Posts about: "Fuel (All)" [Posts: 1005 Pages: 51]

Pretty much what I was thinking. Maybe someone turned off the fuel switches, or a rare software glitch. Guys I have been working with have suggested fuel contamination which I have thought unlikely. Or maybe a structural failure upon wing loading that caused fuel lines to rupture.

Hopefully the route cause will be found, and I would not be surprised one bit if it is something totally left field that no one had considered, simple or complex.

There is at least one thing common to the TCMA on each engine: The TCMA software.

My recollection may be inaccurate, but wasn't there something in the software for 787 generator control units that would cause generator shut down if the aircraft was 'powered up' for a continuous 248 days? Same software, so all 4 generators would shut down. Is my recollection inaccurate?

What we do know, for sure, is that the TCMAs have the same 'authority' and effect as the fuel cut-off switches. The difference is that the crew control the latter.

We have two donks individual fuel supply cut simultaneous in split seconds. There is no rudder activity visible for any thrust asymmetry during this timeframe. TCMA is implemented via the FADECs which are independent for each engine with their own power source from each engine. TCMA is designed to shut down its engine if its power lever is in retard position and the engine is still powering with too much thrust. In addition the airplanes ground sensors must indicate that it is on the ground. For each thrust leaver there are two independent position sensors. It is similar redundant designed as in modern car acceleration pedals. A dual redundancy in each thrust leaver. For TCMA to shut down two fuel supplies within split seconds we have to assume that 4 thrust leaver sensors malfunctioned and the ground sensing logic failed at the same time. The probability that this happens is nil (may be 1 in every 10exp15 hours) which would be about 10 times the age of our universe.
Unless there is a software error in the FADEC TCMA system which only came to light on this flight. But there seem to be nothing special on this flight until rotation. If there is a software error I expect, that we get false single engine shut downs first. And that would already made the news if it happened during rotation.

Thank you for confirming.

This is not only happening to the FDR but to any reciever on the data busses. And likely not only when the engine spools down and power supply switches but also when power busses come offline and bus bar breakers activate or in any severe fault in the electrical system involving large currents, possibly arching shorts.
Hence my comments on SISO and input filtering and verification in the closed thread.

I'm pretty sure the software is written independently. Same as Airbus, you don't want the same software error on duplicate critical systems.

So, also as an outsider when it comes to cockpit engineering, there is one commmon "system" in the sense of the very close physical location, the two engine systems have in common, and that is the physical cut off switches and their behind the panel connections.

It wouldn't take a kids pool of liquid to intefere with those?
(I asked this question previuously, in the middle of a long text, but the discussion had a very different direction then.)

What are possible ways of a common failure/triggering of these contact points somewhere in their physical installation in the cockpit?
Remember when the A350 had to be modified only 5 years ago to not allow coffee spill to turn off engines.
What about the same location in the B787?
What are the actual switches? Are they purely traditional electromechanical contact switches? How do they make contact, ie. what are the actual gaps and dimensions? Are they digital in some sense? How are they protected? Are both installed the exact same way, or are they installed with different physical screening/protection/orientation as so to make the failure modes different? How are they physically kept apart, isolated from each other to avoid interaction and/or common failure. What is the physical distance involved there? What about the cables and connectors to them? separate or bundled in the same wiring harness? Or even in Mil or D-sub connectors? I find one description of them as a common(both in one box) line replaceable unit with quick connects. Both of them in the same unit with a common connector? Sounds wild if so!
Just had to ask, and hope it doesn't disturb the great discussion too much.

Actually the engines are fed by all tanks during take off. (L engine: L wing tank + Center tank (if filled) / R engine: R wing tank + Center tank (if filled)).

Due to the fuel pressures of the feed pumps (that are all running) the center tank fuel is used first. In case the pump in the center tank fails or the center tank is empty the fuel from the wing will be used w/o any switch over taking place as the wing feed pumps are already running.

Thanks for the clarification.

Surely that's not quite right? If the center tank has fuel, both engines will be fed from the center tank. Only once/if the center tank doesn't have fuel, will the engines be fed from their respective wing tanks.

I think you may be inferring something that isn't actually true. It certainly isn't true in my case. Wanting to explore the details of a function known to be designed to shut down engines, in a case where unexplained shutdown of engines appears to be a likely cause or contributing factor, doesn't suggest that we are assuming TCMA is involved. It's just exploring the details of a a function that is designed to do that and doesn't put on a light, smoke and sound show, or produce obvious debris and residue, when it does.

