Posts about: "Fuel (All)" [Posts: 345 Pages: 18]

(re:skwdenier and the photo of the switch. )
And those wires, which all i can find points to having (non-english speaker) screw terminals. within the LRU shared by both switches. Those things go bad over time even when installed in non-movable equipment.
For those that argue that these are some kind of very special switches. They aren't. Sure they are really nice switches, but that series is available through normal distributors like mauser or elfa-distrelec in europe for, and the price isn't sensationally high compared to other switches.
I am curious as to how the LED light power is threaded through to the switch top. Why do they have a LED, in the first place? Seems a bit gimmicky.

Since they have such inherent damage potential in systems that are otherwise carefully isolated through redundancies and physical seperation, why aren't they? Why aren't the 2 cut off switches placed in 2 different locations in the cockpit. Seems like such a cheap insurance.

Sorry if I am adding noise, I know these are just one of many possibilities, and I am not knowledgeable enough to weigh these different theories against each other, but this switch thing is just something I know personally have more failure potential than what I thought were acceptable for this application.

From the EASA type-certificate data sheet for GEnx series engines, document no. IM.E.102, issue 11, dated 22/11/22:
1.3 Fuel Inlet Temperature (C):
At engine fuel pump inlet:
GEnx‐1B Engine Series
Temperatures \xb0C
Minimum ‐ 53.8
Maximum 65.5

I think the mods are right to squelch vapor-lock theories because AFAIK there's no support for the notion that it would happen under these circumstances. I can provide a brief explanation but I don't know the operating parameters of a 787 fuel system so I can't speak authoritatively on that. I can speak authoritatively on modern automotive fuel systems where vapor lock on a running system is just not a thing, even though gasoline has much higher vapor pressures and cars can be operated in temperatures much higher than 43C with fuel temperatures to match.

This explanation comes with a money-back guarantee and if I'm wrong I'll send out refunds.

First, vapor lock is simply where a pump or other device becomes inoperative because it is designed to pump liquids but is presented with a gas (vapor) at it's inlet and thus cannot develop pressure and pump the fuel. Think of a very old car with a mechanical fuel pump on the engine block that draws fuel through a long tube from the fuel tank. If you shut the car off on a hot day, the residual heat may boil off the fuel in the lines and carburetor so that when you try to restart, there's no fuel anywhere and your pump has lost it's prime. It is key to note that even with a very crude system like this and volatile gasoline as a fuel, vapor lock usually only affects starting and not running engines. There are exceptions, of course.

The three key factors are the absolute pressure at a particular point in the fuel system, the vapor pressure of the fuel at whatever temperature it is at and system design. System design has all but eliminated vapor lock as a serious issue in the gasoline automotive world. At near sea level, the outside pressure is about 1 bar (15psi) and at 50C typical jet fuel will have a vapor pressure of perhaps 0.02 bar. So the only way to cause it to vaporize jet fuel, even at 50C+, would be to subject it to a very, very strong suction. AFAIK there are no vulnerable points where you'd have suction during normal operation because the fuel pumps are presumably (I don't actually know) immersed in fuel and the entire system has greater than 1 bar pressure all the way to the high pressure pumps. Even without the electric pumps, the inlet to the mechanical pump is below tank level. So absent some major fuel line restriction, there aren't any points where you'd have strong suction aka very low absolute pressure.

The discussions about fuel temperature also seem a big irrelevant to me--even at 60 or 70C the vapor pressure is still very low and I doubt you'd see significant vapors at all under 100C with any reasonable fuel system design and properly blended fuel . I'm assuming the fuel temperature limits are for other reasons, perhaps flash point or ignitabilty (TWA 800) or viscosity and lubricity concerns with the high pressure pump. Again, IDK, but vapor lock with Jet A seems very far fetched to me. I would note that improperly blended fuel could have a much higher vapor pressure and still work OK in most cases as long as positive pressure was maintained. So if the electrics and the pumps went offline and the fuel vapor pressure was way too high, I suppose there could be vapors formed in the suction line going to the mechanical pumps. But I don't have nearly enough knowledge to proclaim that as a possibility. I presume they've taken fuel samples at the source and tested them. Here's a paper on Jet A vapor pressure:

https://www.researchgate.net/publica...Kerosene_Jet_A

I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.

I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.

The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.

tdracer addressed the shutoff valve operation earlier: "the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). "

There were simultaneous engine failures, but those were due to massive birdstrikes ( US1549 ) or due to epidemic engine failures on Il-62s of various versions (like LOT 007 or LOT 5055 ).

Fuel related total engine failures like Aeroflot 366 or Air Transat 236 at least had the decency to have the engines starve one after another as the fuel in the individual tanks depleted.

