Posts about: "Fuel (All)" [Posts: 1005 Pages: 51]

OK I can accept that two bad pumps are unlikely but what I originally wanted to know was when the suction-feed system--as a whole--is ever tested. Your answer as I understand it is effectively "never". So then I'd ask what other parts of the system are there--check valves, tubes, fittings etc--that have to work properly in order to get fuel to the engines without electric pumps? The engines are lower than the tanks so it really is suction-augmented gravity feed, but are there any points where a leak could air-lock the system? Is the fuel feed to the pumps via a standpipe going through the bottom of the tank or via a loop that enters from the top of the tank? There have been cases before where mechanics have systemically misassembled things.

Unless the distance from the phone to the aircraft is known, it is impossible to calculate the height.

Can anyone help with my theory - I'm an electronics and software engineer, but not a pilot.
My understanding of the infamous and previously fixed 787 issue was that the PCU software would trigger a shutdown of all AC generators (or rather their respective control units) after 248 days of continuous power due to an overflow of a software counter, and that this was fixed in software alone.

Hypothetically , if the PCU software triggered this state during takeoff, what would happen? I know the engines may continue running with engine-driven fuel pumps, but I also understand this doesn't work in all situations and perhaps during rotation with a high fuel demand and fuel tanks not horizontal this could be an issue? What does everyone here think it would look like if all AC generators were shut down, in terms of engine performance - would you expect there to be a reduction in thrust? With the gear stuck down would that be serious enough?

Firstly, I've read through this whole thread - thank you Admin & Mods for your considerable efforts to clean things up.

Secondly, as a (now ex) glider pilot who remains extremely interested in aviation in most of its forms, this discussion has been an education and thought-provoking, as it so frequently is whenever I lurk here (usually without logging in). Thank you all for sharing your knowledge, expertise and thoughts.

To my mind the above post (especially the sentence I highlighted) is amongst the best (and most succinct) summary of what the pilots likely faced, with little to no time to resolve the situation. I cannot imagine those last few seconds and my heart goes out to them, the passengers and the many loved ones left behind. If there is any good that can come of this, it is that the cause is found quickly, with no bias, and steps are taken to ensure the same holes in the cheese cannot happen again.

How long does it take for an engine to fail in terms of thrust output - what does thrust over time look like for various failure scenarios - e.g., no electrically powered fuel pumps, or contaminated fuel, or thrust set to idle or other issues?

The original mobile video (not the copy from someones phone screen) clearly sounds like a RAT but what does the engine itself sound like - is it idle or reduced in some way?

What is the minimum amount of thrust that would need to be lost to stop climbing and sink back down - it took 30 seconds from leaving the ground to impact from the CCTV and the first 15 was climbing.

I would look carefully at the fact that the PCU still has the technical ability to tell all AC generator control units to turn off via software, as proven in the documented and fixed 248-day software issue.

I will wager that this is absolute nonsense. The effect of pulling the power levers back to idle at rotate would be readily countered by pushing them back up again. The engines are still delivering thrust, it is a function of N1, not the lever. The lever commands where the thrust level will end up, the N1 gives the thrust output. The acceleration/thrust characteristics of these engines is not like a J52 or JT3D etc.

The proposition that is floated is that the pilot does not pull back on the control column, which he is holding onto with both hands as his seat slides backwards like a caricature of a bad Cessna 180 seat rail, that is plainly obvious from the pitch attitude of the aircraft, yet grabs lustily a double handful of thrust levers and holds onto those until meeting Ganesh in the next life?

Greek papers appear to be as rigorous and incisive in their cognition as the Daily Telegraph. Golly.

Seats: electric.
RAT deployment... presumably the hapless pilot doesn't grab the control column, or the thrust levers, just grabs both fuel control switches instead????

Do any reporters bother to read what they write?

I think it\x92s made up nonsense, but it is at least worth noting that pulling back to idle and pushing back with the wheels still on the ground is a potential TCMA trigger.

Voltage fluctuation can have very nasty effects on electronics and sensors. There is a hacking technique called "voltage glitching" which makes use of these effects to trick electronics in states they are not designed for and never supposed to be.
So I wouldn't vouch for the FADECs if there was catastrophic problem with the power distribution in the aircraft.

To simplify the chicken/egg:

Tdracer earlier confirmed that an airplane electrical power loss would allow engines to keep running , because 1) engines are fully-capable of suction feed operation in takeoff envelope (if boost pumps lost), and 2) the EECs are powered by their own PMAs when running and to substantially below idle (I recall roughly 10% N2). Airplane powers the EEC for ground starts, prior to PMA coming online, and as backup to the PMA after that.

Related:

Engine igniters are powered by the aircraft. So theoretical full loss of aircraft power would disable Autorelight upon a flameout. Ignitors typically don't make the cut for most-essential battery-only loads because it would also take an engine flameout, and the airplane past V1 in ground roll can fly fine on one engine that can achieve takeoff thrust.

