Posts about: "Fuel (All)" [Posts: 1005 Pages: 51]

This sounds convincing, but I have read the investigation report on Jetstar Airways serious incident (VHVKJ) with great attention, and if I understand it right, things may be a bit more subtle:

First, the problem involves the valves (notably but not exclusively FMV and FSV), not the combustion of the product:
Second, the doses apparently don't need to be that high to result in a problem. A x10 dose seems sufficient:
Third, the main cause of the incident seems to be associated with magnesium salts dissolving in water instead of fuel:
Fourth, and despite the report indicating that ( my bold ) "In this serious incident, it is highly probable that, when the Aircraft was descending for landing, there occurred oscillation in rpm of each engine causing both engines to temporarily fall below idle at separate times because Residue primarily composed of magnesium salts accumulated in spools impeded movement of spools that involved in fuel metering of both engines.", it should be noted that the reported "rpm oscillations" of left and right engines were close to each other in time:



These "rpm oscillations", leading to substantial loss of thrust, could as well have occurred simultaneously, and 81 seconds (for the RH engine) is an awfully long time. According to the report, Kathon FP1.5 is not used anymore for biocide treatment, but another contributor ( nachtmusak , who seems to be a petrol specialist) suggested that other products may have similar effects .

Therefore, regarding the case we are discussing at large (thanks again, mods!), I think we shouldn't overlook the hypothesis of fuel contamination by biocide, since it is a single point of failure (among a very limited number of SPoFs) from a system analysis point of view.

Yes - Yes it does.
However, that water scavenge works by picking up fluid from just next to at aft boost pump inlet, and dripping it into the aft boost pump inlet. Powered by the motive flow of the aft boost pump.
Whereas the suction feed inlet, is - although not far away - in a different location that could itself be sitting in water.

After a good look at the SDS - It seems like the system is assuming a small amount of water, with fuel flowing.
But when the centre tank override pumps are doing all the supply, its the same fluid being circulated in the same bay. If there is a 'lot' of water, then the aft boost pump is just circulating water (or very water rich fuel).

I think the key point of my post was that in an significant power failure, when the pumps stop working, the fuel supply is changed from centre to wing tanks, that it will take a few seconds from after the pumps stop working, to the fuel being received at the engines to be coming from a different source. That source being the bottom of the wing tanks. If the fuel quality is very different in the 2 different locations, the engines are going to struggle.

My understanding of the 78 fuel system is it\x92s very similar to the 777; assuming center tank fuel all pumps are turned on for takeoff (the center tank override pumps are at higher pressure than wings so it feeds first). If all electrical power is lost at lower altitudes engines suction feed just fine (probably from the wing tanks).

I don't think ‘worst case scenario will be preferred’ is the philosophy they use. The way tdracer explained it, there can't be any single failure that leads to uncommanded high thrust on the ground. Presumably, each FADEC channel is treated as a single 'fault isolation area.' That's why the inactive channel has to be able to effect a shutdown in case the active channel causes a runaway.

For the sake of argument, imagine if every air/ground sensor had to say 'ground' to enable TCMA. That should still meet the 'no single failure' requirement since you'd need at least 2 failures to get a runaway engine: the original thrust control problem, and a faulty air/ground sensor.

IIRC, he said that the 747-8 looks at weight on wheels, gear truck tilt, and radio altimeters. At least one of each has to say 'ground' for TCMA to be enabled.

It would be nice if there were some `cutaway` drawings of the centre tank,not generic` block `diagrams,and it`s venting/pressurising system..If anyone has such or knows where it can be found ,I`d be grateful..I presume it is a metal `box`,but sealed,not with an internal Bag-tank...How often are they internally inspected? Presumably by a `robot`...? Is there a `procedure`,either by aircrew or engineering to check that the `suction` system works..ever.ie after landing are all the fuel pumps turned off,(each engine /not together),or engine `run-ups` after a big `maintenance ` job...?...I have a vision of a `hissing Sid` finding a nice vent to get into..not that uncommon in the tropics...

There's actually no discrepancy.

