Posts about: "Fuel (All)" [Posts: 1005 Pages: 51]

The extended spec sheet for these switches shows that there are versions with a center indent, and others without. But the picture up above which is said to be of the 787/8 actual switch seems - to me - to not have a center indent option. Ie, it is either on or off, with a spring loaded lift of about 2mm needed to move it from one position to another.

Obviously. If yours is the switch I think it is (with the metal, unscrewable dome) then yes, it is very different. Very hard to "balance" yours in the middle.
Not so the Boeing fuel switches: they can be relatively easily "sat" in the middle, on the centre raised bit and could be bumped either way. Hence our (non-787) FCOM saying make sure you jiggle them when you put it in the On position to confirm it's locked there.

That's a Beechcraft Kingair starter switch

Mods, feel free to remove this if you think it's not contributing.

Folks, the exchange here about the cutoff switches ("fuel control switches") is exactly the kind of discussion that contributes meaningfully to our collective understanding of one possible causal or contributing factor in the accident. Smart, well-informed people politely considering and evaluating the suggestions of others. No snark or sniping. Love it.

I hope/wish. I accept that it's not at all likely that TCMA is the/a culprit in this crash, but it is, like the cutoff switches, one of the few things designed and intended to shut down an engine in a very big hurry. It would be good to know as much as possible about how it determines the aircraft's ground/air state.

And add the radio altimeter(s). I think, but don't know, that they provide inputs to the FADEC TCMA function also.

I have read most of the thread (old and new). As a lawyer working in forensic investigations, I am constantly involved in problem-solving. My field of work also includes complex investigations related to insolvencies, which almost always require an analysis of the causes behind a specific, established outcome. In doing so, I naturally also have to deal with probabilities. However, it often turns out that the most likely or plausible explanation does not reflect what actually happened.

Many of the considerations I’ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.

With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought—and it was nothing more than that—was that their activation becomes more probable if it can occur accidentally. That’s how I came across SAIB: NM-18-33.

Another user then brought up an iPhone. That notion would, of course, be dramatic—but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the “Off” position. Due to the buttons on top of the switches, which provide some resistance, it’s even possible that the object both pulled and pushed them.

But all of this is speculation. The investigation report will bring clarity.

Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety—especially considering that the FCS are protected laterally by metal plates.

I thought this was a very good point. There are some detailed posts discussing the TCMA patent including this post . Is it possible the TCMA software functioned exactly as specified, and the issue is input data into TCMA?

In a total electrical failure, when the system switches to emergency battery power, how are input variables like rad alt and wow switches processed? (these were inputs someone mentioned on the 747-8, have the TCMA inputs been identified yet?)

I speculate the gear truck forward tilt is a symptom of a C hydraulic failure caused by a total electrical failure around the time of VR. Once they got 10 deg nose up on the rotation, with a total electrical failure, could the FADEC receive erroneous rad alt or wow inputs, and how would TCMA handle these inputs in the transition from ground to air logic?

What is baffling is the simultaneous nature of the suspected dual engine shutdown. There is no obvious asymmetry, with the flight path or rudder movements. If the engine fuel control switches had been manually cut one at a time, there should have been some visible flightpath change or flight control response. Something happened to both engines at exactly the same time.

It is probable that the switches are becoming easier to move across the gate after 10,000 operations. Something falling on them would be a possibility to cause that. And there is certainly an argument to be had whether down=on is a safer way for them to operate.

I think it's not a coincidence that tdracer's post was chosen to be the thread starter of part 2. I'll wait for the preliminary report to see it confirmed or disproved.

(re:skwdenier and the photo of the switch. )
And those wires, which all i can find points to having (non-english speaker) screw terminals. within the LRU shared by both switches. Those things go bad over time even when installed in non-movable equipment.
For those that argue that these are some kind of very special switches. They aren't. Sure they are really nice switches, but that series is available through normal distributors like mauser or elfa-distrelec in europe for, and the price isn't sensationally high compared to other switches.
I am curious as to how the LED light power is threaded through to the switch top. Why do they have a LED, in the first place? Seems a bit gimmicky.

Since they have such inherent damage potential in systems that are otherwise carefully isolated through redundancies and physical seperation, why aren't they? Why aren't the 2 cut off switches placed in 2 different locations in the cockpit. Seems like such a cheap insurance.

Sorry if I am adding noise, I know these are just one of many possibilities, and I am not knowledgeable enough to weigh these different theories against each other, but this switch thing is just something I know personally have more failure potential than what I thought were acceptable for this application.

