Posts about: "Fuel (All)" [Posts: 1005 Pages: 51]

Gary Brown
June 19, 2025, 12:49:00 GMT
permalink
Post: 11905995
Originally Posted by Kraftstoffvondesibel
The spec sheet says 100,000 cycles.
Switches fail sometimes. I have changed lots of lots of malfunctioning toggle switches in my day.
But both at the same time?
It has to be a common thing happening at the same time.
Someone slipping both switches into a worn middle detent is such a thing though, that is one habit that could be developed. A slight bump at takeoff and they both go to cutoff. [emphasis added]
Or they are worn and theres an iphone behind the throttles, as someone mentioned.

The switches themselves are on-on 4 pole toggles, and doesn\x92t fail into one position over the other, and gravity would prefer the cutoff position in this design.

I mentioned I have used my share of switches, knobs and buttons. In much larger quantities than what you find in aircraft, but without the life and death factor, and thus no SOP.

Unexpected things happen, no one dies, but I myself brodcasted jolly sounding very inappropriate intro music over a very dark news report on the unravelling Joseph Frietzl case by dropping my phone on a switch. Several million viewers, a good chunk of which called to complain.

Grave errors can be banal.

Other than that, common connectors, the harness itself, I have seen a large amount of unexpected electronic things happen when those get bendt the wrong way.
The extended spec sheet for these switches shows that there are versions with a center indent, and others without. But the picture up above which is said to be of the 787/8 actual switch seems - to me - to not have a center indent option. Ie, it is either on or off, with a spring loaded lift of about 2mm needed to move it from one position to another.
Capn Bloggs
June 19, 2025, 12:55:00 GMT
permalink
Post: 11906000
Originally Posted by syseng68K
I guess it depends on the model
Obviously. If yours is the switch I think it is (with the metal, unscrewable dome) then yes, it is very different. Very hard to "balance" yours in the middle.
Not so the Boeing fuel switches: they can be relatively easily "sat" in the middle, on the centre raised bit and could be bumped either way. Hence our (non-787) FCOM saying make sure you jiggle them when you put it in the On position to confirm it's locked there.
Xeptu
June 19, 2025, 12:57:00 GMT
permalink
Post: 11906003
Originally Posted by Capn Bloggs
That is not a Boeing Fuel switch.
That's a Beechcraft Kingair starter switch
OldnGrounded
June 19, 2025, 13:06:00 GMT
permalink
Post: 11906009
Mods, feel free to remove this if you think it's not contributing.

Folks, the exchange here about the cutoff switches ("fuel control switches") is exactly the kind of discussion that contributes meaningfully to our collective understanding of one possible causal or contributing factor in the accident. Smart, well-informed people politely considering and evaluating the suggestions of others. No snark or sniping. Love it.

OldnGrounded
June 19, 2025, 13:51:00 GMT
permalink
Post: 11906035
Originally Posted by bbofh
Has anybody the skill, knowledge, hands-on system familiarity or diagrammatic access to examine the
Ground/Air,
gear-handle,
gear doors
gear position lights
emergency extension,
Throttle lever position and
W.o.W. circuitry - in any sanguine detail?
I hope/wish. I accept that it's not at all likely that TCMA is the/a culprit in this crash, but it is, like the cutoff switches, one of the few things designed and intended to shut down an engine in a very big hurry. It would be good to know as much as possible about how it determines the aircraft's ground/air state.

And add the radio altimeter(s). I think, but don't know, that they provide inputs to the FADEC TCMA function also.


Last edited by T28B; 19th June 2025 at 14:38 . Reason: brackets completed
Seamless
June 19, 2025, 14:08:00 GMT
permalink
Post: 11906053
I have read most of the thread (old and new). As a lawyer working in forensic investigations, I am constantly involved in problem-solving. My field of work also includes complex investigations related to insolvencies, which almost always require an analysis of the causes behind a specific, established outcome. In doing so, I naturally also have to deal with probabilities. However, it often turns out that the most likely or plausible explanation does not reflect what actually happened.

