Posts about: "Fuel Pumps" [Posts: 151 Pages: 8]

Three hydraulic systems, each with their own reservoir, pumps, and accumulators. Engine bleed air (I think; some newer aircraft have a semi-permanent nitrogen charge) keeps a few tens of PSI of positive pressure in the reservoir to prevent pump cavitation; loss of this is not an emergency.

Left and right hydraulics have an engine driven pump that will keep turning as long as the engine is turning unless explicitly disabled.

Low reservoir levels are both a maintenance check and something that will raise an EICAS warning.

If TCMA cut fuel flow while still on the runway the aircraft would have been decelerating from the moment it lifted off, which is not what the ADS-B data indicates. The kinetic energy in the rotating parts of the engine wouldn't add much speed to the aircraft as the engines run down with no more energy being added via fuel.

I have been really wondering what single point of failure could take out both engines simultaneously as seems to be the case here. One single main bus contactor closing in error seems to possibly be such a single point fault.
Online/running generators connected together by accident/fault will cause a HUGE load on everything, electric connections, generator itself and the shafts and gears driving the generators. Heck, I wouldnt be surprised if the generator could disintegrate due to such an electromagnetic shock load.
So, the question is if there is something between the generators that could limit the electric current. A VFD possibly would as the VFD maybe would not be able to pass the current required for shearing the drive shaft for example. But then again, electronic switches like IGBT/MOSFET and such are able to pass an incredibly large over current for some milliseconds before exploding. Possibly 50 to 100 times the nominal current. So I am not sure if a VFD really would save the rest of the system in a situation with two generators connected together in error.
So, where is the VFD part installed, directly on each generator or somewhere else in the system? Are there physical interlocks on the contactors or only electric interlocks?

This is a regular test during maintenance at my airline (British operator of 787s)
Carried out as part of a 12k check.

Fuel level in the wing tanks made to be between 3100 kg & 3400kg. Engines are started, APU shut down and boost pumps are selected off.
As long as the engines keep running, it\x92s test passed. (Just have to remember to fire the APU back up before shutting the engines down!)

Seems to be funny that no-one has mentioned the Battery, which because of its age could have failed either Short-circuit or Open-circuit.
Maybe some Boeing Electro Techs, could explain what role the battery has in this circumstance.
The simultaneous failure of both engines points towards an electrical problem, unless the high temperature had adversely affected the fuel flow.

This discussion happened after Jeju. I note that one of the video sources here is actually leaked (camera-pointed-at-screen) airport CCTV. Do not mistake airport CCTV not being publicly available for it not existing.

We'd need to know the impedance/available fault current of the generators. 50x would be unusually high in an industrial setting.

VFDs are for frequency conversion to drive the motors (CAC/pumps/engine start). They won't be carrying the full generator load for galleys and anti-ice; that will be handled by cross-ties, which is a big black box on the 787.

Fast fuses can be faster acting than circuit breakers, but are one-shot. I'm not sure how fast-acting and effective the generator contactors/controllers are; conventional ACBs/MCCBs will blow open magnetically under sufficient fault current regardless of what the trip unit or close coil commands.

I wouldn't really expect electrical reconfiguration to happen on climbout, and I wouldn't expect it to be the first time this contactor gets used since maintenance - everything should get a good workout during sequential APU/engine starts.

Not designed to parallel, but you still need to switch each generator on/off buses and tie or separate buses.

In a very simple main-tie-main arrangement you can close any two of three breakers and still keep the sources separate. It gets much more complicated when you have ten different sources.

I suspect the 'large motor power centre' might parallel the rectified output of some generators.

The 787 flight controls remain almost entirely hydraulic except for stab trim and two spoiler pairs. The centre system is now electric- or RAT-only with no ADP backup. Left and Right systems are still driven by EDPs and will remain pressurised as long as there's fluid and the engines turn.

1.5MW is the figure for all six generators; only four can be used at once.

There's no indication they had any flight control issues.

Battery is essentially unused in normal operations other than to start the APU and keep the clocks running. It's there for emergencies (like after the engines fail). And yes, been discussed.

