28L wrote:

Quote:

---

Ref the AA 777 incident yesterday, I understand the problem was probably with the autothrottle rather than the engine. Entirely different to the BA 777 incident.

---

28L, is your source for this information something different than the flightglobal.com article? I ask only because, IMHO the article reads very similarly to those that came out immediately after the BA038 incident with reference specifically to the autothrottle.

Incidentally, American 777s do use the Trent 800.

Far-flung possibility (feel free to shoot it down mercilessly): If I remember correctly, there was a recent FADEC software update on the BA 777 (Dec 2007 if I remember correctly). Now, I know all systems performed "as expected" according to the AAIB including the FADEC. However, it is possible that this update introduced an anomaly that would go undetected in testing, was not logged in system events, and would only occur under specific circumstances.

Does anyone know if the FADEC software on the AA 777s has been recently updated as well? Might be worth looking into.

Whether mechanical or software, I do know that these types of intermittent issues are especially tricky to deal with in that they tend to correct themselves before anyone can take a close enough look to find the problem. Even the most elaborate or event logging across numerous systems cannot capture every detail.

I am SLF with nothing more than a PPL but have been following this thread in great detail and appreciate all the expert input that has come up so far. BA038 is proving to be a very complex incident. It reminds me of TWA800 in that respect. TWA800 taught us a lot when it was finally resolved. Hopefully, BA038 will do the same.

29feb08/1022
To: All Pilots
Subject: B777 Lax Event

Initial Review Of Dfdr Data By Rolls Royce Indicates A Very
Different Event Than What British Airways Experienced. There
Were A Number Of Markers In The Ba Event That Are Not Present
In Our Dfdr Data. I Know This Is A Very Concerning Event And I
Will Keep You Informed As Details Become Available.

For The 777 Fleet Team,
Ca Jim Dees

Is there any way of knowing how many times a single engine has shut down on the same type, at the same stage of flight? If there's a systemic problem that affects engines infrequently, statistics suggest that sooner or later both engines will be affected at the same time. That would make the BA38 incident just 'sooner' rather than later.

I'm sure the AAIB are combing the figures for clues, but I'd be interested to know how many incidents of single engine throttle-up 'issues' at any stage of the flight, on this type, professionals are aware of?

If organizations keep all their FOQA/FDA data, then there is the possibility, given sufficient software capability, to "retrospectively" analyse the data for such an event.

Can anyone cast any creadence upon a rumour that I have heard:

Airbus do engine software updates sequentially following a trial period; Boeing do parallel updates on all fixtures.

:hmm:

Should software updates be done to both engines on a twin at the same time? Whether this is or is not the cause of the problem it surely is prudent not to change the operating criteria of both engines at the same time.
If my memory serves me correctly didn't an engineer once replace the oil drain plugs incorrectly on all 3 engines on a tristar.

Re. software updates. Please allow a general question: what is actually certified? Not really the a/c itself (after a s/w update, it is no longer the same a/c). How does the regulating authority handle this issue?

software updates are treated in a similar manner to hardware items. Only software from the manufacturer, or approved by the manufacturer from an approved source can be used on an aircraft. It must be installed in the approved manner only and installation certified by an appropriately licenced and approved engineer. No deviation is acceptable, unless that is also approved by the manufacturer and regulatory authority.

..."then what?"
... well Ed, I guess you point the nose at the threshold rather than 10nm CF & yell 'Mayday'. Surely better than radar vectors around the houses... don't you think?

Subject to height I would suggest that you shut one engine down leave for 30 secs then attempt a relight. (OK start the APU as well to give you start pressure).

HP Rotor Drive covers on a 737-400, see AAIB Report here.

Yes, sky9, I think the event you have in mind involved the omission of all the O-ring seals on the magnetic chip-detector plugs on an Eastern Air Lines Lockheed L-1011 on May 5 1983.

This incident (amongst others) is mentioned on page 2 of this interesting Flight Safety Foundation article entitled Simultaneous Engine Maintenance Increases Operating Risks.

There was also a very similar incident involving a BAe 146 (RAF 32 Sqn) in 1997, which is described in the preceding bulletin here.

CAP 718: Human Factors in Aircraft Maintenance and Inspection is both relevant and interesting reading.