Many of the considerations I’ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.

With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought—and it was nothing more than that—was that their activation becomes more probable if it can occur accidentally. That’s how I came across SAIB: NM-18-33.

Another user then brought up an iPhone. That notion would, of course, be dramatic—but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the “Off” position. Due to the buttons on top of the switches, which provide some resistance, it’s even possible that the object both pulled and pushed them.

But all of this is speculation. The investigation report will bring clarity.

Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety—especially considering that the FCS are protected laterally by metal plates.
Aerospace101
June 19, 2025, 14:11:00 GMT
permalink
Post: 11906054
Originally Posted by PBL
It does not follow that MCAS malfunction is a software malfunction.
As far as I know, the software functioned exactly as it was specified/required to function. The problem did not lie in the quality of the software, as you suggest. It lay in the functional requirements for the function, and the hazard analysis of those requirements, and those are manufacturer tasks.
I thought this was a very good point. There are some detailed posts discussing the TCMA patent including this post . Is it possible the TCMA software functioned exactly as specified, and the issue is input data into TCMA?

In a total electrical failure, when the system switches to emergency battery power, how are input variables like rad alt and wow switches processed? (these were inputs someone mentioned on the 747-8, have the TCMA inputs been identified yet?)

I speculate the gear truck forward tilt is a symptom of a C hydraulic failure caused by a total electrical failure around the time of VR. Once they got 10 deg nose up on the rotation, with a total electrical failure, could the FADEC receive erroneous rad alt or wow inputs, and how would TCMA handle these inputs in the transition from ground to air logic?

What is baffling is the simultaneous nature of the suspected dual engine shutdown. There is no obvious asymmetry, with the flight path or rudder movements. If the engine fuel control switches had been manually cut one at a time, there should have been some visible flightpath change or flight control response. Something happened to both engines at exactly the same time.
DTA
June 19, 2025, 14:36:00 GMT
permalink
Post: 11906073
Originally Posted by Seamless
I have read most of the thread (old and new). As a lawyer working in forensic investigations, I am constantly involved in problem-solving. My field of work also includes complex investigations related to insolvencies, which almost always require an analysis of the causes behind a specific, established outcome. In doing so, I naturally also have to deal with probabilities. However, it often turns out that the most likely or plausible explanation does not reflect what actually happened.

Many of the considerations I\x92ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.

With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought\x97and it was nothing more than that\x97was that their activation becomes more probable if it can occur accidentally. That\x92s how I came across SAIB: NM-18-33.

Another user then brought up an iPhone. That notion would, of course, be dramatic\x97but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the \x93Off\x94 position. Due to the buttons on top of the switches, which provide some resistance, it\x92s even possible that the object both pulled and pushed them.

But all of this is speculation. The investigation report will bring clarity.

Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety\x97especially considering that the FCS are protected laterally by metal plates.
It is probable that the switches are becoming easier to move across the gate after 10,000 operations. Something falling on them would be a possibility to cause that. And there is certainly an argument to be had whether down=on is a safer way for them to operate.
sabenaboy
June 19, 2025, 14:51:00 GMT
permalink
Post: 11906087
Originally Posted by tdracer
OK, I promised some informed speculation when I got back, so here goes:
Disclaimer: never worked the 787, so my detailed knowledge is a bit lacking.

First off, this is perplexing - especially if the RAT was deployed. There is no 'simple' explanation that I can come up with.

GEnx-1B engines have been exceptionally reliable, and the GE carbon composite fan blades are very robust and resistant to bird strike damage (about 15 years after the GE90 entry into service, I remember a GE boast that no GE90 (carbon composite) fan blades had needed to be scrapped due to damage (birdstrike, FOD, etc. - now that was roughly another 15 years ago, so is probably no longer true, but it shows just how robust the carbon composite blades are - far better than the more conventional titanium fan blades).

