LATAM B773 complete electrical failure?

[poorjohn]

Incident: LATAM B773 near Belo Horizonte on Dec 20th 2018, electrical failures (http://avherald.com/h?article=4c1cc3f6&opt=0)

Surprised this isn't a hot topic - I must not understand the situation correctly.

[Machinbird]

Looks like they reverted to basic Night VFR Cessna mode. Put the gear and flaps down, and plopped it onto a suitable runway. Everyone OK and aircraft reusable.
Good Job!

[fullforward]

;)...maybe a complete electrical failure is something that happen very often on a modern widebody like the 777-300 ER... People are not very excited about it. After all it wasn’t a BA or Qantas 777 ;)

Surprised this isn't a hot topic - I must not understand the situation correctly.[/QUOTE]

[Capn Bloggs]

ipad arrival anyone? ;)

[AN2 Driver]

Surprised this isn't a hot topic - I must not understand the situation correctly.
Have to say it surprises me too. I'd be interested to hear from some 777 experienced people what they think could have happened which would render both engine generators as well as APU unavailable. By the looks of it they were on stand by electrics including the RAT generator. Obviously it was enough to land the plane but no easy feat most probably.

[Vasco dePilot]

Incident: LATAM B773 near Belo Horizonte on Dec 20th 2018, electrical failures, RAT deployed (http://avherald.com/h?article=4c1cc3f6&opt=0)
Read all about it here.

[reverserunlocked]

Looks like the ATC comms got patched by mistake onto the PA and went out in the cabin, hence the pax knew that they were in deep Doodoo.

Either way an outstanding bit of airmanship from these guys. If this had happened mid Atlantic then we’d be looking at another MH370, no?

[WingNut60]

Azul Linhas Aereas ATR-72-212A registrations PR-AKJ and PR-AKD have been dispatched to take about 7 tons of equipment, including the needed hydraulic jack and replacement tyres, to Belo Horizonte.

Might need a couple of new harnesses / looms too.

The MH370 people will, no doubt, be looking at this with deep interest.

[Wannabe Flyer]

"The MH370 people will, no doubt, be looking at this with deep interest."

Key Operative line is that the captain kept communicating with ATC on the one remaining radio.....

[JumpJumpJump]

The other issue is how it was reported here in Brazil, a company spokesman / very senior manager / exec said (I'll find the original quote in Portuguese later, so translating from memory)

"I have spoken to the cabin crew of this flight, one member told me that this was a miracle and without faith and God, we would all certainly be dead"

A very interesting stance for the company to take.

By interesting... I think I mean "ridiculous". What are people's thoughts on this?

[Sailvi767]

Looks like the ATC comms got patched by mistake onto the PA and went out in the cabin, hence the pax knew that they were in deep Doodoo.

Either way an outstanding bit of airmanship from these guys. If this had happened mid Atlantic then we’d be looking at another MH370, no?


Not even remotely like MH370.

[Onceapilot]

It certainly will be interesting to know what electrics they had left and what caused this. Aircraft like this have considerable levels of automatic electrical fault isolation and huge redundancy that only multiple failures can cripple. However, as some of us appreciate, when shit happens....
Good to see a safe landing! :)

[JumpJumpJump]

This is doing the rounds already in Brazil... Whatever was wrong, was no small thing

[etudiant]

This is doing the rounds already in Brazil... Whatever was wrong, was no small thing
Impressive, the crew managed the airplane for at least 3 hours with 1 radio link and basic instrumentation, at night time.
A serious glitch indeed, wonder if the preceding faults had any connection to this.

[PPRuNe Towers]

That pdf link from JumpJumpJump really is worth looking at.

Rob

[His dudeness]

"I have spoken to the cabin crew of this flight, one member told me that this was a miracle and without faith and God, we would all certainly be dead"


Well, the dude talked to the best educated people (cabin crew) on the matter and referring to a captain / flight crew as "god" certainly is correct...

[zerograv]

It is indeed worth looking at ...
Looks like a freaking nightmare.
Well done guys !!!

[Gipsy Queen]

Agreed - this is beyond scary.
But after the recent posts lamenting the loss of traditional pilot skills, this is a wonderful testimony to a very competent crew.

[kaikohe76]

Like very many of the other comments regarding this incident, my opinion, is that it was a serious situation & was certainly very well handled by the Crew.

