Thanks for that NSEU, glad to say that in 33 years of flying, I never encountered an iceberg. Pity Titanic didn't have wings. Interesting username you have. Neutron Single Event Upset?:ok:

It is not the norm at all. In fact it is very much the exception to the norm. Typically, most systems will have more than one channel (think of it as a primary channel and a back up channel) on separate cards. Typically there would be some health checking between the channels with the primary staying in control of the system unless it is "less healthy" than the second channel. In most cases, the software contained in each channel is identical. In rare cases, the software will be different (referred to as Multi Version Dissimilar Software in RTCA/DO-178B - the guidance to which the vast majority of modern aeronautical software is compliant).

On the first, I don't know. Porus chinese walls I could believe, ditching triplex development completely I would find slightly suprising. I don't know the details though.

As to the second question - yes. Although it may be better stated that normal would be separate teams (which may be in same company). Typically the teams would be in different sites / locations etc. (regardless of company). The geographical separation probably doesn't buy you as much these days.

The technique is known as multi-version or N-version development. The assumptions (eg. that separate development reduces common-mode failure risk) that underly it have been questioned - look up Knight Leveson experiment.


All of which, though interesting, is of no relevance to BA38, as the AAIB have already established that flight data shows all the software working correctly right through to opening of the fuel valves. The only possibility for software failure now is if it was a type of failure that caused the engines not to respond as commanded and simultaneously caused all systems to send fake data to QAR and FDR that everything was normal. Simultaneous (or nearly) flying saucer ingestion is more probable.

CTR tank water scavenge pumps.
 

Swedish Steve,

You say that the CTR tank water scavenge pumps are ALWAYS running.

But you also state that their "power supply" comes from the tank booster pumps outlets.

My question is then - how can the water scavenge pumps run if there is no fuel in the CTR tank?

I suppose that they will shut down automatically, when booster pumps stop producing pressure due lack of fuel (at approx. 900 kg) - you see what I mean?:confused:

HotDog Says
 

It would appear that the evidence and opinion is becoming increasingly supportive of the center-tank having been the logical source of the obstruction causing the double-engine stagnation and pump cavitation (as pointed out in detail at post 111)
.

It has become a plain and simple Occam's Razor exercise

All that would appear necessary to identify now is the exact physics, timing and mechanics of the event.

Correct me again if I am wrong please.....Engine failure drill (or possibly thought engine failure)
The drill is.....after Fuel Control Switch to cut off action (possibly not done) comes....open fuel cross feed...start APU..
Question ...Any evidence on the tapes a crew member did this?
Presently it seems people think a fuel cross feed was open and the APU was in the first stages of starting.
If the engines were giving power above flight idle to impact...why did the APU
start without human assistance.
If it did begin to start automaticly it seems it started with the landing gear
collapsed and one engine fuel cock open.
It also appears the increasing pitch attitude to near stall AOA if that occured was not helpfull to fuel feed problems.
Could a B777 pilot (Hand SOLO maybe) explain the logic of how this all could have occured.

With fuel in the CWT and the (CWT) boost pumps running (this fuel is ALWAYS used first due to the fact that the pump pressure is 36psi as opposed to 12 psi for the wing tank pumps) the motive flow water scavenge pumps draw fluid from the bottom of the tank and pass it into the inlet side of its respective boost pump. As Swedish Steve points out these scavenge 'pumps' are small diameter pipes certainly less than 1/2 inch bore.
Each wing tank boost pump also has a fuel scavenge motive flow pump BUT this line (same or similar diameter!) has a float operated valve in the CWT AND a float operated valve in its respective wing tank. When the fuel is used up (down to about 900kgs) in the CWT the float valve will open and fuel will attempt to move into the wing tanks, BUT at this point because the wing tanks are full the float operated valve cannot open. When the fuel level in the wing tanks has dropped to a predetermined level the float valves open and the fuel is scavenged from the CWT into the wing tanks.

You say that the CTR tank water scavenge pumps are ALWAYS running.

But you also state that their "power supply" comes from the tank booster pumps outlets.

My question is then - how can the water scavenge pumps run if there is no fuel in the CTR tank?

I suppose that they will shut down automatically, when booster pumps stop producing pressure due lack of fuel (at approx. 900 kg) - you see what I mean?

