imagine anything going on prior to touchdown, I was referring to the fact that the fuel panel would not be disturbed under normal operating conditions at that point in the flight. Actual crew procedures and matters concern the flying of the aircraft are best commented on by pilots themselves.
I am only presenting some basic facts about the fuel system and possible warnings that could have occured.

[PBL]

In the A320, the mother of civil digital FBW, the designers took a deliberate decision to go for well-proven COMMERCIAL chips, which were already being used in large numbers in a wide range of applications. For the SECs (spoiler-elevator computers), they chose the 80186. ...... Airbus and Sextant Avionique had the option of developing what they called "mathematically correct" micro-processors.........

If the missions of the SECs and ELACs (elevator-aileron computers) are not much more demanding in 2008 than in 1988, and replacement chips are still available, why indeed go for a more complex chip?

The 8086 was a 16-bit architecture in which all processing and all data channels were 8-bit. It means you had to do everything twice: once for the lower half and once for the upper half of the 16 bits. The 80186 had full 16-bit data paths and processing.

The option to develop a "mathematically correct" chip was there only in theory. To find out what happened when the Brits tried to do that, Google on "Viper RSRE". You'll see Brian Randell's submissions to Risks about what happened commercially with the Viper chip at
http://catless.ncl.ac.uk/Risks/10.15.html#subj4
http://catless.ncl.ac.uk/Risks/11.73.html#subj1
and you can follow the story by searching through earlier Risks issues.

The points are that (1) you have to get it right; (2) other people have to believe you have gotten it right; (3) you then have to fabricate and sell quite a few of them. Fabricating a special chip to put in a few thousand Airbi was not then a commercially viable proposition, and a risky proposition even if the entire development costs were written off (read: government subsidised). Things are somewhat different now.

There is, however, a problem with supply. It costs a lot of resources to keep chips in production over decades, and manufacturers don't do it, with processor capabilities doubling every 18 months (Moore's "Law") and SW writers making full use of it.

Parts of FAA ATC ran until recently on mainframe computers that were many decades old. The manufacturers had stopped supporting them; the FAA had to build its own fabrication labs, and then it had a hard time keeping the boffins around who knew how to fabricate and repair the processing elements after retirement age. It became a crisis on which the NTSB produced a special report.

I know one major ATC en-route system designed in the 90's (weren't they all?) based on banks of commercially-available desktop computers. For a number of years, the service provider has been stockpiling replacements by buying up all stocks of these machines wherever they surface in the world (ebay and so on). This business of keeping processors around for the projected lifetimes of aviation systems is not a trivial problem.

PBL

[Swedish Steve]

NSEU
The leakage would have occured after the spar valves, perhaps in the strut area, prior to the fuel pumps and FMU: The FMU has a high pressure shut off valve, so if this was closed, the leakage would have to be between the spar valve and the HP shutoff. Even if the FMU HPSOV was open, the fuel would have a bit of a stuggle to get throught the engine pumps, especially with the tank pumps off and the engines not turning.

Look at the state of the engines. They were badly damaged. The AAIB report specifically mentions that although the spar valves were turned off they did not close because the wiring was damaged by the undercarriage failure. So the fuel in the engine feed lines was leaking out through the damaged engines onto the ground.

[Spaz Modic]

:confused: Notwithstanding the B777 fuel system having been rebuilt several times over, the odds are still, it ran outa gas :cool:

[cats_five]

:confused: Notwithstanding the B777 fuel system having been rebuilt several times over, the odds are still, it ran outa gas :cool:

The AAIB say there was 'adequate' fuel on board. Are you failing to be clear about if you mean the tanks were empty or fuel wasn't reaching the engines, or do you think the AAIB are lying?

[overthewing]

Notwithstanding the B777 fuel system having been rebuilt several times over, the odds are still, it ran outa gas

The engines didn't stop, therefore they were still receiving fuel.

[whiowhio]

Quote:
Notwithstanding the B777 fuel system having been rebuilt several times over, the odds are still, it ran outa gas

Fuel STARVATION as opposed to fuel exhaustion

[PAXboy]

JackharrAs someone said recently in this thread, unless there is some satisfactory explanation in the near future, the public's confidence in Boeing equipment and/or British Airways will be seriously eroded. Maybe little will happen until the share prices fall significantly and only then will the shareholders ask the real questions.I doubt it. I really would not expect that to happen - and I am generally a pessimist where these matters are concerned!!
No deaths.
It was a 1st world airline with an extremely high safety record.
The public often have zero idea what type of a/c they are on. Any wide body can automatically be dubbed a 'jumbo'.
Boeing has, in the eyes of the public, a fine safety record. Did they lose any business over the 737 rudder problem?? In that series of accidents (some of which, IIRC, are not fully explained) many people died.
Post crash, the TV carried reports from smiling pax saying 'I did not realise that we had crashed'.That is not to say that some pax will be concerned but the stats of 777 operations over the past decade, make it clear that this is an unusual and rare event. To those that take an interest, that makes it even more worrying but, I suggest for most pax? Not a jot.

[3db]

Quoting Green-dot
“I agree, the B777 is a very safe A/C. If PEDs are only built to a price and not to a spec, does that mean there is no quality control? To my knowledge, a spec defines what a device is made of and what it should comply with (e.i. items or details included in a description of requirements or plans of a design).”

In my experience, any PED (or domestic kit) more than around 10 years old is unlikely to have been built to any EMC standard. Less than 10 years, most kit sold in the EU will conform to an EMC requirement – usually sufficient for domestic use, not necessarily suitable for aviation use. E.g. A computer with bubble jet printer was installed in an un-pressurised light twin for some monitoring work. As the A/C climbed through FL100 the printer burst into flames. It transpired the spec for the printer bubble jet cartridge had not considered extreme altitude in un-pressurised A/C and would instantaneously combust with no ignition source at around FL100. This manufacturer was responsible and modified the design. To emphasise your point, the kit was made to a spec, but the spec did not take account of all operational conditions. Similarly with the kettle, it still boiled water fine and did not emit any RFI and was within spec. “Our” radio station emitted high levels of RF energy, again within spec. However, an unusual combination of circuit elements in the kettle decoded “our” radio signal. The space inside the kettle (old type, not a jug kettle) acted like a guitar sound box and amplified it so it was audible. Again, everything in spec, but the spec did not consider all possible uses of the kit.


Green-dot:
“I agree, perhaps EMI could have been a contributing factor. I am also convinced that the B777 is a very reliable aircraft design.

Therefore, EMI seems highly unlikely. That said, so is a dual engine rollback on a design such as the B777.”

I agree totally.


Green-dot:
“There is one physical difference between the valves i refer to and the B777 spar valves. The valve i refer to has the control relay (which was sensitive to EMI, hence the filter) integrated in the shutoff valve. In the B777 the control relay and spar valve are separate components. The spar valve control relays (together with the APU fuel shutoff valve relay) are grouped together on a single panel. However, i do not see any EMI filters on the B777 spar valve schematics. Perhaps not required due to other measures taken, making the system imune for such effects, i don't know. Location of other equipment in the vicinity of the relays or valves (or absence of it) is also a factor determining system sensitivity, which obviously varies between aircraft types.”

Also worth noting anything physically mounted on the engine is not in a faraday shield (like the fuselage is). It has 2 large holes at either end, 1 for air in and the other for exhaust out. I accept it will be shielded around the sides.