JD
:)

Fly the airplane
 

Quote:"Suppose we do a power response test and the engines don't respond. Then what?"

Re-configure for best glide, and FLY THE AIRPLANE! (Sorry, not wanting to shout, but can't get the italics I wanted.)

See thread (Ameican investigates as 777 engine fails to respond)
...American quotes engine hung up for 15 secs before responding
...Olaf Husted post #24 refers to possible compressor icing after long descent with engine de icers ON , but inneffective at idle
...Orester,post #23 quotes high Alpha

Relevant or Not?
 

from this link (Washington Post article)
.
"The parts for commercial airliners such as the Boeing 727 and 737 were once manufactured almost exclusively in the United States. But the parts on today's big jets, such as Boeing's 777 and its planned 787, are made in such countries as China, Japan, Brazil, Italy, France and Australia, in addition to the United States. Boeing, Pratt & Whitney, GE and other plane manufacturers buy parts made overseas largely because they are cheaper.
But the bargain-hunting has come at a price, according to a new report by the Transportation Department's inspector general.
.
"Neither manufacturers nor FAA inspectors have provided effective oversight of suppliers; this has allowed substandard parts to enter the aviation supply chain," reads the report, dated Feb. 26. The agency released the report yesterday after it was made public by the Project on Government Oversight, a nonprofit organization that focuses on government accountability.
The report cited four engine failures in 2003 -- three on the ground, one in flight -- that were traced to "unapproved design changes made by a . . . supplier" of speed sensors on engine fuel pumps."

I am not sure that there are any software implications in this incident. The AAIB report makes it clear that the engine software and systems responded correctly but there was a problem with the fuel supply, not the demand. This is supported by the evidence of HP pump cavitation.

There is actually one instance in which Boeing suggest that a fuel supply problem can cause engine thrust deterioration or flame out. This is when an engine has to revert to suction feed at altitude, following dual wing tank pump failure. (No mention is made of the low altitude situation.) The background to this advisory is that dissolved air in the fuel is released at altitude and can accumulate in the suction feed pipe. The implication being that low atmospheric pressure in the tank, plus air in the suction line will disrupt or cut off the fuel flow under suction conditions.

Note from the fuel synoptic posted by Jet11 that the suction pipe is connected directly to the engine fuel supply manifold, isolated only by a pressure bypass valve. Also that the tank pump nominal output pressure is 14psi, but can be much lower. For argument's sake, I will assume that the suction bypass valve opens when there is a pressure differential around 5 psi and it closed under normal conditions.

In Bejjing, BA038 takes on fuel with an unusually high dissolved air content. This is due to a combination of production/storage/transportation/pumping and weather variables. The a/c flies high, long and cold. The air is released from the fuel and the suction pipe is completely filled with (relatively) dense air. This air remains in the pipe during the descent and once below 6000ft is inceasingly pressurised by denser ambient air and rising temperatures. At 1000ft atmospheric pressure reaches 14psi, equalling the fuel manifold pressure. Fuel hydrostatic static pressure and adiabetic heating add another 6psi, causing the suction bypass valve to open against tank pump pressure.This releases pressurised air into the fuel supply manifold and disrupts the fuel supply. This happens in both tanks, but not simultaneously. The opening of the valve could be assisted by a momentary drop in fuel manifold pressure during the initial power demand.

Just another theory. My assumptions about the bypass valve are probably wrong. Also, why is this not a regular occurence? Maybe the fuel and meteorological conditions were unique to BA38. Maybe we have always been operating close to this scenario.........

The output of the boost pumps will be added to the atmospheric pressure. Its always implied that we are talking about values above atmospheric pressure because it acts across the whole system- input and output.

Jetdoc: Your observation does not neccessarily invalid my theory. There is no way of knowing what pressures would be reached in the suction pipe ( would Boeing have checked it under all conditions?) and it could maybe reach higher values than I suggested. Do you know what diff pressure opens the suction bypass?