I think those of us who are persistently trying to learn the details of the sensor inputs to and logic of TCMA (I prefer that characterization to "obsessed with") understand quite well the points you make here — at least those of us whose interest survives in this new thread. However, I at least, and I believe others as well, have also come to the tentative conclusions that (a) the accident aircraft had engines providing little to no useful thrust from nearly the first moments after rotation, and (b) the only possible reasons for that which have been considered here so far involve the sudden and approximately simultaneous shutdown of those engines, most likely by interruption of fuel flow (because that's one of the very few things we know that can do that without producing big bangs, flames and smoke, etc.).

I don't agree that it's more logical to posit that something we don't know about has shut down the engines rather than something that we do know about that is intended to shut down engines. Do you know of other routines/subroutines in the FADEC that shut down fuel supply?

I certainly don't assume that and I haven't seen posts from others (that I consider serious and reasonably well-informed) that "seem to assume" that.

Yes, we know that.

Right, and you won't see a serious attempt to do that until we know, at least, what specific sensor inputs the TCMA function uses to determine the air/ground state of the aircraft and the logic that uses those to make the determination.

Many years ago I maintained a Hawker 1000 business jet equipped with PW305 engines with FADEC. The fuel control did not have a separate switch to control fuel flow to shut down the engines. Shutdown was accomplished by pressing a release on the power levers allowing the lever to be pulled past the idle stop all the way to the cutoff position.

One day upon returning from a flight, the crew pulled both power levers to cutoff. The right engine shutdown immediately as expected, but the left engine kept running. By the time we in maintenance got out to the airplane, the engine finally shutdown by itself.

Troubleshooting found the cause of the problem. The cutoff position of the power lever closed a micro switch that sent a ground to the FADEC. That ground went through two discrete wires. One went directly to one input on the FADEC. The other went through a squat switch on the main gear leg to a second input on the FADEC. The engine would only shutdown immediately if both inputs went to ground simultaneously. If only one input went to ground, the FADEC would delay shutdown for 30 seconds. This was to protect against an inadvertent movement of the power lever to the cutoff position in flight causing an immediate shutdown.

The squat switch on the left gear leg had failed in the open position, causing the problem.

I am wondering if more modern FADEC engines have similar protections against immediate shutdown in the air? I can see why the designers of the Hawker implemented the system the way they did, because the shutdown command was integral to the power lever, and it potentially could be pulled to the cutoff position in flight by an inadvertent release of the locking mechanism that would normally prevent it from going past the idle stop, whereas modern FADEC engines like found on the 787 have a discrete locking switch.

But, if a similar protection against immediate shutdown does exist in the 787, would the engines keep running for a period of time (in the air) even if the fuel control switch was accidentally or deliberately moved to \x93off\x94?

As more days pass without the FAA/EASA issuing an emergency Airworthiness Directive re. the 787 Dreamliner, it does appear more likely the cause of the crash was specific to the Air India aircraft (as per speculation on fuel contamination, bad maintenance, crew error etc. etc.)

Having gone through every possible way the aircraft (or those in it) can shut down both engines, thought it would be helpful to look at what investigators have looked at/for in a somewhat similar case. Perhaps it will move the discussion to more unplowed ground.

Going through AAIB Bulletin10/2008 from the British AAIB in the BA 38 case. Before finding the exact cause, they had investigated the following with findings in quotes:

1. General aircraft examination - "no pre‑existing defects with the electrical systems, hydraulics, autoflight systems, navigation systems or the flying controls."
2. Spar valves - "Extensive testing to induce an uncommanded movement, that remained unrecorded, could not identify any such failure modes."
3. High Intensity Radiated Field (HIRF) and Electro- Magnetic Interference(EMI) - "There is therefore no evidence to suggest that HIRF or EMI played any part in this accident."
4. Fuel System - "The examination and testing found no faults in the aircraft fuel system that could have restricted the fuel flow to the engines."
5. Engines - "No pre‑existing defects or evidence of abnormal operation were found with the exception of signs of abnormal cavitation erosion on the delivery side of both HP pumps. Some small debris was recovered from the left FOHE inlet chamber but this would not have restricted the fuel flow."
6. Fuel Loading/Fuel Testing - "No evidence of contamination was found." "The properties of the sampled fuel were also consistent with the parameters recorded in the quality assurance certificate for the bulk fuel loaded onto G‑YMMM at Beijing."
7. Water in Fuel - "It is estimated that the fuel loaded at Beijing would have contained up to 3 ltr (40 parts per million (ppm)) of dissolved water and a maximum of 2 ltr (30 ppm) of undissolved water (entrained or free). These quantities of water are considered normal for aviation turbine fuel."