[Zeffy]

Updated description of the electrical failures (http://avherald.com/h?article=4c1cc3f6&opt=0)

On Dec 22nd 2018 The Aviation Herald learned that the electrical problems started with the failure of the right hand backup generator, as result both transfer and both converter circuit breakers popped leaving all electrical busses unpowered although left and right main generators as well as their generator controls, the APU and the left backup generator remained operative (see ELEC page below, the lines to the L MAIN and R MAIN should be green not white and these symbols should be green, too). As result almost all systems except a few connected to the standby busses lost power, only systems remaining powered are: stand by busses (powering one VHF radio) and emergency lighting, the left inboard and outboard and upper center displays as well as the left CDU remain also powered (according to FCOM via the batteries and/or RAT - with the RAT operating also the right hand - first officer's - displays are being powered).

[Long Haul]

IF the AV Herald report is correct, and circuit breakers had tripped, I would be interested to learn whether or not the crew attempted to reset them. Back in the dark ages that was a standard troubleshooting procedure, but these days it is greatly frowned upon; so greatly in fact, that at my employer we are supposed to first contact maintenance, which for this crew obviously would have been impossible. Great job landing this crippled airplane.

[hans brinker]

Also I think the 777 has an avionics bay underneath the cockpit that has breaker panels. Would not be surprised if they put the big stuff there.

[fullforward]

It looks like HAL 9000 took control of this airplane electrical system...Probably this is the second incident like this on a tripple. The first was MH370.
Just think about something like this in mid Atlantic.

[Long Haul]

This aircraft continued to communicate with ATC, received radar vectors and landed at the nearest suitable airport. This was nothing like MH370.

[fullforward]

I humbly disagree: imagine something like this happen by night, in mid Ocean, beyond VHF reach, no HF, no SATCOM, no nav and ONLY BATT as electrical source. Recent developments show that even RAT wasn’t available on this LATAM event. It landed at SBCF on battery power alone.

[FullWings]

The fault list reads like a printout of the DDG!

Given that synoptic display, I think I would be erring on the side of getting it on the ground ASAP as at the back of my mind would be the possibility of battery power only, which doesn’t give you that long before you’re in a cockpit with no instrumentation at night. I can’t find it in the manuals but I think the backup batteries in the flight controls are only guaranteed for 20mins... :eek:

There isn’t a MAIN BATTERY DISCH advisory in that list so maybe power was getting through to the battery charger, although I wouldn’t like to depend on it! Top marks to the guys for a rapid and successful diversion. :D

[tdracer]

The 777 RAT includes a generator that provides electrical power - you're not dependent on the battery.

[The Ancient Geek]

Breakers tripped in the avionics bay - now thats why we used to carry an FE,:rolleyes:

[fullforward]

What I’ve learned from a source directly involved in the incident, they were definitely on battery power alone at landing.

[FullWings]

The 777 RAT includes a generator that provides electrical power - you're not dependent on the battery.
Normally I would agree but given the electrical malfunctions that were present, who could say for definite? After all, both IDGs, a backup generator and the APU generator were functional and available but unable to supply power...

[Dee Vee]

After all, both IDGs, a backup generator and the APU generator were functional and available but unable to supply power...

Anyone have a photo of the electrical panel in normal operating mode?

If indeed those lines connecting the various components should be green where power is being fed, there are indeed some serious questions to be answered, including if its truly un-powered, or if its just a sensor/signalling error, or a computer/programming bug!


I found this diagram, but it just begs more questions that it answers, especially around the SATCOM being depowered..... and in this case the jettison fuel pumps being INOP.




https://cimg7.ibsrv.net/gimg/pprune.org-vbulletin/1095x768/3bwbm29_4d64e7712ad0b623a1005fcfdae9bbe4a8a917f3.jpg

[tdracer]

Normally I would agree but given the electrical malfunctions that were present, who could say for definite? After all, both IDGs, a backup generator and the APU generator were functional and available but unable to supply power...

It's been many years since I was involved in the 777 development, but IIRC, the RAT generator fed the battery bus directly - if they still had the battery bus they would have still had the RAT generator.

DeeVee - again, a couple decades since I was involved, but based on what I remember, the only way they could have lost all main bus electrical power (with both engines running) would have been either:
latent failures in the electrical bus isolation system (there are regular maintenance checks to confirm such failures are not present), or
the crew didn't correctly follow the QRH procedures after the initiating failure.
(or possibly some combination of the two)

[megan]

Outcome if it had occurred in the middle of an ETOPS? Dog of fate lift its leg on the pillar of science? Be an interesting report.

