Aviation Accidents and Lessons Unlearned LXXX: British Airways, Flight 38
On January 17, 2008, at 1242 Coordinated Universal Time (UTC), a Boeing 777-236ER, Serial number 30314, Registration number G-YMMM, crashed while completing its flight from Beijing, China, to Heathrow airport in London, England; the airliner was equipped with Rolls-Royce Trent 895-17 engines. On its final approach, the airliner suffered an in-flight engine rollback in its right-hand #2 engine when it failed to respond to auto-throttle commands. Seven seconds later the left-hand #1 engine lost power. The airliner touched down 330 meters (1083 feet) short of Heathrow’s Runway 27L.
British Airways Flight 38 came to rest
The Air Accident Investigation Branch (AAIB) investigated with the National Transportation Safety Board (NTSB) assisting. “The report identified the following probable causal factors:
1) Accreted ice from within the fuel system released, causing a restriction to the engine flow at the face of the Fuel-Oil Heat Exchanger (FOHE), on both engines.
2) Ice had formed within the fuel system, from water that occurred naturally in the fuel, whilst the aircraft operated with low fuel flows over a long period and the localized fuel temperatures were in the area described as the ‘sticky range’.
3) The FOHE, although compliant with the applicable certification requirements, was to be susceptible to restriction when presented with soft ice in a high concentration, with fuel temperature that is below -10°C and a fuel flow above flight idle.
4) Certification requirements, with which the aircraft and engine fuel systems had to comply, did not take account of this phenomenon as the risk was unrecognized at that time.”
It was argued back and forth in the AAIB report whether the cross-feed fuel valves were open or closed, the report’s internal debate bordering on schizophrenic; “They were open,” “They were closed,” and so on. The conclusion? Subsection 2.3.2 stated: “The DFDR [Digital Flight Data Recorder] showed both (cross-feed) valves to be CLOSED throughout the flight.”
Why is this important? The AAIB stated the fuel had excess water, it was important to determine which tank(s) the water-contaminated fuel was in. Why was that important? Since the cross-feed valves were closed, “… throughout the flight.” (not likely), there would’ve been water-contamination in both wing tanks; each tank feeding its own engine. However, the center tank feeds both engines; because of the flight’s length, the center tank would have been used. That’s important!
To be clear, the AAIB found that two engines – running off two independent fuel tanks – both failed at low engine speeds. What’s the chance of that happening? For two separate identical events to take place within seconds of each other? On the same aircraft? Not probable. Yet the AAIB found that two independent, yet identical events did happen almost simultaneously. Coincidence? Also, not probable.
The R/R Trent Fuel-Oil Heat Exchanger
In aircraft maintenance (ACMX), there are no coincidences, no twists of fate. In ACMX, one must consider how many years and thousands of successful trips and hundreds of thousands of flight-hours with numerous operators, the B777 and/or R/R Trent 895-17 engine had been operating – without incident. In ACMX, two engines … on the same aircraft … being fed independently … and failing identically seconds from each other, are NOT coincidence. They are two independent events that, together, are symptoms of a larger problem. One must look for the common denominator – the ROOT cause – to determine what happened.
What tied both engines together? What mechanical component? Hydraulic? Digital? What common denominator did they share? Was there anyone on the AAIB’s investigation team with the technical knowledge to examine, for instance, the aircraft’s digital central data computer or fuel controls to understand what could have happened? Was there anyone on the AAIB’s investigation team who worked with digital technology on a daily basis; who programmed or uploaded data to these computers; who understood the signs, the symptoms of the digital system? The answer would be, “No”. Therefore, those strings of facts were ignored to safety’s disadvantage.
If the AAIB’s icing theory is true, would water alone have caused the icing? In Conclusion #104, the notorious words, “Ice probably began to accumulate …” Probably? If it’s not a fact, then it’s not a finding; it’s an opinion. The report is full of opinions.
Water is heavier than fuel. A gallon of water weighs 8.33 pounds; it would settle to the bottom of the fuel tank … that is, when it’s not suspended. A gallon of jet fuel weighs 6.5 pounds per gallon therefore, during the thirteen-hour flight (enough time to settle) most of the water should’ve burned off first. Could there have been that much water? In each tank? Was there really icing in both FOHEs? Inconclusive. Didn’t the ice in the engines’ FOHEs melt before the engines were recovered from the accident site and opened up? How was it determined the ice was the cause … if the ice had melted? Ah, yes, they did a ‘test’ that ‘duplicated’ the icing. For many reasons any tests were corrupted by inexperience.
The FOHE full of ice
This is why it is folly that any investigatory agency doesn’t have trained and experienced maintenance technicians leading a group. Not engineers looking at ACMX, but technicians. Engineers don’t work these types of problems; mechanics do. Engineers don’t troubleshoot these types of problems; mechanics do. To suggest both engine FOHEs clogged from ice was a stretch; a leap (not of faith) and unproveable.