Green-dot:
“Another point that may be of interest is that (theoretically assuming EMI was a factor) if the spar valve control relays were switched unscheduled from "run" to "cutoff" for a certain period of time, the APU fuel shutoff valve control relay could have switched from "closed" to "open" during the same unscheduled event due to its close proximity to the former control relays. This may perhaps explain why the APU inlet door was observed in the open position?”

An electromagnetic pulse may have caused the logic states to reverse, at least until everything re-set itself – however, I would have expected that to be recorded in the FDR somewhere or some other anomaly would make the AAIB think “what caused that reading” on the FDR?

Green-dot:
“Since EMI has occurred sporadically in the past as i have explained, why couldn't it happen again on other aircraft designs?”

I think EMC issues are happening to A/C of the FBW type with some regularity now. Often it is not possible to reproduce the event and it goes unexplained, so “something” was changed as a precaution. As more A/C types become FLB and more PED’s are taken on board the chances of an adverse interaction increase – that is simple mathematics.

Maybe its like the micro-burst situation. Years ago it was not known about and any incident/accident was put down to pilot error. Now it is recognised and specifically looked for. Maybe its time for the AAIB or others to start looking for EMI issues in accident reports?

Green-dot:
“Summarizing, i have factual information that action has been taken to prevent EMI on fuel shutoff valve control relays in the past on another aircraft type. But regarding this B777 incident, evidence (of a source) pointing in that direction would have to be found in order to determine it as a possible cause for a dual engine rollback.”

Evidence of a source pointing in that direction is positive logic. How about negative logic? If, I repeat, if, the AAIB can’t find the positive source, then should they consider EMI (and other) sources? It is clear from the AAIB information so-far (in laymen’s terms) fuel that met the spec did not get to the engines when the computers requested more and it was available on-board. Usually, the fuel system works well, but on this occasion it did not perform as expected. In the absence of other sources being positively identified, I would say that is a classic case of EMI awaiting investigation.

Regards
3db

[greekdalek]

but not accelerating.
This is not fuel starvation.
What else would prevent engine spool up? An airflow problem?

[infrequentflyer789]

The public often have zero idea what type of a/c they are on. Any wide body can automatically be dubbed a 'jumbo'.


Not just the general public either - try this from the Times (once arguably a respected source of news) regarding the 777 fly-by sacking:

http://www.timesonline.co.uk/tol/news/uk/article3427696.ece

"Jumbo Jet" in the headline and the first para, in between the video, showing... clearly not a jumbo jet. I think I would have known this wasn't a jumbo at about age 10. :ugh:

[sispanys ria]

I would be pleased to have some comments on this scenario:

Before reaching the end of the CT, some of its fuel might have been frozen due to the small quantity, inhibiting both boost pumps due to the LOW PRESS condition. If for some reason the crew didn't manually switch off the pumps, the frozen fuel from the main tank may have melt during the descent, causing the boost pumps to restart, feeding both engines with the slush from the center tank.

[Chris Scott]

Quote from PBL [Feb26/08:29]:
The 8086 was a 16-bit architecture in which all processing and all data channels were 8-bit. It means you had to do everything twice: once for the lower half and once for the upper half of the 16 bits. The 80186 had full 16-bit data paths and processing.
[Unquote]

Many thanks for the links re the "Viper" chip in 1990, which I'll do my best to read later.

My post was based on information (by an engineer that played leading roles in both 8086 and 80186 design) that, notwithstanding what you have said, the 80186 CPU design was "deeply derivative" of the 8086; the changes being mainly in the "integrated peripherals". Once the 80186 had been out for a couple of years, the chances of undocumented bugs was "pretty darn low".

This thread is so much better debated than its immediate predecessor – thank goodness – even though theories are still revolving almost entirely around semi-informed minutiae of H2O and the B777 fuel system. The discussion of FBW computer architecture is, on the face of it, entirely off-topic.

No one is suggesting that there was a flight-control problem on BA038. But discussions in this area – by the like of PBL, bsieker, 3db, Green-dot, and ve3id – have given us non-engineers a fascinating insight, and could yet read across to the engine fuel system, if not the aircraft fuel system.

Perhaps you guys should all meet with 3db in the UK! So far, the arguments have mainly related to what we ordinary mortals might think of as hidden potential anomalies in logic. Apart from a few anecdotes, little attention has been given to the possible effects of EMI...

Quote from 3db [Feb26/13:22]:
Evidence of a source pointing in that direction is positive logic. How about negative logic? If, I repeat, if, the AAIB can’t find the positive source, then should they consider EMI (and other) sources? It is clear from the AAIB information so-far (in laymen’s terms) fuel that met the spec did not get to the engines when the computers requested more and it was available on-board. Usually, the fuel system works well, but on this occasion it did not perform as expected. In the absence of other sources being positively identified, I would say that is a classic case of EMI awaiting investigation.
[Unquote]

Let's hope it has not been (awaiting).

[Piper_Driver]

PBL, You are mistaken about the 8086 architecture. The 8086 is a true 16 bit architecture with full 16 bit data paths. it was the first member of the Intel family of processors to come out. I think you are thinking about the 8088, a chip that came out shortly after the 8086 as a lower cost alternative. The 8088 is the one with the 8 bit data path, and is incidently the chip around which the first IBM PC's were built.

The 80186 is a chip that has the identical core processor architecture as the 8086. The 80186 variant added many of the typical peripherals used in a system design to the processor chip. These included items like an interrupt controller, etc.

As far as EMC issues are concerned, all aircraft systems were tested for immunity against EMC long before 10 years ago. The FAA's certification procedures required EMC checks as specifed in thier RTCA documents long before that.

[infrequentflyer789]

I would be pleased to have some comments on this scenario:

1. Crew failure to switch off the CT boost pumps would be in the data
2. Pump switch on would probably be recorded also (I am less certain on this one)
3. CT would be reading 900kg or more, instead of empty - so you would have to have CT fuel sensors also failing (reading 900kg over)
4. If the CT didn't empty into the wings (fuel scavenge failed), then you'd have 900kg less than expected in the wing tanks - in fact they had more than expected, suspiciously so according to some previous posters.


I agree that centre tank is tempting as the source of a common problem, but it should have been empty at this point in the flight and the data so far (at least as reported) indicates that it was empty.

[archae86]

PBL, You are mistaken about the 8086 architecture. The 8086 is a true 16 bit architecture with full 16 bit data paths. it was the first member of the Intel family of processors to come out. I think you are thinking about the 8088, a chip that came out shortly after the 8086 as a lower cost alternative. The 8088 is the one with the 8 bit data path, and is incidently the chip around which the first IBM PC's were built.

The 80186 is a chip that has the identical core processor architecture as the 8086. The 80186 variant added many of the typical peripherals used in a system design to the processor chip. These included items like an interrupt controller, etc.
I was one of the four 8086 design engineers, and aided our Haifa facility in making the 8088 derivative. I also briefly was the leader of the 80186 design team during part of the product definition phase, and knew well the main design engineers who carried out the active design phase.

The intended difference of the 8088 from the 8086 was only in the external bus to memory, which had only eight data bits, unlike the 16 of the 8086. However, all internal data paths (which is what a microprocessor designer means by data path, though perhaps a pilot uses the words differently) were identical in the two chips. A few slight variations in microcode were required to work correctly with the external bus difference.