Yes, took a peek in the AMM. It is not very clear but the Centre tank scavenge pump and the Centre tank Water scavenge pump are linked. It looks as though with the Centre Tank scavenge system running, liquid is sucked through the centre tank water scavenge lines as well. The centre tank scavenge jet pump motive power comes from the wing booster pumps.

Re drop in fuel pressure - If there was an obstruction in the fuel supply between the tanks and the HP pump(s) the pressure in the pipework between the obstructon and the HP pump inlet would drop to hugely negative levels due to the suction caused by the HP pumps. Could this not cause rapid freezing of the fuel, especially if it had a higher than normal water content?

I accept that this doesn't explain both engines beinging affected at similar times etc, but I would be interested on peoples views on the possibility of fast freezing as described above.

My first post, so now crouching for the flames! I'm a PPL rotary pilot who has learnt pretty well everything about jetliner fuel systems from reading this facinating thread.

James

From my reading of the AAIB report, they tested the wing tanks, but due to contamination with foam, etc, the center tanks were not tested. Also, due to the center tank breach by MLG, does it not seem possible that any ice may have melted and drained from the center tank by the time the AAIB had a look, or any remaining water mixed with foam etc so as to make any analysis difficult at best

CT Feed Theory
 

We’re talking about the centre tank, not the wing tanks.

No, it would be fine.

Quote:

---

Machaca

---

Thanks for the pics. Got a system schematic?

No, but I can’t imagine the 777 tank environment is so different to the types I’ve worked on. Secondly, in many years experience, I’ve never come across a single reference to fuel stratification as an issue for aircraft fuel systems.

First, several folks here seem to be assuming that all the aircraft systems were working as designed and that, e.g. “the CT would have emptied early on” or that the water would have been scavenged into the wing tanks. This approach doesn’t make too much sense. If it did, the corollary is that this aircraft systems were operating as the designers intended, and 777s would be dropping out of the sky every other day. There must have been failures (not necessarily equipment failures).

My inferred design philosophy for the CT transfer system is:
-CT boost pumps operate until the inlets uncover. Inlets are positioned forward in the tank to avoid picking up large quantities of water in climb/cruise attitude.
-Wing tank boost pumps now take over supply to engine feed.
-CT (fuel) scavenge jet pumps with motive flow from wing tank boost pumps empty the CT at a leisurely pace. Any water picked up is safely mixed with wing tank fuel before being fed to the engines.
-CT water scavenge jet pumps get motive flow from the CT boost pumps, so only operated when CT boost pumps do.

Now, here are the 2 functional failures necessary to support my theory (post 216):

1) Failure to scavenge effectively CT water.
2) Engine feed source switches from wings to CT during approach.

Failure 1) possible contributory factors:
1a) Water remains frozen during turnarounds precluding effective drains operation (See NSEU post 292).
1b) Water remains frozen during most of flight precluding effective water scavenge operation.
1c) FOD

Failure 2) possible contributory factors:
1a) The most nose-down attitude of the whole flight (including descent) occurs when landing flaps are selected. This I think is likely true of many civil types. Perhaps someone can confirm for 777. So any residual liquid in the CT moves forward at this point.
1b) CT boost pumps remain running throughout flight (I imagine this should generate a warning).
1b) CT boost pumps switch back on uncommanded when pick-ups become covered (is there any way (including failures) that this can happen in the 777 system?).
1c CT boost pumps switch back on by crew action.

Please remember that the CT was breached and contaminated by firefighter’s foam and hydraulic fluid after the landing. It is not clear from the AAIB report that they even tested for water in the CT. It sounds like it may have been a pointless exercise.

It is conceivable that in the final seconds of the approach, with the increase in pitch, the CT boost pump inlets uncovered again allowing engine feed to resume from the wings, helpfully flushing evidence from the feed lines but not in time for the engines to spool up enough to make a great difference to the outcome.

Like I said before, I’ve not seen anything here or from the AAIB that rules out this theory. I’m open to offers, though.

In the B777-200, the center tank message is shown at approximately 14.5 gallons.

14 *decimal* 5. Does anyone else think the "138 gallons H20" thing is a missing decimal point? Otherwise the difference between the -200 and the -200ER is just shy a factor of 10; and I doubt the -200ER's centre tank is 10 times as big as the -200's.

