BA038 (B777) Thread
Join Date: Feb 2008
Location: UK
Posts: 50
Likes: 0
Received 0 Likes
on
0 Posts
Fuel stratification - bowing out (for now)
Warning: I'm non-professional; not crew, not engineer - just guest here, thanks.
Green-dot,your post #328, thanks for the clarification regarding the visibility of maintenance pages to the flight crew. And, we agree with each other, there is no indication in the AAIB bulletins to suggest that water content in any of the tanks triggered a warning message. I also think the AAIB statements of fuel testing rule out gross water contamination of the fuel. This does not mean that H20 did not contribute to the cause of the accident, but then, neither does it mean H20 did contribute.
I seem to have reached a point where my lack of understanding of the 777 systems, coupled to some contradictory statements on how the systems work on this thread, has convinced me that I should now stop scribbling.
I'll leave the fuel stratification idea hanging mute and await the final AAIB report.
Thanks to the moderator(s) for allowing me to participate on this professional forum and for the forbearance of the professionals.
Last words - the flight crew performed truely wonderfully. I wonder how much additional revenue BA will earn over the coming years from that display of pure professionalism.
Regards, Tanimbar
PS. I reserve the right to return
Green-dot,your post #328, thanks for the clarification regarding the visibility of maintenance pages to the flight crew. And, we agree with each other, there is no indication in the AAIB bulletins to suggest that water content in any of the tanks triggered a warning message. I also think the AAIB statements of fuel testing rule out gross water contamination of the fuel. This does not mean that H20 did not contribute to the cause of the accident, but then, neither does it mean H20 did contribute.
I seem to have reached a point where my lack of understanding of the 777 systems, coupled to some contradictory statements on how the systems work on this thread, has convinced me that I should now stop scribbling.
I'll leave the fuel stratification idea hanging mute and await the final AAIB report.
Thanks to the moderator(s) for allowing me to participate on this professional forum and for the forbearance of the professionals.
Last words - the flight crew performed truely wonderfully. I wonder how much additional revenue BA will earn over the coming years from that display of pure professionalism.
Regards, Tanimbar
PS. I reserve the right to return
Join Date: Jul 2007
Location: BRU
Posts: 82
Likes: 0
Received 0 Likes
on
0 Posts
.... My only thought then was it was all down to the filters plus a bit of heat and agitation and thought no more about it.
That bit of heat might just not have been there. Could the temperature of the fuel at the boost pump inlets have been significantly lower than the recorded total fuel temperature according to you (due to suction, ie pressure drop when more thrust was commanded) could this in turn have influenced viscosity enough to cause a restriction and hence cavitation? No water or ice involved in this scenario, nor any post-incident evidence after a certain time.
Join Date: Jun 2006
Location: Canada
Posts: 94
Likes: 0
Received 0 Likes
on
0 Posts
I am not sure if it has been mentioned before, but in addition to the 2 fuel pumps in each main tank, there is a pump bypass valve in the left and right tanks that allow the engine driven fuel pump to suction fuel from the tanks in the event the boost pumps are not working. I believe that this situation would be highlighted by a level B ENG FUEL PRESSURE warning which includes an audio warning.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.
Even if the crew had no time to deal these warnings, these should have been recorded and the data should have been correlated with system faults in the central maintenance computers. I am sure that these computers have been interrogated already and we would have heard about these problems.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.
Even if the crew had no time to deal these warnings, these should have been recorded and the data should have been correlated with system faults in the central maintenance computers. I am sure that these computers have been interrogated already and we would have heard about these problems.
Join Date: Feb 2008
Location: Subterranea
Age: 70
Posts: 187
Likes: 0
Received 0 Likes
on
0 Posts
Quoting hotdog:
". . .from aliens to EMI to RMI. . . ."
May i remind you that a bad connection in aircraft wiring can result in EMI?
Neither the electronics nor the well shielded wiring itself but the wiring connections seem to have been problematic on occasions.
Sometimes the cause has been traced to such bad connection by disconnecting and reconnecting LRUs, solving the problem.
For example on one such incident (i stress, a different time, different plane), a MCP (mode control panel) was doing strange things intemittently like letting both pitch and autothrottle fight each other to maintain speed. Nearly all LRUs involved were changed before it was discovered that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved the problem.
From examples like this the industry has learned over the years.