It is true that the 80186 CPU internals were strongly derivative of the 8086, but not that they were identical. For one example, the need for an 80188 variant was in the plan from the beginning, so was accommodated with a few wires and a few transistors, rather than the 10% relayout required to make an 8088 out of an 8086. For another example, Jim Klovstad took my suggestion to add an "execute next micro-op during jump" capability, which gave some performance improvement at extremely low cost. (I got the idea from a paper on on of the early MIT LISP machines). There were other differences on this order, though it is correct to say that the major departure in the machine was the integrated peripherals.

I'm not a pilot.

[Nipper2]

Sorry guys, but I had to comment. The above post must rank near the top for 'thread creep in one step'.

By the way, as an engineering enthusiast and a humble PPL, I'm enjoying the guided tour of the 777 fuel system.

[Nipper2]

Sorry guys, but I had to comment. The above post must rank near the top for 'thread creep in one step'.

By the way, as an engineering enthusiast and a humble PPL, I'm enjoying the guided tour of the 777 fuel system.

[PBL]

Piper Driver is right that I was confusing the 8086 with the 8088. Sorry about that. The definitive post from archae86 puts the record straight.

As for Nipper2's suggestion of "thread creep", I am not yet convinced that bits and bytes are not relevant to this accident.

PBL

[snowfalcon2]

Thread creep or not, I feel rather humble to find myself in an aviation forum with guys such as archae86. I wonder if that team had any idea at the time about how much their work would change the world. Kind of similar pioneer teams to those that worked for Glenn Curtiss and Geoffrey de Havilland when aviation developed from an adventure to something useful.
OK, OT, I know. Next post after next info from AAIB :O

[Bis47]

Hello everybody.

I'm new to this forum. French my native language. No modern jet experience. Some airmanship (I hope). Be clement we me ...

I think that we are perhaps misleaded by the assumption that the problem occured "almost simultneously" to both engines, when they failed to spool up.

General scenario :

More likely, the flow fuel restriction problem was there well before the demand for higher engine output occured on short final. Maybe the fuel flow started to be restricted (cold related - any kind fuel of contamination, make you choice : ice, wax, bioslush ...) much earlier in the descent. The restriction built up slowly, somewhere between the LP pump in the wing fuel tank and the engine HP fuel pump. In a very cold spot? In a bend? Idlle fuel flow and very low temps at TOD might be a factor. Everything almost symetric (same cause, same effects). The restriction went unnoticed as long as only minimum fuel flow was required. Then ... when more fuel was required, i-e when the valves downstream the HP pump opened, the engines initialy accellerated, burning all the available fuel in the line, until the fuel flow became regulated by the fuel restriction upstream.

So : almost simultaneous evidence, but a relatively long standing cause.

Ok, this is only a theory, I'm not fluent with the 777 fuel system (I did learn a lot reading this thread in full). But this theory does free us from the double "sudden" failure mode : the failure were not sudden, the problem was a "progressing" one, going unnoticed for a while.

My two cents ...

[PBL]

I wonder if that team had any idea at the time about how much their work would change the world.

Yes, they knew, very well. But they didn't know if would turn out to be a few years of glory (c.f., the Z80), or dominance that would last a quarter century.

PBL

[wilyflier]

High Angle of attack or highspeed stall has been known to cause engine surge, lack of acceleration or even blow out
...108 knots = high AofA
But 108 knots did not occur till well after the problem had started,
Unless perhaps there WAS sufficient wind shear coupled with a few knots slow to start with.
Stalled engines trying to spin up would make a lot of noise.Have you ever had or heard a slow start? How long can it take to reach a stable self sustaining speed?
If something like this did occur,engines being limited by high jpts on the limit should show on the FDR and QAR ? as well as airspeeds

[777fly]

From the latest AAIB update, it is clear that the problem was either fuel starvation or fuel aeration. As far as I can see, there has been plenty of speculation about fuel stavation/ icing but little about fuel aeration ( I have not followed the whole thread)
So, where can significant amounts of air get into the fuel? Apart from the tank vents and surge tank ( which aerate the tank system normally and are above the tank fuel level, anyway) the only other way in which the fuel system can be open to the air is via the fuel jettison nozzle valves. If these were to somehow be signalled to open, there would be a large diameter pipe, open to air, which is routed via the override/jettison pumps into the same area as the wing tank pumps. It might then be possible that the wing tank pumps would ingest both air and fuel, leading to fuel starvation in both engines.
The time difference in the power down of each engine could be explainable by differing amounts of residual fuel in the jettison line to each wingtip.
This speculation could explain the simultaneous failure in two 'independant' systems. However the question would have to be: what could signal the jettison nozzle valves to open independently of the jettison master switch. Maybe EMI or a software glitch? Also, I have no idea if the override/jettison pumps are an axial type without any kind of reverse flow check valve, which would allow air to pass through.

[Milt]

Fuel Aeration ??

The fuel system designers will have gone to a great deal of effort to prevent air entering the systems. Cannot imagine any possible entry point which would not have been leaking under normal fuel pressured operating conditions unless such a leak/s were contained within a fuel tank and hence undiscovered. Any air bubbles in the fuel at the input to the high pressure pumps could be expected to promote cavitation which will reduce pump output but only remotely possible below that being demanded by the engines at low thrust.

The AAIB is probably being simplistic in calling fuel vapourisation or partial vacuum at the HP pump inlets under cavitation conditions "aeration". Such conditions almost simultaneously in two seperate sytems is a very long shot.

I guess somone is rapidly assembling an instrumented test rig.

What a fascinating problem for our armchair Investigation Board to dwell upon and many pilots and engineers will benefit from their enhanced knowledge of jet engine fuel systems and fuel behaviour.

Missing from my know how and experience as a TP is the propensity of cold jet fuel to form vapour (not air bubbles) at the HP pump inlets at pressures close to a vacuum and can extensive vapourisation occur instantly to both damage the pumps and substantially reduce pump outputs?

[Jetdoc]

Both the boost pumps and ovrd/jett pumps are designed to provide vapour free fuel to the engines. The air is returned to the tank and the fuel goes to the engine. The outlets of the pumps which all connect to the engine feed manifold are have check valves which must be forced open by the fuel. When the center tank pumps are supplying fuel, the main tank outlet check valves are held closed by the higher output of the ctr tank pumps. This prevents any fuel from flowing through the main tank pumps. When the center tank pumps have emptied their tank, the main tanks are now pushing their check valves open and forcing the center tank check valves closed thus preventing any fuel from feeding back to through those pumps.
If none of the pumps are working, the fuel bypass check valves are pulled open by the suction effect from the engine driven pump and will allow fuel to pass to the engine.
The crew would actually have a warning message alerting them to turn the center pumps off when the tank has emptied and I doubt that they would ignore that.
Possibly the only thing that could have happened is that the aircraft attitude became so extreme at the low speed that the aircraft was flying that all 4 of the main tank pumps and the 2 bypass valves pickups became uncovered and fuel flow to the engines was interrupted.

[NSEU]

The fuel tanks NEED a slightly positive air pressure to help stop the tank collapsing when fuel is being pumped out of the tanks. The vent system provides this positive pressure.

