National Transportation Safety Board
Safety Recommendation
Washington, D.C. 20594
|
Two recent events involving failure to
achieve commanded thrust on Boeing 777-200 airplanes powered by Rolls-Royce
RB211 Trent 800 series engines have caused the National Transportation Safety
Board to be concerned about the potential for additional failures to occur.
Testing following the two events has demonstrated that the Trent 800 series
fuel/oil heat exchanger (FOHE) can be overwhelmed by ice formed inside the 777
fuel feed system from normal amounts of water present in jet fuel. This
condition can restrict the fuel supply to both engines, resulting in failures
to achieve commanded thrust. Procedures intended to mitigate this condition are
in place, but the Safety Board is concerned that they are insufficient to
prevent additional occurrences and that, until the present FOHE design is
replaced by one more tolerant to ice accumulation, additional failure events
may occur and could result in accidents and injuries. Although the
investigations of these events are ongoing, the Board believes that immediate
action is required to address this safety issue.
On January 17, 2008, about 1242 coordinated
universal time, a Boeing 777-236ER, registration G-YMMM, powered by two Trent
800 series engines, crashed short of the runway on final approach to Heathrow
International Airport, London, United Kingdom. One passenger was seriously
injured, and eight passengers and four flight crewmembers sustained minor
injuries. The airplane was substantially damaged. The scheduled commercial
passenger flight was operated by British Airways as flight BAW038 from Beijing,
People’s Republic of China, under an instrument flight rules flight plan. The
flight crew reported that the airplane was configured for landing, with both
autopilot and autothrottle systems engaged, when the No. 2 (right) engine power
decreased below the commanded thrust. About 7 seconds later, the No. 1 (left)
engine power also decreased. Both engines continued to produce thrust, but less
than the thrust commanded. With reduced thrust, the airplane was unable to reach
the runway and impacted the ground about 1,000 feet short of the runway. The
136 passengers aboard deplaned using the emergency slides.
On November 26, 2008, about 1930 coordinated
universal time, a Boeing 777-200ER, registration N862DA, powered by two Trent
800 series engines, experienced a single-engine rollback while in cruise flight
at flight level (FL) 390 (about 39,000 feet) en route from Pudong International
Airport, Shanghai, People’s Republic of China, to Atlanta-Hartsfield
International Airport, Atlanta, Georgia. No injuries were reported. The
scheduled commercial passenger flight was operated by Delta Air Lines as flight
18 under the provisions of 14 Code of Federal Regulations Part 121 under
an instrument flight rules flight plan. The flight crewmembers reported that
the airplane’s autopilot and autothrottle systems were engaged, when, about 1
hour after two maximum climb thrust routine step climbs were performed, they
detected that the No. 2 engine was operating below the commanded thrust level.
The flight crew descended the airplane to FL310 and performed the 777 engine
response non-normal checklist. The engine recovered and responded normally, and
the flight continued to Atlanta, where it landed without further incident.
BOEING 777/TRENT 800 SERIES FUEL DELIVERY AND
CONTROL SYSTEM
The Trent 800 series engine draws fuel into
the main engine pump, which then routes the fuel to an FOHE. The FOHE heats the
fuel to prevent the accumulation of ice in the engine fuel metering system. The
heated fuel passes through a fuel metering unit, which regulates the fuel
flowing to the engine combustor based on a thrust demand signal received from
the electronic engine control (EEC).
The FOHE is designed to both melt ice being
carried by the fuel and cool hot engine oil. Inside the FOHE, fuel enters 1,180
small-diameter steel tubes that protrude from the inlet face and extend the
length of the unit. FOHEs are designed with this large number of tubes to
permit maximum exposure to heat from the hot engine oil: The tubes, and the
fuel inside them, are warmed by the hot oil that enters the FOHE just below the
inlet face, flows to the bottom of the housing, and then passes across the
tubes.
