Posts about: "DFDR" [Posts: 81 Pages: 5]

Paraphrasing from the article above-
They originally refused to allow UN and ICAO observers as part of the investigation, but have now reversed course.
They gave one press conference in the last 30 days and no questions were taken.
They took almost 2 weeks to read out the boxes.
UN stated that it is up to the Country leading the investigation on wether to release the report at all- a frightening thought.

They are not being transparent, for whatever reason. I don't really care as I'm more concerned with the technical details of what went wrong or who did what that led to the accident.

Or we could wait two more days because certainly that would be in the flight recorder data.

This. If power was lost first, it's complicated. If switches to cutoff was first, it may be a simple and unpalatable answer.

OK, a couple of informed comments, again with the disclaimer that I have very little first hand knowledge of the 787.

Every single engine parameter I've seen on a DFDR readout has been recorded at 1/second (most parameters), or slower. I've never seen an engine parameter recorded at more than once/second.
The recorder doesn't do an instantaneous snapshot - it cycles through the thousands of recorded parameters. So a once second difference on the data could - in reality - be anywhere from 0.01 seconds to 1.99 seconds. If it matters, a deep dive into the avionics and FDR logic could narrow that time interval down. That being said, moving both switches to cutoff could happen in about a second. The switches make a rather distinct noise (especially if moved rapidly) so the CVR should give better resolution.

There have been instances in the past where the locking tab on the switch has been broken or 'worn down' from heavy use. But that's been seen on very high cycle aircraft - usually 737s that fly short hops. No memory of ever hearing of an issue with relatively new 787s that are - by nature - long range aircraft and don't get a lot of cycles.

On the 747-400, the fuel switches are a 'break before make' design with a distinct gap of ~0.050 seconds during a normal switch cycle (it's a long, somewhat painful story about why I know that...). I don't know the specifics of the 787, but I'd be very surprised if it's any different.

BTW, if the investigators had reason to believe the switches somehow moved on their own, I think a fleet wide inspection would have been ordered by now.

I keep coming back to my 'muscle memory' hypothesis...

I am going by the list in the excellent post here: Air India Ahmedabad accident 12th June 2025 Part 2

Anyway, here goes:

A. Misconfiguration or wrong takeoff data — OUT : 5 tons under MTOW, flaps 5, takeoff roll uneventful

B. Flaps retracted post-takeoff instead of gear — OUT : flaps 5 still set at crash

C. Low-altitude capture — OUT : throttle was at take-off thrust the whole time

D. Loss of both engines at or shortly after rotation — IN: confirmed to have occurred 3-4 seconds after liftoff

I. Bird strike/FOD — OUT

II.Fuel-related
1. Loss of electric fuel pumps — OUT
2. Fuel contamination — as good as OUT , but lab work is ongoing
3. Vapour lock — OUT

III. Improper maintenance — mostly OUT , switches might have been defective

IV. Large-scale electrical fault (e.g. due to water in E&E bay) — OUT . This would have been obvious from the flight recorder.

V. Shutdown of engines by TCMA — OUT . Conditions not met (not on ground, throttle not at idle)

VI. (Inadvertent) shutdown by flight crew
1. Spontaneous execution of memory items (fuel control switches OFF, then ON; deploy RAT) due to assumed engine malfunction — OUT from CVR
2. No indications whatsoever of an intentional shutdown for nefarious reasons — IN but unsupported

VII. Malfunction/mishandling of the fuel cutoff switches (most recent)
1. Wear or improper operation of the switches, so that they do not lock but can shift back into the OFF position. — IN

Read the previous post to this by 9 lives and reconsider VII.1
Senior Pilot

2. Spilled drink leading to short in the wiring — IN (barely) , 8 separate switch contacts must be affected in just the right way

If you never supported any of the theories that are now out, pat yourself on the back!

SLF: I have a small observation but I'm not sure what it means or if it has any relevance to the accident.

Previously I had assumed that the ADS-B data cut out at the same time as power was lost, so I imagined that whatever caused the fairly clear loss of thrust would have happened not too long before. But this report throws a bit of a wrench in my understanding of that.

According to the report, the fuel cutoff switches transition from RUN to CUTOFF at or very shortly after 08:08:42 UTC. Both engines' N2 values pass below minimum idle speed and the RAT begins supplying hydraulic power at about 08:08:47. Does this not imply that the generators have already been lost? With the APU also being off (the APU inlet door is noted to start opening at 08:08:54), I would have expected ADS-B data to cut out at or before 08:08:47. But curiously FlightRadar24 at least claims to have received data frames from the aircraft until 08:08:51.640970, almost five seconds later and almost ten seconds after the transition to CUTOFF (though the last frame containing coordinates comes at 08:08:50.871005).