What about the oil equation? It’s the FOHE’s other purpose; oil temperature must be considered as part of the problem. The engine oil that transfers heat as it goes through the FOHE operates at around 100°C and 150°C (212°F and 300°F). Oil doesn’t cool very fast, thus the heat exchanger. Therefore, if there was fuel icing, it would’ve been in the fuel filter screens – not the FOHE.
A similar rollback occurred on a Delta Airlines B777 at cruise flight in November 2008. The NTSB investigated and found, according to a March 2009 Safety Recommendation A-09-19-20, footnote 13, “Before the rollback, there was likely (italics and bold added) ice on the face of the FOHE …” No facts, just opinion. The problem with ‘likely’ is it’s inconclusive, unproveable. The NTSB investigator looking into the Delta incident focused on proving the FOHE icing theory and ignored all other possibilities.
There were three important factors the AAIB and the NTSB (with Delta) ignored, namely root causes:
1. If the fuel was contaminated, did anyone address the fueler who supplied the accident flight with fuel? What was the condition of the supplier’s fuel farm? Their trucks? Did anyone test the fuel at the fuel farm for water or other contaminants?
2. Speaking of which, did anyone consider other fuel contaminants, like microbial growth? If the FOHE was clogged, microbial growth would’ve been a more logical contaminant because it clogs over a long period of time, impeding water while insulating the transfer of heat from the oil; it is often viscous and resistant to flow. Did anyone look at the accident aircraft’s tank for microbial growth or any other contaminants? How about at the fuel suppliers’ fuel farms?
3. What about Maintenance? Was ACMX adding microbial contaminant cleaner to the accident aircraft? Was the B777 on a microbial program? Did ACMX sump the fuel tanks? Were the tanks sumped as part of British Airways’ ACMX program?
4. If – and only if – the R/R Trent engine was to blame, was the B777 the only aircraft the recommendations addressed? What about Airbus airliners using the R/R engine model?
This report, Aircraft Accident report 1/2010, presented a few expected problems:
a) To begin with, there’s no such thing as probable cause in aviation. Title 49 Subtitle B Chapter VIII refers to ‘probable cause’ as what the NTSB seeks but does not define probable cause. Under §835.2 Definitions, the term probable cause is part of a definition but itself is never defined. Probable cause is like a secret catch phrase, a buzz word. It’s unclear where probable cause fits in the British regulations. However, probable cause in any country or language still means probably … maybe … not quite sure … can’t commit to. Probable causes are not solutions, not causes. Probable causes are opinions … and ambiguous opinions, at that.
b) The AAIB identified its Group Chair for Fuel and Fuel System as being from Engineering – not to be confused with an Aircraft Maintenance Engineer (AME), the Canadian version of an aircraft mechanic. An engineer? What fuel systems training did these engineers receive? What fuel system troubleshooting have these engineers ever done? Do engineers work on fuel systems? How can engineers understand fuel systems and what operational factors affect them? Simply stated, AAIB engineers had no training, no working experience, or knowledge of the fuel system.
c) The AAIB identified its Powerplant Group Chair was … an engineer. Again, no knowledge, no experience, no training, no troubleshooting skills, no usable talent to investigate an accident, least of all an advanced engine like the Rolls-Royce (R/R) Trent engine.
d) In a move resembling an NTSB decision, the AAIB didn’t list an aircraft technician (mechanic) on the team, one to look at British Airlines’ maintenance program; what experience on Boeing and R/R products there was; what fueling or powerplant maintenance was performed recently; what engine changes had taken place and when; where the engines were last overhauled. It was almost as if the AAIB didn’t want to know what happened.
e) The last point of conflict was the two investigating engineers, with no specialized experience, worked a problem from opposite ends: a fueling system problem and an engine problem. The engineers didn’t understand the fundamental problems both couldn’t identify or put into words, especially with their probable causes.
This report had eighteen recommendations. With root cause, there shouldn’t have been more than three or four – tops. With numerous report recommendations, the report resembles a target hit with buckshot; investigators don’t aim for the target, they destroy it. They fix it beyond all repair. The problem is you don’t know what ‘fixed’ the problem because your aim was too wide. Everybody’s so busy high-fiving each other, they never realized they wasted time and found … nothing.
These are not questions to be asked seventeen years later. For decades the aviation industry blindly accepts investigatory agency accident reports based on maybes. This is not safety; these are agenda items. Accident investigators are inexperienced with the equipment they’re examining; they look only to solve the problem at hand, not prevent future occurrences; still playing with the illusion of probable cause and not the reality of root cause. In other words, investigators waste industry’s time and safety suffers.