There is also a difference between a factory fresh airplane and an airplane being in service for several years subjected to the elements, and wear and tear. Good maintenance keeps things in check but EMI can be something intermittent which can only be addressed if it exists at the time of an inspection or an operational check.
Not to mention if it is a combination of signals mixing in like multiple signals from PEDs or from outside sources. PEDs also have specs but what happens to those specs if the user has dropped his PED once or twice on occasion, perhaps damaging it but is still functioning?
Now (and this is just theory) to go back to the aircraft in question and its engine feed system. What if EMI in some way had gotten hold of both spar valve control relays or open-close actuators on the valve control, mounted on the rear spar (outside of the fuselage / Faraday cage) and were temporarily closed and re-opened as the EMI appeared and disappeared. This would have restricted fuel flow to the engine pumps. What effect would that have had on pump cavitation . . . . .?
Also, i am aware that fuel "run" to "cut-off" switching would have appeared on the DFDR recording but would the DFDR also record uncommanded closure of the spar valves with the cut-off switches still in "run" position?
Regards,
Green-dot
". . .from aliens to EMI to RMI. . . ."
May i remind you that a bad connection in aircraft wiring can result in EMI?
Neither the electronics nor the well shielded wiring itself but the wiring connections seem to have been problematic on occasions.
Sometimes the cause has been traced to such bad connection by disconnecting and reconnecting LRUs, solving the problem.
For example on one such incident (i stress, a different time, different plane), a MCP (mode control panel) was doing strange things intemittently like letting both pitch and autothrottle fight each other to maintain speed. Nearly all LRUs involved were changed before it was discovered that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved the problem.
From examples like this the industry has learned over the years.
There is also a difference between a factory fresh airplane and an airplane being in service for several years subjected to the elements, and wear and tear. Good maintenance keeps things in check but EMI can be something intermittent which can only be addressed if it exists at the time of an inspection or an operational check.
Not to mention if it is a combination of signals mixing in like multiple signals from PEDs or from outside sources. PEDs also have specs but what happens to those specs if the user has dropped his PED once or twice on occasion, perhaps damaging it but is still functioning?
Now (and this is just theory) to go back to the aircraft in question and its engine feed system. What if EMI in some way had gotten hold of both spar valve control relays or open-close actuators on the valve control, mounted on the rear spar (outside of the fuselage / Faraday cage) and were temporarily closed and re-opened as the EMI appeared and disappeared. This would have restricted fuel flow to the engine pumps. What effect would that have had on pump cavitation . . . . .?
Also, i am aware that fuel "run" to "cut-off" switching would have appeared on the DFDR recording but would the DFDR also record uncommanded closure of the spar valves with the cut-off switches still in "run" position?
Regards,
Green-dot
Join Date: Aug 2007
Location: Alabama
Age: 58
Posts: 366
Likes: 0
Received 0 Likes
on
0 Posts
For example on one such incident (i stress, a different time, different plane), a MCP (mode control panel) was doing strange things intemittently like letting both pitch and autothrottle fight each other to maintain speed. Nearly all LRUs involved were changed before it was discovered that the windshield heat was not correctly grounded. This is located just a few inches from the MCP and is one of the big consumers on board. Tightening a few nuts solved the problem.
Join Date: Jul 2007
Location: UK
Age: 59
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Re. Avrflr post 330.
Avrflr,
“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.
Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “
Are “centre tank pump1, 2 running normally” recorded FDR parameters?
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?
Note that some things can’t be recorded as they are not signalled e.g. jet-pump induced water scavenge flow.
Can anyone out there help with an applicable list of FDR parameters?
While I'm asking, can anyone help with a schematic?
That’s not what I said. So, what I did say is very unlikely. The accident was unlikely too. It had unlikely causes. Dismissing possibilities on the grounds that they are unlikely is not helpful. I’ve never noticed blinkers in the kit of any of the air accident investigators that I’ve met.
The key to this accident is that there was a common-mode failure. The same thing happened to both engines at the same time. One common failure mode could originate from the engine control system/software. This has been ruled out by the AAIB. The engines themselves also got a posthumous clean bill of health. Another source of a common-mode failure might be the fuel quality. The AAIB have found no fault with it. Likewise temperature: the aircraft was operating within its environmental design envelope.
