ianwood

28L wrote:

Quote:

Ref the AA 777 incident yesterday, I understand the problem was probably with the autothrottle rather than the engine. Entirely different to the BA 777 incident.

28L, is your source for this information something different than the flightglobal.com article? I ask only because, IMHO the article reads very similarly to those that came out immediately after the BA038 incident with reference specifically to the autothrottle.

Incidentally, American 777s do use the Trent 800.

Far-flung possibility (feel free to shoot it down mercilessly): If I remember correctly, there was a recent FADEC software update on the BA 777 (Dec 2007 if I remember correctly). Now, I know all systems performed "as expected" according to the AAIB including the FADEC. However, it is possible that this update introduced an anomaly that would go undetected in testing, was not logged in system events, and would only occur under specific circumstances.

Does anyone know if the FADEC software on the AA 777s has been recently updated as well? Might be worth looking into.

Whether mechanical or software, I do know that these types of intermittent issues are especially tricky to deal with in that they tend to correct themselves before anyone can take a close enough look to find the problem. Even the most elaborate or event logging across numerous systems cannot capture every detail.

I am SLF with nothing more than a PPL but have been following this thread in great detail and appreciate all the expert input that has come up so far. BA038 is proving to be a very complex incident. It reminds me of TWA800 in that respect. TWA800 taught us a lot when it was finally resolved. Hopefully, BA038 will do the same.

Halfnut

29feb08/1022
To: All Pilots
Subject: B777 Lax Event

Initial Review Of Dfdr Data By Rolls Royce Indicates A Very
Different Event Than What British Airways Experienced. There
Were A Number Of Markers In The Ba Event That Are Not Present
In Our Dfdr Data. I Know This Is A Very Concerning Event And I
Will Keep You Informed As Details Become Available.

For The 777 Fleet Team,
Ca Jim Dees

overthewing

Is there any way of knowing how many times a single engine has shut down on the same type, at the same stage of flight? If there's a systemic problem that affects engines infrequently, statistics suggest that sooner or later both engines will be affected at the same time. That would make the BA38 incident just 'sooner' rather than later.

I'm sure the AAIB are combing the figures for clues, but I'd be interested to know how many incidents of single engine throttle-up 'issues' at any stage of the flight, on this type, professionals are aware of?

PJ2

If organizations keep all their FOQA/FDA data, then there is the possibility, given sufficient software capability, to "retrospectively" analyse the data for such an event.

mocoman

Can anyone cast any creadence upon a rumour that I have heard:

Airbus do engine software updates sequentially following a trial period; Boeing do parallel updates on all fixtures.

sky9

Should software updates be done to both engines on a twin at the same time? Whether this is or is not the cause of the problem it surely is prudent not to change the operating criteria of both engines at the same time.
If my memory serves me correctly didn't an engineer once replace the oil drain plugs incorrectly on all 3 engines on a tristar.

pax2908

Re. software updates. Please allow a general question: what is actually certified? Not really the a/c itself (after a s/w update, it is no longer the same a/c). How does the regulating authority handle this issue?

avoman

software updates are treated in a similar manner to hardware items. Only software from the manufacturer, or approved by the manufacturer from an approved source can be used on an aircraft. It must be installed in the approved manner only and installation certified by an appropriately licenced and approved engineer. No deviation is acceptable, unless that is also approved by the manufacturer and regulatory authority.

Static in the Attic

..."then what?"
... well Ed, I guess you point the nose at the threshold rather than 10nm CF & yell 'Mayday'. Surely better than radar vectors around the houses... don't you think?

sky9

Subject to height I would suggest that you shut one engine down leave for 30 secs then attempt a relight. (OK start the APU as well to give you start pressure).

RomeoTangoFoxtrotMike

HP Rotor Drive covers on a 737-400, see AAIB Report here.

Jumbo Driver

Yes, sky9, I think the event you have in mind involved the omission of all the O-ring seals on the magnetic chip-detector plugs on an Eastern Air Lines Lockheed L-1011 on May 5 1983.

This incident (amongst others) is mentioned on page 2 of this interesting Flight Safety Foundation article entitled Simultaneous Engine Maintenance Increases Operating Risks.

There was also a very similar incident involving a BAe 146 (RAF 32 Sqn) in 1997, which is described in the preceding bulletin here.

CAP 718: Human Factors in Aircraft Maintenance and Inspection is both relevant and interesting reading.



JD

Woodenwonder

Quote:"Suppose we do a power response test and the engines don't respond. Then what?"

Re-configure for best glide, and FLY THE AIRPLANE! (Sorry, not wanting to shout, but can't get the italics I wanted.)

wilyflier

See thread (Ameican investigates as 777 engine fails to respond)
...American quotes engine hung up for 15 secs before responding
...Olaf Husted post #24 refers to possible compressor icing after long descent with engine de icers ON , but inneffective at idle
...Orester,post #23 quotes high Alpha

UNCTUOUS

from this link (Washington Post article)
.
"The parts for commercial airliners such as the Boeing 727 and 737 were once manufactured almost exclusively in the United States. But the parts on today's big jets, such as Boeing's 777 and its planned 787, are made in such countries as China, Japan, Brazil, Italy, France and Australia, in addition to the United States. Boeing, Pratt & Whitney, GE and other plane manufacturers buy parts made overseas largely because they are cheaper.
But the bargain-hunting has come at a price, according to a new report by the Transportation Department's inspector general.
.
"Neither manufacturers nor FAA inspectors have provided effective oversight of suppliers; this has allowed substandard parts to enter the aviation supply chain," reads the report, dated Feb. 26. The agency released the report yesterday after it was made public by the Project on Government Oversight, a nonprofit organization that focuses on government accountability.
The report cited four engine failures in 2003 -- three on the ground, one in flight -- that were traced to "unapproved design changes made by a . . . supplier" of speed sensors on engine fuel pumps."