[SeenItAll]

It looks like HAL 9000 took control of this airplane electrical system...Probably this is the second incident like this on a tripple. The first was MH370.
Just think about something like this in mid Atlantic.

Sorry FF. but your conspiracy theories don't hold water. Unless you can prove that the customer airphone is one of those few systems that is powered by the battery system in the event of generator or APU power interruption (when even cockpit satcom is not), your attempt to suggest that MH370 suffered a full power interruption is unavailing.

[Dee Vee]

Be an interesting report.

At least there are no issues locating the FDR's :)

[etudiant]

A design where the circuit breakers can put all power offline with no obvious way to reset them seems deficient. How does that get regulatory approval?

[LandASAP]

The incident electrical page shows Main Bat with 28 Volts and 0 Amps. If they were on Bat power only should not be there any load on the amps?

[BlankBox]

Breakers tripped in the avionics bay - now thats why we used to carry an FE,:rolleyes:

...betcha reading that...a bunch of bean-counter knees went weak...

[pattern_is_full]

What I’ve learned from a source directly involved in the incident, they were definitely on battery power alone at landing.

Interesting - but the phrase "at landing" is a bit ambiguous.

It is certainly true that a RAT, as the name says, runs off ram-air pressure (airspeed) and will need some minimum airspeed (130 knots in a 767) to produce useful output. So they would have lost the RAT power at some point in the final approach or roll-out, even if it was deployed and functioning for most of the event. And been on battery power alone from that point on.

[armchairpilot94116]

This should not have happened. Uncle Boeing is going to get more grey hair

[FullWings]

It's been many years since I was involved in the 777 development, but IIRC, the RAT generator fed the battery bus directly - if they still had the battery bus they would have still had the RAT generator.
Looking at the FCOM, the RAT supplies the C1 & C2 TRUs, which power the capt & FO instruments and via them, the battery busses. I also see a note: “The main battery can power the standby system for a minimum of 10 minutes”, which isn’t much!

This should not have happened. Uncle Boeing is going to get more grey hair
I suppose there are two ways of looking at this: on one hand, that this shouldn’t have happened and is evidence of poor design (sorry td) but on the other, that after a once-in-a-hundred-million-flight-hours level failure(s), there was enough redundancy/backup in the system to allow the crew to make a successful approach and landing, which is indicative of a very good implementation. I think I would side with the latter...

[Onceapilot]

there was enough redundancy/backup in the system to allow the crew to make a successful approach and landing, which is indicative of a very good implementation.

Hold on! They landed yes. But, there were probably some circumstances that made this possible and, others where it would not have ended so well. Those who operate similar aircraft will possibly get the full detail on this and learn something. The rest of us are probably not going to know that much. Would be good, when the truth is known, for someone in the real know to describe exactly what happened, please. :) In the meantime, I don't think anyone can make statements about how good/bad the systems performed here.

[Ian W]

A lot depends on how far down the probability tails you want to proceed. In almost all FMEAs you get to conditions occur only where several highly improbables occur concurrently in a highly improbable sequence. It gets very difficult to persuade system developers to redesign systems to cope with probabilities in the 10^-15 range.

[wiedehopf]

Notable incident of the 777 electrical system: United 777 on the Ground in London 2007 with a complete meltdown of a contactor
https://aviation-safety.net/database/record.php?id=20070226-0


Also this diagram seems interesting:
https://cimg1.ibsrv.net/gimg/pprune.org-vbulletin/602x452/main_qimg_8f64db007969c2b6fd0e56d34935e252_c23535b143954a2c2 de17df293f9881c4bc05838.png

[aterpster]

Do I presume correctly that one IRU must have been powered for one attitude platform to be functional?

[Onceapilot]

A lot depends on how far down the probability tails you want to proceed. In almost all FMEAs you get to conditions occur only where several highly improbables occur concurrently in a highly improbable sequence. It gets very difficult to persuade system developers to redesign systems to cope with probabilities in the 10^-15 range.

