Monday, October 9, 2006

The Unthrustworthy 777

Emergency Airworthiness Directive Issued For The 777's GE90 Thrust Rollbacks

An emergency Airworthiness Directive (AD) issued September 30 stems from two occurrences of engine thrust rollback during takeoff on Boeing 777-300ERs, which are powered by General Electric GE90-115B engines. The concern is that the GE90 engines powering Boeing 777-200LRs and 300ERs could suffer dual thrust reductions on take-off, with potentially catastrophic consequences.

In the two instances cited, just the one engine was affected but because it's software-related, the FAA cites the possibility that "a dual-engine thrust rollback could occur just after V1 (takeoff decision speed after which takeoff is to proceed even after an engine failure). This would result in the airplane not having adequate thrust to complete the takeoff. A dual-engine thrust rollback, if not corrected, could result in the airplane failing to lift off before reaching the end of the runway or failing to clear obstacles below the takeoff flight path."

Trouble-shooting technicians have found that the two cases in which there were single-engine thrust reductions during takeoff were the result of a flawed software algorithm in the Full Authority Digital Engine Control (FADEC). The emergency AD requires operators of GE90-115Bs powering 777-300ERs as well as GE90-110Bs powering 777-200LRs to amend their procedures to prohibit takeoffs at anything less than full-rated thrust. This is being stipulated because the rollbacks are only likely to occur at reduced powers, during the so-called "balanced field" takeoffs. When the power levers are set to maximum, the predictive software is out of the picture. For the foreseeable future, passengers on lightly loaded 777's are liable to think that they're on a shuttle launch.

If you read the entire AD, what it says is that the anomaly was introduced by an error in a certain software update for the FADEC on the LR. However, because the -300 has an identical software update, it could presumably cause the same problems on that aircraft as well, on the affected GE engines. All airlines operating the affected aircraft operate a mixed fleet of engines, some with the update installed and some without it. Apparently, the FAA didn't want to leave it to the flight crews to determine which software version they had, so the AD applies to all the potentially affected aircraft until a software update patch is designed, tested and approved - hopefully via a methodology other than last used. While they've identified the software version that first introduced the problem, they obviously haven't been able to conclusively identify the fix and test its integrity to the FAA's satisfaction.

The FAA also leaves it to the airlines to propose a different procedure, the well-known alternative means of compliance (AMOC). This may involve a ready hand on the throttle handles and closer monitoring of the thrust output until the aircraft reaches a certain altitude. We'll see if that passes muster at the FAA, because it's hard to imagine that airline engineering departments will want to see max-thrust takeoffs on every leg. However, having said that, the engine guarantee must hold good whenever the software proves to be malfunctioning.

The FAA says that the problem presents only during a derated takeoff in certain ambient conditions, and results in a progressive rollback in thrust by a FADEC that obviously isn't calculating something properly -- i.e., it thinks it's doing the right thing by the conditions, but it isn't. The problem doesn't occur on max-thrust takeoffs because the FADEC isn't being asked to perform certain convoluted calculations and recursive functions. As mentioned, it will be fun to see those aircraft taking off like rockets for a few weeks. But in all seriousness, why don't they just roll back to a previous software revision, if the problems really were caused by the latest patch? IT workers would be very familiar with the need to roll-back to an earlier version whenever something "new and improved" broke stuff (or in Microsoft parlance, introduced new features).

In the two reported cases of thrust rollback during takeoff (Sept. 28, 2006 and Aug. 23, 2006), the N1 thrust level on the affected engine "progressively dropped, resulting in a thrust loss of 65-77 percent due to an erroneous N1 command" generated by the FADEC system. In each case the engine recovered to the proper thrust level as the aircraft climbed above 400ft (122m). In one case the flightcrew returned the aircraft to the departure airport, but in the other the crew elected to continue to the destination airport.

Some would be surprised that the FAA should allow an ETOPS aircraft with a defect that reduces engine power by up to 77 percent on takeoff to be considered serviceable. In theory, an engine with FADEC version A.0.4.5 installed has a defect that can't be cleared and is therefore unserviceable. Others might wonder how such safety critical software can make it through the validation and verification regime into world-wide fleet service. Overall, it's shades of the previous GE90 "rollback" and IFSDs (inflight shutdowns) from earlier days. The only difference was in those cases, it was in cruise and was caused by moisture freezing in the P3B and PS3 lines to the FADEC, and it was resolved by increasing the tubing diameters. Perhaps the software now needs uppercase zeroes and ones in its coding -- or a larger pitch font.



The Original AD for General Electric's 777 Engines

Granted the following AD applied to GE90's but does appear to confirm that there are paths where FADEC signals can be corrupted.

SUPPLEMENTARY INFORMATION: The Federal Aviation Administration (FAA) has received seven reports of loss of thrust control (LOTC) on General Electric Company (GE) Model GE90 turbofan engines installed on Boeing 777 series aircraft. Five LOTC events occurred in-flight and two occurred on the ground. The five in-flight LOTC events were temporary in that the engine recovered and continued to operate normally for the remainder of the flight.


The investigation revealed that water can accumulate in the Ps3 and P3B pressure sensing system, which can freeze in the full authority digital engine control (FADEC) sensing ports or pressure line. Frozen water can result in a restriction or a blocked signal to the FADEC. This blocked signal can cause a corruption of the FADEC signal and result in abnormal engine start characteristics on the ground or lack of engine response to commanded thrust levels in flight. Although there have been no LOTC events attributed to icing of the P3B sensing system in the field, inspections have identified moisture in this system, which could freeze and corrupt the P3B signal to the FADEC as well. This condition, if not corrected, could result in LOTC due to blockage of the FADEC sense lines, which if it occurs in a critical phase of flight, could result in loss of aircraft control.

Simultaneous LOTC Events

The FAA is especially concerned about the possibility of simultaneous LOTC events on both engines installed on the Boeing 777 series aircraft due to common mode threats, such as certain atmospheric conditions that may result in ice in the Ps3 or P3B pressure sensing system and causing corrupted signals to the FADEC in both engines.

SUMMARY: This amendment adopts a new airworthiness directive (AD) that is applicable to certain General Electric Company GE90 series turbofan engines. This action requires visually inspecting Ps3 and P3B sense lines and full authority digital engine control (FADEC) Ps3 and P3B sensing ports and fittings, cleaning Ps3 and P3B fittings and sensing ports, purging the Ps3 and P3B systems of moisture, and, if necessary, blending of high metal, nicks, burrs, or scratches on Ps3 and P3B fitting threads. This amendment is prompted by seven reports of loss of thrust control due to corruption of the signals to the FADEC caused by water freezing in the Ps3 sensing system. The actions specified in this AD are intended to prevent loss of thrust control due to corruption of the Ps3 and P3B signals to the FADEC which if it occurs in a critical phase of flight, could result in loss of aircraft control.

Interim Action

Both Ps3 and P3B pressure systems incorporate weep holes that allows drainage of water in the lines that may accumulate from condensation or ingested water; however, the field events and the investigation have determined that these design features may not always be effective in eliminating water from these systems. GE is assessing design changes that will prevent water from freezing in these systems and causing corruption of the signals to the FADEC. The requirements of this AD may change based on the ongoing investigation of the root cause and field inspection results, and future rulemaking may be necessary.

Link - The Cold Fuel Management Story

Link - The British Airways (Flight BA038 Heathrow) Likely Crash Cause