But all those are probably highly irrelevant when considering the Air India accident. An engine disintegration or a heavy birdstrike would have been visible on the videos, a sizeable bird would have left some remains. And gradual fuel starvation would have shown some yaw.

As much as I despise the thought, the issue that got AI171 must have come from within the aircraft, although this most decidedly does not infer any wrongdoing by any crewmember.

One thing that just came to my mind: We are scratching our heads why that happened after the type is in service for almost 15 years with millions of flight hours and surely hundred thousands of T/Os and landings.
What if it takes something to be worn/used after many years to get that kind of failure? The AI 787 was 11 years old. We have been discussing the fuel switches, but there are thousands of other parts that might contribute to such a failure in connection with some other problem.

With such high redundancies and a large degree of isolation between the engines, if it was indeed a simultaneous dual-engine shutdown, we don\x92t know of a single hardware component that could have worn out and caused it (as far as I know)

Shutting down the wrong engine is not extremely rare:

1. GoAir320 at Delhi
2. Transasia AT72 at Taipei
3. Alitalia A332 at Seoul
4. SA Airlink JS41 at Durban

Not saying it happened here!

*On the ground* you get into a latched state, once TCMA deploys: after activation the relays stay latched to prevent a re-runaway. A full power reset of the affected EEC channel(s) and relay logic - normally done only at the gate - is required before fuel can flow again. So you can\x92t easily relight.

I rather think of more than one failure. For example (and I don't think that is what happened!): Some 11 year old contactor fails fatally in the central electrical equipment bay. This failure leads to a total electrical blackout. The engine driven fuel pumps, being older as well, don't do gravity feed anymore as they should.
ONCE AGAIN: I don't think that is what happened - it's just an example of a chain of events triggered by worn out and/or older equipment. Both failures would never happen on a new aircraft.

Thanks, makes sense.

Technically, then, if TCMA deployed erroneously during takeoff, there would be no way for the pilots to restart the engines?

It would surely be nice to get clarified. Does the FADEC control the fuel cut-off valves? Isn't that messing up the hierarcy somewhat? And wouldn't/shouldn't these be separate from everything else?
If so , the likelyhood of this having anything to do with the switches, their harness, or connectors drops way down. (although most theories are dealing with statistical "impossibilities", what better time than after decades for such to occur.)

The switches are double on's or 4 pole, that means they are (can be) connected to 2 different systems individually. Anyone know how that system looks? Why 2 signals?

DISCLAIMER: Poster (a) is one of the (apparently quite numerous) lawyers following this thread; (b) a long-time forum lurker and aviation enthusiast who loves studying FCOMs for fun (to each his own, I guess); (c) has followed and read this thread from the start.

What I cannot do is add new theories or uncover any new facts the actual experts have not already thought of. However, since summarizing and structuring information is one thing lawyers tend to regularly do (and sometimes even do well), here is my attempt at a useful contribution to this thread: an attempt to summarize the main theories discussed here since day one (which I think hasn't been done for quite some time) in the hope that a birds-eye view will be helpful to those who have not read everything since the beginning or might even trigger some new flash of inspiration for someone more knowledgable than me. I have focused on the cons since there does not seem to be enough evidence to come to any positive conclusion.

I shall try to be concise and to refrain from personal evaluations of my own. Of course, no disrespect whatsoever is intended towards all those who have contributed to this thread and to the individual theories, one or combinations of which may turn out to have led to this tragic outcome. That arguments can be made against every single theory that has been propagated seems to be the result of the highly improbable and unusual nature of this deplorable event and certainly not due to any lack of knowledge or reasoning skills in this forum.

DEAR MODS: If I have distorted anything or if, meaning well, should have achieved the opposite \x96 I guess you know where the delete button is\x85

Anyway, here goes:

A. Misconfiguration or wrong takeoff data
Widely refuted, since

• rotation, takeoff and initial climb seem normal;
• likely extreme errors would have been required to have such tragic effect (the fuel tanks should have been only about half full, so not close to MTOW);
• there is strong evidence that at least some flaps were extended for takeoff (post-crash photo, perhaps also visible in video from behind)

B. Flaps retracted post-takeoff instead of gear
Still brought up from time to time. However, widely disregarded due to

• the fact that with two working engines an inadvertent flap retraction should easily be recoverable, even with gear down;
• strong indications that hydraulic and electric power were lost (audible/visible indications of RAT extension, survivor statement, lack of engine noise, position of MLG bogies).

For a while, the forward tilt of the bogies as first part of the retraction cycle was seen as additional evidence that the gear had been selected up. However, it has been pointed out that the forward tilt and the opening of the gear doors occur almost simultaneously so that it seems unlikely that hydraulic power was lost in the split second between bogie tilt and gear door actuation. It is now assumed the forward tilt of the bogies was merely a consequence of the hydraulic power loss.
It should be pointed out that the question of "RAT in or out" was for a while the most contentious in this thread.