Knowing the history of this flight, the previous flights and the climate that day, I left out all the discussion in the report of fuel waxing/ice. That seems as irrelevant as 'vapor lock'.

I too am beginning to think this will be, as an earlier poster termed it, a "unicorn" event.

Source: Bulletin_10-2008.pdf

Bringing part of my previous question back up: I know that fuel waxing was at some point one of the suspects in the BA 38 accident, but was ruled out via testing fuel samples. However I've been unable to find any records of airliner accidents or incidents that did involve fuel waxing, which I thought most likely existed if it was a possibility the investigation was considering? Does anyone know of any such incidents?

More accidents/incidents where fuel starvation was triggered by crystalline contaminants blocking fuel lines might also be useful - I'm trying to establish a range of how quickly and under what conditions such blockages could cause a loss of thrust in both engines.

One would hope, but, whilst there has been confirmation that the EAFRs have been recovered, nothing has been reported about their state or whether they have been downloaded or examined.

If the data is readable there may be a lot of politics and reputation on how that data may be interpreted. Behind the veneer of international cooperation vested interests will be being considered, advocated and agreed.

It, unfortunately, is naive to think that politics will not have a silent presence in agreeing a press release. Boeing and GE are flagship USA companies. Air India is the flagship carrier of India.

Investigations of all types first establish what happened, then how and why, before recommendations and actions. There is a possibility that they know the what, but the how and why incur liability.

Investigators will try to establish a single source or truth. For them, that\x92s an ideal outcome. But due to the nature of investigations, the aim gets derailed as established facts versus possible/potential scenarios based on missing links of the chain are pieced together. But for sure, commercial considerations and liability wont enter into a proper investigation. The task of the investigators is to determine the how and why.

Theres a saying, and it may even have been the title of a book\x85 Lift is a gift but Thrust is a must. In this case, certainly one or both were absent.

For 2 (maybe 3 if it was a training flight) professional people, the day started with waking up, getting ready, saying goodbye to loved ones, who they believed they would see again soon in 2-3 days. Sadly, that won\x92t happen, and it\x92s the job of the investigators to find out why and liability isn\x92t a hindrance to them.

They will look at every piece of evidence and recreate the events. But it will take time.

information worthy of note is:

A) The gear was still down.
B) It would appear (due to some work by amazing members) that the RAT was indeed deployed.

Other observances:

1. Bits flying off the aircraft. (From experience of operating in this area, they like to fly kites, and waste thermals and floats around, notably plastic bags) I have no idea if that la what we see or not.

2. Generally in India, they love using their horns. So whilst you can compare the frequencies of a potential RAT to a motorbike, appreciate there would be a million horns going off too.

3. Some posters have spoken of the \x93startle effect\x94 like they know what they are talking about. The most startling effect of a professional flight deck during an emergency is how calm it is. There aren\x92t hands flying around everywhere. In fact:

V1 > Rotate > Positive Rate > Gear Up > Confirm FD/AP Modes is adjusted to:
V1 > Rotate > Positive Rate > Gear Up > Silence the bell (Or your SOP Variation) FD/AP modes and the PF flies the aircraft.

the next step is to identify the problem, agree on it and then perform the actions. That won\x92t happen below 400\x92.

4. There\x92s no company in the world where Pilots are being fed and watered between V1 and 1000\x92 so spilling drinks on run switches isn\x92t a thing on this departure.

5. Temperature inversion. Yes it\x92s possible and it degrades performance. However, if it\x92s present, it\x92s usually announced on the ATIS. IF other aircraft have reported it.

6. Fuel contamination. Without knowing the systems, yes it\x92s potentially possible, but it would appear no other aircraft have reported being affected by it.

I think, this accident is especially interesting to Professional Aviators and Engineers because I think none of us would ever believe that it could happen. The aircraft is highly automated, the crew have been properly trained and the operation was a regular or possibly training flight.

A query I have is, do later Gen aircraft like the 777/787/747 A330/A350/A380 constantly send Airframe/Engine data home to ops/engineering/oem\x92s. Is it likely the data is out there?

