The Unthrustworthy 777

Emergency Airworthiness Directive Issued For The 777's GE90 Thrust Rollbacks

An emergency Airworthiness Directive (AD) issued September 30 stems from two occurrences of engine thrust rollback during takeoff on Boeing 777-300ERs, which are powered by General Electric GE90-115B engines. The concern is that the GE90 engines powering Boeing 777-200LRs and 300ERs could suffer dual thrust reductions on take-off, with potentially catastrophic consequences.

In the two instances cited, just the one engine was affected but because it's software-related, the FAA cites the possibility that "a dual-engine thrust rollback could occur just after V1 (takeoff decision speed after which takeoff is to proceed even after an engine failure). This would result in the airplane not having adequate thrust to complete the takeoff. A dual-engine thrust rollback, if not corrected, could result in the airplane failing to lift off before reaching the end of the runway or failing to clear obstacles below the takeoff flight path."

Trouble-shooting technicians have found that the two cases in which there were single-engine thrust reductions during takeoff were the result of a flawed software algorithm in the Full Authority Digital Engine Control (FADEC). The emergency AD requires operators of GE90-115Bs powering 777-300ERs as well as GE90-110Bs powering 777-200LRs to amend their procedures to prohibit takeoffs at anything less than full-rated thrust. This is being stipulated because the rollbacks are only likely to occur at reduced powers, during the so-called "balanced field" takeoffs. When the power levers are set to maximum, the predictive software is out of the picture. For the foreseeable future, passengers on lightly loaded 777's are liable to think that they're on a shuttle launch.

If you read the entire AD, what it says is that the anomaly was introduced by an error in a certain software update for the FADEC on the LR. However, because the -300 has an identical software update, it could presumably cause the same problems on that aircraft as well, on the affected GE engines. All airlines operating the affected aircraft operate a mixed fleet of engines, some with the update installed and some without it. Apparently, the FAA didn't want to leave it to the flight crews to determine which software version they had, so the AD applies to all the potentially affected aircraft until a software update patch is designed, tested and approved - hopefully via a methodology other than last used. While they've identified the software version that first introduced the problem, they obviously haven't been able to conclusively identify the fix and test its integrity to the FAA's satisfaction.

The FAA also leaves it to the airlines to propose a different procedure, the well-known alternative means of compliance (AMOC). This may involve a ready hand on the throttle handles and closer monitoring of the thrust output until the aircraft reaches a certain altitude. We'll see if that passes muster at the FAA, because it's hard to imagine that airline engineering departments will want to see max-thrust takeoffs on every leg. However, having said that, the engine guarantee must hold good whenever the software proves to be malfunctioning.

The FAA says that the problem presents only during a derated takeoff in certain ambient conditions, and results in a progressive rollback in thrust by a FADEC that obviously isn't calculating something properly -- i.e., it thinks it's doing the right thing by the conditions, but it isn't. The problem doesn't occur on max-thrust takeoffs because the FADEC isn't being asked to perform certain convoluted calculations and recursive functions. As mentioned, it will be fun to see those aircraft taking off like rockets for a few weeks. But in all seriousness, why don't they just roll back to a previous software revision, if the problems really were caused by the latest patch? IT workers would be very familiar with the need to roll-back to an earlier version whenever something "new and improved" broke stuff (or in Microsoft parlance, introduced new features).

In the two reported cases of thrust rollback during takeoff (Sept. 28, 2006 and Aug. 23, 2006), the N1 thrust level on the affected engine "progressively dropped, resulting in a thrust loss of 65-77 percent due to an erroneous N1 command" generated by the FADEC system. In each case the engine recovered to the proper thrust level as the aircraft climbed above 400ft (122m). In one case the flightcrew returned the aircraft to the departure airport, but in the other the crew elected to continue to the destination airport.

Some would be surprised that the FAA should allow an ETOPS aircraft with a defect that reduces engine power by up to 77 percent on takeoff to be considered serviceable. In theory, an engine with FADEC version A.0.4.5 installed has a defect that can't be cleared and is therefore unserviceable. Others might wonder how such safety critical software can make it through the validation and verification regime into world-wide fleet service. Overall, it's shades of the previous GE90 "rollback" and IFSDs (inflight shutdowns) from earlier days. The only difference was in those cases, it was in cruise and was caused by moisture freezing in the P3B and PS3 lines to the FADEC, and it was resolved by increasing the tubing diameters. Perhaps the software now needs uppercase zeroes and ones in its coding -- or a larger pitch font.