Posts about: "FDR" [Posts: 192 Pages: 10]

Those switches are lift to move. They were lifted to shut off and thrown back to start in the report. No CVR or FDR trace is going to explain why two switches were throw by error or by intention. Only a video would. PnF would have had his eyes outside or on instruments for the calls. As mentioned, other manufacturers put such switches out of harms way for general use. QRH is the only reason to go to them.

I\x92d like to add for emphasis that we do not know what was said. We only have the investigators summary/narrative. We don\x92t know which exact words were used, or in which language they were spoken, or even which way across the command gradient those unknown words were uttered.

Having a non-english first language myself, I can find several translations from english to my own language of which all will be equally correct but fit each of the various interpretations in this thread.

Someone said the data and audio must be interprered together, but we don\x92t have the audio.

The other language bit os the \xabtransitioned\xbb rather than \xabmoved\xbb.

We don\x92t know from the report whether it was moved. We know it electrically transitioned between states. If it was a short because of contamination, or the gate was wrongly installed or worn, cycling it back(or simply fiddling with it in high stress) explains both the sequence and time used.

The only thing we know is that the switches were physically in run when found. Right next to the throttles in Idle\x85

There is also the sample rate issue raised by several. A millisecond difference can be sampled as a second difference. They might also not be sampled at the same time.

Not aviation, but a automated system I owned recorded all positions and values of thousands of switches and potentiometers sequentially over about a second. The 787 is a much newer system, but processor speed isn\x92t necessarily the top priority.

So maybe try and not put so much effort into analyzing words we don\x92t know and sub-second FDR data?

The cockpit area microphone just might have picked up discernable clicks or plonks from the switches being moved.

how about this:
A nice, uncontroversial alternative to cockpit video could be a small microphone array. It would, when visualising audio data, show where and when to the millimeter a sound changes or emanates in the cockpit, any switch or mechanical fault, but not arms moving, facial expressions or who does what.

It would be an easy add on/expansion to the existing battery powered area mic.

They do it in large factories to pin-point loose bolts or mechanical wear well ahead of tgem needing to be changed.

OK, a couple of informed comments, again with the disclaimer that I have very little first hand knowledge of the 787.

Every single engine parameter I've seen on a DFDR readout has been recorded at 1/second (most parameters), or slower. I've never seen an engine parameter recorded at more than once/second.
The recorder doesn't do an instantaneous snapshot - it cycles through the thousands of recorded parameters. So a once second difference on the data could - in reality - be anywhere from 0.01 seconds to 1.99 seconds. If it matters, a deep dive into the avionics and FDR logic could narrow that time interval down. That being said, moving both switches to cutoff could happen in about a second. The switches make a rather distinct noise (especially if moved rapidly) so the CVR should give better resolution.

There have been instances in the past where the locking tab on the switch has been broken or 'worn down' from heavy use. But that's been seen on very high cycle aircraft - usually 737s that fly short hops. No memory of ever hearing of an issue with relatively new 787s that are - by nature - long range aircraft and don't get a lot of cycles.

On the 747-400, the fuel switches are a 'break before make' design with a distinct gap of ~0.050 seconds during a normal switch cycle (it's a long, somewhat painful story about why I know that...). I don't know the specifics of the 787, but I'd be very surprised if it's any different.

BTW, if the investigators had reason to believe the switches somehow moved on their own, I think a fleet wide inspection would have been ordered by now.

I keep coming back to my 'muscle memory' hypothesis...

The photo of the engine switches in the report shows the toggle of both switches pretty clearly, with the caps burned off (to be expected, has zero effect on function, nor detent locking). The fact that the toggles and lower mechanism of each switch appears in the photo is pretty conclusive (a) to the position of the switches at the time of crash, and (b) that the locking detent function of the switch was functional as intended. I've worked with these switches for decades, and they are very robust. Their lesser cousin design, which also has a center detent lock position (double throw) are less robust that these (single throw) switches, and they last well too. Though I have seen them worn, I have never seen the locking function worn to the point of not functioning as a lock. And these switches would be too new to have experienced wear/damage to that point.