British Airways Flight BAW038
Post accident inspections of the British
Airways airplane found that the EECs of both engines correctly demanded fuel
flow increases in response to autothrottle and flight crew commands and that
the engine fuel metering units properly responded to EEC demands. However, the
fuel flows delivered to the engines were lower than the volumes demanded.
Specifically, when the flight crew pushed the throttle levers to the full
forward position, the EEC of each engine requested fuel volume in excess of
30,000 pounds per hour (pph), but the actual flows were 5,000 pph to the No. 1
engine and 6,000 pph to the No. 2 engine. These findings indicate that
rollbacks resulted from restricted fuel flow to each engine.
Damage characteristic of cavitation was found
in both main engine pumps. Cavitation damage at this location indicates that
the fuel components downstream of the main engine pumps were demanding more
fuel than was supplied. The United Kingdom Air Accident Investigation Branch
(AAIB) concluded that the rollbacks resulted from non-mechanical fuel flow
restrictions upstream of the high-pressure stage of each main engine pump.
Post accident Fuel System Testing
Extensive
research and tests were conducted by Rolls-Royce and Boeing, under the
direction of the AAIB and with participation by the Safety Board, to understand
the nature and location of the fuel flow restriction. Ice in the fuel was
considered because ice can form from water molecules normally present in jet fuel.
Research has shown that water molecules entrained in jet fuel will begin to
form ice crystals as the fuel cools below 0 C. This research also determined
that ice crystals suspended in fuel can begin to adhere to their surroundings
and accrete at fuel temperatures between -9 C and -11 C (temperatures often
reached on flights that are not exposed to unusually cold conditions). Heat
exchangers and filtration systems, like the FOHE in this case, are included in
aircraft fuel systems to prevent ice from blocking or otherwise affecting fuel
flow to engines. AAIB-directed laboratory testing at Boeing confirmed that at
fuel temperatures between -5 C and -20 C, ice crystals tend to form and adhere
to fuel component surfaces. The British Airways thrust rollbacks occurred at
about -22° C. Tests showed that ice crystals formed solely from entrained water
can restrict fuel passages and that, under certain conditions, substantial
amounts of ice will accumulate on the inner surfaces of the fuel feed system.
This ice can be released during high fuel flows, such as those that occurred
during the final approach of the British Airways flight. When a sufficient
amount of ice is released, ice can enter the engine fuel system and collect in
a mass on the inlet face of the FOHE. (See the following figure.) The testing
demonstrated that, after high fuel flows, the FOHE can be presented with ice
concentrations well beyond the amounts for which the engine fuel system was
certified to withstand. Further, ice in sufficient concentrations could block a
large enough portion of the FOHE inlet face to restrict fuel flow so that the
thrust demanded could not be supported and a rollback could occur.
Figure. Ice on the inlet face of a Rolls-Royce
RB211 Trent 800 series FOHE.
Testing also found that reducing the volume
of the fuel flow through the FOHE can clear ice from the face of the FOHE
within a few seconds. A reduced fuel flow through the FOHE reduces the amount
of fuel available for oil-to-fuel heat transfer in the FOHE, and this causes
more heat from the oil to be retained. Heat from the oil then spreads further
up the FOHE tubes to the face and to the ends of the tubes protruding from the
face, melting the ice collected on the face and tubes. In fact, fuel volume
tests showed that temporarily reducing fuel flows by moving the power levers to
minimum idle will melt ice that may be blocking the FOHE.
OPERATIONAL CHANGES IN RESPONSE TO THE
BRITISH AIRWAYS ACCIDENT
On September 12, 2008, the AAIB published its
second interim report on the British Airways accident and included several
safety recommendations. In conjunction with the report, Boeing issued a flight
crew operations manual bulletin addressing the prevention of long-term ice
accumulation in the Trent 800 series engines fuel system during extreme cold operations.