Could anyone with relevant experience confirm how long it would take for AC power to be lost in this situation? Also, is it usual/unusual for a preliminary report like this to mention if/when the flight recorder switched to its independent power supply? I imagine it would definitely be in the final report, but I'd hoped it would be easily observable enough to be in this one.

Beyond idle curiosity I'm asking because the report also says the no. 1 engine's cutoff switch transitioned from CUTOFF to RUN at "about 08:08:52", which oddly coincides with the last ADS-B data frame at 08:08:51.640970, and that seems important somehow. Or more likely I'm just ignorant of some quirk of the 787's electrical system.

For reference FR24's CSV containing all ADS-B frames supposedly received from the aircraft can be found in their post here: https://www.flightradar24.com/blog/f...rom-ahmedabad/

as per the report- at *most* 1s apart, particularly significant given that it has been mentioned the recording interval of the DFDR is 1s

also I don\x92t know if we\x92ve had an adequate answer to the fact of what data streams the DFDR records, was it only detecting the electrical signal of fuel cut off or the actual position of the toggles- I don\x92t believe it would be the latter which opens an entirely different rabbit hole

On the "at *most* 1s apart" comment: no, that's incorrect. This has been stated above already but to recap: if the recording interval is 1 second, then having two events recorded on consecutive samples would mean that the gap between them was more than 0 and less than 2 seconds. You can say no more than that.

Regarding your second point: it has been noted by multiple posters that "the actual position" of the switch is a fairly meaningless concept for the EAFR data if you want to exclude the electrical signal arising from the switch itself. So I have to ask: what would you regard as a measurement of the "actual position of the switch", in this context?

I'm guessing they use a separate set of contacts to electrically isolate the FADEC wiring from the flight recorder wiring. Which would seem like a good idea.

The Australian Transport Safety Bureau recently investigated the loss of an R66 and praised the ability of the factory-fitted video recorder to assist in identifying the cause of the accident. DFDR & CVR legislation was written, literally, half a century ago, long before on-board video was even possible, yet alone considered, and technology hasn't kept up with the times. It's about time it did.

Truck & bus driver's, cabbies, train driver's, even the kid at Macca's who hands you your burgers are all filmed at work and don't feel it's a hostile workplace, so sorry to say that airline pilots are most certainly not special enough to argue against the introduction of such technology - no matter how big your ego. The same argument of Big Brother was used when CVR's were introduced and no one bats an eye anymore, it's widely accepted, even though you'll still get the odd bloke here or there who erases the CVR before handing over to the next crew. If regulators want to introduce onboard CCTV with the same protections as CVR data, you won't win an argument against it. E specially when the increasing number of fatalities whose ultimate cause is pilot suicide will sway public opinion against you by people who themselves already subject to such surveillance at work. "Why are they so special?" will be the sentiment...

Granted, accident investigates are good at what they do, and I'm in awe of their ability to reconstruct the majority of accidents to determine the ultimate cause (without video). but when technology is available that would have already solved this accident ie. "On-board CCTV shows the Effo selecting the engine run switches to OFF for reasons that remain under investigation" (and to be clear, I AM NOT suggesting that's actually what happened...), it would solve a lot of issues and put to bed speculation about what actually happened to the fuel control switches, who did what and when and I'm at a genuine loss as to why people would argue against it, when it's already so widespread and entrenched in other industries.

Even now - with the preliminary report, I haven't seen mention of which pilot asked the other "Why did you [go to] CUTOFF?" whereas a video would have already told the whole story of this accident - with the exception of the why?

For historical reasons, adding CVRs (Voice/Audio) to aircraft was a controversial subject. I think there was a particular accident that led to their introduction, but involved the 'buy-in' from pilot's unions, who were able to play their part in the legislation and installation. For instance, each cockpit (at least until 10 years ago) has a CVR erase button.
Recording images/videos is prevented by similar union/regulator agreements AFAIK . It might take this accident to change that, of note the GE EAFR fitted to the 787 has the capability:
i.e. the 787 EAFRs appear to have the crash protected ability to record images/video, but not (yet?) the cameras etc. to do it.

Once in a bazillion, eh?

It seems more passengers are dying in scheduled flights in recent times due to pilot suicide than any other cause - and people still want to argue about whether it was suicide or an accident after the fact.

