Swedish Steve

Fullwings
Quote:
I cannot see any reference to a 15 sec T/D or ELMS auto shut off.

I've had a further browse through the manuals and this appears to have come about through an update in 2006 (ELMS software?), so may not have found its way into all the documentation yet? Service bulletin was 777-28A0040.

Thats why I don't know about it. It is not listed as an SB in the BA B777 AMM.

Jetdoc

I just wanted to repost my comment that i made yesterday. It seemed to have been buried under a bunch of posts on EMI and computers that are not even installed on B777s. I just wanted to add a couple of comments regarding the fuel system.
I am not sure if it has been mentioned before, but in addition to the 2 fuel pumps in each main tank, there is a pump bypass valve in the left and right tanks that allow the engine driven fuel pump to suction fuel from the tanks in the event the boost pumps are not working. I believe that this situation would be highlighted by a level B ENG FUEL PRESSURE warning which includes an audio warning.
Additionally, if the boost pumps were not providing flow, they would also give a similar LOW PRESSURE warning. And if all that ice was heading down to the engine, I am sure that the FUEL FILTER clogging warning would have come on.
Even if the crew had no time to deal these warnings, these should have been recorded and the data should have been correlated with system faults in the central maintenance computers. I am sure that these computers have been interrogated already and we would have heard about these problems.
I have not heard of anything along these lines and I was wondering if any B777 guys had any comments.

3db

Green-dot.
"PEDs also have specs but what happens to those specs if the user has dropped his PED once or twice on occasion, perhaps damaging it but is still functioning? "

In my experience PED are normally built to a price, not a spec; as such. A/C, are generally still built to a spec and that includes all the electronics. If that spec is adequate, is a different question. However, the B777 is a very safe A/C.

In a different field, I once had to investigate a problem of a little old lady with voices coming from her kettle! Yes, its was true, voices were coming from her kettle. Quickly traced to a unusual combination of resistance/capacitance/inductance in the kettle was de-coding "our" radio transmissions. We provided a new kettle, end of problem. Just to illustrate PED are built to a price, any spec (unless it adds "bells/whistles") is secondary.


Barrymung.
I concur!
Previous AAIB investigations seem to indicate 3 or more items are required to fail before an accident results. Perhaps, only perhaps, EMI was 1 of the 3?

sispanys ria

Correct me where I'm wrong:

During the cruise, the CT pumps are switched of when reaching 900 kgs. Untill the wing tanks are 50 % empty, these 900 kgs remains in the CT, cooling down much faster than in the wings. Some of this fuel might freeze, and not be transfered by the scavenge pumps. During the descent, the remaining untransfered frozen fuel melts in a kind of slush. If for some reason the CT right pump was on, then this mix would have been transfered to both engines (via the X-feed that was supposed to be open according to the previous report and statements of the crew). This would explain the similar reaction of both engines, provided with slush coming from the same location. The 7s delay might be explained by the longer distance to reach the left engine than the right from the CT right pump.
Question, how can this CT right pump be operating during the approach ?

Roseland

The AAIB report states:

The aircraft was serviceable on departure from Beijing
and there were no relevant reported defects. It departed
with 79,000 kg of Jet A-1 fuel on board, and the planned
arrival fuel at London (Heathrow) was 6,900 kg.

My understanding is that the centre tank can hold 80,000 kg of fuel, and each wing tank can hold 29,000 kg.

Doesn't this suggest the aircraft could have completed this flight using just fuel from the centre tank!

Does anyone know how the fuel was distributed between these tanks?

gas path

Full wings first and the rest in the belly!

bsieker

I can answer that at least partially.

The FACs, SECs and ELACs in the A320 do not in all cases control exactly the same control surfaces, and they never control the same surfaces at the same time through the same hydraulic system. There are three different strategies for dealing with failures:

1/ One computer only controls a fixed set of surfaces, with no overlaps:

- SEC 1 controls spoiler surfaces 3 and 4, SEC 2 control spoiler surface 5 and SEC 3 controls spoiler surfaces 1 and 2, on each side.

If one SEC fails, the respective spoiler surfaces can no longer be controlled and are retracted.

2/ One computer controls the surfaces, and there is a reversion priority if that fails. Different hydraulic systems are also used:

- ELAC 1 normally controls the ailerons, if it fails, ELAC 2 controls the ailerons. If both fail, the ailerons revert to damping mode.