OK I can accept that two bad pumps are unlikely but what I originally wanted to know was when the suction-feed system--as a whole--is ever tested. Your answer as I understand it is effectively "never". So then I'd ask what other parts of the system are there--check valves, tubes, fittings etc--that have to work properly in order to get fuel to the engines without electric pumps? The engines are lower than the tanks so it really is suction-augmented gravity feed, but are there any points where a leak could air-lock the system? Is the fuel feed to the pumps via a standpipe going through the bottom of the tank or via a loop that enters from the top of the tank? There have been cases before where mechanics have systemically misassembled things.

Can anyone help with my theory - I'm an electronics and software engineer, but not a pilot.
My understanding of the infamous and previously fixed 787 issue was that the PCU software would trigger a shutdown of all AC generators (or rather their respective control units) after 248 days of continuous power due to an overflow of a software counter, and that this was fixed in software alone.

Hypothetically , if the PCU software triggered this state during takeoff, what would happen? I know the engines may continue running with engine-driven fuel pumps, but I also understand this doesn't work in all situations and perhaps during rotation with a high fuel demand and fuel tanks not horizontal this could be an issue? What does everyone here think it would look like if all AC generators were shut down, in terms of engine performance - would you expect there to be a reduction in thrust? With the gear stuck down would that be serious enough?

Firstly, I've read through this whole thread - thank you Admin & Mods for your considerable efforts to clean things up.

Secondly, as a (now ex) glider pilot who remains extremely interested in aviation in most of its forms, this discussion has been an education and thought-provoking, as it so frequently is whenever I lurk here (usually without logging in). Thank you all for sharing your knowledge, expertise and thoughts.

To my mind the above post (especially the sentence I highlighted) is amongst the best (and most succinct) summary of what the pilots likely faced, with little to no time to resolve the situation. I cannot imagine those last few seconds and my heart goes out to them, the passengers and the many loved ones left behind. If there is any good that can come of this, it is that the cause is found quickly, with no bias, and steps are taken to ensure the same holes in the cheese cannot happen again.

How long does it take for an engine to fail in terms of thrust output - what does thrust over time look like for various failure scenarios - e.g., no electrically powered fuel pumps, or contaminated fuel, or thrust set to idle or other issues?

The original mobile video (not the copy from someones phone screen) clearly sounds like a RAT but what does the engine itself sound like - is it idle or reduced in some way?

What is the minimum amount of thrust that would need to be lost to stop climbing and sink back down - it took 30 seconds from leaving the ground to impact from the CCTV and the first 15 was climbing.

I would look carefully at the fact that the PCU still has the technical ability to tell all AC generator control units to turn off via software, as proven in the documented and fixed 248-day software issue.

Voltage fluctuation can have very nasty effects on electronics and sensors. There is a hacking technique called "voltage glitching" which makes use of these effects to trick electronics in states they are not designed for and never supposed to be.
So I wouldn't vouch for the FADECs if there was catastrophic problem with the power distribution in the aircraft.

To simplify the chicken/egg:

Tdracer earlier confirmed that an airplane electrical power loss would allow engines to keep running , because 1) engines are fully-capable of suction feed operation in takeoff envelope (if boost pumps lost), and 2) the EECs are powered by their own PMAs when running and to substantially below idle (I recall roughly 10% N2). Airplane powers the EEC for ground starts, prior to PMA coming online, and as backup to the PMA after that.

Related:

Engine igniters are powered by the aircraft. So theoretical full loss of aircraft power would disable Autorelight upon a flameout. Ignitors typically don't make the cut for most-essential battery-only loads because it would also take an engine flameout, and the airplane past V1 in ground roll can fly fine on one engine that can achieve takeoff thrust.

Autorelight is relevant - if there was a single-engine failure post V1, autorelight will attempt to relight the engine, so there is no need for a pilot to try to cycle the fuel switch to reset the EEC (potentially grabbing the wrong one), or to otherwise intervene. In such a circumstance, they need to trust their training. I've heard accounts that the most likely pilot instinct in such a situation would be to push the throttle(s) forward.

Finally - there was talk earlier about accidentally cutting the fuel switches - and it was duly noted that they have to be pulled out over the detent, so very unlikely. The same cutoff effect could be achieved with the engine fire handle(s), right behind the fuel switches on the pedestal - though they are an upward pull, so also not subject to inadvertent or accidental engagement.

It is similar to the 248-day continuous power software bug on the 787. In both cases a counter in the software would overflow after an amount of time that would be proportional to something like the number of seconds, milliseconds or other unit.

