UPDATE on the LHR (Heathrow) 777 incident

[TangoWhiskey]

This is an update to the original thread on the Heathrow 777 that landed short.

At about 700 ft AGL, the auto throttle commanded engine acceleration. One engine started to rollback during and the other engine started to accelerate then 8-10 seconds later began to roll back. Once the flight crew noticed, they pushed the throttles up and the engines' EECs responded but the engines did not. It appears that no fuel was getting to the engines.

The investigation continues to look broadly for a cause of the dual engine rollbacks. Fuel exhaustion is the only item that has been positively ruled out. Aspects that the FAA believes the investigation is concentrating on are:

• Ice in the fuel somehow limiting the fuel flow to the engines. A maintenance message indicating excessive water in the center tank was set during taxi on the two previous flight legs, although it cleared itself both times. The airplane was being operated in a high humidity, cold environment, conducive to ice formation.

• Small-sized contamination building up in the engine fuel systems somehow limited the fuel flow to engine. All the fuel samples have tested for contamination of larger particles (sizes outside the fuel specification). Testing has been started looking for small particles (greater than 5 microns).

• Engine hardware failures sending inaccurate data to the engine electronic control (EEC) causing the EEC to demand insufficient fuel. A preliminary review of the EEC data from the right engine shows erratic combustor inlet pressure (P30). A leaking P30 sense line could cause this, or the EEC receiving a higher than actual fuel flow parameter.

• Software coding problem in the EEC causing the EEC to demand insufficient fuel. British Airways installed a new engine EEC software revision in December 2007. The software was approved in May 2006. There were several changes to the software as part of the revision. Two items seem remotely related to the accident: improvements to low power stall recovery logic and fan keep out zones for ground maintenance. The first two items would be related to a part 25 compliance issue, while the last two items would be related to a part 33 compliance issue.

As stated yesterday in this briefing paper, the electrical system anomalies noted earlier have been resolved, as describe below, and the conclusion now is that the electrical buses were powered until impact and performing as expected.

• The auxiliary power unit (APU) began its auto start sequence, even though the buses were still powered. In the days following the event, the flight crew has added additional details to their report. The crew now believes they turned the APU on prior to impact. There was sufficient time before the impact for the APU inlet door to open, but not for the APU fuel pump to turn on or the APU engine to start spooling up.

• The quick access recorder (QAR) saved data and shut down approximately 45 seconds prior to impact. The QAR saves data in batches. It is believed the QAR was working properly and was in the process of saving data when impact occurred, accounting for the “lost” 45 seconds of data.

• The fuel crossfeed valves were closed in flight according to the flight crew, but the switches were found in the open position and only one valve was open. In the days following the event, the flight crew has added additional details to their report. The crew now believes they opened the valves just prior to impact and the airplane lost power before both valves moved to the open position.

• The ram air turbine (RAT) was found deployed, even though the buses were still powered. It did not deploy until after the airplane came to a stop, as determined by the pristine condition of the turbine blades. The RAT either deployed due to electrical power loss during impact with a failed air/ground signal or the impact unlatched the RAT door.

Fuel system: Leads regarding water in the fuel and fuel contamination are continuing to be investigated. Fuel testing looking for small-sized contaminants (5 microns) is beginning. The tanks are still being drained and the team hopes to start evaluating the fuel system hardware tomorrow.

Engines: Component testing and teardown of the engine-driven fuel pumps and the fuel metering units is planned for later this week. The data from the electronic engine controls is still being analyzed. Rolls-Royce is planning an engine test, unscheduled as yet, to try and duplicate the rollbacks.

Crashworthiness: Cabin crew and passenger questionnaires indicate that the evacuation bell was faint, but the evacuation light was seen and the captain’s message to evacuate over the passenger address system was heard. Preliminary data indicates that the descent rate at impact was roughly 30 ft/sec. Dynamic seat requirements that became effective at the introduction of the Model 777 series airplanes require seats protect occupants for hard landing impact up to 35 ft/sec. The passenger with the broken leg was sitting next to the point where the right main landing gear punctured the fuselage and pushed into the cabin (pictured below).





Crashworthiness: There was only one serious injury, a compound fracture to the leg. The airplane landed on the main gear, bounced, came back down on the gear, then the gear failed, and the engines supported weight of the airplane. The descent rate at landing was 1500-1800 feet per minute. One of the main landing gear swung around and pushed slightly into the cabin. The other punctured the center fuel tank (empty) leaving a 1-by-2-foot hole. The report of a fuel leak is unconfirmed. All the slides deployed and the doors worked. Some passengers had to shuffle down the slides due to the slight angle. The flight deck door opened on its own during the landing. Some oxygen masks dropped.

[Checkout_my_Six]

nice account.

[I am a dad!]

That's an interesting read, thank you very much for posting that and to your friend for sharing it; it's much appreciated! I look forward to hearing more as the investigation progresses.