C. Low-altitude capture
Still argued, even if refuted by many since

• inconsistent with apparent loss of hydraulic/electric power;
• PF would have been flying manually (however, A/T reaction would have been unexpected for the PF);
• should have been recoverable (unless one assumes that the crew (a) remained unaware of the changed FMA annunciations although alerted by the unexpected FD commands; and (b) was so startled that an A/T thrust reduction was not noticed and corrected, even though the PF was apparently sufficiently alert not to follow the FD commands).

D. Loss of both engines at or shortly after rotation
Various possible reasons for this have been discussed:

I. Bird strike/FOD

• Would have to have occurred simultaneously due to lack of rudder/aileron input indicating symmetric thrust.
• No remains/traces on runway, no visual indications (flocks of birds, flames, structural engine damage).

II. Fuel-related III. Improper maintenance
Unclear which maintenance measures could possibly have been performed that would have resulted in simultaneous loss of both engines. No apparent relationships between malfunctions reported by previous passengers and essential systems.

IV. Large-scale electrical fault (e.g. due to water in E&E bay)
The engines will continue to run if electrical power is lost. FADECs are powered independently.

V. Shutdown of engines by TCMA
A parallel is drawn to the ANA incident. However, this would require not only a fault in the air/ground logic but also a sensed discrepancy between T/L position (not necessarily idle) and thrust output on both engines simultaneously.

VI. (Inadvertent) shutdown by flight crew VII. Malfunction/mishandling of the fuel cutoff switches (most recent)

The TCMAs will not 'activate' - trigger fuel shut off - on a rejected take off if the engines do what they are told when the thrust levers are set to idle. The software monitoring the engine parameters v throttle position is quite sophisticated, for obvious reasons.

User989 thanks for a nice summary
I am at risk of turning into one of those folks who gets their mind locked on one possibility and keeps banging on about it but here goes;
If the authorities determined that the accident aircraft had been treated by maintenance for microbial growth in the fuel tanks within the last week or so, and they suspected that that procedure was carried out in a way that could result in fuel contamination, then that would explain

1/ No other aircraft being affected
2/ No measures taken at the airport
3/ No AD’s from the regulators
4/ No grounding of 787’s
5/ Flight profile
6/ Rat deployment etc etc

I agree with your statement that dual flameout due fuel contamination is very unlikely, but we ARE dealing with something that is very unlikely. I favour the theory because an error in treating the fuel is so predictably human and simple, and a dual engine failure being related to fuel is also a simple and obvious idea, and it satisfies all we know both about the aircraft’s behaviour, and the authorities behaviour post accident.
I posted a report earlier of a 787-8 powered by the same engine type have both engines roll back sub-idle within a minute of each other while airborne due to this, so we know it can happen in theory.

Now……I want to be clear that I’m not saying I think I know what happened, I’m an average Joe with my hands full just flying the line, but I am a bit surprised that the idea of ‘fuel contamination specific to that airframe’ doesn’t get discussed more on this thread.
Thanks again for the clear summary of discussion thus far.

Fuel guy here. I've been "sitting on my hands" as requested by the mods but I will bite on that. Because dual engine failure is a "common mode fault" contamination is one of simplest explanations. Forget wax, think sediment, water or misfuelling. The only reason this has been discounted in favour of an electromechanical/software fault is that there is no yaw, i.e. both engines ran down at the same time at more or less the same rate, and would have to have been fed from the same tank (so the contaminated fuel reaches the engines at EXACTLY the same time on each side - is that even possible?). Its a stretch but I suppose it is possible, however the retention samples should have been tested by now. I would be interested in confirmation that they were taken and tested. I would also want to know if there is a "hot hydrant" system at AMD or if there are bowsers and if any maintenance had been done (think Cathay at Surabaya). But honestly, the fuel supply chain is usually rigorous...[edit: I have just seen a Reddit post pointing to a major construction project involving the fuelling facilities at Ahmedabad...will try to find out more...]

Does anyone have a link to a document (Boeing / FAA) that attests / mandates to the solenoid being a locking type?

Just so I have this clear, are you saying that the implementation of the TCMA functionality involved no new components being added to the pre-existing FADEC? Are you saying, in effect, that the two switch relays described in the TCMA patent application, which relays and their configuration achieves the described two channel redundancy, were already there as components or are mere depictions of what the software does itself?

I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications.

That is the implication I have heard all along, particularly from tdracer's posts.

It uses existing thrust-lever-angle inputs, existing N1 inputs, and (presumably) existing WoW inputs, does software stuff inside the ECU, and if necessary uses the existing overspeed cutout outputs to stop the engine.