Posts about: "Dual Engine Failure" [Posts: 270 Pages: 14]

That's how I read this:


Obviously, because it's going to require quick action to catch high RPM. And maybe that's what they tried.

Not sure about this. I think it's saying Resetting to initiate a Restart attempt. Not repeating it.

It is not inconceivable to me that a human being who THINKS they've had a dual engine failure at possibly the worst time imaginable (correctly or incorrectly) and has not taken the time to confirm, or take it all in and has immediately launched into memory items. I could certainly foresee one being rather startled by the energy state and the rapidly approaching buildings.
I'm not saying that this happened to this crew but it certainly could happen to someone. People do weird !!!! under high stress. There is an initial "oh !!!!, what's going on" then the training kicks in. Often at super fast rate and the challenge becomes slowing it all down.
The bloody master warning on the Airbus for smoke in the forward Lav used to get me everytime. Was always at night over the ocean too.

It\x92s also not inconceivable that a human being who KNOWS they\x92ve had a dual engine failure at the worst time has immediately launched into memory items. Those memory items include \x91cycling\x92 the fuel cut off switches\x85

A couple of points if I may......

I don't see it written in the 787 FCOM but I have always been told that the action of resetting the Engine Cutoff switches in the event of a dual engine failure, is merely backing up what the FADECs have already done. If there is an 'engine event' the FADECs will manage ignition and fuel-flow to restore the thrust that was demanded before the event. If that management has failed then the manual resetting may be more successful. (The same holds true for the RAT, manual selection is merely backing up the auto-deployment).

Any airline pilot will tell you that executing an in-flight relight on a big engine, no matter if it is by electric start, windmilling RPM or cross-bleed assisted, can take between 1 and 3 minutes to restore power. This aircraft was airborne for less that 30 seconds. No pilot in his right mind would prioritise an in-flight relight procedure, in a situation where they had neither the time, the height nor the speed for it to succeed. I have no doubt the crew focussed entirely on pointing the aircraft at the clearest area they could see, to mitigate what would inevitably follow.

Assuming the 2nd/3rd-hand 'leaked' info about fuel switches is even accurate the scenarios of what they know (investigators / leaker) would be:

1. They know exactly 1 fuel switch was cut off, perhaps implying single engine failure + wrong engine shutdown
2. They know 1 or both switches were cycled off then on, implying a last-ditch attempt at some sort reset at any point up to say ~30s
3. They know both fuel switches were cut off, and remained off, implying sabotage

Working logically through these:

1. If the cut off happened within 20s of leaving the ground perhaps it could explain why CCTV shows the initial climb then level for ~10s before descent. It could also explain the RAT and gear trucks perhaps if gear up was delayed? However, in this scenario they must know that the engine failed, that information would be clearly recorded and surely the leak would lead with that info? Also 'switches' is plural implying both, the radio call didn't mention single engine failure and like you say its quite hasty, even within 20s.
2. Again assuming switches plural, this implies either of the prevailing theories of dual engine failure leading to loss of AC or loss of AC leading to reduced thrust or engine failure. However, it also seems strange to lead with that info rather than the state of the engines or electrical systems in any flight data, unless someone can explain how the data would be impacted?
3. If this was the case then it would imply that there is no voice or engine data to explain the cut off, nothing was said and the engines were normal up until that point

Capn Bloggs ...... As you should be aware as an 'apparent' professional pilot, the handling of abnormal situations requires an informed decision to action an appropriate checklist, at an appropriate time. Any professional would be able to see that. Boeing training teaches that throughout.

Notwithstanding what it says in the B787 FCOM and FCTM, I don't think Boeing ever envisaged the dual engine failure procedure being required 10 seconds after rotate. There are many pilots in civil aviation who live and die by what is written in the manuals without thinking past the text. There are times when what is written is sensible and appropriate, and there are times when application is just plain daft. This is why a man is in charge, not a machine.

For those thinking about a SEF followed by an incorrect shutdown..... In the event of a SEF you control the aircraft, take the gear up and engage the autopilot. You then sit on your hands until 400' AGL. If an engine is on fire - You let it burn until 400'. No procedure is actioned until the problem is confirmed between you, and you are safely climbing away. To deviate from that would be very unprofessional and highly dangerous.