For myself, I have total confidence that the switches functioned as intended. Obviously they commanded the fuel valve as intended, and can be seen intact (other than the plastic caps), and in the run position, so it is safe to conclude that a mechanical/electrical fault of both independent switches at the same moment is unlikely in the extreme. The FDR data states that they were moved to "off" position, which caused the engine shutdown, then returned to "run", so they obviously were mechanically and electrically functional.

The automatic deployment of the RAT is an indicator of the airplane systems sensing an engine shutdown, as is the APU autostart. Pax 11A mentioned the green cabin lights, which, if I understand correctly is an indication of a complete electrical generation failure.The time of all these events can be plotted from recorded data, which I expect we'll see in a full report later. In the mean time, it all makes unfortunate sense.

It could be done that way, but the secondary contact and wiring could fail and, unless a continuous power circuit was used to ensure that there wasn't a break, the digital recorder might not get coordinated information. This would also end up extended to all other switches making for a major increased in wiring and an increase in the number of channels for the FDR.

Small cameras capturing all the switches on each panel would be sufficient and make for a tiny increase in the amount of wiring while capturing not only the events with the switches, but also any actions of the crew, intentional or accidental.

Like, intending to push a button, but it was accidentally pushed an insufficient amount to engage, that sort of thing. For a few bucks more, a motion analysis module could decide what button or selection is being made, compare to the result to see if there is some problem, and/or generate an alert in response to operation outside of typical practice.

Since the effect of the state of the switches is usually immediate, the amount of recorded video need only be a few minutes. Example - it is unlikely that a switch that was in one position, moved, and then moved back, will have an effect that is only noticed 5 hours later. If the switch is put in the wrong position, then it will remain in the wrong position until it is moved, even if that wrong position causes an incident hours or days later, at which time it will still be on the video recording.

I don’t know if the FDR measures the switch position or the electrical signal. The latter is probably more likely, although there has been much discussion around potential scenarios involving accidental switch movement as well as possible causes of electrical glitches. Let’s assume that the switches were actually moved, and ignoring the “bad faith” scenario, we need a situation that encompasses the switches being moved to Cutoff by one pilot, this action being queried by the other pilot and denied by the pilot who moved the switches.

For consideration, here is a possible scenario that hasn’t been mentioned yet and encompasses the frailty of human performance. The report mentions that the flight crew on the immediately prior flight had written up a "STAB POS XDCR" status message, and that troubleshooting was carried out. I wonder if the scenario could be that the accident crew received a Stabiliser EICAS message on or around take-off and the Capt (who was PM) decided to action the first checklist item immediately from memory, by intending to move the Stab switches to Cutoff but moving the fuel switches instead. As in all modern Boeings, the Stabiliser Cutoff switches are immediately next to the Fuel Cutoff switches and operate in the same sense (i.e. down for Cutoff). They are guarded and never normally moved but, with an intent to move the stab switches, “muscle memory” (cerebellum activation if you prefer) may have taken the Captain’s hand to the Fuel switches, which are operated on every flight. The FO (who is PF) is manually flying at this stage sees and queries it. The Capt denies it, as he doesn’t realise what he has done (confirmation bias perhaps). After a few seconds, the terrible mistake is realised, and the fuel switches are moved back to run, but sadly too late and the Capt makes a Mayday call.

Perhaps a bit of a stretch but not as much of a stretch as many of the other scenarios in this thread. I think it is a real possibility. Sadly, the only other explanation that I can see is the deliberate “bad faith” scenario, which we would all hope is incorrect.

Fly Safe
PJ88

A plausible theory, however, if that were indeed the case wouldn't supporting FDR data be available/have been included in the initial report?

Excellent point!