- The reversion priority for the elevators is: ELAC 2, ELAC 1, SEC 2, SEC 1.

- for the rudder it is: FAC 1 -> FAC 2.

3/ multiple computers control the same surfaces, but through different hydraulic systems:

- SFCC 1 controls the slats through Blue hydraulic and flaps through Green hydraulic system, SFCC 2 controls slats through Green and flaps through Yellow hydraulic system.

(Source: FCOM 1.27.10, P 5, SEQ 100, REV 24)

So, for the infamous Lufthansa flight with wrongly wired sidestick, only ELAC 1 will control the ailerons with the wrong sese, and although the spoiler-roll-function will work in the correct sense, at low speeds, the ailerons are more effective than the spoilers, and roll-effect will be reversed.


Bernd

dxzh

Given the mundane nature of the flight and reliability of 777s, the set of circumstances leading to BA038 accident must be very rare.

My favourite, most unlikely alignment (of the Swiss cheeses) would be:

1. Outbound, centre tank fuel used first and remaining centre tank fuel later scavenged to main tanks.
2. Condensation froze on large inner surfaces of centre tank outbound.
3. Freezing surface temperature in Beijing so ice remained as ice on centre tank surfaces.
4. Refuelling melted some ice triggering water alert (138+ gallons) when taxiing but fuel cold and centre tank only 25% full so most ice remained frozen on centre tank surfaces.
5. Inbound, centre tank fuel used first and remaining centre tank fuel later scavenged to main tanks.
6. More condensation froze on large inner surfaces of centre tank inbound.
7. Ice on inner surfaces of centre tank only started to melt late on descent inbound.
8. Newly melted, very cold water scavenged (perhaps after change of attitude from flaps moved water between baffles closer to scavenge suction point) from centre tank to each of main tanks.
9. Main tank fuel well above Jet A1 freezing temp, but well below OAT and water freezing temp.
10. On entry to cold Jet A1, concentration of scavenged water froze forming ice particles suspended in or falling to bottom of each of main tanks.
11. Increased demand on finals sucked (and/or change of attitude from flaps moved) ice particles to inlets causing partial blockage to fuel line inlets from main tanks, exacerbated on right hand main tank by foreign object (scraper).
12. Fuel lines, heat exchangers, bypass, pumps, metering unit and engines continued to work but with a lot less fuel flow than desired.
13. Ice remained trapped in main tanks due to size of particles.
14. No water found in main tank sumps as did not settle there.
15. Only minute % of water found in each main tank as over 5+ tons of fuel in each.

First post – guess I will be on probation for a long time now.

Green-dot

Quoting 3db:

"In my experience PED are normally built to a price, not a spec; as such. A/C, are generally still built to a spec and that includes all the electronics. If that spec is adequate, is a different question. However, the B777 is a very safe A/C."

I agree, the B777 is a very safe A/C. If PEDs are only built to a price and not to a spec, does that mean there is no quality control? To my knowledge, a spec defines what a device is made of and what it should comply with (e.i. items or details included in a description of requirements or plans of a design).

3db:
"In a different field, I once had to investigate a problem of a little old lady with voices coming from her kettle! Yes, its was true, voices were coming from her kettle. Quickly traced to a unusual combination of resistance/capacitance/inductance in the kettle was de-coding "our" radio transmissions. We provided a new kettle, end of problem. Just to illustrate PED are built to a price, any spec (unless it adds "bells/whistles") is secondary."

Same as above, no quality control? Surely there must be procedures in place defining the allowable limits regarding transmitted radiation of PEDs before they are put on the market (and permitted to be used on a plane).

3db:
"Previous AAIB investigations seem to indicate 3 or more items are required to fail before an accident results. Perhaps, only perhaps, EMI was 1 of the 3?"

I agree, perhaps EMI could have been a contributing factor. I am also convinced that the B777 is a very reliable aircraft design.

Therefore, EMI seems highly unlikely. That said, so is a dual engine rollback on a design such as the B777.

The reason i address the EMI issue is that i have had first hand experience with unscheduled closing of fuel shutoff valves in the past due to EMI. This was on another type of aircraft (not any of the Boeing types). I dug up my fuel system manuals for that particular A/C type and checked the wiring diagram which includes the original valve (before EMI became an issue) and the improved valve with an EMI filter installed (lifting restrictions after the original valves were replaced with the improved valves).