I think the correct Boeing reply would be: "it is not part of the certification process". So yes, loss of thrust on both engines during the takeoff phase is not really countered for in the procedures.

That does not mean that the pilots "out of habit" would have reverted to the procedure. Who would not? But in that case, the fuel control switches would be found in the RUN position post crash (if anything was left). So did they find the switches in the cutoff position, or did the action of switching got "stored" somewhere in FDM (not a specialist on these things, only to hear many times in the past that "maintenance is already aware" if we had an issue and called maintenance post flight)

Seconds count: That was with 10 seconds delay vs. 13 seconds for engine 2.

Time was spent with the verbal exchange, and then perhaps each pilot expected the other to put the switch back?

Anyway, the preliminary report also establishes that the aircraft had only 3-4 seconds of powered flight. (Would the gear lever be operated that early?) Everyone who saw that from the CCTV video, pat yourselves on the back.

Mayday call, dual engine failure, RAT deployment all confirmed.
TCMA was a red herring, the aircraft was firmly in air mode as the accident unfolded, and the thrust levers were at takeoff thrust the whole time.

For those sky gods who confidently state they would reset the cutoff switches immediately I would say that 10 seconds is not a particularly unusual time for startle effect to impair cognition, especially for something as monumental and unexpected as a dual engine failure at rotation. One reference amongst many: https://www.icao.int/Meetings/LOCI/P...Strategies.pdf

And for those who scoff at the possibility of the PM inadvertently operating the cutoff switches (which is done as frequently as operating the gear lever), I\x92d remind you that more than one Airbus has landed with its parking brake on after the PM inadvertently set it rather than arming the spoilers.

Again I agree with you, 3 seconds is about right for positive rate, I would be starting to lean over toward the gear handle about then. So did the start switches manually move to shutoff or not, if not then, they must have been manually cycled off to run 10 seconds later and what raised the "why did you" query, wouldn't that query be "dual engine failure"

It pretty much can and the odds are vastly in favor of a human hand on the switches. I *hate* the idea someone is either that clueless turning off random things or that evil, but the odds of anything else being the cause are rapidly approaching being hit by lightning after winning the lottery.
I know.......it could turn out to be some way out cause no one has thought off.

A buddy went down with double engine failure in an Aztec, when he switched tanks water that had leaked into the airplane formed an ice ball that jammed the cables to the actual switches between tanks and cut off all fuel. If he hadn't landed in a field and gotten an A&P on it before the temps went above freezing maybe no one would have ever known why 2 engines with totally separate fuel systems died at the same time.

I well understand the notion, but the hard reality is that accidents are more often the result of complex overlays of circumstance rather than single individual or system issues. That was really my only point.

In this case it was spectacular but gliding in just off the airfield from a few hundred feet up is not guaranteed to result in total loss whereas spearing in from a few thousand feet would be a sure end. Why take the chance if you're determined to end your life.

A query, the FO was pilot flying and the Captain was pilot monitoring. Is it SOP that pilot flying sits in the LHS at takeoff? As I understand it the situation on power failure is that the battery backup will keep the displays alive until the APU comes online but only on the LHS. Trying to maintain best gliding performance and look for best landing site without any instruments to show speed or attitude would be more difficult. Captain taking over and swapping roles at 200 feet mid crisis is disruptive.

Tdracer has certainly explained that separation of cabling runs etc would have it very improbable that a single cable fault or short would impact both engines simultaneously in the same way. The CVR data is derived from local sensors with a dedicated battery backup, however all the FDR data and the fuel shut off commands are electrical signals which ultimately have a common source in the aircraft power buses. A water ingress into the EE bay at rotate which momentarily shorted all the low voltage buses to higher AC voltage is unlikely but is it unlikely to the same extent.

I think that one of the pilots moving the switches and the other noticing he did that is much more likely, considering the "Why did you cutoff?" question. As others mentioned, especially the "Why" part does indeed strongly point towards this possibility. But, while I think it's unlikely, it's still possible that the question might have been the result of seeing an EICAS message, and guessing the other pilot did something, but the switches might not have actually been moved by a pilot, or at all.