As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank. If anyone can think of any others, please post them.
“We'll call that miracle number 1 “
“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.
Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “
Are “centre tank pump1, 2 running normally” recorded FDR parameters?
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?
Note that some things can’t be recorded as they are not signalled e.g. jet-pump induced water scavenge flow.
Can anyone out there help with an applicable list of FDR parameters?
While I'm asking, can anyone help with a schematic?
“So, miracle number 2 is that the last drop of water passes through the injectors on both engines at the precise moment that the engines hit the ground? Come on.”
The key to this accident is that there was a common-mode failure. The same thing happened to both engines at the same time. One common failure mode could originate from the engine control system/software. This has been ruled out by the AAIB. The engines themselves also got a posthumous clean bill of health. Another source of a common-mode failure might be the fuel quality. The AAIB have found no fault with it. Likewise temperature: the aircraft was operating within its environmental design envelope.
As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank. If anyone can think of any others, please post them.
Last edited by SyEng; 23rd Feb 2008 at 15:56. Reason: site doesn't support superscripts.
Join Date: Jul 1999
Location: 58-33N. 00-18W. Peterborough UK
Posts: 3,040
Likes: 0
Received 0 Likes
on
0 Posts
FrequentSLF.
Disagree. Arcing across a bad electrical connection can cause, and is called, Electro Magnetic Interference. Isn't that what Marconi used to send his first radio signals? 
A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.
Based on my knowledge such kind of problem is not EMI. A badly grounded windshield heat cannot generate radio frequency which is the cause of EMI. Grounding issues are not related to EMI.
A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.
Join Date: Apr 2005
Location: Stockholm Sweden
Age: 74
Posts: 569
Likes: 0
Received 0 Likes
on
0 Posts
Are “centre tank pump1, 2 running normally” recorded FDR parameters?
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?
Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.
I.e. Pump switch ON or OFF command
and pressure switch Pressure or NO Pressure.
Failure of sensors is not recorded, has to be determined by logic.(not computor logic but human logic!)
Are the centre tank push-buttons positions recorded?
Would failure of the CT pump pressure sensors be recorded?
Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.
I.e. Pump switch ON or OFF command
and pressure switch Pressure or NO Pressure.
Failure of sensors is not recorded, has to be determined by logic.(not computor logic but human logic!)
Join Date: Aug 2007
Location: Alabama
Age: 58
Posts: 366
Likes: 0
Received 0 Likes
on
0 Posts
Disagree. Arcing across a bad electrical connection can cause, and is called, Electro Magnetic Interference. Isn't that what Marconi used to send his first radio signals?
A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.
A spark-gap transmitter is a device for generating radio frequency electromagnetic waves. These devices served as the transmitters for most wireless telegraphy systems for the first three decades of radio (1885-1916) and the first demonstrations of practical radio were carried out using them.
However here we are talking about grounding. There should be no arching on the ground connection.
When using the ctre tank do they on the 777 switch off the pumps with 500kg remaining in the tank as is done on 75/76's due the alleged problems with fuel pumps. On the 76 this amount gets scavenged when the wing tanks are down to approx 7 tons each side. Mmm! just wondering?
Join Date: Apr 2005
Location: Stockholm Sweden
Age: 74
Posts: 569
Likes: 0
Received 0 Likes
on
0 Posts
When using the ctre tank do they on the 777 switch off the pumps with 500kg remaining in the tank as is done on 75/76's due the alleged problems with fuel pumps. On the 76 this amount gets scavenged when the wing tanks are down to approx 7 tons each side. Mmm! just wondering?
you get an EICAS msg when the centre tanks pumps are on, and the qty is around 900kg. You then turn off the centre tank pumps for the remainder of the flight. Later on as the Wing tank qty decreases, two transfer jet pumps transfer this 900kg to the wing tanks. This procedure is completed well before landing.
you get an EICAS msg when the centre tanks pumps are on, and the qty is around 900kg. You then turn off the centre tank pumps for the remainder of the flight. Later on as the Wing tank qty decreases, two transfer jet pumps transfer this 900kg to the wing tanks. This procedure is completed well before landing.