The HPSOV is made up of 2 parts which I'll call the main valve and the pilot valve. The pilot valve is actuated by a solenoid and supplied with fuel from the high-pressure side. The main valve is held shut by a spring. As long as the pilot valve is open and the high-pressure fuel pump is operating, fuel flows through the pilot valve, then pushes and holds the main valve open. The pilot valve and solenoid are 'latching,' i.e. they maintain their position until electrical power is applied. However, a certain pressure still has to be provided by the pump in order to hold the main valve open. Note that when I say 'high-pressure fuel pump,' I'm referring to the one that's mechanically driven by the engine's high-pressure shaft, not any of the electric pumps.



Note: The HPSOV is mistakenly labeled as 'PSOV' in this diagram.

I read the whole threads, keeping my hands on the mousewheel so far since I'm not a pilot, just a EE / safety / systems engineer.
The hamsterwheel ist spinning a lot here, and of course it could be anything including some VHDL FPGA code line or a broken RAM cell in a cheap memory bar within the computer it was compiled with. Anything is possible, but to be honest: development processes, if followed, are usually pushing the probability to a level where it becomes pure theory. BOSCH uses FPGA+\xb5C on the brake control box of cars. They sold 100 millions of those, used 4000h each (car lifetime) without error, with less strict development process. Most errors are made on requirement level, not code.

Also, so far there is no evidence I've seen regarding the 'chicken-egg' problem, did the engines fall below idle (fuel, stall...) and this caused an electrical blackout (-> battery, RAT...) or did an EE problem cause the engines to reduce thrust (FADEC, SW bug...). And where is the common cause in all this?
There has to be a systematic error common to both engines, an external failure affecting both or a dependent fault with one affecting the other within seconds. This is the only thing I think everyone agrees here. And I refuse to beleave the external failure or dependent fault was sitting in the cockpit.
I think it is something not common to every aircraft type for the last 50 years.
So I started searching and found a candidate.

I read myself into the EE architecture of this unique 'bleed-less' design and it's megawatt powergrid since this is the part where I may be able to contribute (and I'm most curious about). Generators on the 787 are >250kW instead of <100kW each and there are two per engine instead of just one. In fact, they can go up to 516 kW and shear off the gearbox at >2200Nm (equal to >2 MW, per generator).
https://www.easa.europa.eu/en/downloads/7641/en (page 11)
So while on any other aircraft the generator is more like the dynamo on your bicycle, those generators are massive (x10).
The gearbox is connected to the HP shaft (N2) on the GEnx. I learned from Wikipedia that RR moved this gearbox to the IP shaft on the Trend 1000. And RR is happy that the A330neo Trend 7000 uses bleed air and less load on the gearbox, since this maintains stability on the HP shaft at light load (also Wikipedia).
Those generators are not in phase and frequency sync, or in other words: If you parallel them, they fight each other, it's like a short. They will almost block if this is not handled by the control box if possible (or some melting fuse blows at some point).
787 electrical system - variable frequency generators?
Somehow I find it hard to believe that they are not able to disturb the engines despite that everyone here so far is claiming that there is no way an electrical problem could influence them because FADEC has it's own supply. I read that one is sufficent to start the engine, usually both are used.
In my mind I find lot's of ways this could influence both engines simultanously. If just the BTBs on the 230V grid got some humidity (hot, no AC, water cooling...) and went up in one big arc (I think they made them semiconductor relays, too).
Could those gearboxes and engines handle 4500Nm / almost 5 MW on each HP shaft, applied within a fraction of a second without any problem?
Or if the engines were in a condition not far from compressor stall, one was stalling and 400kW load jumped from one engines generators to the other...
I did some rough estimation and one of the generators could push N2 below idle in a second or less without fuel just with its normal 250kW load (just inertia).
This is one point which is unique to this airplane model, so maybe worth a closer look.

I know that those engines are burning at >100MW at full power, but how fragile in the balance between compressor load and this one turbine stage on the HP shaft / N2, without the inertia of a 2.8 meter fan? This is just out of my background, any thermodynamic expert here?
Of course I also have no insight in SW and communication within the control boxes, how much they are talking to each other, delaying/ramping load redistribution etc. If FADEC recognizes a flameout, could it instantly command the generators to cut the load, even above idle rpm?