Not saying it wasn't somehow birdstrike related, just that is very unlikely (then again, all the other explanations I can come up with are also very unlikely ).

Using improper temp when calculating TO performance - after some near misses, Boeing added logic that cross-compares multiple total temp probes - aircraft TAT (I think the 787 uses a single, dual element probe for aircraft TAT, but stand to be corrected) and the temp measured by the engine inlet probes - and puts up a message if they disagree by more than a few degree tolerance - so very, very unlikely.

N1 power setting is somewhat less prone to measurement and power setting errors than EPR (N1 is a much simpler measurement than Rolls EPR) - although even with EPR, problems on both engines at the same time is almost unheard of.

The Auto Thrust (autothrottle) function 'falls asleep' at 60 knots - and doesn't unlock until one of several things happens - 250 knots, a set altitude AGL is exceeded (I'm thinking 3,000 ft. but the memory is fuzzy), thrust levers are moved more than a couple of degrees, or the mode select is changed (memory says that last one is inhibited below 400 ft. AGL). So an Auto Thrust malfunction is also extremely unlikely. Further, a premature thrust lever retard would not explain a RAT deployment.

TO does seem to be very late in the takeoff role - even with a big derate, you still must accelerate fast enough to reach V1 with enough runway to stop - so there is still considerable margin if both engines are operating normally. That makes me wonder if they had the correct TO power setting - but I'm at a loss to explain how they could have fouled that up with all the protections that the 787 puts on that.

If one engine did fail after V1, it's conceivable that they shut down the wrong engine - but since this happened literally seconds after takeoff, it begs the question why they would be in a big hurry to shut down the engine. Short of an engine fire, there is nothing about an engine failure that requires quick action to shut it down - no evidence of an engine fire, and even with an engine fire, you normally have minutes to take action - not seconds.

The one thing I keep thinking about is someone placing both fuel switches to cutoff immediately after TO. Yes, it's happened before (twice - 767s in the early 1980s), but the root causes of that mistake are understood and have been corrected. Hard to explain how it could happen ( unless, God forbid, it was intentional ).

I think it's not a coincidence that tdracer's post was chosen to be the thread starter of part 2. I'll wait for the preliminary report to see it confirmed or disproved.
Kraftstoffvondesibel
June 19, 2025, 16:28:00 GMT
permalink
Post: 11906174
(re:skwdenier and the photo of the switch. )
And those wires, which all i can find points to having (non-english speaker) screw terminals. within the LRU shared by both switches. Those things go bad over time even when installed in non-movable equipment.
For those that argue that these are some kind of very special switches. They aren't. Sure they are really nice switches, but that series is available through normal distributors like mauser or elfa-distrelec in europe for, and the price isn't sensationally high compared to other switches.
I am curious as to how the LED light power is threaded through to the switch top. Why do they have a LED, in the first place? Seems a bit gimmicky.

Since they have such inherent damage potential in systems that are otherwise carefully isolated through redundancies and physical seperation, why aren't they? Why aren't the 2 cut off switches placed in 2 different locations in the cockpit. Seems like such a cheap insurance.

Sorry if I am adding noise, I know these are just one of many possibilities, and I am not knowledgeable enough to weigh these different theories against each other, but this switch thing is just something I know personally have more failure potential than what I thought were acceptable for this application.
lancs
June 19, 2025, 17:47:00 GMT
permalink
Post: 11906225
Originally Posted by Roseland
I appreciate the link to Musician's posts. I had read them before and have now reread them, and yes, they add valuable info although for me they did not discount the potential for a problem.
As I understand it, the fuel temperature is measured in the tanks, not just before the centrifugal pump and it's not inconceivable that the nacelles are warmer. I also understand that the Fuel Synoptic Display only turns to Amber if the temperature is too high. As it's not in red it might thought to be one of those "it will be OK" alerts, especially if it's not unusual in Indian summers..
From the EASA type-certificate data sheet for GEnx series engines, document no. IM.E.102, issue 11, dated 22/11/22:
1.3 Fuel Inlet Temperature (C):
At engine fuel pump inlet:
GEnx‐1B Engine Series
Temperatures \xb0C
Minimum ‐ 53.8
Maximum 65.5





