AAIB BA38 B777 Initial Report Update 23 January 2008

[NSEU]

of course there is a bypass mechanism for the fuel filter and a differential pressure system that indicates a clogged filter.

Depends on which filter you are talking about. I don't recall reading about a bypass and warning system for the HP Fuel Filter on the Trent.

I just confirmed that BA's 777's do not have dual sensors for fuel temperature (based on what was written in their Maintenance Manual). Whilst it's not unusual in the aviation world, you would have to ask why don't they (on any aircraft, not just ETOPS aircraft).

[gas path]

Damn I did think twice about mentioning the HP filter in case it clouded the issue However it is nought more than an 'elephant' strainer and not worthy of further detail.

[M.Mouse]

I just confirmed that BA's 777's do not have dual sensors for fuel temperature (based on what was written in their Maintenance Manual). Whilst it's not unusual in the aviation world, you would have to ask why don't they (on any aircraft, not just ETOPS aircraft).

In 20+ years of longhaul flying on both B747s and B777s I have only twice had low fuel temperature warnings. Both times long trans-Siberian flights in exceptionally cold conditions. I have never had a fuel temperature indication failure.

Which all leads to me asking the question what justification is there for dual sensors given the extremely unlikely event of a sensor failure AND a low fuel temperature situation occuring at the same time?

[airfoilmod]

Mr Mouse

If your question isn't rhetorical, I suppose the answer is, where does one stop re: redundancy? Ask the pilots of the 747 who lost their Vertical Stabiliser and flew around for awhile before putting a new hole in Fujiyama, Or the UAL DC-10 (exPanAm) that lost its VS and slammed rather hard into Sioux City. I'm with you. Two VS on aircraft? Where shall we place the second one? At first blush, but perhaps especially ETOPS, a redundant Fuel temp sensor might not be a bad idea, maybe just not a very good one.
I defer to you, Sir.

[Krimi]

Should the fuel temp indication fail you can refer to the Total Air Temperature (TAT) indication, which comes close enough IMHO.

[Stoic]

NSEU/M.Mouse

I just confirmed that BA's 777's do not have dual sensors for fuel temperature (based on what was written in their Maintenance Manual). Whilst it's not unusual in the aviation world, you would have to ask why don't they (on any aircraft, not just ETOPS aircraft).

Thank you for that information NSEU.

In 20+ years of longhaul flying on both B747s and B777s I have only twice had low fuel temperature warnings. Both times long trans-Siberian flights in exceptionally cold conditions. I have never had a fuel temperature indication failure.

Which all leads to me asking the question what justification is there for dual sensors given the extremely unlikely event of a sensor failure AND a low fuel temperature situation occuring at the same time?

Making the huge assumption that the single source fuel temperature sensing system was implicated in the accident, surely this would be the case of a very unlikely event having a potentially catastrophic outcome.

I remain surprised that the separate tank/engine pairs do not have their own fuel temperature sensing systems.

It will be extremely interesting to see what the AAIB comes up with.

Regards

Stoic

[ChristiaanJ]

Originally Posted by Krimi

Should the fuel temp indication fail you can refer to the Total Air Temperature (TAT) indication, which comes close enough IMHO.

My 'educated' guess would be that there is a considerable lag between fuel temp and TAT..... especially after coming off the TOD.
I come from the ancient 'belts and braces AND a piece of string' school (blue, green and yellow...) so I would probably have voted for a dual sensor, to stop a single one from telling porkies....
But the fuel temp indication does not seem to be a primary issue here.

[Krimi]

Christiaan,

I agree completely!
Since we don´t rebuild the 777 here, we stay with the one and only fuel temp indication it seems to have.
Anyway: Shouldn´t the pilot be on the safe side with OAT during climb and cruise? And especially during descend where everything becomes warmer?

[M.Mouse]

According to my manuals 'Generally fuel temperature will tend to change towards TAT at a rate of 3°C/hr'

I am sorry but I believe talk of dual sensors is a red herring and quite futile.

First of all we have no idea whether fuel temperature was an issue, secondly even if it was for some as yet undisclosed reason the sensing system had NOT failed and thirdly although aeroplane designers do not always get it right I would suggest that some pretty logical design went into what is a fairly uncomplicated system i.e. the design has a very simple with a reliable bunch of components in the, proven from testing, coldest area of the entire fuel load to alert crew when the rare event of very cold fuel requires action.

[barit1]

Stoic - Thank you for the historical perspective. I had heard a bit about the early -100 donks but your story puts it in a new light.

P&W, R-R, and GE all had some pretty terrible early problems, but the improvements over the decades have completely changed the industry, haven't they? I recall when the airlines thought a engine shop visit rate (TBO, if you prefer) every 3000 hours was an unattainable goal. Today, 20K hours is not unusual.

[Stoic]

M. Mouse, Barit1

I would suggest that some pretty logical design went into what is a fairly uncomplicated system i.e. the design has a very simple with a reliable bunch of components in the, proven from testing, coldest area of the entire fuel load to alert crew when the rare event of very cold fuel requires action.

M. Mouse

You seem to be suggesting that the designers made the 777 crash-proof! Something caused the accident. I am not suggesting that it was the single temperature sensing system that was the problem. But surely, given the almost simultaneous thrust loss on both engines, the likelihood is that there was a common cause. Fuel temperature sensing is one common system. There may be others. Let us see what the AAIB comes up with.

Barit1

I take that as an apology! The great thing about getting down the route after the initial sim training on the Classic was to find that the aeroplane was much easier to fly on three than the horrible simulator.

Regards

Stoic

[Jumbo Driver]

I recall that on both 747 Classic and 744 that the Fuel Temperature Indicating System (sensed in No.1 Main Tank) could be u/s for dispatch (but not ex-Main Base), provided that TAT was substituted as indication of fuel temperature. However I must say that I do not remember any instance in over 20 years of 747 flying when a Fuel Temperature Indicating System was found unserviceable.