What bothers me is that message about the stab cutoff switches on the previous flight. It's a bit of a strange coincidence, since those switches are quite close to the fuel switches. I'm thinking that maybe some liquid could have been spilled during the previous flight over the area of the fuel switches and stab cutoff switches. Perhaps it initially affected just the stab switches. Then, during the accident flight, the acceleration and/or the rotation might have caused residual liquid to move and cause some issue for both fuel switches. Then, as the acceleration stopped after the loss of thrust and the aircraft stopped climbing, maybe the liquid moved again and the fuel switches recovered. But I admit this seems very unlikely.

Because it wouldnt have been immediately available to support engine restart and/or other electrical functions, as it didn't open until around 13 seconds after cutoff event. It's relevant in so much of how it may (or may not) have affected recovery efforts.

It was working as per the conditions absolutely, but those conditions meant it wasn't available immediately.

I hardly think that the single sole relevant learning from an event such as this, and hence the sole discussion point, is around the trigger of the event. Yes, very relevant, but plenty of other areas to understand further as well (for example how a dual engine failure at such altitude could be adjusted in future process). If you aren't interested in that discussion that's ok of course, but it doesn't make it irrelevant.

Someone had posted a short clip of a simulator session where the captain did just that, and the PF then moved his hands immediately towards the switches, and the captain moved his hand back to guard them so that the PF now had to deal with the dual engine failure. I don't remember what their head movements were, and the post got lost in a hamsterwheel purge.

I've mentioned PACE before, it stands for "probe alert challenge emergency", more at https://psychsafety.com/pace-graded-assertiveness/ , or search pprune. It's a scale of assertiveness, and if there's an "authority differential", as in a junior F/O vs. a senior captain, it becomes more difficult the further you move up the scale. Hence the need for CRM.
I'd put "Why did you turn the engines off?" at the "probe" level, "What the h*ll do you think that you're doing?" at the challenge level, and reaching down to put them back would be the highest level. So I think whether someone would be capable of doing that depends on cockpit dynamics and training.

Not a B787 pilot but many hours on its wide body predecessors.

It is conceivable that you could notice hand movement around the throttle quadrant in your peripheral vision (noone's hands are on the thrust levers between V1 and shortly after takeoff), however even if you didn't, you'd immediately notice the loss of performance. The instinctive reaction is big loss of performance -> quick glance across at instruments -> why are they winding back? Also if the fuel control switches were moved to cutoff you'd suddenly get EICAS messages saying the engines were shutdown. So there are immediate clues and it's only a minor head movement to see where the fuel control switches are because they're right down there behind the thrust levers. Then the immediate action for a dual engine failure, which would by then likely be obvious with both sets of instruments showing everything winding back, is "fuel control switches cutoff, then run". There is no significant pause in that action because it's only to reset the electronic engine controls, so the 10 second gap between setting them back to "run" is not explained by the dual engine failure procedure but perhaps by a startle factor. One way or another, your eyes are going to end up checking where those switches are.

I have flown B777 and B787 and have operated these switches many times. They are solid secure switches that need a deliberate action to move.
My thoughts, without any weighting or inference are that they were:
1. moved deliberately to shutdown the engines
2. moved unintentionally and ended up shutting down the engines
Airlines focus on many safety topics, one of which is action slips.
Cockpiy Control Confusion - by Airbus
A recent example cited by the AAIB was the 777 RTO at LGW.
The only time that both fuel control switches are switched off together (and not immediately switched back on - Double Engine Failure) is at the end of the flight once parked on stand. This is a very familiar, routine action that pilots do with probably little thought. I have heard of some very odd action slips by some very experienced pilots. In this instance maybe the cue for the action was gear up? It could fit the timeline.

It is also part of the evacuation drill, as practiced regularly during recurrent training in the simulator. If a high stress situation had developed after V1, a "brain fart" may have resulted in the deliberate but unintended switch selection.

For the action slip theory, while worth of considering, I have one question. That is that both switches are reported to be moved to CUTOFF at practically the same time, quote "within 0.1 seconds". You can not move those switches one after the other in 0.1 seonds (grip one, pull it, move it, let loose , grip the other one ...).

Question: is it an often encountered practice when arriving at the stand, to shut-down both engines simultaneously? The switch design seems to try to prevent simultaneous action. But we are humans, right?

Why this is relevant. Because if normally you do two actions, maybe with 2..5 seconds gap between them. It would be unlikely that you would shut down both engines instead of gear up. One, yes, on a bad strange day, but not both of them. Except ... you got a habit and always Cut-Off both engines in one single go.