I don't see how a jettison system can positively pressurise/aerate the fuel in the tanks. The wing nozzles face aft (no scooping effect)

How about the opposite of positive pressure in the tanks? With full fuel in the wings, maybe the float valves in the vent system iced up in the closed position (condensation + cold on the hinges and seals). Float valves have been know to stick before (but usually you only notice it when they stick open... dumping fuel in the surge tank).

Maybe the fuel being pumped out of the tanks to the engines gradually created a partial vacuum, and the fuel could not be fed to the engines fast enough at high thrust settings... hence the cavitation.
Looking at the diagrams in my manuals, it looks like all three tanks are kept at the same pressure.

Maybe just as crazy as the other theories, but I've been told it can cause problems in car fuel tanks :}

Looking forward to being shot down ;) (I've probably overlooked a negative pressure relief valve in the system)

Regards
NSEU

[CAAAD]

I find it impossible to contribute to this excellent debate without visibility of the fuel system. Are diagrams available?
I'm sure that full illustrations, chapter and verse will be provided in the Final Report, but that's of no help now.
In the meantime it is impossible to comprehend the layout with written descriptions. Which leads to endless misapprehensions.

Where can we access the schematic?

[rasobey]

Taking the literal defition of jumbo as simply something that's big, and the 777 is by definition a jumbo jet. If they referred to it as a 747 that's a different matter ;)

Just out of interest, when did "the jumbo jet" become a standard phrase to define the 747?

[Jetdoc]

I have some drawings but I have no way to post them here. Anyone who has a means of posting them is welcome to them.
The vent system has more than one channel on large transport aircraft and it is standard for the Boeing aircraft to have a pressure relief valve in the surge tank that works to relieve positive or negative pressure in the wing. This valve can be seen inboard of the NACA duct at the wingtip.

The pumps do not pressurize the tank. The fuel tank pumps separate the fuel and air and supply a positive flow of fuel to the engine. The engine fuel feed manifold is the only thing that is pressurized by the pumps. The vent system gives a slight pressure to the fuel in the tanks to minimize fuel sloshing and aeration.

[Jerry B.]

Spot on NSEU. A relatively simple theory usually proves to be the correct one. Forget about all these shlush theories or EMI/ESP etc. The only problem is that we are unlikely to ever find out for sure.
Awaiting to be shot down in flames together with you.

Cheers,

Jerry B.:)

[Jet II]

Where can we access the schematic?

Any help?



http://img260.imageshack.us/img260/3500/777fuelpw3.th.jpg (http://img260.imageshack.us/my.php?image=777fuelpw3.jpg)

[CAAAD]

Terrific - a great help, but do you have the bit that goes from the Engine Feed Manifold to the pylon or aircraft / engine interface? And what happens to the left of the spar valve?

Nevertheless, a great leap forward - Thanks

[NSEU]

The vent system has more than one channel on large transport aircraft and it is standard for the Boeing aircraft to have a pressure relief valve in the surge tank that works to relieve positive or negative pressure in the wing.

Can't find any reference to vent negative pressure relief regarding the surge tank vent valve in the Boeing 777 Maintenance Manual D&O. Is it mentioned in the (proper) AMM? Wouldn't the float valves normally provide negative px relief?

[Swedish Steve]

777FLY
the only other way in which the fuel system can be open to the air is via the fuel jettison nozzle valves. If these were to somehow be signalled to open, there would be a large diameter pipe, open to air, which is routed via the override/jettison pumps into the same area as the wing tank pumps.

Sorry to disappoint you but the Jettison system does not use the engine fuel feed lines. There is a Jettison pump in each wing tank that pumps fuel into a Refuelling/Jettison manifold. At each end of this is a jettison nozzle.
To Jettison from the centre tank, the normal centre tank pumps must be switched on manually (if not already on), then when jettison is armed two jettison isolation valves open to allow the centre tank pumps to pump centre tank fuel into the jettison manifold. So to get air from an open jettison nozzle into the centre tank the jettison isolation would need to be open as well.

[Swedish Steve]

NSEU
Can't find any reference to vent negative pressure relief regarding the surge tank vent valve in the Boeing 777 Maintenance Manual D&O. Is it mentioned in the (proper) AMM? Wouldn't the float valves normally provide negative px relief?

AMM 28-10-00 p17/19 shows the surge tank pressure relief valves.
Boeing says..If a pressure difference opens the valve.. I assume this means either way.

By the way, posters that ask for details of the fuel system. The Boeing manuals are copyright and I am not posting them here.

[borghha]

JerryB:

Spot on NSEU. A relatively simple theory usually proves to be the correct one. Forget about all these shlush theories or EMI/ESP etc. The only problem is that we are unlikely to ever find out for sure.
Awaiting to be shot down in flames together with you.




Indeed an interesting theory. In my last post I suggested a vacuum created by fuel restriction (waxing) could have been the reason for the cavitation, but as the actual fuel freezing temp was -57°C, it seems more logical that the vacuum was caused by another factor, such as a stuck pressure valve... But then again, in both main tanks at the same time... ?

How about the 'loose union' mentioned in the report? could it have introduced air in the fuel system?

[Jet II]

Terrific - a great help, but do you have the bit that goes from the Engine Feed Manifold to the pylon or aircraft / engine interface?


The engine feed is pretty basic and I dont believe that the investigators have found anything wrong with the system.

http://img442.imageshack.us/img442/4701/777engineug1.th.jpg (http://img442.imageshack.us/my.php?image=777engineug1.jpg)

And what happens to the left of the spar valve?

That is the main feed down to the left engine

[Jetdoc]

A couple of points:
1. The pressure relief valve is illustrated in the pressure refuel ref AMM 28-21-00 or storage ref AMM 28-10-00.
"An open pressure relief valve is a symptom of a blocked vent scoop or flame arrestor.
The pressure relief valve can also open to relieve air or fuel pressure if there is too much pressure during refueling."

2. Float valves in the vent system block the vents from filling with fuel as the fuel level increases and drain the vent channels of fuel that gets in there.
The only air getting in the tank is from the vent system and this is normal.

3. The jettison manifold is connected to the eng feed manifold thru the jettison manifold isolation valves. It is not open to the tank itself. The main tank jettison pumps feed the jettison manifold itself and the center tank override/jettison pumps feed the jettison manifold through the engine feed manifold through the isolation valves and into the jettison manifold.

[Kolossi]

JerryB:

Spot on NSEU. A relatively simple theory usually proves to be the correct one. Forget about all these shlush theories or EMI/ESP etc. The only problem is that we are unlikely to ever find out for sure.



Not a particularly unusual post on this long long long thread JerryB, and I don't mean to pick you out in particular, but paraphrasing what it you (and lots of other posters) say "We don't yet know the answer, we may never know the answer, but I have an idea in my head and I want to dismiss all the other possible answers".

AAIB has given NO indication in any of their reports as to the cause of the [in/ac]cident. They have noticed a safety issue regarding engine shutdown after the event, and have issued advice. They have noticed cavitation on the pumps, but also said "The manufacturer assessed both pumps as still being capable of delivering full fuel flow." (page 4 of S1/2008). They have noted all computer/control systems appeared to be functioning normally. In short they don't know (or at least haven't given any opinions in the publicly available reports).

Occams Razor (simplest explanation is the correct one) does often apply, but in safety investigations - particularly those where the cause is not found quickly - it is often a case of multiple events leading to the outcome.