Autorelight is relevant - if there was a single-engine failure post V1, autorelight will attempt to relight the engine, so there is no need for a pilot to try to cycle the fuel switch to reset the EEC (potentially grabbing the wrong one), or to otherwise intervene. In such a circumstance, they need to trust their training. I've heard accounts that the most likely pilot instinct in such a situation would be to push the throttle(s) forward.

Finally - there was talk earlier about accidentally cutting the fuel switches - and it was duly noted that they have to be pulled out over the detent, so very unlikely. The same cutoff effect could be achieved with the engine fire handle(s), right behind the fuel switches on the pedestal - though they are an upward pull, so also not subject to inadvertent or accidental engagement.

It is similar to the 248-day continuous power software bug on the 787. In both cases a counter in the software would overflow after an amount of time that would be proportional to something like the number of seconds, milliseconds or other unit.

The 248 day bug would cause the PCU to trigger ALL 4 AC generator control units to shut down. The fact that this is even possible in software alone is remarkable and should make any engineer concerned. The fact that this was only fixed in software with no redundant physical system (e.g. 1 or more AC units being independent of this system) is concerning. The fact that Boeing had a second software overflow error causing the 51 day directive should really have everyone discussing software as a possible cause for this crash.

People may say that the engine driven pumps / suction feed / gravity feed would continue to power the engines but my understanding is the aircraft attitude and high fuel flow at takeoff could potentially mean less thrust than was needed if all 4 AC generators disconnected and stopped all AC fuel pumps during rotation.

A loss of lift AND thrust at this critical juncture could have had caused this awful disaster. I think the data recorders have already revealed the cause but If it's this, then I don't think we will hear much anytime soon.

I don't believe I owe you anything, I believe this is done adequately previously and has already taken up enough time on this thread. I am of the opinion that we have shown the RAT being deployed satisfactory enough to be of use for speculation in this thread. I find repeated comments about the bad video being the only evidence a bit disrespectful, though. Even from a mere physicist. It is based on a spectrogram over time. The source file shows audio up to about 16 kHz, it is unknown whether this limitation is in the file format (ie. 32kHz sampling rate) or microphone. Doesn't matter much. The frequencies above 16kHz is not important in this context as it is not where the sound energy is anyway. The audio will have been lossy data compressed, but it does not affect these prominent properties of the audio. It does make me hesitant to draw conclusions from the parts of the spectrum with more broadband noise and several intersecting sounds. Noise floor suggests 16 bit sampling depth. Spectral resolution? N/A All samples are included. The spectrogram covers the entire frequency range recorded, It shows comparatively the same overtones of the fundamental expected from the technical specifications of the 2 bladed RAT running at it's intended RPM, the doppler characteristics fits completely with a reasonable range of passing speeds and distance to the passing source plotted out. Compareatively, All the harmonics are identical both in pitch and seperation to a recording of a known B787 landing with RAT deployed, while the Doppler fall shows a longer time frame in the landing video taken from a further distance. As expected. The overtones easily discernable in this recording falls in the 220-2700Hz range. Below that, there is other noise centered around 150Hz, which gradually fades towards the end of the recording. This, as far as I can find in available information, fits with an idling or even windmilling B787 engine, but this is not conclusive. This falls in a range of the spectrum where there are other noise sources and the signal/noise is low and of a broader band characteristic, these masking frequencies is where the lossy data compression might play tricks, so I do not weigh that heavily. Recordings of landing B787 without the RAT, shows none off the same characteristics, and completely lack the tonal components and exact overtones shown with the RAT deployed. More importantly, compared to videos of B787s taking off with normal take off thrust, the latter shows distinct tonal elements, but with very different overtones,, both in separation and composition, again possible to relate to known quantities of the rotational speed and elements of the engine at high power. The AI recording shows none of this.

The latest techniques let us separate such things as reverbration from the source, when superimposing the reverberation/ambience and background noise of the AI crash urban environment on the clean, dead open field recording of the known B787 w/rat, they do indeed sound exactly the same to this very skilled and experienced listener. Although this is not courtesy of the computer analysis. It is just another angle of confirmation.

All in all, i think this source audio is excellent. The source is an iphone, their mems based microphones, although noisy shows great spectral balance and is comparable to basic measurement microphones of professional application. There is plenty of information to analyse from in this sample.

And again, I can't see it in the video either, and until I put on some really expensive headphones and fired up the software I was of a different opinion. I bowed to the science.

Edit: I took an extra look, I am prepared to say the fall off at slightly above 16kHz is from the original recording, this is probably a limitation in the microphone, as it is not a hard cut-off before a 16kHz Nyquist frequency as it would be with a 32kHz sampling rate, there is dither noise from 16-20kHz fitting with the source being 16 bit.