OK Ian! Yes, you are correct. However, for simple folk, like me, we work in a simple world where the faults in aircraft electrical power systems work something like this.... Short circuit in a system=CB Trip. Overload of a Busbar=Isolation or,=Auto load shedding (normally alternate systems avail on another Bus). T/R fail=Isolation (also, normally alt sys avail). Gen Fail= Isolation, (normally single Gen fail accommodated with alt source select and, no services lost). Multi Gen fails, protected by isolation of Busbars to protect partial remains of system with working generators and avoid overload. Batt fail, can be complicated but, generally systems work as long as engines/Generators working. etc...
Therefore, rather than talking mathematics, it would be great to know what failure mitigation worked or, didn't work in this case?

[Big Pistons Forever]

Still a better design than Airbus were one grenaded engine in the QANTAS A380 took out 55 systems......

[SteveB1]

I not qualified on 777, but every Boeing I flew the anti-skid was AC powered.... These guys land Hot, Heavy, and no flat tires. Deflated due to heat not having the bottom worn off ;-)) Job well done.

[Fursty Ferret]

Did you see what the debris did to the wiring looms on that A380? This is entirely different - it's one tiny fault that should never, ever, have progressed any further than an EICAS advisory.

I think there will be some concerned engineers at Boeing over Christmas.

[belfrybat]

According to the commander, interviewed on TV, power came back after the engines were shut down. Presumably from the APU, on the footage the cabin lights were visible.

[zerograv]

DeeVee - again, a couple decades since I was involved, but based on what I remember, the only way they could have lost all main bus electrical power (with both engines running) would have been either:
latent failures in the electrical bus isolation system (there are regular maintenance checks to confirm such failures are not present),

Notable incident of the 777 electrical system: United 777 on the Ground in London 2007 with a complete meltdown of a contactor
https://aviation-safety.net/database...?id=20070226-0 (https://aviation-safety.net/database/record.php?id=20070226-0)

Would speculate that we getting in the right track ...

AC Power is the "standard", or is prefered, for several systems in commercial air transport aircraft. Don't ask me why, as I don't know the reason ...

AC Power has however a big inconvenience. You can have 10 sources of good working AC Power available. However only 1 of those sources can supply power to an AC Bus at a time. You cannot connect them in Parallel, or in Series, like with DC Power.

If a contactor becomes stuck, for whatever reason, and doesn't "let go", to allow another source of AC Power to power the an AC Bus that is without power, then this kind of scenario can happen. Several sources of AC Power available, but none is allowed to supply power to AC Buses that are without power, because the contactor is stuck in position that allows only the Failed source to power the Bus, or it didn't shift completely to allow another source in.

AC Power ... we owe that to Tesla

[Onceapilot]

zerograv,
AC power generation and systems on aircraft are used for reasons of efficiency and weight. DC is needed for systems that require it and, is generally derived from Transformer rectifiers. Of course, the DC battery is usually used as a power source for starting a fully shut-down aircraft and, linked into the DC system, it can act as a limited power source in malfunctions. To back this up, there are usually Inverters to provide AC for certain equipment where/when it is not available from the normal AC Generators. AC power supplies on large aircraft can usually be paralleled and the AC system will normally be operated in parallel.
You are correct that "contactors" can have switching or latching failures. In fact, all components can fail. Where faults occur, it may be that a generator cannot be paralleled. These systems on large aircraft are quite complex but offer large resources of failure mitigation, which is why this apparently serious failure is important. Cheers

[Big Pistons Forever]

These systems on large aircraft are quite complex but offer large resources of failure mitigation, which is why this apparently serious failure is important. Cheers


Thinking about this some more, I bet when the full story is out inaction or inappropriate action by the crew contributed to the severity of this situation, like for instance the LOT 767 gear up. The 777 is a very mature design so I find it hard to believe that there is a fail mode that can kill everything.

There does appear to be a trend to minimizing the importance of system knowledge in modern training systems.

in any case however the crew got to a dark cockpit, they still did a very good job of getting the airplane on the ground with negligible damage.

[zerograv]

Onceapilot

Thanks for that !

To improve my concept of "paralleling", 2 generators can supply power to an AC BUS at same time ?

[Dee Vee]

AC generators can most definitely share a load, and co-exist on the same "bus" or transmission medium.
The only requirement is that they are in sync, phase and frequency wise.

Pretty much exactly the same as how your home Solar Inverter feeds its energy back into the grid.

I would hope aircraft generators ran in sync, otherwise switching at an inopportune moment (like when one failed) might lead to smoke and noise......

[NWA SLF]

Sorry for what may be a stupid question. I am a mechanical engineer so my EE skills went by eons ago in college and I have only worked with DC circuits on mobile equipment but the electrical grid has tens of thousands of generators powering it, all synced to the same frequency. In the old days they used primitive means to sync but putting a generator on line out of phase can negate the power so they must be synced. Is this not possible on an airplane?