The bulletin instructed flight crews to follow specific re-fuelling
instructions before long-range flights when the ground fuel temperature was
below 0 C. The bulletin also included a cold fuel operations supplementary
procedure that specified flight crews should perform an ice accumulation
clearing procedure 3 hours before descent if the fuel temperature was below -10
C by briefly increasing the thrust of each engine to maximum climb thrust.
Finally, based on the results of the tests described above, Boeing added an
engine response non-normal procedure to the airplane flight manual that
instructed flight crews to temporarily reduce fuel flows by moving the power
levers to minimum idle to clear ice from the FOHEs if the engines did not reach
commanded thrust after performing the cold fuel operations supplementary
ice-clearing procedure or after operating at a high-thrust setting. The manual
changes were mandated by the Federal Aviation Administration in Airworthiness
Directive 2008-19-04, issued September 29, 2008.
DELTA AIR LINES FLIGHT 18
Analysis of the flight data recorder (FDR)
data downloaded from the Delta Air Lines airplane and an evaluation of the No.
2 main engine pump confirmed that the flight experienced a rollback similar to
the dual engine rollback that occurred during the British Airways accident
flight. In addition, FDR data allowed investigators to positively establish
that the fuel flow to the engine was restricted at the FOHE during the event.
FDR data indicate that, after high fuel flows
were commanded during a routine maximum climb thrust step climb, a 30 C
increase in the No. 2 engine oil temperature occurred and persisted for 55
minutes, while the oil in the other engine experienced no such increase in
temperature. During that time, the airplane performed a second routine step
climb, followed by 35 minutes of cruise flight, during which the rollback
occurred. After the rollback, the flight crew descended and reduced engine
power (in accordance with Boeing’s engine response non-normal procedure), and
the engine recovered. However, the response was delayed due to the flight
crew’s confusion about the title of the procedure. After the recovery, the oil
temperature in the No. 2 dropped and experienced normal variations, varying as
the other engine did, for the remainder of the flight. This period of elevated
oil temperature indicated that the effectiveness of the oil cooling function of
the FOHE was reduced before and during the rollback. A blockage of the FOHE
will result in an increase in engine oil temperature because decreased fuel
flow through the FOHE reduces the amount of fuel available to cool the engine
oil. When the No. 2 engine fuel flow returned to normal after the blockage
cleared, the engine oil temperature dropped, indicating that the FOHE oil
cooling effectiveness was restored. Therefore, the oil temperature excursion
that occurred during the Delta event is evidence that the FOHE was restricted
for about 55 minutes before and during the rollback.
The Safety Board also notes that, although
the British Airways airplane was operated for long periods of cruise flight at
unusually low temperatures, the Delta flight was not. In fact, the British
Airways flight experienced fuel temperatures as low as -34 C, whereas the
lowest measured fuel temperature during the Delta Air Lines flight was -22 C;
both the British Airways and the Delta rollbacks occurred when the measured
fuel temperature was about -22 C. Critical fuel icing temperatures, those
between -5 C and -20 C, are commonly encountered by long-range transport
airplanes. Therefore, the Safety Board concludes that there is risk of ice
crystal blockage of FOHEs on Trent 800 series engines installed on 777-200s at
temperatures commonly encountered by long-range transport airplanes.
REVISED OPERATIONAL CHANGES FOLLOWING THE
DELTA EVENT
Following the Delta event, Boeing revised its
operating procedures to require that the cold fuel operations supplemental
procedure be performed 2 hours before descent rather than 3 hours to reduce the
time available after the procedure for the build up of ice. In addition, flight
crews are now required to retard the throttles to minimum idle speed for 30
seconds during initial descent. Because the flight crew on the Delta flight was
confused about the applicability of the engine response non-normal procedure
and to ensure that the procedure is used when needed, the procedure was
modified such that it is accomplished if an engine fails to reach commanded
thrust and fuel system icing is suspected.