Jumbo Driver, sky 9,

you may find the report on the oil-seal incident you mention in our Compendium of Computer-Related Incidents with Commercial Aircraft under the heading "Eastern Airlines L1011 Common Mode.... 1983"

pax 2809 asks Actually, yes, the aircraft itself is what carries the airworthiness certificate. Yes, it is not in a strict sense "the same aircraft" after a SW update, and this is what worries SW safety people. However, it is the same aircraft as far as the certificate goes, unless something awful is installed and discovered (in which case the certificate will be quickly revoked). SW updates are offered by the manufacturer of the kit at regular intervals and each is "controlled" by controlling the process by which it is developed and offered and what it must show to be approved. There is an incremental process: for example, I don't think one has to perform MC/DC testing on each update. MC/DC testing is an extremely high resource swallower and according to some who have tried to quantify its effects, does not appear to improve the quality of the code.

Attempting to control quality by process does not work to guarantee SW quality; there is no significant correlation that anybody has been able to nail down. However, it "stands to reason" (whatever that phrase might mean) that controlling the process by which code is developed is likely to lead to better quality SW than without.

ArcticLow says
and presages his further discussion on this premiss.

I doubt anyone at the the AAIB would agree to such a statement without qualification. People who do forensics of this sort know that your conclusions are only as good as the data you have, and the data you have is both selected (in terms of parameters) and sampled (recorded only at discrete time points). And that goes for *all* data. Suppose a computer commands a valve to open. You may record the command on the data recorder. Is the position of the valve sensed? You may record that also if it is. Is the sensor working correctly? You are unlikely to record that, but maybe there are duplicated sensors. But was there a common-mode failure of the sensors allowing erroneous readings to be recorded? These are not theoretical questions: all of the phenomena mentioned have arisen in recent incidents. There is one phenomenon that is even worse: in which one and the same data signal is interpreted in two different ways by two different devices (say, one way by the data recorder and another way by the intended receiver). Such phenomena are known as Byzantine failures, and a series of such almost led to the airworthiness certificate for one common aircraft type being withdrawn in the early 2000's, which would have been a commercial disaster for worldwide aviation.

So there are a lot of ways in which reality can slip through the cracks in the data. I think you have to take the AAIB wording literally: "The recorded data indicates that there were no anomalies in the major aircraft systems." The first five words of that sentence are essential. They go on to say that the autopilot and autothrottle "behaved correctly" and that the EEC and associated systems "were providing the correct commands". That leaves large parts of the continuous physical-electric-electronic causal system for producing thrust that are not yet addressed by what has been written. I have confidence that they will be, if nothing else is found in the meantime.


PBL

The bypass valves are simply check valves or non return valves. They are held closed by fuel pressure from the tank boost pumps. If the tank boost pumps are off and the crossfeed valves are closed so that pressure is supplied by the other side of the aircraft, the engine driven pumps can suction feed by pulling the bypass valves open.

Interesting thought: The 777 uses a 'new' acoustic based fuel volume measurement technique. Presumably a pure ultrasonic tone is far more likely to set up a standing wave than the white noise from a vibration source, unless of course the designers had already thought of the potential problem and use frequency agility based on prime numbers?

I guess such a standing wave would only occur at particular resonant path lengths dependent on air and/or fuel volume shapes. I'm not sure if short wavelength standing waves would restrict fuel flow, but they would cause cavitation, as happens in ultrasonic cleaning.

Quoting Bill_s, ref. post #527:

Quote:

---

The problem is that you would have to induce some 20 volts of stray RF directly into the relay coil wiring, for a significant period of time, for this scenario to work. This RF would have to penetrate both the acft metal hull and any shielding on the wires. I have no idea how much RF power would have to be delivered to the outside of the hull, but my guess is it would be upwards of tens of kilowatts. This massive amount of RF power would probably disrupt other electronics in the acft long before it acted directly on any relay.

---

and quoting ve3id, ref. post #529:

Quote:

---

I think you are barking up the wrong tree here! I just did a quick calculation using 28 Volts across a 1k ohm load (the coil at RF) and used 140dB for space loss beyond the e-field.

I came up with 78 TeraWatts!

If someone was using that kind of RF power, you would know. All the lights in and around the airport would dim!

---

Bill_s and ve3id:
Reading your posts it seems you are assuming the (possible) source originated from outside the aircraft.

The scenario could be considerably different if the (possible) source originated from inside the aircraft.

To my knowledge certain transmitting PEDs can generate electric fields in the order of 20 Volts (or more) in relatively close proximity to the transmitting PED.