The 248 day bug would cause the PCU to trigger ALL 4 AC generator control units to shut down. The fact that this is even possible in software alone is remarkable and should make any engineer concerned. The fact that this was only fixed in software with no redundant physical system (e.g. 1 or more AC units being independent of this system) is concerning. The fact that Boeing had a second software overflow error causing the 51 day directive should really have everyone discussing software as a possible cause for this crash.

People may say that the engine driven pumps / suction feed / gravity feed would continue to power the engines but my understanding is the aircraft attitude and high fuel flow at takeoff could potentially mean less thrust than was needed if all 4 AC generators disconnected and stopped all AC fuel pumps during rotation.

A Qantas 747-438 suffered an 'Electrical System Event' when on approach to Bangkok airport on 7 January 2008. The following extracts are taken from the report:

"System malfunctions

Between 0846 and 0852, 4 after passing FL 100 and when the aircraft was turning
onto an extended left downwind leg for runway 01 Right (01R), the EICAS, flight
displays and automated systems showed faults of numerous electrical and other
aircraft systems, including:
\x95 AC buses 1, 2 and 3 not powered
\x95 autothrottle disconnected
\x95 autopilot disengaged
\x95 some fuel pumps not operating
\x95 weather radar not operating
\x95 automatic cabin air conditioning and pressurisation system not operating
\x95 right (FO\x92s) displays blanked
\x95 between three and five pages of messages on the EICAS display
\x95 lower EICAS display blanked.
The CSM contacted the flight crew and advised that the cabin lighting had failed."

"Origin of Generator Control Unit (GCU) faults

Post-incident examination of the GCUs revealed corrosion of the internal circuit
boards in all three of the GCUs that shut down. Analysis of the corrosion materials
observed in GCU 3 showed evidence of long-term exposure to water, including
evidence of acids and carbohydrates that are present in beverages such as coffee,
fruit juice and soft drinks. Those findings indicated a fluid source originating from
the aircraft\x92s galley drains or from spilt liquids in the cabin, and also suggested that
liquid ingress had been occurring over an unknown, but extended period of time."

https://www.atsb.gov.au/sites/defaul.../ao2008003.pdf

This link to the report includes diagrams of where the 747 forward galley was located, directly above the Main Equipment Centre and the E1/E2 racks.

The phtographs show how ineffective the dripshield was in protecting the electrical equipment and the extent of corrosion and damage.

The aircraft was 17 years old at the time of the incident and had completed a C-check approximately three months before the incident.

As FDR notes, this issue seems to have carried over to the 787-8 with Airworthiness Directive AD 2016-14-04 ( https://drs.faa.gov/browse/excelExte...A0058AF6B.0001 )

"We are issuing this AD 2016-14-04 to prevent a water leak
from an improperly installed potable water system coupling, or main cabin water source, which could
cause the equipment in the EE bays to become wet, resulting in an electrical short and potential loss
of system functions essential for safe flight"

AD 2016-14-04 mirrors precisely what occurred to the Qantas 747 on 7 January 2008. It is possible something similar may have occurred on take-off of AI171, with water causing the equipment in the EE bays to become wet resulting in electrical short and potential loss of system functions

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

What you are saying is, as several have said before, is that everything started to fail at or shortly before rotation. Joining the dots from two other branches in this thread is it correct to say that there are only two things that happen at that point: the aircraft transitions from "ground" to "air" (multiple sensors) and there is a change in orientation such that any liquid (eg potable water) that has found its way into the EE bay will move. Question: the aircraft was routed DEL-AMD-LGW. Where was the potable water tankage topped up? Presumably prior to the longest sector? In addition to the inspection list that the Indian AAIB has mandated should they also inspect peer aircraft for EE bay corrosion...?

Sometimes complex sequences can have very simple causalities. A lot of complex speculation in this thread so far focused on highly technical things. Yet the basic fundamentals of powered flight have not changed (despite our attempts to do so) over the past 100 years.

1. As a general rule it is a bad idea to run out of either altitude or airspeed or both.
2. If you try to maintain altitude without sufficient thrust you will eventually run out of airspeed.
3. If you have sufficient thrust you can maintain your altitude at a given airspeed, and if you have excess thrust you can maintain your airspeed and increase your altitude. If you have lots of excess thrust you can increase your altitude and increase your airspeed.
4. If you try to increase your altitude by pitching the nose up, and without sufficient excess thrust, your speed will decay quickly, up to the point of stall, at which point you will lose any small amount of altitude you have gained and begin descending.