If we are going to have a discussion about the possible causes, of which the fuel flow discussion is highly valuable, then let's talk about all the possible causes, unless there is evidence to the contrary.

So please let's all stop all these "let's all stop talking about X" posts! :O

(and yes, the oxymoron of this statement was intentional in an effort to inject some humour, but the sentiment was genuine!).

[NSEU]

"If a pressure difference opens the valve.. I assume this means either way."
Never assume, Steve ;)

By the way, posters that ask for details of the fuel system. The Boeing manuals are copyright and I am not posting them here.

Neither should anyone else.

How about the 'loose union' mentioned in the report? could it have introduced air in the fuel system?

Even if it did, it would only introduce air to one side of the aircraft ;)

[Swedish Steve]

NSEU

Quote:
"If a pressure difference opens the valve.. I assume this means either way."
Never assume, Steve

Yes good idea, but the B777 AMM are very sketchy on a lot of descriptions, and its all I have to go on. I would have thought that if it only opened on surge tank overpressure, it would have said that, and not pressure difference.

By the way the B777 B1 course notes are lifted 100pc from the AMM Pt 1. So no good looking in there!

[777fly]

Thanks JET11 for the fuel diagram, very helpful but notable that it does not show the position of the wing tank jettison pump. It is a fair bet that its location and pickup point is close to the fwd and aft boost pumps pickup points.
NSEU I am not suggesting at all that the jettison system can in some way get air into the fuel by surface mixing. What my suggestion is, is that with a jettison nozzle valve open, significant air could be drawn down the jettison manifold by the wing tank boost pump suction and introduced into the pump inlets. ( Provided the non-running jettison pump allowed reverse airflow)
MILT: Why don't you read the AAIB update? The pump damage was either due to a reduction in fuel flow, or fuel aeration, according to AAIB.
SWEDISH STEVE: I was not suggesting, in any way, the centre tank or its pumps are involved. I know that the jettison sytem is not part of the engine supply manifold but if you have one, look in the Boeing tech manual 12.20.07 ( jettison schematic) imagine the jettison valves open and see where air could go if all tank pump inlets are close together. The scenario I suggest is valid with wing tank to engine feed, cross feeds closed and the centre tank empty, with pumps off.
JETDOC: The wing tank boost pumps may very well filter air or vapour, but if a relatively huge amount of air was introduced at the pump inlets, the filter system could be overwhelmed and the result would be loss of fuel flow to the engine HP pumps.

Standing by for more flak, but I am simply suggesting a way that aeration of the fuel supply manifold could occur. I wonder if the AIMS or any recording system notes the jettison valve position, if the system is not activated.

[Jetdoc]

B777fly

All of the boost and ovrd/jett pumps on the aircraft are centifugal pumps. The air and fuel separation occurs as a result of pump action. The inlet to the pump is screened at the pump pickup point.
The outlet of the pumps have check valves installed. Fuel goes out of the pump but nothing can return through the pump.

[CAAAD]

Jet II - Many Thanks for that - I'm sure it will be very helpful to all.

NSEU and Swedish Steve and anyone else with sanctimonious attitudes to essential material, please do try to get out a little more.

[777fly]

JetDoc,

Thanks for the tech info. I am not sure that the pump inlet screens would be relevant to my argument , but if the three wing tank pumps ( fwd/aft/jettison) all have a fuel AND airtight NRV at the outlet, my suggested possible scenario is invalid.

Why would the wing tank jettison pump need an NRV? Everything is going overboard anyway............

Can you show the schematic with the NRV in the line?

[Blues&twos]

I don't think the AAIB reports have said that the cavitation observed was as a direct result of anything related to this incident. The cavitation damage could have occurred at any time.

[777fly]

Blues&Twos Cavitation 'could' have occurred at any other time? Maybe, but why would it during years of normal operation? If 2 engines lose power due to lack of fuel to the HP pumps, it is almost certain that the pumps were damaged, in this particular way, during this incident.

[bsieker]

Courtesy of Jetdoc, here are some more drawings.

These are not specifically for the B777, but from other Boeing types, but they are probably very similar to the 777 variants.

Click the thumbnails for bigger images.

1/ A Typical auto-sumping installation, or water scavenge system.

http://panchromat.org/.misc/B777-docs/auto_sumping_typical_installation_th.jpg (http://panchromat.org/.misc/B777-docs/auto_sumping_typical_installation.jpg)


2/ A typical Boeing vent system

http://panchromat.org/.misc/B777-docs/typical_Boeing_vent_system_th.jpg (http://panchromat.org/.misc/B777-docs/typical_Boeing_vent_system.jpg)


3/ A typical boost pump and override/jettison pump installation

http://panchromat.org/.misc/B777-docs/typical_boost_pump_or_ord_jett_pump_installation_th.jpg (http://panchromat.org/.misc/B777-docs/typical_boost_pump_or_ord_jett_pump_installation.jpg)


Thanks again for making these available, also to Jet II and all the others who post diagrams, images and other information!

Bernd

[Jetdoc]

B777fly

From the B777 AMM
A discharge check valve is installed in the pump housing for each fuel boost pump, override/jettison pump and jettison pump. The discharge check valve prevents the flow of fuel back through the applicable fuel pump.

I wish I could show you a good schematic. The B777 AMM is not like the previous AMMs that Boeing has produced and really good schematics are lacking.

[777fly]

Thank you for the illustration of the (non B777) tank pump. Can JetDoc or anyone produce the same for a B777 Main Tank Jettison pump?

[Jetdoc]

Bsieker

Thanks for posting those drawings. I hope they give some people an understanding of the components in the fuel system. They give some details of what the pump installations, pickup points and ejector pumps look like.
Also, I wanted to add that the vent system runs along the top of the wing.
Just out of curiosity, I was wondering how long damage from cavitation takes to become noticeable. Are there any pump experts out there?

[3db]

Chris Scott,

3db would be happy to meet the aforementioned PPRUN’ers in the UK. Do you think we would increase the useful knowledge on the subject, remembering it’s the AAIB who have all the real information? That said, a face to face meeting may prove valuable for the “shadow AAIB”. Chris, I also hope it (EMI) is not still awaiting investigation by the “real AAIB”.
Regards
3db

[777fly]

JetDoc, my last entry crossed with yours. If the main tank jettison pumps do indeed have NRVs, I retire my argument.

One last question: are the NRVs fitted to these pumps on G-YMMM? Worth a look, maybe. It might have been Friday at the factory...

[Jetdoc]

B777fly

The drawings I gave to bsieker represent typical installations on Boeings. They are actually from my B757 notes. If you look at the pump installation, thats how the jettison pump would look as well and I doubt that they could forget the NRVs.

I forgot to add that the jettison manifold also serves as the refueling manifold. A missing NRV would be noticed.

[Machaca]

Thanks to all who have posted photos, diagrams, images, excerpts, reports, articles, etc., from a wealth of varied sources. It is vital to the quality and progress of our discussions and debate.


Even the most litigious nation allows for such fair use of copyrighted materials:
.
.

From the U.S. Copyright Act of 1976, 17 U.S.C. § 107

"... the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
the nature of the copyrighted work;
the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
the effect of the use upon the potential market for or value of the copyrighted work..
.
Let's keep the excellent information and discourse flowing!