777fly

I am not sure that there are any software implications in this incident. The AAIB report makes it clear that the engine software and systems responded correctly but there was a problem with the fuel supply, not the demand. This is supported by the evidence of HP pump cavitation.

There is actually one instance in which Boeing suggest that a fuel supply problem can cause engine thrust deterioration or flame out. This is when an engine has to revert to suction feed at altitude, following dual wing tank pump failure. (No mention is made of the low altitude situation.) The background to this advisory is that dissolved air in the fuel is released at altitude and can accumulate in the suction feed pipe. The implication being that low atmospheric pressure in the tank, plus air in the suction line will disrupt or cut off the fuel flow under suction conditions.

Note from the fuel synoptic posted by Jet11 that the suction pipe is connected directly to the engine fuel supply manifold, isolated only by a pressure bypass valve. Also that the tank pump nominal output pressure is 14psi, but can be much lower. For argument's sake, I will assume that the suction bypass valve opens when there is a pressure differential around 5 psi and it closed under normal conditions.

In Bejjing, BA038 takes on fuel with an unusually high dissolved air content. This is due to a combination of production/storage/transportation/pumping and weather variables. The a/c flies high, long and cold. The air is released from the fuel and the suction pipe is completely filled with (relatively) dense air. This air remains in the pipe during the descent and once below 6000ft is inceasingly pressurised by denser ambient air and rising temperatures. At 1000ft atmospheric pressure reaches 14psi, equalling the fuel manifold pressure. Fuel hydrostatic static pressure and adiabetic heating add another 6psi, causing the suction bypass valve to open against tank pump pressure.This releases pressurised air into the fuel supply manifold and disrupts the fuel supply. This happens in both tanks, but not simultaneously. The opening of the valve could be assisted by a momentary drop in fuel manifold pressure during the initial power demand.

Just another theory. My assumptions about the bypass valve are probably wrong. Also, why is this not a regular occurence? Maybe the fuel and meteorological conditions were unique to BA38. Maybe we have always been operating close to this scenario.........

Jetdoc

The output of the boost pumps will be added to the atmospheric pressure. Its always implied that we are talking about values above atmospheric pressure because it acts across the whole system- input and output.

777fly

Jetdoc: Your observation does not neccessarily invalid my theory. There is no way of knowing what pressures would be reached in the suction pipe ( would Boeing have checked it under all conditions?) and it could maybe reach higher values than I suggested. Do you know what diff pressure opens the suction bypass?

PBL

Jumbo Driver, sky 9,

you may find the report on the oil-seal incident you mention in our Compendium of Computer-Related Incidents with Commercial Aircraft under the heading "Eastern Airlines L1011 Common Mode.... 1983"

pax 2809 asks Actually, yes, the aircraft itself is what carries the airworthiness certificate. Yes, it is not in a strict sense "the same aircraft" after a SW update, and this is what worries SW safety people. However, it is the same aircraft as far as the certificate goes, unless something awful is installed and discovered (in which case the certificate will be quickly revoked). SW updates are offered by the manufacturer of the kit at regular intervals and each is "controlled" by controlling the process by which it is developed and offered and what it must show to be approved. There is an incremental process: for example, I don't think one has to perform MC/DC testing on each update. MC/DC testing is an extremely high resource swallower and according to some who have tried to quantify its effects, does not appear to improve the quality of the code.

Attempting to control quality by process does not work to guarantee SW quality; there is no significant correlation that anybody has been able to nail down. However, it "stands to reason" (whatever that phrase might mean) that controlling the process by which code is developed is likely to lead to better quality SW than without.

ArcticLow says
and presages his further discussion on this premiss.

I doubt anyone at the the AAIB would agree to such a statement without qualification. People who do forensics of this sort know that your conclusions are only as good as the data you have, and the data you have is both selected (in terms of parameters) and sampled (recorded only at discrete time points). And that goes for *all* data. Suppose a computer commands a valve to open. You may record the command on the data recorder. Is the position of the valve sensed? You may record that also if it is. Is the sensor working correctly? You are unlikely to record that, but maybe there are duplicated sensors. But was there a common-mode failure of the sensors allowing erroneous readings to be recorded? These are not theoretical questions: all of the phenomena mentioned have arisen in recent incidents. There is one phenomenon that is even worse: in which one and the same data signal is interpreted in two different ways by two different devices (say, one way by the data recorder and another way by the intended receiver). Such phenomena are known as Byzantine failures, and a series of such almost led to the airworthiness certificate for one common aircraft type being withdrawn in the early 2000's, which would have been a commercial disaster for worldwide aviation.

So there are a lot of ways in which reality can slip through the cracks in the data. I think you have to take the AAIB wording literally: "The recorded data indicates that there were no anomalies in the major aircraft systems." The first five words of that sentence are essential. They go on to say that the autopilot and autothrottle "behaved correctly" and that the EEC and associated systems "were providing the correct commands". That leaves large parts of the continuous physical-electric-electronic causal system for producing thrust that are not yet addressed by what has been written. I have confidence that they will be, if nothing else is found in the meantime.


PBL

Jetdoc

The bypass valves are simply check valves or non return valves. They are held closed by fuel pressure from the tank boost pumps. If the tank boost pumps are off and the crossfeed valves are closed so that pressure is supplied by the other side of the aircraft, the engine driven pumps can suction feed by pulling the bypass valves open.