Join Date: Jan 2008
Location: US
Posts: 251
Likes: 0
Received 0 Likes
on
0 Posts
Common-mode failure
SyEng
Normal procedure would appear to be that the centre tank pumps are switched off in response to the 900kgs EICAS message, meaning they wouldn't re-start manually or automatically unless they were 1st switched back on. System logic has the centre tank pump switches serving as annunciators for low pump pressure when the switches are on but this function is inhibited when the switches are off and I don't believe system logic would allow the centre tank pumps to operate automatically with the pumps switched off and this feature inhibited.
As I understand it, the only way the engines get fuel directly from the common source centre tank is when those pumps are operating and there is sufficient fuel in the tank. I expect the position of those switches will be a recorded parameter and thus known to investigators, who will therefore also know what source was feeding the engines at the time of the accident. If the engines were receiving fuel from the centre tank and not their respective wing tanks this would constitute an anomaly which I am sure the AAIB would have mentioned in their report. Therefore it seems reasonable to assume that at the time of the accident the centre tank switches were off and the engines were receiving fuel from their respective wing tanks. Any contaminated fuel scavenged from the centre tank would logically therefore be still present in some quantity in the wing tanks, but according to the AAIB they didn't find any.
The only remaining common mode failure in respect to the fuel system would appear to be the fuel itself.
Curiouser and curiouser.
As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank. If anyone can think of any others, please post them.
As I understand it, the only way the engines get fuel directly from the common source centre tank is when those pumps are operating and there is sufficient fuel in the tank. I expect the position of those switches will be a recorded parameter and thus known to investigators, who will therefore also know what source was feeding the engines at the time of the accident. If the engines were receiving fuel from the centre tank and not their respective wing tanks this would constitute an anomaly which I am sure the AAIB would have mentioned in their report. Therefore it seems reasonable to assume that at the time of the accident the centre tank switches were off and the engines were receiving fuel from their respective wing tanks. Any contaminated fuel scavenged from the centre tank would logically therefore be still present in some quantity in the wing tanks, but according to the AAIB they didn't find any.
The only remaining common mode failure in respect to the fuel system would appear to be the fuel itself.
Curiouser and curiouser.
Join Date: Feb 2003
Location: Morten Harkett, Dorset
Age: 100
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
Quote: "Based on my knowledge such kind of problem is not EMI. A badly grounded windshield heat cannot generate radio frequency which is the cause of EMI. Grounding issues are not related to EMI."
Correct grounding is extremely important if EMI/EMC problems are to be minimised, especially if there are sensitive instruments nearby.
(I'm not saying this caused the problem)
Correct grounding is extremely important if EMI/EMC problems are to be minimised, especially if there are sensitive instruments nearby.
(I'm not saying this caused the problem)
Last edited by barrymung; 23rd Feb 2008 at 19:53.
Join Date: Feb 2003
Location: Morten Harkett, Dorset
Age: 100
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
Can anyone tell me what happens if the AAIB/Boeing fail to find the cause of the crash?
Will they keep plodding on until they find something? Will they admit defeat and say "We don't know"? Will they do something else.
Obviously the effect of a non-result on the flying public can only be imagined but I suspect they'll lose faith in the 777 and possibly more..
Will they keep plodding on until they find something? Will they admit defeat and say "We don't know"? Will they do something else.
Obviously the effect of a non-result on the flying public can only be imagined but I suspect they'll lose faith in the 777 and possibly more..
Join Date: Jan 2008
Location: Denmark
Age: 79
Posts: 158
Likes: 0
Received 0 Likes
on
0 Posts
SyEng,
You write:
"As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank."
I fully understand that you are searching for a common-mode failure - so am I!
But I have a big problem finding a scenario in which your CTR tank theory fits.
If the SOP was followed, and I have no reason to believe otherwise, the CTR tank became empty LONG before arriving LHR (as already mentioned in many posts).
Any fuel left would imply double scavenge pump failure - very unlikely!
In any case the AAIB report states that there was an indicated fuel load of 10500 kg upon arrival - distributed between the 2 wing tanks (5100 kg and 5400 kg). Nothing is mentioned about fuel in the CTR tank.
Also "the flight was uneventful until the later stages of the approach"
With the information we have received (so far), I cannot see that the CTR tank played any part in the accident.
"As far as systems common-mode failure sources are concerned, the only possibility that has occurred to me so far is that the fuel feed system allows both engines to be fed simultaneously from the same (centre) tank."
I fully understand that you are searching for a common-mode failure - so am I!