If this were to produce any effect, the fuel scavenge valves in the wing tanks would have to open or to be open, as an earlier poster said. But at what wing tank fuel level do these valves open? would the amount left in the tanks of this flight come anywhere near that level?

and where are the fuel scavenge line outlets in the wing tanks? is there any chance of ice or slush coming from them partially obstructing the boost pump inlet screens in the wings?

The effect of CT boost pumps switching on with inlets covered is to feed CT fuel (or water) direct to the engines. (as I understand the system... in the absence of schematics etc.)

Yes sorry SyEng, I was thinking of the CT fuel scavenge pumps being triggered... but I understood this to happen only if the main tanks are low on fuel, triggering an EICAS message too and leaving a trace on the FDR. I was trying to understand how low on fuel they have to be and to compare this to the actual fuel on board.

Borgha,

See Swedish Steve's post 304 above. I imagine the function of the wing tank float valve on the CT fuel scavenge outlet is to prevent transfer into a full tank, i.e. prevent transfer causing wing tank overflow. If that is so, then the float valve coud be set fairly high up in the tank.

Pitch Attitudes
 

Quote from SyEng [Today, 17:04]:
The most nose-down attitude of the whole flight (including descent) occurs when landing flaps are selected. This I think is likely true of many civil types. Perhaps someone can confirm for 777. So any residual liquid in the CT moves forward at this point.
[Unquote]

Haven't flown the B777, but doubt that would be the case. In the absence of a B777 pilot on the forum at the moment (?) I'm going to stick my neck out. :}

The lowest pitch attitude is likely to have been in the early part of the descent from FL380, when still at or near the cruise Mach, when it is likely to have been zero or less. If you think about it, passenger and trolley-dolly comfort in the cruise dictate a deck angle of something between zero and 3 degrees nose-up.

To descend at idle thrust and maintain speed (the standard technique on jets), the change of pitch angle is going to be about 3 - 5 degrees down, initially. This suggests a pitch attitude of minus-something in the descent, i.e., below the horizon.

With the aeroplane fully configured for landing, and at final approach speed, the attitude is definitely nose-up, even with full flap selected. Prior to that, on the glide-slope with intermediate flap, the speed is usually higher, resulting in a similar pitch attitude. There is, admittedly, a short-term pitch-down as each increase in flap is made, before the speed decays to the new value; but at no time would the actual pitch be below zero on the approach on a large modern jet.

Hope this helps.

Thanks Chris,

In the "large amount of water in the tank" scenario, it would still be frozen at TOD. Agree it would be interesting to hear from 777 pilots on pitch attitudes. The answers to the pitch attitude question will be on the FDR of course.

Okay SyEng, I like the way you argue your hypotheses.

There is another point worth mentioning, perhaps, again quoting the AAIB:
During the descent, from FL400, the A/C entered the hold at Lambourne at FL110; it remained in the hold for approximately 5 minutes, during which time it descended to FL90.

Entering the hold at FL110 is a completely different regime from the early part of the descent that I was dealing with above. The aeroplane will be on speeds now, not Mach. Entering the hold, the IAS would be back to about 210 - 240 kts, to comply with holding-pattern rules.

Also, although they continued to descend, they only averaged 400 ft/min during those 5 minutes. This is minimal - not much different from level flight. The pitch attitude to fly at (say) 220 kts would have been of the order of 5 - 8 degrees nose-up. This is as much or more than on final approach.

Additionally, there is every probability that significant thrust would have been used, unless they entered the hold at a higher speed than optimum, and were slowing down.

I wish the AAIB had told us whether thrust above idle was used in the hold, or later on the intermediate approach. It normally is at LHR.

You will draw your own inferences. A B777 pilot could tell us how much fuel-temperature rise normally takes place between FL400 and FL90 in a typical descent, with about 12 tonnes of fuel remaining in the wing tanks. Would it have risen from the -34C quoted to above 0C?

But as for your postulated large block of ice in the centre tank, who can tell?

SyEng said:
Now this is the best thought out argument I've seen, looking forward to seeing how this develops.

Also CWT would have been empty by landing anyway...

If there was enough something (fuel or water) in CWT for the boost pumps to still be running (or they started up again) then I think that would be a serious anomaly that would be in the data and would have been jumped at by the investigation.

If not, then the only way (at least as I understand the fuel system) anything is getting from CWT to the engines is via fuel scavenge into the wing tanks. So you would find evidence of it in the wing tanks.