[tdracer]

The 777 can sync the AC buses when needed. For example, when you shutdown an engine, there is a light delay (250 ms if memory serves) before the fuel shutoff command goes to the engine. ELMS uses this delay to sync the AC bus before the engine spools down and the IDG drops off line (known as a 'breakless transfer'). So if everything is working correctly, on the 777 you don't get that annoying ~50 ms power interrupt when a generator comes on or drops off line that causes the displays to flicker on the 747-400/757/767/

[jimtx]

My memory is hazy but we synced the generators on the 727 using phase lights. If you rushed the sync you could get a little shudder in the A/C.
As part of my expansion of CV during the Arab Oil Emargo, where no flying gig was available, I did a stint in a nuclear/fossil power plant. They told a story of a many ton generator being twisted off mounts when somehow put online out of phase. Off topic sorry.

[EEngr]

The 777 can sync the AC buses when needed.

The 777 does parallel generators. But only for the duration of a power transfer (shutting down or spinning up a generator). The IDGs (and APU controller) are equipped with a speed control input that bring two sources into sync by throttling one up or down. Once synced, the new source is paralleled with the system by closing the proper breaker. Once the new source is on line, a tie breaker is opened to isolate the two sources and their respective loads. Buses do not operate continuously tied together.

On the various 747 models, the generators did remain in parallel continuously, each feeding into the four main buses tied together. 747-400 buses will revert to isolated operation for certain autoland configurations requiring isolated and redundant autopilot channels. On 757 and 767, the electrical systems remain isolated. All transfers are break before make, resulting in a short but annoying power interruption.

During normal operation, the 747 is the only model where an electrical fault can be 'seen' momentarily by all buses. Until the protection systems act to isolate the faulted section. Because of this parallel operation and the need to identify the location of and isolate a fault, the 747 has perhaps the most complex protection system. The heart of this system is something called differential protection, which can identify where in the system a fault has occurred and open the correct breakers to isolate it. All other models have much simpler (if any) differential protection systems and may trip more breakers than needed upon sensing fault currents passing through.

Due to the isolated (at most times) operation of the 777 electrical system, no single fault should affect more than the half of the system (left or right) where it occurs. So this particular incident is troubling. One possible cause is that (for some reason) one of the generator control units failed to transfer load to its generator upon engine start. Leaving the left and right main buses powered from one generator through a bus tie breaker. A subsequent fault, or even an overload condition due to one generator available resulted in the good generator tripping off line. Leaving only standby (battery and RAT) sources to power critical loads.

[WingNut60]

Yes, on large alternators that sort of thing can and has happened.
On large diesel sets the most common failure mode from trying to sync out of phase was either to shear the alternator to flywheel coupling bolts or to snap the crankshaft.

Fortunately that is now a thing of the past since auto-sync became common.

[Big Pistons Forever]

Small Cog

Unanticipated fail modes leading to cascading failures can occur but I would suggest that historically the record shows most of them were exacerbated by inappropriate crew actions. It will be interesting to see the official report on this incident.

Like I said above when the only thing on the PFD and MFD is the makers name, a good outcome is going to depend on the basic flying skills of the crew, something this crew obviously had but sadly is no longer a given on modern flight decks

[SeenItAll]

According to the commander, interviewed on TV, power came back after the engines were shut down. Presumably from the APU, on the footage the cabin lights were visible.

I guess we'll know if this was the case if the new procedure from Boeing to address this fault is:

Power up APU;
Power down both donks;
Wait for APU-powered electrical busses to come back on line;
Pray that both donks (or at least one) can be restarted.

[EEngr]

That fault report (thanks JumpJumpJump) is interesting reading.
Question: How do the time stamps relate to the actual flight? Quite a few faults are logged around 20-Dec : 02:55 (Zulu, I assume) and then a few more at 20-Dec : 03:46. This appears to be a few minutes after landing. But since this incident seems to have gone on for around 3 hours, the earlier logged times don't appear to correspond with the onset of the problems.

[speed2height]

Lots of discussion about the AC busses, looks like an ELMS failure to me. Electrical Load Management System going haywire.

I'm pretty sure the ACE's (Flight Control System) are powered by 28v DC from PMG's (Permanent Magnet Generators on each of the engines) which is independent of all the AC power distribution systems. The fly by wire system would likely have been unaffected by the loss of AC power on the three busses.