But I have a big problem finding a scenario in which your CTR tank theory fits.
If the SOP was followed, and I have no reason to believe otherwise, the CTR tank became empty LONG before arriving LHR (as already mentioned in many posts).
Any fuel left would imply double scavenge pump failure - very unlikely!
In any case the AAIB report states that there was an indicated fuel load of 10500 kg upon arrival - distributed between the 2 wing tanks (5100 kg and 5400 kg). Nothing is mentioned about fuel in the CTR tank.
Also "the flight was uneventful until the later stages of the approach"
With the information we have received (so far), I cannot see that the CTR tank played any part in the accident.
Last edited by grebllaw123d; 23rd Feb 2008 at 20:20. Reason: small addition
Join Date: Jul 2007
Location: UK
Age: 59
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Swedish Steve
“Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.”
“Fuel pump switch position is recorded.
Fuel pump output pressure switch sense is recorded.”
PAXboy
“We learnt that 777 standard procedure is to use the Centre tank fuel first and it it's entirety. Any fuel remaining in CT is then scavenged out to the wing tanks. The rest of the flight is supplied from each wing tank to it's respective engine. (Presumably for better trim?)”
Last edited by SyEng; 23rd Feb 2008 at 20:46.
Join Date: Feb 2003
Location: Morten Harkett, Dorset
Age: 100
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
"The key to this accident is that there was a common-mode failure"
Hmmmm. Does anyone know if any fuel related devices share any of the electronics, eg data bus, earth wires or whatever..?
My car uses a system called VANBus (Vehicle Area Network Bus) which is designed to save on cabling and thus cost...basically, all devices in the car are connected to this bus system and can talk to each other. It enables things like the speedo to talk to the radio so the volume gets adjusted as the speed increases...the wipers speed up and slow down automagically as well, depending on rain levels/road speed. The heater can talk to the headlights if it wants and the interior light to the engine management system if it wanted to. Well, you get the idea.
The major disadvantages is that a fault on the VANBus can cause all sorts of odd problems. One dodgy wire and the whole lot goes boof!
Aditionally, if a device on the VANBus starts sending out spurious data it can cause another device to mis-behave despite it being fully functional and apparently not related...
Hmmmm. Does anyone know if any fuel related devices share any of the electronics, eg data bus, earth wires or whatever..?
My car uses a system called VANBus (Vehicle Area Network Bus) which is designed to save on cabling and thus cost...basically, all devices in the car are connected to this bus system and can talk to each other. It enables things like the speedo to talk to the radio so the volume gets adjusted as the speed increases...the wipers speed up and slow down automagically as well, depending on rain levels/road speed. The heater can talk to the headlights if it wants and the interior light to the engine management system if it wanted to. Well, you get the idea.
The major disadvantages is that a fault on the VANBus can cause all sorts of odd problems. One dodgy wire and the whole lot goes boof!
Aditionally, if a device on the VANBus starts sending out spurious data it can cause another device to mis-behave despite it being fully functional and apparently not related...
Join Date: Jan 2008
Location: Auckland, NZ
Posts: 26
Likes: 0
Received 0 Likes
on
0 Posts
Avrflr,
“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.
Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “
“Miracle” is not standard systems safety analysis terminology. Please define. Here are some of the terms we use in the industry by way of example. Personally though, I prefer to stick to numbers for clarity.
Remote: < 1E-5 failure events per flying hour
Extremely remote < 1E-7 “
Extremely improbable < 1E-9 “
Probability that I may be proven to be totally wrong: 1 in 4
I accept that the accident was unlikely and therefore had an unlikely cause. I don't believe that gives one carte blanche to suggest miraculously improbable coincidences as the cause of the failure.That might be a useful exercise. We can agree that something did happen, and it appears to have gone unnoticed by the FDR. Perhaps a gap can be found where no data is collected that could provide a place for the problem to "hide".
The trouble with playing this game is that we are working with only partial information. If we knew exactly what the AAIB had tested and how they had tested it, we could come up with better theories, and for that matter, better arguments against theories. I may very well be making false assumptions as to what has been established as fact, based only on the very brief reports I have read. I don't believe any of the theories I have read are credible, based on the evidence in front of me. It seems that this is the conclusion the AAAIB have come to (with much more evidence), hence the continuing investigation.