The simple fact is it would likely have 'solved' this accident by now. We'd know if the fuel switches were operated by a crewmember. We'd know which crew member. We'd know who asked who "why'd you [go to] cutoff?", we'd know if there was any physical activity between the two before or after the engine shutdown and we'd (probably) know if there was any indication or external reason for them to do so that isn't captured on the DFDR or CVR. The ATSB raved about the ability to recover video footage in the R66 prang - and that was a single-pilot helicopter that was fitted with it, one could only speculate how much the accident investigators would have liked to have it here...

So...I ask this as a genuine question - why are pilots so fearful of being video'd at work when virtually every other industry - particularly transport related industries - has at least CCTV, if not more intrusive methods of surveilling their employees? In my last company, we had real-time In Vehicle Monitoring Systems , Dashcam's and Cat Driver Safety Systems in our light vehicles, FFCCTV and dataloggers and IR detectors in the locomotive cabin to detect movement, CCTV throughout the shunting yard and car dumpers as well as the datalogging of the signal system and radio communications - and that was just a train company. And the notable thing about all this surveillance is, several times, I was able to demand the relevant evidence be downloaded and it cleared me of an allegation of wrongdoing. In part, due to the lack of protections afforded us in rail when compared to the legislation guarding use and disclosure of the CVR that exists in aviation.

Can anyone articulate a specific reason or their grounds for not wanting CCTV in the flight deck - and not just a catchall "it's a hostile work environment" - what makes it hostile in your view? Why do you feel it's acceptable to be filmed in the aerobridge but not the flight deck? The fact they can watch you screwup instead of just listening to you screwup? The fact you can't hide anything that goes on behind the closed door after an accident? What specific articulatable reasons do pilots have for not wanting to be captured on CCTV in their workplace like so many other employees around the world take for granted every day?

Can you articulate a specific reason or grounds for thinking a camera on the flight deck can reduce the number of pilot suicides? Or is your aim merely to reduce the number of arguments about them?

It seems like a "but the children!" argument, an appeal to emotion. Same with the appeal to MH370 upthread, a camera in the cockpit would have done nothing as satellite communications were off, and the flight recorders are at the bottom of the ocean.

Camera footage from the helicopter would've helped understand what went wrong in the DCA mid-air, but that was a military craft, so...

I had a "page 1 of google results" deep look into rail, knowing that the cab cameras have helped the NTSB before, but then the external camera tends to show more interesting stuff for trains than for aircraft. In rail, camera introduction was piecewise and unregulated, often by companies who wanted to be seen doing something after an accident, and regulation came afterwards (freight trains are still not regulated).

https://www.law.cornell.edu/cfr/text/49/229.136 If I were to regulate cameras in the cockpit, I'd first try it on a smaller scale, to see if there are unforseen negative effects on safety. I'd answer the question, do pilots behave differently when there are cameras? and if so, is the change for better or worse?

Do training simulators have cameras, and is the footage used to debrief simulator sessions?

Two questions for tdracer :

1. What happens to the FADEC channels if both channels have different data / information (e.g. T/L encoders or fuel switches)?
- Will the currently active channel win?
- Or will the most sensible information be used (e.g. keep the engines running)?
- Will there be a disagree message?
- Logged to the DFDR?

2. As per the data sheet the fuel switches are 4 pole versions. 1 pole will be used for each FADEC channel. Will one (or both) of the other poles be used for the DFDR or is that information collected from the FADEC through some data bus?

I know, it's very specific stuff that might only be known by the designer of the FADEC system.

An unresolved difference in TLA between the channels is quite unlikely - the fault detection algorithm is quite good (sine squared plus cosine squared) - but it can happen. In the old days, we'd default to the higher TLA, but since the feds became preoccupied with Uncontrollable High Thrust, we tend to select the lower value. Worst case would be to default to idle. The fuel switch discrete doesn't really get used except for engine start - if it falsely indicates shutdown (on one or both channels), the FADEC won't do anything if the engine is already running. All this will set maintenance faults - and associated EICAS Status messages (L/R ENGINE CONTROL or ENGINE C1). I doubt that would be recorded on the DFDR - it would go to the QAR but that's unlikely to survive a crash. It would also be logged in the FADEC NVM - but again no guarantee that would survive either (although when the Lauda 767 crashed due to the thrust reverser deployment, the DFDR was destroyed but the FADEC NVMs both survived - much of what we know about that crash came from the FADEC NVM.)

Again, not familiar with the specifics of the 787, but on the 747-400/-8, one pole of the fuel switch feeds EICAS - which uses it in various message logic - and sends it out to any other aircraft systems that use it. There is "Digital Flight Data Acquisition Unit) DFDAU (pronounced Daff Du) that takes all the various system digital signals, sorts them and provides them to the DFDR and QAR. The 787 has something similar to the DFDAU but I don't recall what it's called.