I am aware that on the B777 the engine fuel control switching interfaces with ELMS, ARINC 629, AIMS, OPAS and fire switches which are all well shielded systems. The aircraft i refer to (also a FBW design) has none of the above mentioned interfaces. But when comparing the basic electrical control circuit from the fuel control switches to the spar valve actuators, they are functually similar.

Both are fed by 28V dc and with fuel control switch position in "run" or "cutoff", depending on switch position, either the open or close coil in the control relay is energized which controls the valve actuator. Power on the open or close coil moves the actuator motor to the selected position until limit switches are reached which remove power from the actuator.

There is one physical difference between the valves i refer to and the B777 spar valves. The valve i refer to has the control relay (which was sensitive to EMI, hence the filter) integrated in the shutoff valve. In the B777 the control relay and spar valve are separate components. The spar valve control relays (together with the APU fuel shutoff valve relay) are grouped together on a single panel. However, i do not see any EMI filters on the B777 spar valve schematics. Perhaps not required due to other measures taken, making the system imune for such effects, i don't know. Location of other equipment in the vicinity of the relays or valves (or absence of it) is also a factor determining system sensitivity, which obviously varies between aircraft types.

Another point that may be of interest is that (theoretically assuming EMI was a factor) if the spar valve control relays were switched unscheduled from "run" to "cutoff" for a certain period of time, the APU fuel shutoff valve control relay could have switched from "closed" to "open" during the same unscheduled event due to its close proximity to the former control relays. This may perhaps explain why the APU inlet door was observed in the open position?

Since EMI has occurred sporadically in the past as i have explained, why couldn't it happen again on other aircraft designs?

Summarizing, i have factual information that action has been taken to prevent EMI on fuel shutoff valve control relays in the past on another aircraft type. But regarding this B777 incident, evidence (of a source) pointing in that direction would have to be found in order to determine it as a possible cause for a dual engine rollback.

Regards,
Green-dot

NSEU

Many thanks to FullWings and Swedish Steve...

Again, this shows us that we are only as good as the (blurry) manuals available to us

Cheers.
NSEU

(Edit) P.S. Does anyone find it kind of worrying that fuel pumps can turn themselves off? Won't the crew get an EICAS message anyway if the pumps go low pressure?... and I'm sure the crew alertness monitor will wake them if they are asleep

overthewing

Coming at this from an IT perspective, can anyone tell me what the FDR actually records?

Specifically, if it records something that was commanded to happen, would it necessarily know that the 'something' didn't actually happen, if there was no failure signal?

I'm thinking that the fuel valves apparently tried to open to allow maximum fuel throughput. Would it be possible for the FDR to record the open-valve event, but have no knowledge of the valve's failure to do so?

I realise that it's very unlikely that this would happen on both engines at the same time, but then it looks like the cause of this accident was something very unlikely.

PAXboy

RoselandNo. Because we have heard in this thread that standard operating procedures on the 777 (for all operators) is use the centre tank FIRST and then the wing tanks.

In these threads we have heard more than once that the centre tank would have been empty by about half way through the sector.

Please correct this statement, if you know better.

M.Mouse

It is standard procedure for all the applicable Boeings which I have flown. Wing tanks are filled then the centre tank. Fuel is then used first from the centre tank and then the wing tanks. I believe it is a structural reason for doing so.

FullWings

Correct. I think one of the reasons is wing bending relief. If you have u/s centre tank fuel pumps and still have fuel in there, on most types it is a) limited to a certain amount and b) has to included as payload, not fuel (and not for the obvious reason!)

Most of the important valves/actuators, etc. have some sort of feedback as to the actual position or on/off open/shut, so that the operating systems can flag up a problem. Many, many maintenance messages that are generated read "XXX not in commanded position"; they often clear but are a sign of possible future problems. If there are no sensors to show success or failure, then this might be able to be logically inferred from other parameters; don't know how much of this goes on as I didn't design it...

Given the importance of this particular variable, I would wager a serious sum that this information would have been recorded on the FDR, QAR & non-volatile memory in the EECs, to name but a few.