So, let's say there is a big lump of ice in CWT, so it doesn't therefore get scavenged earlier on, and it gets slushy during the descent, then the slush would end up in the wing tanks via fuel scavenge, where it might then perhaps make it's way to the engines in a big enough lump to cause a problem. Then afterwards you'd find water in the main tanks - and they didn't...

SyEng,
 

I am still reading your interesting post #306!:)

A few questions/comments:

You state: "CT water scavenge jet pumps get motive flow from the CT boost pumps, so only operated when CT boost pumps do"

Are you 100% sure that is the case? Info from the AMM?

I agree with the info re pitch attitudes given by Chris Scott.

You suggest that the crew might have left the CTR pumps running for the whole flight. I do not think they did!

I have not flown the 777, but the 767 with a much similar fuel system.
If you do not switch the pumps to OFF acc. SOP, you will get an EICAS message + caution lights in the pump push buttons on the overhead panel.
It is VERY unlikely that any crew would sit for hours without taking action.

BRGDS

I am new to this forum and would like to tell you that although french (no, do not hit me on the head) I am very impressed by the great honesty and technical knowledge of all concerned. I am now retired but have flown a bit for fourty years (pilot flight engineer and pilot again...).
I do not know the 777 and will certainly not play the Sherlock Homes role...
But your remarks lead me to state that to my knowledge, center fuel pumps should not be at work on finals. After emptying the central tank (well...nearly) they will only come alive again if the tail trim tank (when it exists) sends its fuel to the center fuel tank. To my knowledge, the fuel in the tail trim tank is never checked for water, as it is "put" there by transferring fuel from other tanks. But condensation might occur and lead, flight after flight, to some quantity of water resting there.The fuel in the main tanks was checked for water by BA on the very morning of the flight.
And on modern aircrafts (Airbus at least) there are inhibition phases for the central fuel pumps which prevent them from working on finals if there is fuel in the other wing tanks (pumps ON).
As for the aircraft attitude on finals, the pitch must have increased slowly as the speed decreased, to stay on the glideslope, but not much more than in the hold at FL90...so that should not explain a sudden rush of sump water to the pumps...
For a few years I flew the Fokker 100 and we had a lot of water in the tanks, and probably due to this, some cases of fuel contamination by fungus. This was apparently due to the size and ventilation of the tanks, but we checked them every morning for water and drained it. This certainly does not seem to be the case for the 777.
So: serious operator,competent investigation, and nothing yet...Should we not focus on this "wear" of the high pressure pumps due to cavitation? And it would certainly be helpful to know if this is found on other 777s or if it is the sole case to date? An important quantity of air mixing with the fuel seems incredible on both engines fuel systems, but that might explain the fuel partial starvation on finals? Not very proud of this explanation, but that plane certainly behaved in a very baffling way...

A few points of interest.
.
1. CWT tanks are switched off at say 900KG to avoid a TWA 747 event.
2. Different fuel source to engines during T/O and Landing to avoid a single event causing problems to more than one engine.
3. I thought CWT 900KG is removed via the motive force of wing boost pumps.
4. Fuel temp in CWT can change very quick when not much fuel in the tank and the air con packs operating.
.
One question still not answered, after the first engine lack of thrust, did any of the cross feed valves open before the other engine suffered from a lack of thrust, can anybody answer this question- please-
.
After reading the last few posts, does anybody have the 777 MEL item about wing boost pumps inop, should have some good info on fuel figs required and pitch angles, seem to remember on the 747 landing with lots of extra fuel due to inop pumps and making sure fuel pipes never get uncovered. the 747 MEL on this item was often misunderstood and aircraft landed with less than required fuel in tank/tanks. sorry for the drift......

NARVAL

Your input is valued especially when achieved in English, when most of us on here could not do so in your language!

I understand the points you have made but my knowledge is insufficient to respond to you. Someone will, I am sure!

bushfiva
AFAIK when Airbus went FBW they used at least two software houses - from rusty memory Boeing's 777 design timetable was compromised by going down the same route, so they switched and just used the one company. But we are talking Flight Controls not Powerplant, so I suspect it has little relevance to this accident.
TP

Bellagio fountains analogy
 

Let me add another analogy to this morass of speculation with respect to fuel freezing, pressure changes, etc.