-=MachacA=-

[Chris Scott]

Quote from Bis47 [Feb26/21:42]:
More likely, the flow fuel restriction problem was there well before the demand for higher engine output occured on short final. Maybe the fuel flow started to be restricted (cold related - any kind fuel of contamination, make you choice : ice, wax, bioslush ...) much earlier in the descent. The restriction built up slowly, somewhere between the LP pump in the wing fuel tank and the engine HP fuel pump. In a very cold spot? In a bend? Idlle fuel flow and very low temps at TOD might be a factor. Everything almost symetric (same cause, same effects). The restriction went unnoticed as long as only minimum fuel flow was required. Then ... when more fuel was required, i-e when the valves downstream the HP pump opened, the engines initialy accellerated, burning all the available fuel in the line, until the fuel flow became regulated by the fuel restriction upstream.
[Unquote]

Bien ecrit en Anglais, Monsieur/Madame... I certainly would not want to test my French in argument on this forum.

The problem we all have is that we do not have access to the FDR/QAR. :{ And the AAIB is not telling us if thrust above idle was used at any time during the descent. All they have said is that "the A/C entered the hold at Lambourne at FL110; it remained in the hold for approximately 5 minutes, during which time it descended to FL90."

So they descended only 2000 ft in 5 mins (average of 400 ft/min), presumably at a speed below 250 kts. At that speed at idle power, you would expect, say, 2000 ft/min. But we don't know if they were slowing down at the same time, in which case they might not have needed extra thrust.

What happened after they left the hold is also for us to guess. But at LHR at midday it is fairly unusual to fly at idle thrust all the way from leaving the Lambourne hold to the intercept of the ILS glide-slope. [Once you are on the glide-slope, you have a better chance of avoiding thrust above idle, as you are - to oversimplify - generally slowing down.]

To sum up: we don't know.

[lomapaseo]

Chris Scott

The problem we all have is that we do not have access to the FDR/QAR. And the AAIB is not telling us if thrust above idle was used at any time during the descent. All they have said is that "the A/C entered the hold at Lambourne at FL110; it remained in the hold for approximately 5 minutes, during which time it descended to FL90."


To sum up: we don't know.

Good post Chris.

But there is some room for some presumption

If the missing info (FDR/QAR .... etc.) was to have confirmed any speculations along these lines then surely the AAIB/Boeing would have acted on it by now in a heads up to the operators.

back to reading between the lines

[777fly]

Jetdoc, I had forgotten that the jettison manifold also acted as the refuel manifold. If there are NRVs in the pumps at the tank end of the manifold in each tank, where does the fuel get into the tank? Does it enter the tank anywhere near the tank pump inlets? I am still thinking in terms of open fuel jettison nozzles allowing air into the tank pump inlets.

[Green-dot]

Quoting 3db, post #439:
"An electromagnetic pulse may have caused the logic states to reverse, at least until everything re-set itself – however, I would have expected that to be recorded in the FDR somewhere or some other anomaly would make the AAIB think “what caused that reading” on the FDR?"

Fuel control switch position is a DFDR parameter. If spar valve position is a DFDR parameter i don't know. If it is, then it would be interesting to know which position is recorded. Is it the moment the valve is in transit from the open to the closed position or only when fully closed?

If only recorded when the valve reaches the fully closed position but not when in transit, then there may be no record of the valves moving to a partially closed position if reverse logic lasted shorter than it takes the valves to fully close. At the moment that the system re-sets it takes an equivalent amount of time for the valves to reach the fully open position again. For example, if a valve moves from fully open to fully closed in say, 15 seconds but the reversed logic lasted for only 12 seconds (valve almost closed) it would have meant the valve was in transit for a total of 24 seconds in which fuel flow to the engines would have been restricted.

Would such an unscheduled (perhaps only partial) closing of the valves generate an EICAS status message? When reviewing the system logic regarding the spar valve fault indications and projecting this on the condition of reversed logic to the control relay, i don't think so (see AMM: Functional Description of Engine Fuel Spar Valve - Fault Indications).

Next question to answer is, and i stress again it is only theory, if EMI would have corrupted the spar valve control system, how much transmitting power (radiated field emission) would be required to make a 28 Vdc relay move from run to cutoff position? I estimate that to be very large.

Regards,
Green-dot

[Green-dot]

Quoting 3db, post #439:
See previous post, somehow posted twice.



Regards,
Green-dot

[bsieker]

Jet II,

Thanks a lot for the diagrams!

Is the in-engine fuel flow diagram actually for the RR engines?

I've seen different simplified schematics, one for the GE90 engine, which corresponds to this one:

LP pump -> FOHE -> Filter -> HP pump -> FMU -> Engine Valve,

as opposed to another simplified schematic posted earlier, which has:

LP pump -> HP pump -> FOHE -> Filter -> FMU -> Engine Valve.

Can anyone definitively say which is correct for the Trent engines?


Bernd

[boguing]

First post on R&N. Son of RB-211 chief engineer. Suspect spotter, but not stupid.

Blocked vents are a problem in cars and motorbikes. First hand experience. However, a boat experience leads me to suggest that evidence of this would have been immediately available to the AAIB.

Brand new boat fitted with a £30 freshwater distibution pump. Unfortunately the tank breather had tape over it. When we ran out of water I went to refill the tanks. Wouldn't take more than a few gallons into at least 40 gallons capacity. Investigate. Two stainless tanks almost completely crushed. Amazing what a cheap pump can achieve. Bet a 777 pump can get closer to 0 atm than a cheap ITT pump.

The tank structure is unlikely to to have been designed to cope with 'negative' pressure, and would display obvious signs of such.

[CONF iture]

Chris Scott
If I'm correct, there is effectively already a 250kt speed restriction 12 before LAM, so I don't see a sufficient speed excess potential that could prevent any additional thrust requirement somewhere in that hold ... but not a word from AAIB !?

The AAIB say there was 'adequate' fuel on board
It’s what they said on Jan 23, but in the initial report from Feb 18 they were more cautious:
“the total fuel on board was indicated 10500kg” and even if “both of the eng spar valves were found to be open, allowing the fuel leak evident at the accident site” they avoided to mention how much fuel they drained from the main tanks.
I don’t know which rate a spar valve leaks but it must be measurable and an estimated leaked fuel amount must have been determined … but not a word from AAIB !?

BA pilots kind enough to answer
For a typical PEK-LHR T7 flight plan:
- What is the planned fuel allowance for taxi ?
- Is it correct to say that planned arrival fuel is departing fuel minus (planned taxi fuel + planned en route flight fuel) ?
- Which quantity or en route percentage is allowed to reserve fuel ?
- What does include the planned arrival fuel at LHR (in this case 6900kg) ?

AAIB … it doesn’t hurt asking
What was the planned en route time ?
What were the planned and actual ZFW ?

[Sunfish]

The "tank structure" is the wing, and as has already been said, there is a relief valve as well as a vent, furthermore, there would have been a serious number of messages relating to low fuel pressure, which apparently did not happen.

To try and distill this matter to avoid lengthy repetition of questions answered pages ago:

1. Occams razor then suggests that unless the fuel pressure sender, EICAS, DFDR etc. was broken or incapacitated, there was sufficient fuel pressure at all relevant times.