A Qantas 747-438 suffered an 'Electrical System Event' when on approach to Bangkok airport on 7 January 2008. The following extracts are taken from the report:

"System malfunctions

Between 0846 and 0852, 4 after passing FL 100 and when the aircraft was turning
onto an extended left downwind leg for runway 01 Right (01R), the EICAS, flight
displays and automated systems showed faults of numerous electrical and other
aircraft systems, including:
\x95 AC buses 1, 2 and 3 not powered
\x95 autothrottle disconnected
\x95 autopilot disengaged
\x95 some fuel pumps not operating
\x95 weather radar not operating
\x95 automatic cabin air conditioning and pressurisation system not operating
\x95 right (FO\x92s) displays blanked
\x95 between three and five pages of messages on the EICAS display
\x95 lower EICAS display blanked.
The CSM contacted the flight crew and advised that the cabin lighting had failed."

"Origin of Generator Control Unit (GCU) faults

Post-incident examination of the GCUs revealed corrosion of the internal circuit
boards in all three of the GCUs that shut down. Analysis of the corrosion materials
observed in GCU 3 showed evidence of long-term exposure to water, including
evidence of acids and carbohydrates that are present in beverages such as coffee,
fruit juice and soft drinks. Those findings indicated a fluid source originating from
the aircraft\x92s galley drains or from spilt liquids in the cabin, and also suggested that
liquid ingress had been occurring over an unknown, but extended period of time."

https://www.atsb.gov.au/sites/defaul.../ao2008003.pdf

This link to the report includes diagrams of where the 747 forward galley was located, directly above the Main Equipment Centre and the E1/E2 racks.

The phtographs show how ineffective the dripshield was in protecting the electrical equipment and the extent of corrosion and damage.

The aircraft was 17 years old at the time of the incident and had completed a C-check approximately three months before the incident.

As FDR notes, this issue seems to have carried over to the 787-8 with Airworthiness Directive AD 2016-14-04 ( https://drs.faa.gov/browse/excelExte...A0058AF6B.0001 )

"We are issuing this AD 2016-14-04 to prevent a water leak
from an improperly installed potable water system coupling, or main cabin water source, which could
cause the equipment in the EE bays to become wet, resulting in an electrical short and potential loss
of system functions essential for safe flight"

AD 2016-14-04 mirrors precisely what occurred to the Qantas 747 on 7 January 2008. It is possible something similar may have occurred on take-off of AI171, with water causing the equipment in the EE bays to become wet resulting in electrical short and potential loss of system functions

I agree with your analysis about RAT. The source is usable, although far from the original quality.

The cut-off at 16 kHz is typically caused by lossy audio compressions (AAC), not the microphone. In this case, the audio was compressed two times (first the iPhone, then the Twitter). A microphone does not simply cut all frequencies above the certain point.

Also, this audio content is Mono (the same signal on both channels) - an additional loss of information, if the original recording was Stereo.

There have been many speculations about latent threats in systems\x92 design. If you can easiliy come up with some possible latent threat, what are the changes that not a one professional person designing, testing and certifying it couldn\x92t figure it out? Or it was ignore if recognised?

Without any 787 knowledge, I would assume two discreet signals from respective Engine Fuel Switch to each FADEC channel, possibly with other redundancies. Or other solution that is at least as robust.

If decrease in thrust not by transition to climb thrust due to early inadvertent flap retraction and pilot action on fuel control switches from accomplishing dual engine failure memory items, then fuel cavitation /fuel fumes lock may be a cause. Just saying.

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

What you are saying is, as several have said before, is that everything started to fail at or shortly before rotation. Joining the dots from two other branches in this thread is it correct to say that there are only two things that happen at that point: the aircraft transitions from "ground" to "air" (multiple sensors) and there is a change in orientation such that any liquid (eg potable water) that has found its way into the EE bay will move. Question: the aircraft was routed DEL-AMD-LGW. Where was the potable water tankage topped up? Presumably prior to the longest sector? In addition to the inspection list that the Indian AAIB has mandated should they also inspect peer aircraft for EE bay corrosion...?

This doesn't make any sense. The plane was in the air for approximately 30 seconds, the plane stops climbing around 12 seconds after take off, and the noise of the RAT is heard 11 seconds before the plane crashes - even if we assume the RAT both deploys instantly and deployed the exact moment that video began recording, that only gives the pilots a 7 second window to perform an action that results in it being deployed.

There just isn't enough time for the RAT to be deployed as a result of any action by the crew, IMHO. And to demonstrate how long 7 seconds is - that's enough to say 20 words, assuming no interruptions .

If you read the thread, you would know:

The RAT was almost certainly deployed. 4 different sources.
The Flaps were not retracted. Visible at the accident site plus many other sources agreeing they were indeed down.
APU will autostart when all engine power is lost. Potentially explaining why the inlet door was open or partially open at the accident site. Mentioned in several previous posts
On a 787-8, the main bogies tilt as the 1st action of the gear retract sequence. As stated in previous posts. I don't think this happens unless gear is selected up. So the conclusion was, gear was selected up. One caveat, IIRC, there was some discussion around a failure could have caused the bogies to tilt without Gear up being selected but I don't recall the outcome.
As for the Air France remark, un-necessary IMHO. Let's respect the crews please.