It was stated earlier that 2 of the poles in the switch are wired to separate Remote Data Concentrators. The RDCs feed data into the Common Data Network (essentially an Ethernet LAN).

The EAFRs simply sniff the required data from the CDN, so there's no DFDAU as such.

For some parameters, including the fuel cutoff switches, the EAFRs also record a "Source Index." For the fuel cutoff switches, there are 4 sources numbered 1 through 4 as well as a valid/invalid flag. I don't know what the sources are, but perhaps they're the 2 RDCs plus the 2 channels of the EEC/FADEC. It appears that source 1 (the default) is not the EEC.

787 has RDC's - Remote Data Concentrators. Doing the same function. Two of the switch pole-sets go each to one of 2 different RDC's, that feed the EAFR's / QAR, and the common core network so that any system that wants to know, can. The wiring is positive voltage from the RDC's to the switch and to GND through the common pin. So the RDC's would be able to detect anomalies such as both contacts open, or both contacts closed. The EAFR will see two independent channels per switch.
The other 2 contact sets feed latching relays (again driven each coil independently by dropping to GND at the switch) that then drive spar valves and reset signals to the FADEC Channels. (and more).

So - for the benefit of those that hang on to the 'possibility' of electrical gremlins and 'ghost' switch signals.

Each switch has 4 mechanically separated 'channels' - 2 of which do electromechanical things to the engines through separate paths, the other 2 feed through independent paths the FDR and the rest of the computer systems. The results of the electromechanical actions also feed back to the FDR.

Thus the readout from the EAFR will PROVE that the switches MUST have been PHYSICALLY MOVED.

And - I'm nervous to challenge you tdracer - there's quite the authority gradient and I know I'm at the bottom end, but I can't let this fly...
Its 'Deefer Doo'. Fight me.

This has been discussed to death previously. I suggest looking for tdracer's excellent insights into FADEC design and implementation. From the beginning we've been discussing various very rare types of circumstances. Based on the preliminary report we can now lay most of those to rest.

Which actually brings me to this one because I would like to ask for a bit of clarification: By "fuel switch discrete" are you referring to the Fuel Control Switches discussed in the preliminary report?
I would assume from your statement, that if a mismatch in the NC/NO signal on the switch was detected the FADEC would not direct the Fuel Cutoff Valves to close (as far as the types you are familiar with are concerned), is that correct?

The report states:
So this would then mostly preclude the possibility of one or both switches being faulty electrically.

The report then states:
There is a 10 second gap between cutting fuel and re-enabling it and a 4 second gap between switches during re-enabling. Is there a mechanical reason why these switches would be slower to operate in either direction? There are obviously reasons such as startle factor and stress that might negatively affect the speedy operation of switches by anyone, but I am nonetheless curious if this might not be a pointer to some sort of mechanical issue after all, such as asymmetric wear or FOD.

Hi appruser ! I have quoted Pip_Pip 's post above because the position provides a better means to link ADS-B data to the sequence of events, since it's coming directly from the aircraft. The time stamp comes from the volunteer-run receiver, which might experience clock drift. Based on the public CCTV video, we also have a rough triangulation for the rotation, which occurs next to the high-speed turnoff for the third taxiway.

Note that the good folks at FR24 did not apply temperature correction to the barometric altitude (they corrected for air pressure and runway elevation); pilots on pprune have done the corrections themselves and arrived at slightly different values, so take those altitude numbers with a grain of salt. Note also that the 787 sends altitude in 25 ft. increments, and I don't know how these are rounded (up, down, nearest).

We do not know how long the RAT has been deployed in this photo, we only know it can't have been deployed later. I have learned on this thread that the CUTOFF switch will also cause the VFSGs to disconnect, i.e. the B787 systems will electrically isolate the engine from the power buses before it has spooled down. With a dual failure, this would leave the main buses unpowered in short order, so if all of this is correct, the RAT would have clonked into place very soon after the second engine was cut off. This would not depend on the turbine speed.

I personally do not know what items are logged on the flight recorder, but I imagine RAT deployment was not among them. If so, the conditions for its deployment would be logged, but it requires an analytical step to conclude it did, and a preliminary report typically has no analysis at all. Hydraulic pressure to the flight controls is likely logged, so the RAT delivering hydraulic power would be a matter of record.

Where is the RadAlt antenna on a 787? Is it in the nose, or further back between the main gears?

You forget, circumstances are different.

It has taken a while to get the "golden" flight recorder shipped, for instance, to recover the data.