2. If this is true, then that only leaves the supposition that unless nozzles or pipework upstream of the sender were blocked, that what was sprayed through the nozzles into both engines was something that produced less temperature/pressure (and hence less power) than what it was supposed to produce.

I do not know enough to speculate more, but I would like to ask someone with actual knowledge of the aircraft and its engines two things:

(a) Is engine fuel flow recorded? Where is the sender, and at what time interval?

(b) Is turbine inlet temperature/pressure (or similar parameter) recorded and at what interval?


If the fuel flow responded according to autothrottle and pilot inputs, yet turbine inlet temperature/pressure did not, then absent any other possible cause, what went into the engine was not pure Jet A1.

And that of course raises the question of the probability of both engines being affected virtually simultaneously.

As for EMI, I'm not an electronics person, but I would have thought that EMI capable of affecting one part of the aircraft system would also have affected a hell of a lot of other systems, and the damage would have been obvious.

Over to the speculators until we hear more from the Board.

[Green-dot]

Quoting Sunfish:
"As for EMI, I'm not an electronics person, but I would have thought that EMI capable of affecting one part of the aircraft system would also have affected a hell of a lot of other systems, and the damage would have been obvious."

I would have thought so as well . . . .

But as i have addressed before, i have been confronted with a situation where an aircraft type encountered unscheduled closing of the fuel shutoff valves without damage to any of the other electrical or avionics systems on the aircraft. I admit, it was in the early years of FBW technology, yet it happened and was later corrected, hence the introduction of an EMI filter to the valve assembly.


Regards,
Green-dot

[autoflight]

Is anyone claiming that the crew opened the thrust levers to max and kept them there? This is one thing I would have expected to read if it actually happened. If It did not happen, all the speculation about engine access to fuel is diverting attention away from whoever would be responsible for ensuring it did.

[FE Hoppy]

The engines initially responded
but, at a height of about 720 ft, the thrust of the right engine
reduced. Some seven seconds later, the thrust reduced on
the left engine to a similar level. The engines did not shut
down and both engines continued to produce thrust at an
engine speed above flight idle, but less than the commanded
thrust. The engines failed to respond to further demands
for increased thrust from the autothrottles, and subsequent
movement of the thrust levers fully forward by the flight
crew


it's in the report.

[FE Hoppy]

At the point when the right
engine began to lose thrust the data indicated that the
right engine EEC responded correctly to a reduction
in fuel flow to the right engine, followed by a similar
response from the left EEC when fuel flow to the left
engine diminished.


it's in the report.

[Chris Scott]

Quote from autoflight:
Is anyone claiming that the crew opened the thrust levers to max and kept them there?


Quote from AAIB Bulletin S1-2008 (Feb18):
The engines failed to respond to further demands for increased thrust from both auto-throttles, and subsequent movement of the thrust levers fully forward by the flight crew.


Does that go any way towards answering your question?


CONF iture, Thanks for reminding me about the "250 kts 12D before LAM". I also think they are unlikely to have entered the hold at much above 230 kts, decelerating to their ideal holding IAS. I'm guessing this might have been about 210 - 220 kts, as they were light.

So I think it is likely that a significant amount of thrust would have been used in the hold (but see my previous post, above) to average only 400 ft/min ROD. By the way, a typical time taken from exit of the LAM hold to touchdown is 10 - 15 mins, depending on traffic. Even taking the quickest case, they are still likely to have used thrust (above idle) again while flying at a steady 160 kts, normally required by ATC for the segment between (roughly) 7 miles and 4 miles from the runway.

But, in the absence of the FDR/QAR data, this is all speculation...

Quote from CONF iture (discussing/quoting AAIB Bulletin):
“the total fuel on board was [U]indicated 10500kg” and even if “both of the eng spar valves were found to be open, allowing the fuel leak evident at the accident site” they avoided to mention how much fuel they drained from the main tanks.


You seem to be suggesting that the AAIB's economy in words may have been designed to cover some doubt they had about the indicated fuel quantity (FOB) on landing. I think it is likely that the indicated FOB the AAIB stated would have represented the [U]lower of the following 2 figures:
1) total FOB in real time as measured by the FQI sysyem;
2) departure FOB (as entered into the FMS by the crew at Beijing) [U]minus fuel used (as measured by the engine flowmeters); known as the CALCULATED FOB.

Method (2) does not, of course, take into account any leaks; nor (probably) any APU fuel consumption. The latter is not normally used after engine start; the former self-evident post-flight.

The stated FOB on landing being 3600 kgs higher than the F/P destination fuel could be accounted for by a number of (presently unknown) factors in combination. A ZFW lower than planned (as you are thinking?) would have saved 300-400 kgs of fuel per tonne on a 10-hour flight. Again, as you imply, we do not know how much flight time was saved (if any, due to better wind-components and/or direct routings). Contingency fuel is - for the purpose of calculating F/P FOB at destination - assumed NOT to be burned, so is probably irrelevant.

Finally, you will have noticed that TOD was at FL400, which is probably higher than planned, saving fuel for the last part of the cruise with their light payload. Also, the F/P included a temporary descent from FL341 to FL318 early on, which would have been costly in fuel; they avoided this at the request of ATC. The latter is the only known source of fuel saving for us at this stage.

In summary, there is already much known scope for fuel saving, and the unknowns may have even more to offer. I see no reason to infer (as I assume you are) that the AAIB may harbour doubts about the validity of the indicated FOB they published.

[PETTIFOGGER]

At the risk of stating the obvious, we don’t know exactly what caused this do we. What we do know is that there was air, fuel and operationally effective fuel pumps and functioning EEC control, according to the AAIB. Nevertheless, fuel flow was restricted. The question is how. We seem to have exhausted most possibilities. What might be helpful is for someone to run a CFD programme using the same temperature and demand regime experienced by BA 038. Is anyone on here able to do this, or perhaps know someone who might?

[Jetdoc]

B777fly

The aircraft is refuelled through separate refuelling valves. There are 2 in each tank and they are not powered in flight.

[777fly]

Jetdoc,

Thank you for the further information. How do the refuel valves function physically and where are they in the main (wing) tank? I recall that they are powered open during refuelling. If they are closed and depowered in flight, presumably they are locked in position? They must also have a NRV in the out-of-tank direction only?

With such an inexplicable accident it is quite likely that two rare and non-related system failures have combined to produce the engine power loss, so bear with me if I try to eliminate all possible ways in which air might reach the tank pump inlets ( given that there must have been 2 or more system failures for that to happen)

[SeldomFixit]

Sit back and relax 777 - there is a quite professional body, far better resourced than you, trying to achieve just that.

[Jet II]

Nevertheless, fuel flow was restricted.

has that been definitely established?

[Jetdoc]

The refuel valves are solenoid controlled from the refuel panel and they require fuel pressure to push them open. That fuel pressure is supplied by the pumper truck or when the aircraft is on the ground and you want to transfer fuel around, you can use boost pumps in the other tanks to move the fuel. Of course then, you need to open the defuel valve.

[PBL]

how much transmitting power (radiated field emission) would be required to make a 28 Vdc relay move from run to cutoff position?

The question is not well formulated.

The transmitting power would be dependent on how far away the transmitter is (inverse-square law and all that) and whether the transmitter is broadcast or directed-energy.

One needs to know how much energy is required to move the relay. This is not dependent merely on the voltage rating of the part, but on its specific design and manufacture and that of the system of which it is part. Then you have to guess what kind of transmitter you want to know about and where it might have been. Then you can figure out how much power it would have needed.