It is interesting to hear that the RAT did not reconnect AC power to the busses. Were both bus tie circuit breakers tripped? or was the ELMS load shedding everything? How is it the transfer bus remained unpowered with the Rat deployed???

Hat's off to the crew, very impressive presence of mind and aviation skills.

[Fursty Ferret]

If like the 787 then ACEs on independent PMG, but PFC on normal electrical network. Hence loss of autopilot and other degradations.

[viking767]

Any more news on this incident?

[old,not bold]

Megan touched on the question of ETOPS (23rd Dec); I'm guessing this was not an ETOPS flight; correct?

But even if not, was the aircraft maintained and equipped as an ETOPS aircraft?

I wonder how things would have gone if an unconnected (or indeed connected) engine failure had been added to the crew's problems, shortly after the electrical failures at 0254 and 0255?

[BAengineer]

All 777's are ETOPS qualified - its not like the old days where you had some 757's that were ETOPS and some that were not and they had different components on them.

[max motor]

Two decades years of certifying 777 electrical systems and I have never seen anything like this before.

Having read the limited public informational available (particularly the AHM report), and just thinking aloud, I can't help thinking...

The 777 has only a single Back Up Converter controlling both Back Up Generators and both Transfer Busses.

..and wondering...

Would this incident still have happened if each Back Up Generator had it's own, completely independent, Converter?

I am not speculating on the cause - I just don't have access to the detailed information to answer this question.

[Dee Vee]

Would this incident still have happened if each Back Up Generator had it's own, completely independent, Converter?
I am not speculating on the cause - I just don't have access to the detailed information to answer this question.

At least they have the entire undamaged aircraft, so hopefully the real cause will be found and remediated.

[EEngr]

Would this incident still have happened if each Back Up Generator had it's own, completely independent, Converter?

It does appear that the backup generator/converter system was involved and may have been the root cause of this sequence of events. If so, there are two possible solutions: Provide separation within the backup system so as to eliminate a single fault from taking both main AC buses with it. Or make ELMS smarter so as to clear faults with greater selectivity and not disconnect unfaulted sources and buses.

It all comes down to certification costs. While redesigning the backup system to provide additional channel separation would seem to be a more sound solution, there is a strong motive to 'fix it in software'. So I'm betting on a patch to ELMS.

[Dee Vee]

It all comes down to certification costs. While redesigning the backup system to provide additional channel separation would seem to be a more sound solution, there is a strong motive to 'fix it in software'. So I'm betting on a patch to ELMS.

Surely it comes down to safety.

If the design is faulty it needs to be fixed, "putting a patch on it" but leaving the root cause to rear its ugly head some time in the future, isn't an option.

Luckily this time no lives were lost, that might not be the case if it happened again.

[Bidule]

Please remind me how the B787 battery issue was "solved". Was the root cause addressed or a "safe(?)" box put over the battery?:)

[tdracer]

Well, the battery was completely redesigned. The battery charging system was completely redesigned. Then, because the damage to the event batteries was so severe they were unable to conclusively determine root cause, as a failsafe they put the battery inside a steel box that would contain any possible battery failure.
Appears to have worked - prior to the redesign there were two failures on 50 aircraft in a few months. Seven years later, with about 600 aircraft in service, there has been a grand total of one battery failure - which due to the battery redesign was contained to a single cell.
So yes, they fixed the 787 battery problem by putting a box over the battery :ugh:
Constantly repeating the myth that all Boeing did was put the battery in a box doesn't make the myth true.

[EEngr]

Fixing ELMS logic to clear faults more selectively (i.e. not dumping all the sources) is a legitimate fix. One may not be able to identify all possible future fault conditions. Even by redesigning the backup converter. The redesign of which might create a whole new batch of unforeseen failure modes. So handling them properly would be a good approach.

[Dee Vee]

Its providing more (possibly better, possibly worse) complexity, but not addressing the SPOF, therefore not a legitimate "fix", but merely an enhancement that hasn't removed what can still turn out to be an un-recoverable failure.

[EEngr]

but not addressing the SPOF,
Had ELMS not dumped two perfectly good generator sources, there would have been no single point of failure. At most, a change in the ETOPS capabilities.

[Machinbird]

Just wondering.
Considering how far down this aircraft was on the usable generator availability, would the old computer trick of rebooting be applicable to this situation?