[Tim]

Great information, thanks very much.

[Dave Taylor]

Kudos Troy, we feel in the loop thanks to your report!

[sba55]

Out of curiosity, does anyone know if a 1800fpm descent rate with engines at idle is normal/to be expected?

Or was the terrain so bad that they decided that it'd be better to stretch the glide rather than having sufficient speed for the flare?

-Felix

[Tim]

Remember that with failing electricity (the APU hadn't fired up yet) and fading engines the flight controls may not have responded normally if hydro pressure was falling, so I don't know if their impact rate was altered by that possibility.

[Greg Bockelman]

Originally Posted by sba55

Out of curiosity, does anyone know if a 1800fpm descent rate with engines at idle is normal/to be expected?

Nope. Well, NORMAL approach with the engines spooled up the VSI would be about 700 to 800 FPM. So I suppose 1800 fpm at flight idle is conceivable.

Or was the terrain so bad that they decided that it'd be better to stretch the glide rather than having sufficient speed for the flare?

Terrain is flat but you run into housing issues. Any shorter and they would have taken out some buildings, IIRC.

[Greg Bockelman]

Originally Posted by TMetzinger

Remember that with failing electricity (the APU hadn't fired up yet)

Battery power is good for half an hour so that isn't really an issue, IMO.

and fading engines the flight controls may not have responded normally if hydro pressure was falling, so I don't know if their impact rate was altered by that possibility.

Well there are ELECTRIC as well as ENGINE driven hydraulic pumps so that wasn't an issue either.

Thanks Troy

[Fly Right]

More pictures

What caused the hole torn in the side of the fuselage?

[TangoWhiskey]

Originally Posted by KennyFlys

What caused the hole torn in the side of the fuselage?

Did you not read the accompanying text?

The passenger with the broken leg was sitting next to the point where the right main landing gear punctured the fuselage and pushed into the cabin (pictured below).

[sba55]

Originally Posted by Greg Bockelman

Nope. Well, NORMAL approach with the engines spooled up the VSI would be about 700 to 800 FPM. So I suppose 1800 fpm at flight idle is conceivable.

Terrain is flat but you run into housing issues. Any shorter and they would have taken out some buildings, IIRC.

Thanks, Greg. Appreciate the insight.

-Felix

Originally Posted by TangoWhiskey

Did you not read the accompanying text?

I missed that. When I got down to that last paragraph before the picture I got sidetracked by the picture. Later, looking at the other pictures it was puzzling to see the hole by itself.

[TangoWhiskey]

Originally Posted by KennyFlys

I missed that. When I got down to that last paragraph before the picture I got sidetracked by the picture.

That sounds like what I usually do! :-) My wife and I've had many discussions about the hot sauce that she says is in the side door of the fridge, yet I insist it's not there after going row by row, slowly, looking for it. Then she'll walk up and point to it. It never ceases to amaze me how she makes it appear out of nowhere like that.

[Tim]

Originally Posted by Greg Bockelman

Battery power is good for half an hour so that isn't really an issue, IMO.



Well there are ELECTRIC as well as ENGINE driven hydraulic pumps so that wasn't an issue either.

OK - so the batteries will drive the entire electrical load (after whatever shedding happens automatically if the gens kick off line) for 30 min? That's nice!

I'm aware that you have engine-driven and electrical hyd pumps. Just didn't know what you might lose if you lose gens and haven't gotten another source (APU or RAT) operating yet. Of course, I didn't see anything that indicated that the Gens were offline at that point either, so there may not have been any electrical anomalies at all.

Thanks for increasing my understanding.

[Greg Bockelman]

Originally Posted by TMetzinger

OK - so the batteries will drive the entire electrical load (after whatever shedding happens automatically if the gens kick off line) for 30 min? That's nice!

I went back to the manual and looked. I can't find where it specifically says how long the battery lasts. I BELIEVE from my groundschool some years ago that the batteries are good for at least half an hour. But the reality is it only has to power the airplane long enough for the RAT, or Ram Air Turbine to deploy and come up to speed. The RAT is designed to provide back up hydraulic power, primarily, and electrical power if excess capacity remains. Since the airplane lives and dies by hydraulics, that is the priority.

The RAT, according to the report, was deployed but had not had time to spool up. There would have been enough electrical and hydraulic power to keep the airplane flying until the RAT came up to speed.

[Tim]

OK, thanks - the way I read the previous data it wasn't clear if the RAT deployed post crash or not, but it was clear that it hadn't started moving. I recall that the APU had been started but wasn't providing any power at the time of impact

Your other post about them stretching the glide to avoid housing made a lot of sense and explains the 1800 FPM vertical impact to my satisfaction. I hope I'd make the same decision.

I thought there was a FAR that required batteries to hold out for a minimum of thirty minutes based on minimal requirements. I can't tell you where I read that or if I inferred it from something else that was written.