BrogulT
June 19, 2025, 17:48:00 GMT
permalink
Post: 11906226
Originally Posted by Roseland
Thank you for explaining why I'm not seeing references to vapour lock.
It would be helpful if the theory could be discounted (with reasoning) and then I (and I suspect others) would learn why it is less plausible than double-this or double-that.
I think the mods are right to squelch vapor-lock theories because AFAIK there's no support for the notion that it would happen under these circumstances. I can provide a brief explanation but I don't know the operating parameters of a 787 fuel system so I can't speak authoritatively on that. I can speak authoritatively on modern automotive fuel systems where vapor lock on a running system is just not a thing, even though gasoline has much higher vapor pressures and cars can be operated in temperatures much higher than 43C with fuel temperatures to match.

This explanation comes with a money-back guarantee and if I'm wrong I'll send out refunds.

First, vapor lock is simply where a pump or other device becomes inoperative because it is designed to pump liquids but is presented with a gas (vapor) at it's inlet and thus cannot develop pressure and pump the fuel. Think of a very old car with a mechanical fuel pump on the engine block that draws fuel through a long tube from the fuel tank. If you shut the car off on a hot day, the residual heat may boil off the fuel in the lines and carburetor so that when you try to restart, there's no fuel anywhere and your pump has lost it's prime. It is key to note that even with a very crude system like this and volatile gasoline as a fuel, vapor lock usually only affects starting and not running engines. There are exceptions, of course.

The three key factors are the absolute pressure at a particular point in the fuel system, the vapor pressure of the fuel at whatever temperature it is at and system design. System design has all but eliminated vapor lock as a serious issue in the gasoline automotive world. At near sea level, the outside pressure is about 1 bar (15psi) and at 50C typical jet fuel will have a vapor pressure of perhaps 0.02 bar. So the only way to cause it to vaporize jet fuel, even at 50C+, would be to subject it to a very, very strong suction. AFAIK there are no vulnerable points where you'd have suction during normal operation because the fuel pumps are presumably (I don't actually know) immersed in fuel and the entire system has greater than 1 bar pressure all the way to the high pressure pumps. Even without the electric pumps, the inlet to the mechanical pump is below tank level. So absent some major fuel line restriction, there aren't any points where you'd have strong suction aka very low absolute pressure.

The discussions about fuel temperature also seem a big irrelevant to me--even at 60 or 70C the vapor pressure is still very low and I doubt you'd see significant vapors at all under 100C with any reasonable fuel system design and properly blended fuel . I'm assuming the fuel temperature limits are for other reasons, perhaps flash point or ignitabilty (TWA 800) or viscosity and lubricity concerns with the high pressure pump. Again, IDK, but vapor lock with Jet A seems very far fetched to me. I would note that improperly blended fuel could have a much higher vapor pressure and still work OK in most cases as long as positive pressure was maintained. So if the electrics and the pumps went offline and the fuel vapor pressure was way too high, I suppose there could be vapors formed in the suction line going to the mechanical pumps. But I don't have nearly enough knowledge to proclaim that as a possibility. I presume they've taken fuel samples at the source and tested them. Here's a paper on Jet A vapor pressure:

https://www.researchgate.net/publica...Kerosene_Jet_A

Last edited by BrogulT; 19th June 2025 at 19:34 .
CloudChasing
June 19, 2025, 18:05:00 GMT
permalink
Post: 11906239
Fuel valves and TCMA software updates?

Originally Posted by tdracer
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).

As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.

Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).

The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.

I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.