I would not want to just try this in the wild without Boeing testing out and coming up with new procedures, but if in mid Ocean and unable to control fuel transfer, then I might reconsider.

Caution-Not type rated, but I have had occasion to fly jets without electrical power. They generally do not need electrical power to stay airborne- for a while!

[EEngr]

Usually, that is discouraged in such situations. Closing a breaker into what might be a fault could result in even more serious damage. Cycling a circuit breaker can be OK to 'shake loose' a brain-dead processor. In that case, if you opened the breaker, you can close it (deferring to the published operating procedures, of course). But if it tripped on its own, I'd be hesitant to re-kindle a fire someplace.

[Machinbird]

I was thinking something more like turning off all generator switches, and then bringing them back on line incrementally.

[etudiant]

Is that not what the existing system is expected to achieve, by isolating the faulty element?
I still do not understand what actually went wrong in this instance, the generators were green, but the distribution was on strike for some reason.
Turning off the generators might have helped, but it also might have left the system entirely powerless.
Think the crew performed splendidly and hope that the investigation is equally effective.

[FullWings]

I vaguely remember an incident back in the late 90’s on one of our 777s. They were minding their own business in the cruise when they stated getting EICAS advisories for lesser-known utilities. This turned quite rapidly into cautions, with many of the aircraft’s electrically powered systems going off line, to the point that it was looking pretty serious. I can’t recall how they got most of them back but the root cause was established later as being an ELMS failure. Interesting as it was still functioning but had a problem with some kind of feedback, so was load shedding on the basis of too much demand but carried on until it had turned off everything it could...

[etudiant]

So there is a precedent. Was it determined what the root cause was for the ELMS to go haywire in that case?

[Pinkman]

If indeed It is found to be a cascading ELMS failure is there merit in considering a software fix where ELMS is duplicated in the same way as the INS which is effectively "refereed" in many modern designs?

[Escape Path]

So far as I understand they lost both main AC busses. They did have generators available (there’s a picture of the system synoptic somewhere by the beginning of the post) but nowhere to connect them. Given the scenario, I don’t think that your suggestion would have made any difference. Hell even the RAT apparently didn’t engage to a bus! Is that bit of info confirmed? Usually the RAT feeds an essential bus or something different from the main busses. Having the RAT deployed but not powering its bus(ses) would be a true kick the nuts... Electrical system should’ve gone completely bat sh*t crazy somehow for this to happen

[Machinbird]

Escape Path, everyone is entitled to their opinion but:
According to the commander, interviewed on TV, power came back after the engines were shut down. Presumably from the APU, on the footage the cabin lights were visible.
I'm leaning to the interpretation that the RAT dropped off on approach due to low airspeed at that point, but that it was energizing the appropriate DC busses until the approach. Otherwise, it seems the batteries would have been exhausted before the opportunity for the approach.

Is there even a switch or contactor that would even be able to shut down the RAT power once extended?

In any case, If I encountered such a problem inflight in mid-Ocean that was not covered in emergency procedures, training, or whatever, I would not just sit there wringing my hands.
This is not any form of criticism of the LATAM crew, who did an absolutely marvelous job. Didn't even flat spot the tires it seems.

[FullWings]

So there is a precedent. Was it determined what the root cause was for the ELMS to go haywire in that case?
Can’t remember precisely - could have been something to do with load sensing? The net effect, as described above, was load shedding irrespective of the actual draw from the systems.

The LATAM incident sounds a little bit different as most of the busses went off, taking down what was attached to them, as opposed to commanded de-powering of selected units...

[fullforward]

So I support one of my first posts on this thread - sort of HAL 9000 took control of this 777 electrical system. Surprise such a serious and disturbing event generated few discussion.

[EEngr]

Not much to discuss until the forensics is done and a report is published. I spoke with a 777 test pilot yesterday and he hadn't heard about this incident. Cards are being played very close to the chest on this one.

[Fursty Ferret]

The only reason you haven’t seen much discussion is because people rarely make meaningful replies to random speculation.

I’m as curious as the next person to find out why this happened, but I’m putting your “computer became self aware and tried to kill the crew” theory near the bottom of the list of possible causes. Isn’t this supposed to be a forum for professional pilots?

[fullforward]

I'm on the belief that people using this forum are educated enough to realize or at least suspect some statements are metaphoric...I bet you know I made an analogy to an AIMS or EMLS failure, for that matter.