So…

Fact 1: The airplane stopped going up because it lacked excess thrust necessary to sustain the climb, and;

Fact 2: The airplane’s airspeed decreased constantly because they were trying to maintain either altitude or the climb, but lacked the thrust to do so, and;

Fact 3: If they had prematurely raised the flaps, the climb rate would have decreased/possibly turned negative, but the airplane would have continued to accelerate.

So where did the thrust go?

Fact 4: There is no adverse yaw seen in any of the videos, so wherever it went the loss of thrust occurred (nearly) simultaneously in both engines.

Fact 5: The only way to stop a jet engine from thrusting (sorry) is by either blowing it up or removing the fuel supply. If it blows up- like from birds trying to become a fuel source, there will be evidence. (See Jeju Air for a good example.)

Fact 6: There is (so far) no evidence of either engine blowing up. (I’m deliberately using highly technical terms here…)

Fact 7: There is unmistakably clear audible evidence of the RAT being deployed on the raw video from the right rear quarter of the airplane. Near supersonic propellor blades are an unmistakable sound- the RAT was definitively deployed no matter how much people want to argue to the contrary.

Fact 8: In the same video there is silence from the engines when they should be thundering at full (or nearly full) power. (Yes, I know that isn’t a thing- I am a simple man alas.)

Thus the only possible conclusions are (cringes as he waits for fdr to rip him a new ah):

1. The engines stopped burning, at nearly the same moment in time.
2. As a result, the airplane stopped climbing and also began to lose airspeed in an attempt to maintain altitude.
3. The RAT being deployed so quickly means that the ‘puters believed both engines were dead donks. (They were.)
4. If both engines ceased burning it meant the fuel supply was interrupted. We aren’t talking flight idle here- it was lights out for both.
5. (I am quoting someone else here) There is enough suction for the fuel to feed even if the fuel pumps are inop.
6. The engines stopped being provided with fuel. Because something physical was placed between the tanks and the burners. And they flamed out.

The $64,000 question here (remember when that was a lot of money??!!) is simply: What stopped both engines from getting fuel?

There are a very finite number of possibilities to that answer- and I do have my suspicions, but I lack the qualification to opine on that one.

I’ll leave the rest to the more experienced folk here.

Warm regards-

dce

Another hour spent sifting through the stuff since last night (my sympathies to the mods ). A few more comments:

"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.

Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).

As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.

Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).

The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.

The engine driven fuel pump is literally driven off the engine gearbox (driven by a mechanical connection to the N2 shaft) - if the engine's running, the gearbox is turning (baring a major mechanical fault). The engine driven fuel pump is a two-stage pump - a centrifugal pump that draws the fuel into the pump (i.e. 'suction feed'), and a gear pump which provides the high-pressure fuel to the engine and as muscle pressure to drive things like the Stator Vane and Bleed Valve actuators. It takes a minimum of ~300 PSI to run the engine - the HPSOV is spring loaded closed and it takes approximately 300 psi to overcome that spring.
Engine driven fuel pump failures are very rare, but have happened (usually with some 'precursor' symptoms that were ignored or mis-diagnosed by maintenance). It would be unheard of for engine driven fuel pumps to fail on both engines on the same flight.

As I've repeatedly posted, even a 100% aircraft power failure would not explain both engines quitting, at least without several other existing faults. Again, never say never, but you can only combine so many 10-9 events before it becomes ridiculous...

TCMA doesn't know what V1 is - it's active whenever the air/ground logic says the aircraft is on-ground.

A flight test (at least one - it's often duplicated) is performed as a basic part of aircraft/engine certification. One engine with all boost pumps off and on 'suction' feed - the other engine with normal aircraft boost pump operation (for what should be obvious reasons). Start, taxi, takeoff, and climb in that configuration until the test engine quits due to fuel starvation as a result of the engine fuel pump cavitation (done using "unweathered" fuel - once fuel has been at altitude for a period of time (hours or more - i.e. 'weathered'), most of the dissolved gases in the fuel have vented off, and suction feed works far better - often up to cruise altitudes).
I don't think this test is ever done during normal operations or maintenance (at least not on purpose) as it is very abusive to the engine driven fuel pump - the sort of cavitation that this causes rapidly erodes the pumping surfaces (it's SOP to replace the engine driven fuel pump after such a test).