Next question is if something like this had occurred, could it have affected the relays, subject to this discussion? For those "in the know" about where these relays are located and how they "function in the total scheme of things" (Ref. AMM), it would be something to at least take into consideration.

Regards,
Green-dot

From a recent post:
"This is because air dissolved in the liquid will tend to come out of solution at low pressures, and contribute a partial pressure of air to the contents of any macroscopic cavitation bubble. When that bubble is convected into a region of higher pressure and the vapor condenses, this leaves a small air bubble that only redissolves very slowly, if at all."

I previously posted a description of what may be an analogous event which I encountered when I had a small mining operation. It was evidently disregarded as unworthy of comment:). It may be that I do not understand the above, but it seems to imply a similar phenomenon.

To amplify my original post slightly I'd just add that the gradual accumulation of air in the pump casing had little or no noticeable effect until it suddenly reached a critical threshold, at which point the pump quite abruptly ceased to deliver. This ocurred several times, after repeated re-priming, before the cause of the problem (increased restriction of flow in the suction line) dawned on me.

Don't have time to read the whole thread, so apologies, but does anyone know how the engines responded at 1000'AGL when they would have been at approach power IAW BA SOPs?

Fuel - "excessive aeration"
 

Fuel "excessive aeration" theory might be explained, in part, by a significant difference in more recent Boeings (post TWA800). Recent Boeings use centre tank fuel scavenge jet pumps with motive power provided by main tank fuel from the main tank booster pumps. Moreover in 777s such jet pumps remain on, once main tanks reduced to half full, for remainder of flight; whereas in 737s (other than more recent NGs) they are powered on for just 20 minutes (and link only to main tank No1) before a shut-off valve removes motive power.

Accordingly, here is another slightly different, ridiculously remote Swiss cheese line-up:

1. Jet A-1 in main tanks was saturated with air, either when uplifted and/or as result of prior centre fuel scavenge tank jet pump operation on fuel remaining from previous sectors. (Kerosene has much greater propensity to become saturated with air and retain it even at altitude compared to say water.)

2. Centre fuel scavenge tank jet pumps operated to entrain and dissolve air into fuel in each main tank thereby supersaturating fuel in each main tank during last hour of flight (by then last of centre tank fuel has been scavenged). Increasing pressure on descent helped increase the level of saturation.

3. LP main tank booster pumps were unaffected by supersaturated fuel (i.e. no cavitation) and no LOW PRESS alert as a result.

4. Cavitation induced in HP pump as flow increased by order of magnitude on finals.

5. Relatively cold fuel made cavitation much more pronounced (see http://naca.central.cranfield.ac.uk/...rc/cp/1128.pdf) and, once started, cavitation worsened preventing increase in flow rate as more and more air was released into system. Some flow was maintained, just insufficient.

6. Suction feed as alternate to HP pumps was ineffective and/or became ineffective to increase fuel flow to level demanded. Perhaps due to:

(a) inherent weakness of suction feed (for inadequacy of suction feed in certain flight conditions, see article on UAL flight 767 which in climb at altitude suffered rollback when boost pumps turned off and suction feed alone turned out to be insufficient - http://findarticles.com/p/articles/m..._73578123/pg_4).

(b) secondary effect of release of air at HP pumps as a result of cavitation impeding operation of suction feed bypass.

(c) reduced flow at suction feed inlet from main tanks due to (i) FOD blockage on right hand side at least and/or (ii) perhaps (if sufficient newly melted water, derived from ice formed in surge tanks or centre tank, could have entered and frozen in main tanks) ice particles.

Just to clarify this, the ultrasonic fuel measurement for each tank is calculated from sensors contained in individual hollow probes (a total of 20 in each wing tank and 12 in the centre tank). As such, the ultrasonics themselves would not be capable of creating any standing wave.

Flagon, BA sop's don not say approach power has to be set by 1000'. Think you are mistaking that for the 500' "gate".

Thanks Jetdoc. So if the suction bypass valves are simply check valves, at any time the pressure of air trapped in the suction pipe exceeds the fuel manifold pressure, they should open and allow the pressurised air into the engine fuel supply.......?