[InfrequentFlier511]

Remember 11 years or so back, a Qantas B744 landing in Bangkok on battery power? In the end it came down to a drain in one of the galleys flooding an electrical compartment. I predict that, like that incident, the hindsight is going to be strong when they get to the root cause of this one.

[etudiant]

Am surprised there have not been any further developments in this case. It seems a serious enough failure that one would expect an urgent inquiry.

[tdracer]

No first hand knowledge here (but a lot of experience in the Boeing safety program). I know this won't be a popular opinion around here, but the apparent lack of urgency (or even news) suggests crew error - the crew failed to properly follow an established procedure or checklist in response to a relatively minor problem. As I recall, that was the case on the Qantas 747 event mentioned previously.

[BuzzBox]

Crew error was not a factor in the Qantas B747 event at BKK:

ATSB TRANSPORT SAFETY REPORT Aviation Occurrence Investigation – AO-2008-003 Final (https://www.atsb.gov.au/media/3440510/ao2008003.pdf)

[viking767]

Any more news on this incident?

[Check Airman]

Avherald (http://avherald.com/h?article=4c1cc3f6&opt=6144) posted this update


On May 24th 2019 Brazil's CENIPA released a brief update that they found evidence of a short on connector D7232 which connects the right hand backup generator to the right hand converter. The backup converter responded by opening 4 connectors feeding the transfer busses (two transfer bus breakers and two converter circuit breakers).​​​​​​

[stinking cranesbill]

The final report on this incident was published on 8th July 2021 (IG-190/CENIPA/2018), although it references only the aircraft PT-MUG and not the flight number. Both the airmanship of the pilots, and the subsequent electrical fault tracing and analysis are wonderous to behold.

Followers of the "777X Woes" thread might find much of interest.

The fault cascade is somewhat beyond by understanding, particularly the relevance of the fault in the permanent magnet generator. But taking the report's conclusion as correct, are the recommendations not somewhat thin?

Surely an examination of a sample of the failed connectors in other 777s would have been merited, at least?

[Stuart Sutcliffe]

Downloadable reports, in Portuguese and English, available here:

CENIPA - Relatórios Finais (http://sistema.cenipa.aer.mil.br/cenipa/paginas/relatorios/relatorios.php?matricula_anv=ptmug&numero_relatorio=&data_inicial=&data_final=&classificacao=&uf=)

[Lord Bracken]

The aircraft Commander had 29,000 hours, 45 years in aviation? Remarkable.

[FullWings]

That was a truly nasty set of failures. Top marks to the pilots for what looks like excellent CRM leading to a successful outcome.

[AlexGG]

What I found really unexpected, that report says

During landing, the brake set overheated, which started the fire on the wheels of the
main right and left landing gears. The Fire Section carried out the fire fighting, which was controlled in 4 minutes. From the beginning of the fire extinguishing to cooling the set of brakes, 65,700 liters of water and 780 liters of Foam Generating Liquid (LGE) have been spent.

that's 65 tons of water to control the wheel fire. Seems quite a bit more than I would expect.

[Klauss]

I think that´s fully ok. The wheels are big and many, and the brakes: same. Plus, they carry all the heat from braking the overweight airplane in them. Amazing, that they could take it, anyway.
So, a quantity of water is needed to cool things down. Quite ok with me.

[Chu Chu]

And some of the water must have been mixed with the 780 L of foam concentrate. That wouldn't do much to cool the wheels themselves.

[pattern_is_full]

65 tonnes = 65 cubic meters. Or a swimming pool about 5.5m x 6m x 1.96m deep (water is pretty massive). Doesn't seem like a lot to me, given the mass of the main gear trucks (~6.8 tonnes each).

Plus it occured in local tropical summertime. Daily high temperatures of 28°C - the water may have been 25-35°C after sitting in the sun all day, and thus less efficient in absorbing and removing heat from the metal/rubber/carbon of the gear.

One would have to juggle starting temps, specific heats, joules, volumes/masses and such to get an estimate of water required to achieve cooling of xx°C. And then factor in inefficiency of delivery (water that just sprays on the runway).

[WHBM]

That's likely the total contents of the fire tenders, which would just blast until all used up.

[Chu Chu]

By my math, it would take something like 300 tonnes of steel at 1100 degrees Celsius to flash 65 tonnes of 100 degree water to 100 degree steam. So it seems safe to say the runway got pretty wet.