I had been taught the back-up battery for the G-1000 in the Cessna Nav III is supposed to run the entire avionics suite for thirty minutes. I looked for that in both the Garmin and Cessna manuals but cannot find it.

But, I continued... And, found it!

Part 23.1353(h):

(h) In the event of a complete loss of the primary electrical power generating system, the battery must be capable of providing at least 30 minutes of electrical power to those loads that are essential to continued safe flight and landing. The 30 minute time period includes the time needed for the pilots to recognize the loss of generated power and take appropriate load shedding action.

Link in Government Printing Office Site

Link on FAA Airweb Site

Obviously, battery systems can be designed to last longer but I doubt a manufacturer will put much expense into more than the law requires. Then the RAT will supplement that power if it is enabled and operational.

In the case of the Cessna Nav III, there's aircraft batter then the Garmin battery exclusive to the avionics suite.

[iBo Deeh Ibonek]

Originally Posted by KennyFlys

...

Obviously, battery systems can be designed to last longer but I doubt a manufacturer will put much expense into more than the law requires. Then the RAT will supplement that power if it is enabled and operational.

...

Longer can also mean bigger, which generally means heavier. Longer, bigger, uncut....ha ha.

So with the alternative power sources to a battery (apu and the ram turbine), would it really make much sense to have a gigantic battery capable of providing 3 hours of power?

Not criticizing, just wanted to point out that there may be an alternate theory to simply providing the minimum required by law.

At least, I'd sure like to think that there is!

[iBo Deeh Ibonek]

Originally Posted by Greg Bockelman

I went back to the manual and looked. I can't find where it specifically says how long the battery lasts. I BELIEVE from my groundschool some years ago that the batteries are good for at least half an hour. But the reality is it only has to power the airplane long enough for the RAT, or Ram Air Turbine to deploy and come up to speed. The RAT is designed to provide back up hydraulic power, primarily, and electrical power if excess capacity remains. Since the airplane lives and dies by hydraulics, that is the priority.

The RAT, according to the report, was deployed but had not had time to spool up. There would have been enough electrical and hydraulic power to keep the airplane flying until the RAT came up to speed.

Out of curiousity, what is the actual physical size of the RAT (if you know - hopefully you've never seen one deployed!)? I know I've seen a picture of it and I seem to remember it being fairly small, but to provide all that power, it seems like it would need to be fairly large.

[TangoWhiskey]

Originally Posted by Obi Heed Kenobi

Out of curiousity, what is the actual physical size of the RAT (if you know - hopefully you've never seen one deployed!)?

I've read before that the RAT on these big Boeings are the same turbine engines used in some of the smaller business jets (Citations, Lears, etc.)

[Greg Bockelman]

Originally Posted by TangoWhiskey

I've read before that the RAT on these big Boeings are the same turbine engines used in some of the smaller business jets (Citations, Lears, etc.)

The RAT itself, on the 777, is not an engine. It is a propeller that turns a hydraulic pump. That pump provides backup hydraulic power to a limited number of flight controls and that hydraulic power also powers a generator that provides power for a limited number of essential electrical components.

I THINK what you meant was that the APU would be the same turbine engines. That I cannot confirm nor deny because I don't know. But since the one on the 777 can provide enough air to start BOTH of those big honking engines AT THE SAME TIME, I wouldn't doubt it.

[Tim]

Originally Posted by KennyFlys

I thought there was a FAR that required batteries to hold out for a minimum of thirty minutes based on minimal requirements. I can't tell you where I read that or if I inferred it from something else that was written.

I had been taught the back-up battery for the G-1000 in the Cessna Nav III is supposed to run the entire avionics suite for thirty minutes. I looked for that in both the Garmin and Cessna manuals but cannot find it.

But, I continued... And, found it!

Part 23.1353(h):

Obviously, battery systems can be designed to last longer but I doubt a manufacturer will put much expense into more than the law requires. Then the RAT will supplement that power if it is enabled and operational.


In the case of the Cessna Nav III, there's aircraft batter then the Garmin battery exclusive to the avionics suite.

Unfortunately this doesn't apply to transports. They're covered in FAR 25, and the closest I can find is.............25.1351

(d) Operation without normal electrical power. It must be shown by analysis, tests, or both, that the airplane can be operated safely in VFR conditions, for a period of not less than five minutes, with the normal electrical power (electrical power sources excluding the battery) inoperative, with critical type fuel (from the standpoint of flameout and restart capability), and with the airplane initially at the maximum certificated altitude. Parts of the electrical system may remain on if -
(1) A single malfunction, including a wire bundle or junction box fire, cannot result in loss of both the part turned off and the part turned on; and
(2) The parts turned on are electrically and mechanically isolated from the parts turned off.

So the regs call for five minutes on battery power. Boeing may have bigger batteries. And of course, we don't know if the gens were offline. Having the power spool down to idle is not the same as having the engines stop turning and the gens trip off.