777fly

The suction pipe is really not all that long. Just imagine the pipe with a screen on the end of it similar to the boost pump pickups. Its attached directly to the engine feed manifold. The check valve is in the pipeline. The pick up point is somewhat low in the tank about 3 or 4 inches above the tank bottom. Its location is the 4th manhole cover outboard from the wing root and probably less than 10 feet inboard of the engine pylon. One would hope that it is still covered by fuel and not full of air even at that point in the flight.

Blame the snowman ...
 

or:

Why I fly Warriors, in nice warm weather.

Have you noticed how dirty a snowman gets as it melts?

(The situation on the approach to LHR was worse than worst case design spec, so look at worst case design spec. Any numbers are very approximate, but spurious precision has been retained so that their origin is recognisable)

900Kg of 'unusable' fuel in the centre tank - recovered to the outboard (high) end of the main tanks by the fuel scavenge system when main tank pumps are working. That's 2000 lbs or 250 UK gallons.

Up to 138 (US?) gallons of water trigger the water-in-fuel warning - 115 UK gallons. So the centre tank dregs to be scavenged could be half water, half fuel. It gets scavenged 'water first' in the cruise.

The water (mostly) comes in with ambient air replacing fuel used. At altitude the air is cold and even if saturated has relatively low water content. In cloud, the air is saturated and carries suspended droplets as well. Climbing uses fuel at the greatest rate. Climbing on the centre tank through cloud brings water into the centre tank at the greatest rate - but it is a relatively short phase of a long haul flight.

The water droplets, either carried in as cloud or condensing with adiabatic expansion of the air in the tanks, collect in the fuel, and slowly settle at the water scavenge pump inlet (at cruise attitude) and get 'burned off' when the scavenge pump discharges them adjacent to the inlet of the pump supplying the engine. Water only accumulates at the water scavenge inlet if it arrives faster than the scavenge pump sucks it away. Nothing can go wrong ...

But what if it is not water? What if the local condensation and ingested cloud is ice?

Ice granules will not coalesce to form droplets, so the layer of ice granules at the bottom of the centre tank will only be scavenged near the scavenge pump inlet. Instead of flowing to the lowest point as liquid water would, the granules will roll down a local embankment of granules, under the gravitational influence of their small density difference. So whilst the scavenge pump will keep the local area clear, ice crystals will settle like snow everywhere else. The scavenge pump will only start to clean the whole tank when the tank temperature rises above freezing, and the crystals melt into droplets and globules of water that run down to the scavenge point. If the whole take-off, climb and cruise has been in sub-zero temperatures, the centre tank water scavenge pump will be off before this happens. Centre tank clearance of water will start when (and if) the centre tank temperature rises above freezing in the descent, when it will be cleared to the main tank by the fuel scavenge pump, and burned off from the main tank by the main tank water scavenge.

If the centre tank does not collect enough heat to provide the latent heat needed to melt the ice slush before engine shutdown, the slush will melt on the ramp and collect in the sump, potentially causing a water warning at next start-up. This will clear when the water scavenge pump burns it off. If sub-zero ramp and take-off temperatures freeze this water, it almost certainly stays frozen until the next descent. There is no scavenge whilst burning fuel from the centre tank because the inlet is frozen solid. There is then a double dose of solid and powdered ice to be cleared by the fuel scavenge pump when it melts during the next descent.

Provided there is a big enough safety gap between bottom level of useable fuel and the top level of water, and assuming the scavenge pumps can't pump water quickly enough to bring the aircraft down, nothing can go wrong ....

But the snowman effect spoils the party. As a snowman thaws, the atmospheric dirt and dust collected by the falling snow (and, admittedly, dirt collected by the youngsters who built the snowman) is caught and concentrated by its receding and shrinking surface. This is not just because the dirt cannot evaporate. Even a melting snowman seems able to cling on to his dark coat whilst shedding melt water. The dirt is efficiently concentrated on the surface. So after several journeys in freezing or near freezing ground temperatures, or maybe a couple of such journeys through a particularly dirty industrial atmosphere, it is easy to visualise the dregs of the centre tank water and slush, with all its accumulated micro-muck, being slopped into the fuel scavenge area by a change of trim or even by the unstable progression of the melt process.

So water with concentrated micro-dirt surges into both fuel scavenge areas of the centre tank, to be promptly fed to the main tanks, draining 'fairly promptly' to the water scavenge points on the main tanks, to be then fed to the engines - affecting both engines within a few seconds of one another.