If memory serves me correctly, there was a Discovery Channel show some years back concerning problems with the "dancing" fountains installed in front of the Bellagio Hotel in Las Vegas.

These fountains consisted of numerous jets that would spew out high pressure streams of water as commanded by a set of computer-controlled solenoid valves. To create their "dancing" effects in concert with music programs, the solenoids would very rapidly switch the individual jets on and off.

Almost immediately, this system began to have problems as the solenoids would cycle, but water would only intermittantly spew out of the fountain jet. When technicians would examine the valves, which were located at the bottom of the fountain pool, they would find no problem. Finally, someone had the wit to speculate that the rapid pressure drop from an opening of the solenoid valve was causing water to freeze in the line. But by the time the technician reached the valve to inspect it, Las Vegas' >40 degree C. summer heat had caused the ice plug to thaw and disappear.

I can't recall exactly the fix -- whether to slow down the solenoid actuation speed -- or something else. But the problem was eliminated and the fountains have become a major tourist attraction.

Joetom,
 

According the AAIB report:


"The fuel crossfeed valves indicated that they were closed and they had not been operated during the flight."

I see some problems with it (maybe not fatal):

1. CWT boost pumps stop at 900kg - which is a fair bit of "something" to be in the tank.
2a. Given that CWT empty is the expected state (late in flight), CWT reading 900kg+ would be a serious anomaly that they would have picked up on by now.
or
2b. If theres 900kg of something (ice) in CWT but it is reading empty, then you've got a ton less fuel than expected in your wing tanks after fuel scavenge - which doesn't seem to fit the data either.

3a. If CWT boost pump operation is recorded, then having them switch on unexpectedly would be a serious anomaly that they would have picked up on by now.
or
3b. Even if CWT boost pump operation is not recorded directly, I would expect the CWT low pressure advisory (when they turn off) to be. By your theory, they turn off again close to landing (when it goes nose-up, as we know it did), which would generate this warning, which would have been spotted.


Overall, I can't see CWT feeding the engines direct at the end of flight without it showing one way or another in the recorded data, and I think this would have been flagged by now if it was the case. Contamination of some sort (at least water based) from CWT via fuel scavenge would go via wing tanks, where they would have found evidence of it.

I don't have an answer, but I'm struggling to see, with the info we have now, how the center tank could be involved.:confused:

The center tank pumps are manually turned off when the tank reaches 2000 pounds (900Kg.). The scavange system then operates automatically to draw out the remaining fuel when the total fuel remaining reaches 29,000 pounds (do your own conversion). By the time you're on approach your center tank is empty and no pumps are running. I get that there may be some unusable fuel, but it isn't going anywhere.

--------------------------------------------------------------------------------

According the AAIB report:


"The fuel crossfeed valves indicated that they were closed and they had not been operated during the flight."
............................................................ ..................
............................................................ ..................
.
The report says the above up to the point of 780feet on the APP.
.
I thought I read in the distant past that post landing the valve switches were found in the open position, one valve was open and one valve was closed.
.
My thinking is about the 7 or 8 seconds between lack of thrust events, if one of the fuel manifolds had its problems and cross feed valve/s were opened then just may be the problem was allowed to move about.
.
Am sure some posters will know where the comments about the cross feed valves are...please post if found......thanks.......

No decimal point . . . .
 

Quoting Steamchicken:

"In the B777-200, the center tank message is shown at approximately 14.5 gallons.

14 *decimal* 5. Does anyone else think the "138 gallons H20" thing is a missing decimal point? Otherwise the difference between the -200 and the -200ER is just shy a factor of 10; and I doubt the -200ER's centre tank is 10 times as big as the -200's."

The 138 gallons is correct. There is no decimal point missing. As mentioned on previous posts, the 14.5 gallons applies to the -200 center wing tank which is located in the inboard wingbox of the left and right wing. The center wing dry bay divides the center tank in two parts. Two interconnect tubes connect the two halves. The center tank bottom surface has a slope where water can easily collect at the lowest point near the wing root (basically identical to the main wing tanks). This is where the water detector is located for the -200 configuration.

On the -200 ER, the center tank is in the wing center section and in the inboard wingbox of the left and right wings. The bottom surface of the tank in the wing center section is a much larger, flat, horizontal surface, measured from left to right side of the tank. The water detector is located on the right side of the center wing. This is why the alert level is set at 138 gallons because at that value the entire bottom surface (from left to right) will be covered with water and reach the detector.