And then you have to figure out how it might actually achieve the action proposed. It is obviously not sufficient just to put the right amount of energy there - one needs to suggest a causal mechanism.

PBL

[FE Hoppy]

Jet II Quote:
Originally Posted by PETTIFOGGER
Nevertheless, fuel flow was restricted.

has that been definitely established?

The AAIB report states there was fuel, There wer pumps capable of supplying pressure the metering valves were open but the fuel flow did not increase and infact fell from an initial appropriate rate to a rate that was too low.


To state it was restricted is probably not the right term but it was inadequate.

[Chris Scott]

Quote from PBL:
The transmitting power would be dependent on how far away the transmitter is (inverse-square law and all that) and whether the transmitter is broadcast or directed-energy.
[Unquote]

We also need to know the frequencies most likely to affect: (a) valve solenoids; (b) servos/motors; and (c) computers.

[PAXboy]

Chris Scott We also need to know the frequencies most likely to affect: (a) valve solenoids; (b) servos/motors; and (c) computers.As PBL says, that depends ... on its specific design and manufacture ... each solenoid or motor has it's own windings and it's susceptibility to interference will be directly related to where it is in the a/c, and the other components around it.

[ionagh]

I dont think that an EMI scenario where the RF field is sufficient to engergise or de-energise a 28 volt relay is likely. I have never seen any direct effect to an electromagnetic relay from significant RF fields from 2 - 2000 MHz.

Problems only start when the relay has a semiconductor drive circuit (either integrated in the relay or remote from it). With insufficient or defective decoupling and filtering unwanted operation can be caused down to a few Volts/metre at VHF/UHF frequencies. ie 3 or 4 orders of magnitude less than my experience above.

[tanimbar]

Warning: I'm non-professional; not crew, not engineer - just guest here, thanks.

In an earlier post I asked the following but no one has answered. Can anyone assist?

"An article on smartcockpit, written by an Airbus employee about Low Fuel Temperatures, has a table listing the Minimum Inlet Temperatures for engines from various manufacturers. RR has temp of 3C (This figure seems generalised for RR).

What happens next if the fuel heat exchange systems cannot raise the fuel temperature to, or above, 3C?"

I'm interested in the answer because:
1) as far as I have read, no one on the thread has explicitly discussed the systems designed to protect the engines in the event that fuel quality/quantity is below operating standard.

2) I also wonder if there has been a failure in applied logic, meaning, the aircraft systems did exactly what they were designed to do but under the wrong, or unforeseen, circumstances, namely in this case, about to land.

3) It's intriguing to me that some form of self-limiting system operated to reduce the engine speed to just above flight idle. Presumably (?) all of the ways in which an engine can be throttled back are fully known, that the actions are 'programmed' and follow some logic pathways developed during the design stage of the engines/aircraft. If so, the examination of the cause of incident would start by examining these logic pathways and associated systems. Of course, I'm assuming that an engine is never, under any circumstances, allowed to be un-controlled unless there has been some catastrophic failure.

And so, combining 1 to 3 above, and while reading about the 3C minimum fuel temperature, I wondered what the engines are designed to do under such circumstances. Leaving aside the provisions made for starting engines on the ground in freezing conditions, under what other conditions would designers have reasoned an aircraft’s fuel would be about to enter the engines below 3C and what should the engines do to protect themselves and the aircraft?

Could it be that the designers thought that those conditions are ‘only’ to be met at high altitude in very cold air, in which case, the best option is to command the engines to throttle back, to protect themselves, and force the aircraft to descend to warmer air?

But, suppose fuel below 3C was about to enter the engines on flight BA038 at very low altitude; what would the engines do?

You see my point – planned/designed response but wrong circumstances!

By the way, I’ve discussed the 3C temp. issue because that is what triggered my thoughts but you engineer types can probably think of other issues. But the issue must result in some system commanding a throttle back.

Okay, heading for bunker ….

Thanks in advance.
Regards, Tanimbar

[gustep12]

When I read about the cavitation evidence in the fuel pumps, I immediately wondered if maybe a vacuum had built up in the fuel tanks, for example because the vent valve (used to let air enter the tanks as needed) might have been stuck.

A vacuum in the fuel tanks, combined with rising outside ambient pressure (plane approaching sea level), might ultimately lead to air bubbling backwards from the engine through the pumps and into the tanks - or not?

Two factors may have precipitated this condition exactly during the landing approach: The first factor being the ever increasing outside air pressure; and the second factor being that the engines were temporarily put into idle, presumably also reducing the pressure in the fuel supply pumps, which then would be more vulnerable to air flowing backwards than they were during cruise.

Once air starts flowing backwards through the pumps, they probably would not recover for quite a while.

[PBL]

To follow up on Chris Scott's query and ionagh's reply, here are a few links from twenty years ago to problems the US Army may have had with EMI affecting its Black Hawk helicopters (I emphasise the words "may have had", in contrast to "did have"!). The Navy apparently did not have similar concerns with its Sea Hawks: they were better shielded because of the extremely EM-loud shipboard environment.

All from the Risks Digest:
From Risks 5.56 (http://catless.ncl.ac.uk/Risks/5.56.html#subj1)
From Risks 5.58 (http://catless.ncl.ac.uk/Risks/5.58.html#subj2)
Also from Risks 5.58 (http://catless.ncl.ac.uk/Risks/5.58.html#subj3)
From Risks 5.59 (http://catless.ncl.ac.uk/Risks/5.59.html#subj4)
From Risks 5.60 (http://catless.ncl.ac.uk/Risks/5.60.html#subj4)
and a cautionary note from me:
in Risks 5.59 (http://catless.ncl.ac.uk/Risks/5.59.html#subj5.1)

PBL

[Green-dot]

Quote:
Originally Posted by Green-dot
how much transmitting power (radiated field emission) would be required to make a 28 Vdc relay move from run to cutoff position?

"The question is not well formulated."

PBL, i agree but you clearly filled in the blanks. Thanks for your clear explanation regarding a complex matter in such few words. :ok:


Regards,
Green-dot

[Pitot Probe]

Firstly, congrats to everyone (including me :)) that read through more than 2000 posts in this and previous threads...:D

Secondly, thanks to all the posters (and/or mods) for keeping this latest thread very much to the point as well as exceptionally "civilised" compared to previous ones.

I am starting with my 777 conversion in May this year and I will probably not have to study anything on the fuel system :p - thanks for all those enlightening us with technical specs (be it 777 or not).

I do not want to speculate on this incident - not because I have anything against speculation, but because I just cannot think what could possibly cause this!

However, to all those with theories involving multiple failures / unlikely events; I think you might be on the right track.
This incident was completely out of the ordinary and very unlikely. Therefore one could expect something unthinkable to go wrong.
If it was a simple answer, we would have had it by now.

Regards
PP

...now where did I stash that popcorn again?

[Sunfish]

Gustep and all of the other "Vacuum/Blocked vent" theorists, there is a "low fuel pressure" warning that would no doubt have been triggered (and recorded) should this have occurred.

[John Marsh]

tanimbar

Would a system commanding a throttle back send the command to the EECs? As I understand it, the EECs reacted to a physical reduction in fuel flow, not a throttle back signal.