Question: I imagine the accident crew /Captain at least would have been aware of this status message, or at least that it had been looked into. Is that fair comment, or known anywhere? Or maybe he even knew what they did, which may well have been FNF.*

I mean, possibly the Captain decided, since he had a young pilot flying, that he would try to avoid any potential Stabiliser problems from startling his junior pilot by pre-emptively cutting off the Stab control while they were still good. And didn't announce the intention because he didn't want to distract the PF, or make him even more nervous. Stuff like this does happen.

If he happened, as you say, to flip the Fuel Cutoffs instead, that's all that would show on the FDR.

Knowing who said what would be a big help.

*Fault Not Found, in case that's not an Aviation acronym.

You shouldn't be doing anything but flying the airplane soon after rotation, regardless of any EICAS messages appearing. Most airlines would have a 'no action until 400 feet' requirement.

No.
A status message is the lowest level message, it\x92s a notification that\x92s all. Doesn\x92t come with an associated checklist.
Simple write up in the aircraft maintenance logbook at block in from the previous flight.
Maintenance will run a check and clear the fault and clear the message.
You certainly wouldn\x92t use the stabilizer cutout switches for a software fault that has been cleared and you certainly wouldn\x92t do this at rotation.
Its just nonsense.

I see pages of deliberation on the physical position of the switches, but I have not seen a single post on how the signal from these switches is actually routed and processed. I have no knowledge of 787 systems, but I rather suspect that the signal is fed into the FADEC or some intermediate processor rather than directly opening/closing the fuel pumps relay switch ... ? Similarly the switch position signal is I presume captured and processed by a separate system which then writes it to the FDR. Anyone in the know whether there is any possible failure mode of the electronics that would simultaneously send the cutoff signal to FADEC and result in an OFF position for the switch at the same time without any actual physical movement of the switch ?

Your post makes a lot of sense and makes all the bits of the puzzle fit nicely together. Final report will decide the truth - in a year or so..

Since some posters seem focused on the theory that the fuel control switches didn't move - just the electric output did (and as I posted earlier, the FDR only knows electrical states, there is literally no other way for the FDR to monitor the switch position).

So I did a little thought experiment. Uncommanded engine shutdowns (for all causes) are already rare - a 10-6 event. Now, during my 40 year career, I can't remember ever encountering a case where the fuel shutoff was commanded without a corresponding movement of the fuel switch. However in this industry it's a good idea to 'never say never', so let's assume it's happened. It would take something like a hot short to cause it to happen (moving the voltage from RUN to CUTOFF) since an open circuit will simply leave the valves where they were. That would put its probability way out there - something like 10-8/hr.

The left and right engine wiring is physically isolated from the other engine - nothing gets routed in common bundles between the engines. Hence there is simply no way a localized issue could affect both engine's wire bundles. So we're talking two independent events that cause the switch output to electrical change state between RUN and CUTOFF without associated switch movement. So now were out in a 10-16/hr. territory. Now, these independent events both occur a second apart - 3,600 seconds/hr., so we've just added ~8 orders of magnitude to the dual failure probability number (10-24/hr.). Now, they both somehow return to normal withing a few seconds of each other - another ~8 orders of magnitude so we're talking 10-32.

That means the probability of this happening at any time since the Big Bang is way less than one....

Space aliens look reasonable in comparison. So can we discuss things that might actually have happened?

Definitely the best and most important post of this thread IMO.

See the quotes in bold. I realise I'm clutching at straws here but if we take the released version of exchange between the pilots at face value:

Then other possibilites must be considered and we should therefore not default to assuming 'a hand was on the fuel cutoff switches'. Especially as neither of the pilots can defend themselves against such allegations.

I would suggest starting with the maintenence engineer/crew who found 'no fault' after the STAB master caution was investigated immediately prior to this tragic flight. It would not be the first time that 'maintenance' caused an incident...