Quoting Tanimbar, post #289:

"water detection message for a particular tank to show". There was no such message shown during the flight, therefore there was no water, greater than 7 gallons, present in the bottom of the wing tanks and the water scavenge jet pumps did not operate."

Tanimbar, the messages show up on the maintenance pages, which are not directly visible to the pilots. Only if the crew had reason to select a maintenance page they would have seen such a message. I am not suggesting these messages showed up during the subject flight. From what i have read from the AAIB report sofar is that the water content in any of the tanks never came close to a level for the messages to display.

The water scavenge pumps operate continuously (fuel scavenge pumps do not).

Below i have copied a post of mine from another thread (now closed) regarding the scavenge system:

There are four water scavenge jet pumps and two center tank fuel scavenge jet pumps.

Main tanks:
Each main tank has one water scavenge jet pump.

Center tank:
Each side of the center tank has a water scavenge jet pump and a fuel scavenge jet pump.

Fuel scavenge:
The fuel scavenge jet pumps take fuel from the low points in the center tank and send it to the main tanks. Float-operated shutoff valves prevent fuel scavenge when the main tanks are full. Inlet float-operated shutoff valves prevent motive flow to the jet pump until the center tank is almost empty. This prevents the fuel from flowing to the main tank too early if the outlet float-operated shutoff valve fails. A check valve in the jet pump prevents fuel movement from the main tank to the center tank.

Water scavenge:
The water scavenge jet pumps (continuously) take fluid from the low points in the tanks and send it to the fuel pump inlets. This prevents water from collecting in the bottom of the tanks.

Operation:
The scavenge pumps (both fuel and water) operate automatically when the fuel pumps are on. They use fuel from the fuel pumps as motive fuel. The flow of the motive fuel through the jet pump causes suction that takes fluid from the low point in the tanks.

Regards,
Green-dot

And that's the problem ...
Many things mentioned in this thread are NOT from AAIB reports ... but from here !

Either we think this leak is pure BS ...
Either will we have to presume AAIB retains some valuable info ?

Just to make you think harder, on February 15th, Troy W has somehow edited his first paragraph:

January 30th version:
February 15th version:

You forgot number 3: number 2 happens without it being logged by any on board systems. We'll call that miracle number 1So, miracle number 2 is that the last drop of water passes through the injectors on both engines at the precise moment that the engines hit the ground? Come on.

It is being repeatedly mentioned that no significant water/ice was found in the fuel. However ice melts, water evaporates, and a significant amount of fuel leaked out before the investigation began. Could this possibly explain the lack of evidence? Whatever was the cause it seems to be very illusive with no obvious evidence left behind. Water/ice seems to be the most obvious explanation for such a lack of remaining evidence. It is only natural then that a lot of suggestions as to possible causes involve the most likely culprits.

narval: There is no tail trim tank on the 777.

1. Ice melts leaving water at the bottom of whatever fuel it is in, making it difficult for it to evaporate.
2. I don't believe all of the water is going to get out of the engines' fuel systems. They are not open to the air so again, this makes evaporation difficult. The pipework in the engines was pressure and vacuum tested, so no leaks for the "miracle water" to escape from.
3. Jet fuel is hygroscopic. If you have free water in jet fuel, you also have dissolved water, which takes a while to get rid of and is easily detected down to very low concentrations.

There can be no escape for the saboteur water droplets. To believe it was water that brought down BA38 you have to believe that the AAIB, being suspicious of the quality of the fuel and aware of the forensic importance of the contents of the fuel systems, botched the examination of the engines very badly indeed.

