Thrice Almighty - The Virtues of Triple Redundancy

Air Safety Week, April 4, 2005

The fuelish confusion that happens when suddenly no one is driving the digital data-bus

A master computer may not be able to provide command or warning signals, prompting the UK Air Accidents Investigation Branch (AAIB) to urge a fix.

The recommendation was prompted by the Feb. 8 Virgin Atlantic Flight VS201, an Airbus A340-600, which departed Hong Kong for Heathrow with 18 crew and 293 passengers. There was one relevant entry in the technical log prior to departure: both Fuel Control Monitoring Computers (FCMCs) had been reset at separate times on the previous sector. During the pre-flight check for this flight there was one FCMC 2 and one FCMC 1 failure, but the incident crew was able to carry out successful resets on each occasion.

Shortly after takeoff, there was an Electronic Centralized Aircraft Monitor (ECAM) alert advisory "FCMC2 FAULT" displayed. There were no ECAM actions associated with this fault and the commander decided to delay any attempt at a computer reset until the aircraft had reached its cruising level. When the crew attempted an FCMC2 reset using the computer reset procedure in the Quick Reference Handbook (QRH), it was unsuccessful. Note that there were no further fuel system warnings, cautions or messages throughout the remainder of the flight.

The aircraft was cruising at Flight Level (FL) 380 in Dutch airspace when at 0330 hours the No. 1 engine flamed out. The commander decided not to attempt to relight it but to continue towards Heathrow on three engines. The crew noticed that the fuel contents for the inner 1 fuel tank, which feeds engine No. 1, was reading zero. Apparently the engine had flamed out due to fuel exhaustion. However, suspecting a possible fuel leak, a flight crew member was sent aft to inspect the engine area. Soon afterwards the crew observed No. 4's power fluctuate and then noticed that the inner 4 fuel tank was also indicating zero contents. The commander opened all the fuel crossfeed valves and the No. 4 engine recovered. A "MAYDAY" was declared and the flight diverted to Amsterdam Schiphol Airport. When the diversion commenced, the total fuel on board was in excess of 25,000 kg but there were significant quantities of fuel located in the trim, center and outer wing fuel tanks. The flight crew started manual fuel transfer but they did not immediately get the expected indications of fuel transfer on the ECAM. Consequently the flight crew remained uncertain of the exact fuel status.

At Schiphol there were towbar problems as a standard A340 towbar is designed NOT to fit the -600 (a shear-pin consideration for the higher all up weight). Eventually, a Virgin B747 turned up at 1130 a.m. with a towbar and assumed the passenger load. Surprisingly, given the nature of the unserviceability, the A340-600 pushed back and took off for its ferry flight to Heathrow. "Surprisingly" because the AAIB considered the events to be sufficiently serious for it to order a special investigation.

The A340-600 fuel system

Introduced in July 2002, the A340-600 was lauded as having the longest legs and 20 percent better fuel economy than any other jet in its class. It could carry a passenger 100 kilometers for 3.3 liters of fuel. The fuel system is typically designed around aerodynamic efficiency. Fore-aft trim (and thus optimum center of gravity) is achieved by auto-transfer of fuel to and from an aft-located fuel trim tank located in the horizontal stabilizer.

Engine feed

Under normal operation each engine is fed by an independent fuel feed system. This consists of main and standby engine feed booster pumps located within a collector cell, which in turn is located within an engine feed tank (Inner). The main pump operates continuously, the standby pump only operates if the main pump becomes defective or is set to OFF. The collector cells are maintained full until the Inner wing tanks are near empty to help ensure a supply of fuel to the engine under negative 'G' maneuvers. All engine feed systems can be joined to the crossfeed gallery by their independent crossfeed valves. The crossfeed system is used under abnormal conditions such as loss of all electrical power requiring gravity feeding or to connect all engines to a single engine feed boost pump when only the emergency electrical supply is available or to allow the crew to correct an imbalance between symmetrical wing tanks. The scenario in this incident was not envisaged by the designer.

Fuel transfer and usage

On the A340-600 all fuel transfers are controlled automatically (and balanced) for the four Inner tanks, prior to transfer to the collector cells.

Cockpit control panels & indication

Due to the differences in the fuel system architecture, the fuel system control panel and ECAM system page differ from the A340-200/-300. Despite the differences, there is still a pushbutton for each engine feed and transfer pump, for each crossfeed valve and each transfer function, as well as a dedicated toggle for Trim tank isolation. Under normal operation, after initialization at the start of a mission, no crew action is required on the panel. Manual transfer control is by transfer pushbuttons or the de-selection of transfer pump pushbuttons.