The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.

ams6110
June 19, 2025, 18:48:00 GMT
permalink
Post: 11906263
Originally Posted by CloudChasing
I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.
tdracer addressed the shutoff valve operation earlier: "the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). "
Tu.114
June 19, 2025, 18:49:00 GMT
permalink
Post: 11906264
There were simultaneous engine failures, but those were due to massive birdstrikes ( US1549 ) or due to epidemic engine failures on Il-62s of various versions (like LOT 007 or LOT 5055 ).

Fuel related total engine failures like Aeroflot 366 or Air Transat 236 at least had the decency to have the engines starve one after another as the fuel in the individual tanks depleted.

But all those are probably highly irrelevant when considering the Air India accident. An engine disintegration or a heavy birdstrike would have been visible on the videos, a sizeable bird would have left some remains. And gradual fuel starvation would have shown some yaw.

As much as I despise the thought, the issue that got AI171 must have come from within the aircraft, although this most decidedly does not infer any wrongdoing by any crewmember.
EDML
June 19, 2025, 18:55:00 GMT
permalink
Post: 11906268
One thing that just came to my mind: We are scratching our heads why that happened after the type is in service for almost 15 years with millions of flight hours and surely hundred thousands of T/Os and landings.
What if it takes something to be worn/used after many years to get that kind of failure? The AI 787 was 11 years old. We have been discussing the fuel switches, but there are thousands of other parts that might contribute to such a failure in connection with some other problem.
rigoschris
June 19, 2025, 19:01:00 GMT
permalink
Post: 11906271
Originally Posted by EDML
One thing that just came to my mind: We are scratching our heads why that happened after the type is in service for almost 15 years with millions of flight hours and surely hundred thousands of T/Os and landings.
What if it takes something to be worn/used after many years to get that kind of failure? The AI 787 was 11 years old. We have been discussing the fuel switches, but there are thousands of other parts that might contribute to such a failure in connection with some other problem.
With such high redundancies and a large degree of isolation between the engines, if it was indeed a simultaneous dual-engine shutdown, we don\x92t know of a single hardware component that could have worn out and caused it (as far as I know)
sSquares
June 19, 2025, 19:05:00 GMT
permalink
Post: 11906278
Originally Posted by Tu.114
There were simultaneous engine failures, but those were due to massive birdstrikes ( US1549 ) or due to epidemic engine failures on Il-62s of various versions (like LOT 007 or LOT 5055 ).

Fuel related total engine failures like Aeroflot 366 or Air Transat 236 at least had the decency to have the engines starve one after another as the fuel in the individual tanks depleted.

But all those are probably highly irrelevant when considering the Air India accident. An engine disintegration or a heavy birdstrike would have been visible on the videos, a sizeable bird would have left some remains. And gradual fuel starvation would have shown some yaw.

As much as I despise the thought, the issue that got AI171 must have come from within the aircraft, although this most decidedly does not infer any wrongdoing by any crewmember.
Shutting down the wrong engine is not extremely rare:
  1. GoAir320 at Delhi
  2. Transasia AT72 at Taipei
  3. Alitalia A332 at Seoul
  4. SA Airlink JS41 at Durban

Not saying it happened here!
aerobat77
June 19, 2025, 19:11:00 GMT
permalink
Post: 11906283
Originally Posted by za9ra22
Even if this were a possibility, would it not be almost certain other aircraft operating from this departure point would suffer similar problems too - even if not at the TO/climb-out phase of their flights?
Murphy . Maybe this was the first aircraft to receive fuel from a faulty storage tank . After that the airport was closed and nobody departed on this fuel ...

Most other here discussed scenarios are nonsense , e.g the system would simply ignore a cutoff command with thrust levers above idle .

EXDAC
June 19, 2025, 19:37:00 GMT
permalink
Post: 11906312
Originally Posted by aerobat77

Most other here discussed scenarios are nonsense , e.g the system would simply ignore a cutoff command with thrust levers above idle .
Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a nonsense statement?
or
Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a description of how the system behaves?