Narval's Point
 

I think the unexpectedly high cavitation must be looked at in detail. We do not seem to know what the kinematic viscosity [kv] actually was at the critical moment. "Pumpability" if there is such a word requires a certain kv which if we ever look it up at all is usually on a table of such viscosity versus temperature. But it is for clean uncontaminated kerosenes. The other impact on kv besides pumpability and cavitation is its effect on atomisation. In my second college year we used to do lab experiments in which a readily disassembled glass pump body could have various bronze impellers fitted. The working fluid was glycerine I think on one run and the last of the day to clean out the gunge was white spirit. We used to adulterate the working fluid with powdered chalk or packets of "Drummer's Dye", a cold-water dyestuff. You could visibly determine when conditions within the pump body became ape and the flowmeter assembly in parallel with the pump allowed you to determine kv quite accurately up to the onset of cavitation. The effects of density variation are very striking. The powdered dye being very gritty was not used often but it did allow us to to take a sample when the pump conditions broke down. This was then sprayed through a jet onto a piece of filter paper and subjected to electrophoresis for an hour or two to draw out lines where the dye had landed. It was very hit and miss, basically all you could tell was that kv had a first order effect of both cavitation and atomisation. Previously prepared papers of good atomisation could be contrasted with yours. Gycerine showed up what particulate matter did and aerated white spirit showed the effects of frothing to good advantage but of course you couldn't replicate aeration in a jet beyond using brute force. We mustn't overconcentrate on the effects of fuel temperature but maybe have a think. Dynamic viscosity is easily worked out in the lab and is predictable but kinematic viscosity is dynamic divided by density and at the instant pumpability, atomisation and metering all go to pot may have a fleeting cause that vanishes quickly post incident. However if conditions have been building up over a while the cause may have "evaporated" but the evidence of wear and tear remains. Rather than being the dog that didn't bark in the night it has maybe been yelping for ages. I don't have a copy any more but Walsh and Fletcher of Rolls-Royce did publish about ten years ago. My only thought then was it was all down to the filters plus a bit of heat and agitation and thought no more about it.

have not read thru every post but most of them and with all the theories about ice blocking the screens of the jet pumps etc no one has mentioned( i stand to be corrected) if this were to happen then you would get a fuel low pressure warning. i didnt read anything in the report about this.

Tyropicard responds to bushfiva's query TP says I addressed some of Private Eye's suggestions cursorily in Post #184

Maybe now is the time to be a little more specific. The most accessible short reference to the A320-type architecture is pp131-5 of Cary Spitzer's Digital Avionics Systems (Second Edition, McGraw-Hill 1993).

There are actually 7 computers involved in primary flight control, falling into three different functional types of two ELACs, three SECs, and two FACs, with overlapping functional responsibilities. Each ELAC contains a pair of MC 68000 processors, a "command" (or "hot") and a "monitor" (as a check), which run the same inputs in parallel. The SW running on these two processors is "dissimilar", meaning each is written by a different team.

There is no formal criterion for "dissimilarity"; this is done in the hope that elementary bugs will be avoided, but the (in)famous Knight-Leveson work showed that important errors might well be correlated nevertheless. Bugs may also be avoided by using "correct by construction" (CbC) methods and very close inspection. Some like one; some like another. The very best *demonstrated* quality control in critical software to date uses CbC methods and close inspection.

The SECs also have dual processors, in "command" and "monitor" configuration, with similarly "dissimilar" SW.
They also have different processors: Intel 80186. The FACs have a similar dual structure to the ELACs and SECs.

The FACs, ELACs and SECs run in parallel on the inputs. The outputs cannot be determined by voting (you can't vote with only two processors!) but I don't know how the checks work.

The ELACs and SECs are also manufactured by different divisions of the same company, Sextant Avionique.

It may be that in later versions of the A320 the HW has changed. It is certain that the SW has changed over ops lifetime.

The B777 AIMS uses "common" SW across its multiply-redundant HW platforms, which are also of common design (so-called "line-replaceable units", LRUs). Spitzer is also good on AIMS (I have been on a mailing list for a long time with the primary AIMS designers, Ken Hoyme and Kevin Driscoll). The only reference I have to the PFC is a paper by Bob Yeh of Boeing (Bob has a few papers on it, but they all cost money which I haven't yet forked out). The PFC is triple-redundant *in HW*, but they went with one SW; Yeh cites Knight-Leveson as well as some work by Avizienis at UCLA. But the reason why the PFC is single-source SW is as follows: There it is in print from the horse's mouth. Note that Yeh also answers bushfiva's question whether it is "normal" to have redundant SW written by different companies by suggesting it was at time of writing "usual and customary" to have single-source, well-inspected code. With A320-type architectures occupying airspace all over the globe in their thousands, and B777 architectures occupying it in their hundreds, it is probably moot to ask what is "normal" or "usual and customary".

I hope this helps answer some questions about duplication and redundancy in the architecture of the digital avionics of common 4th-gen transports. If anybody wants to know more and thinks I may be able to help, please feel free to PM or email me.

PBL