Also, I urge you all to consider how many accidents have been blamed on 'pilot error' (how convenient when billion-dollar companies are at risk) only for further information to come to light that then exonerates the pilots (these stories don't usually make the front page).

Try to stay open-minded folks. The investigation has a very long way to go.

It is worth remembering that each switch has 4 poles. Think of a pole as a section of the switch. Each section controls a different function - reporting switch position to FDR, fuel cut off and so on. The chances of anything other than real physical switch movement (whether it be spilt liquid, wiring damage, loose canon plug or whatever) changing the status of all 4 sections is impossibly small. Then you have two switches.

In this case it was spectacular but gliding in just off the airfield from a few hundred feet up is not guaranteed to result in total loss whereas spearing in from a few thousand feet would be a sure end. Why take the chance if you're determined to end your life.

A query, the FO was pilot flying and the Captain was pilot monitoring. Is it SOP that pilot flying sits in the LHS at takeoff? As I understand it the situation on power failure is that the battery backup will keep the displays alive until the APU comes online but only on the LHS. Trying to maintain best gliding performance and look for best landing site without any instruments to show speed or attitude would be more difficult. Captain taking over and swapping roles at 200 feet mid crisis is disruptive.

Tdracer has certainly explained that separation of cabling runs etc would have it very improbable that a single cable fault or short would impact both engines simultaneously in the same way. The CVR data is derived from local sensors with a dedicated battery backup, however all the FDR data and the fuel shut off commands are electrical signals which ultimately have a common source in the aircraft power buses. A water ingress into the EE bay at rotate which momentarily shorted all the low voltage buses to higher AC voltage is unlikely but is it unlikely to the same extent.

If it resulted in an eicas message, then leading in to the confused conversation, followed by (several) cycling attempts to reset them successfully to RUN, those 10 seconds later doesn\x92t sound unreasonable at all to me.
If it was a wire strand in the wrong place, that would fit all the facts we know. (Not saying it was, only that it fits)


If you think the timing doesn\x92t quite make, bear in mind the 2 seconds error of margin between any 2 registered parameters in the FDR caused by the (assumed) 1Hz sampling sequential, non-synchronous sampling if you try to draw conclusions from time stamps.

Not been in that situation, obviously, but I have certainly been in stressed situations where somewhere, someone (or something, or even me) pressed the wrong button, and I need to find out which one.
10 seconds is really not a long time if it is unexpected. It is very short.



Please also remember:
-We have no idea of exactly what was said. Whether the conversation referred to a error message, engines spooling down or physical switch movement/position. Throw in possible translation inaccuracies, and we can conclude even less from the information about the conversation, or what the level of clarity or confusion were.

I think that one of the pilots moving the switches and the other noticing he did that is much more likely, considering the "Why did you cutoff?" question. As others mentioned, especially the "Why" part does indeed strongly point towards this possibility. But, while I think it's unlikely, it's still possible that the question might have been the result of seeing an EICAS message, and guessing the other pilot did something, but the switches might not have actually been moved by a pilot, or at all.

What bothers me is that message about the stab cutoff switches on the previous flight. It's a bit of a strange coincidence, since those switches are quite close to the fuel switches. I'm thinking that maybe some liquid could have been spilled during the previous flight over the area of the fuel switches and stab cutoff switches. Perhaps it initially affected just the stab switches. Then, during the accident flight, the acceleration and/or the rotation might have caused residual liquid to move and cause some issue for both fuel switches. Then, as the acceleration stopped after the loss of thrust and the aircraft stopped climbing, maybe the liquid moved again and the fuel switches recovered. But I admit this seems very unlikely.

The preliminary report has provided sufficient information about what happened (in general terms). It has also explained what didn\x92t happen - and hence no need for an AD or groundings etc.

The information from the FDR is quite detailed. That from the CVR is conspicuously less so.

it has likely been decided that other investigative bodies need to be brought in to answer the who and why.