From the EASA type-certificate data sheet for GEnx series engines, document no. IM.E.102, issue 11, dated 22/11/22:
1.3 Fuel Inlet Temperature (C):
At engine fuel pump inlet:
GEnx‐1B Engine Series
Temperatures \xb0C
Minimum ‐ 53.8
Maximum 65.5

I think the mods are right to squelch vapor-lock theories because AFAIK there's no support for the notion that it would happen under these circumstances. I can provide a brief explanation but I don't know the operating parameters of a 787 fuel system so I can't speak authoritatively on that. I can speak authoritatively on modern automotive fuel systems where vapor lock on a running system is just not a thing, even though gasoline has much higher vapor pressures and cars can be operated in temperatures much higher than 43C with fuel temperatures to match.

This explanation comes with a money-back guarantee and if I'm wrong I'll send out refunds.

First, vapor lock is simply where a pump or other device becomes inoperative because it is designed to pump liquids but is presented with a gas (vapor) at it's inlet and thus cannot develop pressure and pump the fuel. Think of a very old car with a mechanical fuel pump on the engine block that draws fuel through a long tube from the fuel tank. If you shut the car off on a hot day, the residual heat may boil off the fuel in the lines and carburetor so that when you try to restart, there's no fuel anywhere and your pump has lost it's prime. It is key to note that even with a very crude system like this and volatile gasoline as a fuel, vapor lock usually only affects starting and not running engines. There are exceptions, of course.

The three key factors are the absolute pressure at a particular point in the fuel system, the vapor pressure of the fuel at whatever temperature it is at and system design. System design has all but eliminated vapor lock as a serious issue in the gasoline automotive world. At near sea level, the outside pressure is about 1 bar (15psi) and at 50C typical jet fuel will have a vapor pressure of perhaps 0.02 bar. So the only way to cause it to vaporize jet fuel, even at 50C+, would be to subject it to a very, very strong suction. AFAIK there are no vulnerable points where you'd have suction during normal operation because the fuel pumps are presumably (I don't actually know) immersed in fuel and the entire system has greater than 1 bar pressure all the way to the high pressure pumps. Even without the electric pumps, the inlet to the mechanical pump is below tank level. So absent some major fuel line restriction, there aren't any points where you'd have strong suction aka very low absolute pressure.

The discussions about fuel temperature also seem a big irrelevant to me--even at 60 or 70C the vapor pressure is still very low and I doubt you'd see significant vapors at all under 100C with any reasonable fuel system design and properly blended fuel . I'm assuming the fuel temperature limits are for other reasons, perhaps flash point or ignitabilty (TWA 800) or viscosity and lubricity concerns with the high pressure pump. Again, IDK, but vapor lock with Jet A seems very far fetched to me. I would note that improperly blended fuel could have a much higher vapor pressure and still work OK in most cases as long as positive pressure was maintained. So if the electrics and the pumps went offline and the fuel vapor pressure was way too high, I suppose there could be vapors formed in the suction line going to the mechanical pumps. But I don't have nearly enough knowledge to proclaim that as a possibility. I presume they've taken fuel samples at the source and tested them. Here's a paper on Jet A vapor pressure:

https://www.researchgate.net/publica...Kerosene_Jet_A

I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.

I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.

The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.

tdracer addressed the shutoff valve operation earlier: "the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). "

There were simultaneous engine failures, but those were due to massive birdstrikes ( US1549 ) or due to epidemic engine failures on Il-62s of various versions (like LOT 007 or LOT 5055 ).

Fuel related total engine failures like Aeroflot 366 or Air Transat 236 at least had the decency to have the engines starve one after another as the fuel in the individual tanks depleted.

But all those are probably highly irrelevant when considering the Air India accident. An engine disintegration or a heavy birdstrike would have been visible on the videos, a sizeable bird would have left some remains. And gradual fuel starvation would have shown some yaw.

As much as I despise the thought, the issue that got AI171 must have come from within the aircraft, although this most decidedly does not infer any wrongdoing by any crewmember.

One thing that just came to my mind: We are scratching our heads why that happened after the type is in service for almost 15 years with millions of flight hours and surely hundred thousands of T/Os and landings.
What if it takes something to be worn/used after many years to get that kind of failure? The AI 787 was 11 years old. We have been discussing the fuel switches, but there are thousands of other parts that might contribute to such a failure in connection with some other problem.

With such high redundancies and a large degree of isolation between the engines, if it was indeed a simultaneous dual-engine shutdown, we don\x92t know of a single hardware component that could have worn out and caused it (as far as I know)

Shutting down the wrong engine is not extremely rare:

1. GoAir320 at Delhi
2. Transasia AT72 at Taipei
3. Alitalia A332 at Seoul
4. SA Airlink JS41 at Durban

Not saying it happened here!

Murphy . Maybe this was the first aircraft to receive fuel from a faulty storage tank . After that the airport was closed and nobody departed on this fuel ...

Most other here discussed scenarios are nonsense , e.g the system would simply ignore a cutoff command with thrust levers above idle .

Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a nonsense statement?
or
Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a description of how the system behaves?