There can indeed be a significant lag between a fall in TAT and it being reflected by a corresponding drop in fuel temperature, it being dependant both on the difference between the two temperatures and also on the quantity of fuel involved. Therefore, using TAT in place of fuel temp will still be an effective (but more restrictive) method of ensuring that fuel temperature limitations are not exceeded.

I imagine that Boeing design philosophy in this regard in the 777 is likely to be similar to the 747.

However, I do agree with M.Mouse on this - I think talk about need for dual sensors is not justified - indeed it is almost certainly highly irrelevant to this 777 event.


JD

[ChristiaanJ]

Hum...
Using "fuel temperature = TAT" during descent sounds dumb, precisely because of the considerable lag between the two.

Maybe we can kick this around a moment more, without necessarily implicating it automatically as having to do something with BA038?

[Jumbo Driver]

Originally Posted by ChristiaanJ

Hum...
Using "fuel temperature = TAT" during descent sounds dumb, precisely because of the considerable lag between the two.

I don't find it "dumb" at all.

Normal flight profile in the cruise phase is a stepped climb. During this phase, TAT will indicate the eventual tendency of the fuel temperature. If TAT is or approaches 3°C above the fuel freeze point, action would be required and would almost certainly involve a descent to provide a significant increase in TAT. Provided there is no flight below critical TAT, I cannot see how fuel temperature would not be safeguarded by this method.

During final descent, of course, TAT would not reflect fuel temperature in the same way. However, at this stage it is not critical because the higher TAT would now be tending to cause the fuel temperature to increase rather than fall.

As far as I can see, the only disadvantage in using TAT instead of actual fuel temperature is that remedial action may need to be taken earlier than otherwise would be the case. However, I cannot see why either method could not be used to ensure adequate margins over the minimum fuel temperature limitation.


JD

[avrflr]

So if cold fuel isn't the culprit, how about cold water? How would an engine respond if you ran it on progressively more "watery" fuel? Erratic combustor inlet pressure? Failure to produce much thrust?

[grebllaw123d]

Fuel temperature...

Jumbo Driver,

I flew the 767 (ONE temperature sensor in the L wing tank) for many years on arctic routes, and I agree with you that the method you describe using TAT indications is a very SAFE method, which surely will keep the fuel temperatures within limits at all times during the flight.

But it is a bit conservative during the first couple of hours into the flight where the spread between TAT and actual fuel temperature can be quite large - so we used a combination of TAT and actual fuel temperature in order to stay at the cleared flight level as long as possible thereby saving fuel.

I have the same experience with the ONE sensor system as other posters have, i.e. I have never experienced a failure!

[Stoic]

fuel temperature

I have the same experience with the sensor as other posters, i.e. never seen a failure!

I flew the 747 Classic for 23 years on worldwide, including arctic, routes. I cannot recall (but, due to great age, my memory may be faulty!) ever encountering a U/S fuel temperature gauge.

However, naive question, how can you be sure that a single temperature gauge is not over-reading?

I am certainly not pushing any theory that the single fuel temperature gauge caused the accident. But it is logical, in my opinion, to question what common components there were that caused independent ETOPS engines to fail to provide the required thrust at virtually the same time, thus causing a catastrophic accident.

What other common components were there?

Regards

Stoic

[wilyflier]

Please what TAT do you expect at Mach.83, at cruise , when oat is as low as -75?

[HotDog]

what TAT do you expect at Mach.83, at cruise , when oat is as low as -75?

It is _47.

[Green-dot]

Thinking outside the (ice) box:

Regarding the engine fuel feed system and thinking "outside the box", engine fuel feed is mostly electrically controlled. The system uses power from the ELMS (and the engine fuel spar battery).

As mentioned in previous posts, the B777 is regarded as 2 independent engines flying in close formation. Same goes for many other systems, including ELMS which in flight basically consists of left, right and standby power management panels. Many engine fuel feed electrical controls go through ELMS.

ELMS are located in the main equipment center, basically split between left and right side of this center. My question to insiders is why the panel which contains the left and right spar valve control relays (amongst a few other relays) are not located in the main equipment center but placed on the same panel outside of the equipment center? Why not also split between left and right on separate panels in the main equipment center? Perhaps access for ease of maintenance or trouble shooting?

Reason i ask is because years ago i have had experience with valves, similar in function, that closed uncommanded. Investigation revealed that this uncommanded closure was due to 2 factors, corrosion in the electrical connectors and EMI. Suffice to say, the flight crew had the luxury of an ejection seat as a back-up in case the valve closed which had happened on a few occasions at the time before the problem was identified.

We had to take certain measures to ensure valve function / fuel flow until a higher dash-number valve was available. As i recall, the new valves were easily identified by the presence of a little black box on top of the valve, an EMI filter.

I assume through the years, technology in shielding equipment from EMI, has improved considerably. But my experience regarding this matter (also on a FBW aircraft) stands clear, every time the aircraft was to be released for flight with suspect valves, we had to remove a red cross from the pilot binder by taking certain measures to ensure correct functioning of the valve. The red cross action was lifted when the new valves were installed.

Speculation on:

If the spar valves on BA038 were to possibly have closed and reopend due to EMI, a period of 15 seconds is calculated to close, and another 15 seconds to re-open these valves in a full cycle on a B777. Shorter if such an interfering signal lasted shorter than 15 seconds. If this happened on the subject aircraft in such a critical phase (2 miles out at 600 ft) the end result (landing short) could have been the same. Perhaps the 8 second difference between right and left engine could be due to difference in fuel line length between spar valves and respective engines?

Speculation off.

Regards,
Green-dot