The dirt nucleates cavitation, killing throughput of the LP engine pump.

Fire away ...

Cripes...! :D

Nowhere near Beijing then :hmm:

Not quite simultaneous thrust reduction
 

So when does this happen (Rightbase)?

5LY in post 326 had an answer:

Doing the conversion gives 13,500kg. The aircraft landed with roughly 10,500kg on board (AAIB). So rough calc suggests the scavenge from the Center to BOTH Main tanks started about half an hour before landing (72,000kg/12 hours = 6,000kg/hr of flight). At what point did it reach the possible contamination - depends on rate of flow of scavenge system... - but the contamination reached both main tanks at roughly the same time... thrust reduction 7 seconds apart ... (pure speculation of course!).

For both engine LP pumps to fail to deliver sufficient flow (and failing in such a way as to prevent suction feed) within a few seconds of each other due to prior events (wear/damage) or instantaneous fault is as unlikely as to be unimaginable.

For the fluid diet of the pumps and engines to be the cause, fed from different tanks, and again with that vital proviso - within a few seconds of each other - the common centre tank and its associated functions at that stage of flight must be involved ?

This seems to be the guts of what we are hearing now...

Sorry, just thinking out loud to focus my feeble ability to keep up with some of the earlier posts, but the Dirty Snowman has put nucleation and cavitation into contextual focus for me... Any more ..ations needed to complete this picture?

Leodis - don't lose any sleep over purely speculating on this thread. Subtract 2 AIB report posts from the total and the rest equals the number of other speculators sharing the beach with you :ugh:

It happens when ...
 

melting slush in the otherwise empty centre tank collapses and slips down into the fuel scavenge intake areas - both at about the same time.

The fuel scavenge pumps (powered by pressure from the main tank pumps) then start to transfer the muck to the main tanks. With one wing slightly higher than the other (was the cross wind from the South on that day?) this purged muck slides down one main tank faster than the other, so the right engine gets it first, followed a few seconds later by the left.

Only an idea, but as a jigsaw puzzle piece it looks to me like a better than average fit.

But what do I know? I only fly singles with gravity feed.

On advice ...
 

Just to stop others making money out of my fabulous (good word?) idea:

Suggestions - published so that they are freely available, not patented:

Refuel the tank to be used for climb out with warmed fuel, so that the water build up can be purged before it freezes. This will also prevent legacy build up from previous flights. It might even thaw legacy frozen muck so that maintenance can drain it off before engine start.

Lag the tank so that it stays warm.

Warm tanks in flight so that the water purge works in the cruise, instead of leaving it to the warmer descent phase.

Disable the fuel purge from at least one side before you are committed to needing power to make the field.

HarryMann - some forensic found-ation would be nice!

"The fuel scavenge pumps (powered by pressure from the main tank pumps) then start to transfer the muck to the main tanks."

Note that muck in the CT has to pass through an inlet screen before it is scavenged, then through a narrow opening at the jet pump, then, flowing from the outlet of the jet pump, has to jump over baffles, pass through wing boost pump inlet screens, then has to pass through one or two engine filters (depending on where the blockage is), one of which has an impending bypass alert..... and almost simutaneously affect two engines.

Not saying it couldn't happen, but.... :p

The CT fuel scavenge rate is 400Kg/per hour minimum. By your calculations the centre tank would have 700Kg remaining on landing :confused:

Still barking up the wrong tree
 

The fact that there is a measurement of 20 Volts per metre does not mean that the voltage will be developed across a coil. The problem is that the relay coil has a very low impedance compared to air, even looking like a short circuit. There is no way a PED would create a field strong enough to drive the current.

Sorry, it is out of the question.

If a PED had interfered with the high-impedance parts of a circuit that controlled a relay, then I could see it, but by the fact that we are talking about relays acting on their own I assume that has been ruled out

Rightbase: "Climbing in cloud brings water into the centre tank"
How does that happen? During the climb the air in the centre tank will be venting overboard as it expands due to reducing external atmospheric pressure. How does cloud vapour overcome that, to get into the tank? Even if it could, the volume of tank occupied by the 4000kg or so of fuel used in the climb could not contain enough 'cloud' to hold a signficant amount of water. Also it is very rare to spend more than a few minutes in cloud during the climb, if at all.