Anyway, I just wanted to post this to reassure the travelling public that Pilots don\x92t try to shut down engines before they raise the gear.

Given the number of times I reviewed DFDR data supplied by an operator after some sort of event/incident, I think most major operators have access to the equipment needed to download a healthy data recorder. So I'd be a bit surprised if Air India does not have this capability. OldnGrounded has also posted that the Indian AAIB also has that ability.

Usually when I hear of data recorders going back to the US NTSB or the recorder manufacturer, it's because the crash damage is such that specialized equipment is needed to download the data. The recorder in the tail would likely have little damage.
While the AAIB may have held off on downloading the recorders until all the major players are present, it's been several days - I'd expect everyone who matters is already there. So I think it is reasonable to believe that the investigators have done a download and have had at least a preliminary look at the data. If there is a smoking gun, they probably already know (and the longer we don't hear something regarding the rest of the 787 fleet, or at least the GEnx powered fleet, the less likely it is that they suspect a systemic problem with the aircraft and/or engine). However the proviso that I posted earlier about potential data loss/corruption due to a sudden shutdown still applies - so maybe the data simply isn't on the recorder.

As has already been posted, EMI is highly unlikely - the current cert requirements for HIRF are quite high, and due to the composite airframe construction of the 787, the lighting requirements are much higher than for conventional aluminum aircraft (the higher resistance of the composite airframe results is higher lightning induced currents).

FDR has suggested a large slug of water hitting critical aircraft electronics at rotation - it is possible that resultant electrical short circuits could falsely signal the engines that the switches are in cutoff. Highly unlikely that it would do that to both engines, but possible.
Then again, all the other plausible explanations are highly unlikely, so...

BTW, I do have a life outside PPRuNe - and I'm going to be traveling the next several days, with limited to non-existent internet access. So don't be surprised if I'm not responding posts or PMs.

Could someone post an authoritative list of the inputs to the EAFR\x92s? By \x93authoritative\x94, I mean the actual wiring diagram excerpt of the aircraft model and engine configuration (and hopefully mod state...), that labels each input.

I\x92m confidently assuming that it will, for example, include an input monitoring the state of the input controlling the fuel shut off valves in the wing roots. But does it monitor, separately, each and every one of the switches and systems that can change the input controlling the fuel shut off valves? I'm hoping and assuming \x91yes\x92, but hope and assumptions can be unhelpful and misguided.

As we know, there are some things the pilots can do that will result in fuel shut off, but other things will result in fuel shut off without pilot intervention.

Of course, it may be that the recorded data will indicate that there was no change in the state of the inputs controlling the fuel shut off valves during the short flight. Hopefully \x96 yes hopefully \x96 that will be confirmed one way or other, soon. Along with another dozen questions....

I was struck by a comment in this or the earlier thread that I cannot now find. It was to the effect \x96 I\x92m paraphrasing \x96 that fuel shut off results in an almost immediate cessation of thrust. (Please correct my paraphrasing if I\x92m off track.) I was also struck by how quiet the aircraft was in the original video, except for the RAT. (Or was it a motorcycle? Sorry couldn\x92t resist. Just joking\x85)

Someone earlier asked how the aircraft could have kept climbing if both engines stopped very late in the take-off roll or shortly after take-off. My answer: Momentum. A bullet fired into the air loses thrust immediately after \x91take off\x92 but continues climbing for a while. And my understanding of the expert opinion on the available, reliable information is that the aircraft didn\x92t climb very far.

Spot on, there's so much fuel being sucked at that power setting, it would be super quick and presumably at near enough to the exact same time.

I assume (rightly so) that you're focused on what could cause them to fail at what appears to be the exact same time given the absence of yaw and any correcting rudder input.

One the face of it, it could only be throttle or fuel supply, with fuel supply only being able to be cut off by valves so abruptly. Any kind of blockage or similar wouldn't give such a result, even if there was a low fuel condition, short of the pickups being exactly right next to each other, presumably that wouldn't give the outcome we've seen.

tdracer explained that earlier: T/O power to sub idle on fuel shutoff only takes 1s, at most 2s.

Slamming the throttles back is a lot slower as the FCU (on a traditional engine)/FADEC spins down the engine slowly - I suppose to make sure that the airflow through the engine remains stable.

Regarding the momentum: As the first few seconds of the climb were normal compared to previous T/Os of the same flight (speed & altitude, confirmed by comparison of the RAW ADS-B data) I don't believe the engine failure happened before or on lift-off.