Glad to be of service

wilyflier

As I remember the first AAIB report was said to have stated that the Captain after his initial debrief "Thought he had selected crossfeeds open" after the lack of engine response.
This would imply that Xfeeds OPEN would not be initiators of the problem.But also as I remember it was added that one Xfeed was open, but the other was not,(fully open) This led me to wonder out loud if the Xfeed had for some reason been like that the whole time

NSEU

I mentioned a similar scenario a few days ago, but was shot down in flames....

As mentioned previously:
The scavenge plumbing tubing isn't large. It takes a long time for fuel to be scavenged. I don't think you're going to get a lot of slush through those pipes. Water, maybe, but someone said that even *water* in that quantity is still not enough to affect the engines that much.

To stop (wing) fuel reaching an engine, you'd have to block off both wing boost pump inlets AND the suction feed inlet.

Additional info: Note that the CT fuel scavenge system dumps liquid (fuel or water) well away from wing tank pump inlets (unlike the water scavenge system). If it's dumping slush.. .it's dumping it well away from the pump inlets.

Regards.
NSEU.

Mad (Flt) Scientist

Re the discussion of FDR parameters.

Without knowledge of the specific parameters recorded for this FDR, it's very dangerous to assume that "parameter X is important therefore would be recorded".

The FDR parameter list which is REQUIRED for certification, per the FARs and the equivalent other regulations is very much a minimum list. You may be surprised at just what can be missing. For example .... glob99 posted this list. Check item 42, "Throttle/Power Lever Position". There is a Note to that requirement, which states that it only applies to airplanes with "non-mechanically linked cockpit engine controls". Which means that on any non-FADEC aircraft, where the engine is controlled hydro-mechanically, there is no recording of one of the main control inputs by the crew. Logically, throttle is quite important; you'd think an accident investigation would like to know it. But it's not required on some aircraft at all.

Bluntly, if it's not on the regulatory list, it's safer to assume it ISNT there, unless you have the actual spec to hand.

dxzh

Even if slush is only transferred into each main tank at rate of 200 kg per hour, then in 10 minutes that is 33 kg in each main tank.

If all, or even only part, of it freezes on contact with fuel that is a lot of potentially clogging debris in each main tank relative to the number and size of inlets. In context, the AAIB have highlighted for consideration four or so foreign objects in whole fuel system which are minute in comparison. I wholly agree that if it does NOT freeze in each main tank and remains as water then it becomes an irrelevance.

I have no idea which main tank inlet would be affected first in this most unlikely scenario which as you say requires the blockage of all inlets at least partially. I expect that eddies particularly from the operation of the the water scavenge pumps might push debris around unless/until it became trapped. Also I expect that the suction feed inlet might be blocked earlier without any noticeable effect - particularly on the right hand side given the foreign object.

Wornout Rubber

It was an interesting decision by the crew to leave the autopilot engaged as the speed decayed.
Perhaps there was a good reason for this. Perhaps they were understandably so preoccupied with trying to work out why there was no response from the thrust levers, that the speed decay went unnoticed.
However, the reason why the autopilot allowed the speed to decay was not because it was attempting to fly at the best speed for the situation presented to the crew. It was because it was attempting to maintain a glideslope that it was commanded to follow. Unfortunately, a decaying speed from about 140 knots at 750 feet to 108 knots at 200 feet, resulted in a severely degraded flight path angle.
If the autopilot/authorottle is not performing what it is commanded to do, (in this case maintaining the commanded speed), then it is best to disconnect, and correct the situation manually.
In this instance, as the speed started to decay, an autopilot disconnect followed by flying at a speed of between VREF and VREF minus 10 would, quite probably, have resulted in a different outcome, and a more controlled landing.

Milt

dxzh post #384

Not a bad scenario with commendable contemplation of many inter-relating aspects to line up the holes in your Swiss cheese BUT

Approximately how much water condensation do you contemplate will occur during the venting of an emptying CTank at heights where the vented air has very low specific humidity and which empty volume will be offset to a large extent by almost fully saturated fuel vapour. There will be extra venting with air during descents but my guess is that the most water you might get from the vented volume would be much less than enough to fill a tea cup.

Now there is a challenge to our meteorological boffins. Is my reasonably well educated guess better than yours?

And while you are about it how close might it be to a vacuum when jet fuel at sub zero temperatures C starts boiling? This is significant to the onset of cavitation at the HPressure fuel pump inlets.