The Delta event shows that the original
procedural changes were insufficient to prevent the occurrence of FOHE-related
failures to achieve commanded thrust. The Safety Board also notes that if the
modification of the ice-clearing procedure had been in place before the Delta
event, the procedure likely would not have prevented the single-engine rollback
because it occurred just over 3 hours before the top of descent. Although the
engine response non-normal procedure may be effective in clearing ice
accumulations from the FOHE face and in restoring normal operation, it is not
an acceptable substitute for immediate development of an engineering solution
to prevent the occurrence. Failures to achieve commanded thrust expose
airplanes to unacceptable hazards, even if engine thrust can be recovered. The
Safety Board is especially concerned that ice might accumulate on the FOHE
during critical flight phases, such as during approach, when reducing power as
required in the procedure could result in a dangerous loss of altitude. In
fact, loss of altitude can be dangerous at any phase of flight, in part because
it could expose an airplane to rising terrain and hazardous weather. In
addition, a partial blockage of the FOHE during approach could result in the
inability to achieve maximum thrust power, which would be hazardous should a
missed approach or runway obstruction require a go-around.
The AAIB and Safety Board investigations of
these events are ongoing; however, tests have shown that ice can restrict fuel
flow at the Trent 800 series engine FOHE and result in rollbacks or other
failures to achieve commanded thrust when high-fuel flows are commanded. The
British Airways event demonstrated that this condition can restrict the fuel
supply to both engines, resulting in dual engine rollback. Current operational
mitigations, which require power reductions, may not prevent additional
occurrences at critical flight altitudes when reducing power would require an
unacceptable decrease in altitude or when power must be immediately available
for a go-around. Therefore, until the current FOHEs are replaced by FOHEs more
tolerant to ice accretion, additional failures to achieve commanded thrust
could occur and could result in a serious accident and, possibly, injuries and
deaths.
The Safety Board is aware that on February
23, 2009, Rolls-Royce issued a memo to operators stating its intent to redesign
the FOHE on Trent 800 series engines. The Safety Board is encouraged by this
proposed permanent solution; however, because the adequacy of the design, the
speed and appropriateness of the FOHE testing, and the installation of the
redesigned FOHE are critical to the flight safety of Boeing 777-200 airplanes
powered by Rolls-Royce RB211 Trent 800 series engines, the Safety Board
believes that the FAA and European Aviation Safety Agency should take an
oversight role and direct the development and installation of the new FOHE
design.
Therefore, the National Transportation Safety
Board recommends that the Federal Aviation Administration:
Require that Rolls-Royce redesign the RB211
Trent 800 series engine fuel/oil heat exchanger (FOHE) such that ice
accumulation on the face of the FOHE will not restrict fuel flow to the extent
that the ability to achieve commanded thrust is reduced. (A-09-17) (Urgent)
Once the fuel/oil heat exchanger (FOHE) is
redesigned and approved by certification authorities, require that operators of
Boeing 777-200 airplanes powered by Rolls-Royce RB211 Trent 800 series engines
install the redesigned FOHE at the next scheduled maintenance opportunity or
within 6 months after the revised FOHE design has been certificated, whichever
comes first. (A-09-18)
The Safety Board has issued two related
safety recommendations to the European Aviation Safety Agency.
In response to the recommendations in this
letter, please refer to Safety Recommendations A-09-17 (Urgent) and -18. If you
would like to submit your response electronically rather than in hard copy, you
may send it to the following e-mail address: correspondence@ntsb.gov. If your
response includes attachments that exceed 5 megabytes, please e-mail us asking
for instructions on how to use our Tumbleweed secure mailbox procedures. To
avoid confusion, please use only one method of submission (that is, do not
submit both an electronic copy and a hard copy of the same response letter).
Acting Chairman ROSENKER and Members HERSMAN,
HIGGINS, and SUMWALT concurred with these recommendations.
[Original Signed]
By: Mark V. Rosenker
Acting
Chairman