I would assume that some fuel contamination, valve blockade, even compressor stall would pop up slower. But such a generator could kick in within milliseconds.

As a safety guy I learned that one tends to look first at things one is familiar with (SW, HW, mechanics, pilot behaviour, maintainance, depending on one's profession) and in the end it's often the interface and dependent faults within which are not carefully considered (e.g. takeoff situation vs. thermodynamics vs. mechanics vs. power generation vs. humidity vs. generator control...) together with transient behaviour. It was the same with MCAS (safety culture vs. pilot training vs. SW design (repeated action) vs. single AOA input vs. bird strike probability close to ground vs. trim loading/blockade vs. stickshaker noise/distraction).
In fact, I was trying to find information on all those systems and directly found slides on how the engines and generators could be simulated and the power grid tested in a HIL (hardware in the loop) environment. My experience from automotive is that such simulated environments are often far from reality and HIL environment programming finished after the product is already at the customer. But of course its far easier and cheaper to apply and test faults there. But then, some programmer programms what he thinks the reaction of the engine would be.
This 'bleed-less' design was some massive change in airplane EE architecture with hugh consequences on the whole airplane design and extremely hard to fully analyze.

I'm just asking questions and hope that we all learn a lot and this was fully considered or just not an issue. It's just an aspect I found worth mentioning and not only spinning the wheel.

PS: I doubt it was TCMA. The air/ground decision is done in a different box, evaluating 5 inputs in a 1/3 and 1/2 decision according to this discussion. This is then safely sent to the FADEC (as one input) and combined with the thrust lever position and N2. But if the thrust lever position is sensed (redundant and direct) close to idle, you do not need TCMA or ground mode to expect reduced thrust.

The Centre Wing Tank is as it says the centre of the wing. The top and bottom skins continue the aerofoil section through the fuselage, with the front and rear spars' webs forming the fore and aft ends. The inner surfaces of the top and bottom skins have spanwise 'stringers' (well that's what we called them at Airbus), which are 'I' sections attached to the inside to provide stiffness to the skins. The inner faces of the centre wing tank are the tank. There is no separate fuel bag.
The tank is unpressurised. It is vents to atmosphere throughout the flight. There is a fuel tank inerting system which feeds nitrogen-enriched air into the ullage (air space above the fuel). On the 787 it does this on all tanks. Other airliners only do it on the centre wing tank (and any other fuselage tanks if fitted).
Entry to the tanks once they have had fuel in, generally needs breathing apparatus once it has been in service.

Pictures of the inside of a completed 787 Centre Wing Tank aren't easy to find. This shows either the upper or lower skin with its stringers.

OK - Fair Challenges - good post, I'll have a go at answering and simultaneously expanding my own thoughts. In fact I'm not having a go at you, I'm more working my theory....

Experience. Without wishing to dox myself, I've worked in engineering at a major airline from apprentice through (in no particular order) Line Maintenance, Heavy and Light Maintenance, to technical support and maintenance control on both Boeing and Airbus products, with various qualifications and authorisations along the way. [Hmm - Scrap this sentence?]On the day 9/11 occurred, I should have been making modifications inside a fuel tank instead of staring at the TV with mouth on the floor.
However, I would describe my experience as broad, yet shallow in respect to this incident. Some of my fleet I know every rivet. Some of my fleet I've only ever seen from a distance. I don't touch airplanes for a living any more. B787 though - is not my area of specialty. I'll dig in, but am not the expert. I am not a systems design engineer, so precise numbers and flow rates, are not what I do. But what the systems do, how they operate, what they look like, smell and taste like... yeah, I'm not a muggle. And I do have access to all the manuals and know how to use them. And - let me be clear, I am speculating. I was advancing a theory. It WILL be some flavour of wrong. The investigation will reveal all.

I Agree, Water in fuel is not a novel concept. Aircraft fuel tanks attract water - fact. How much? It varies. I've sumped tanks and got no water, I've seen drops of water beading about in the bottom of a gallon jug, I've seen gallons of water. I've been so covered in fuel I cant smell it or think straight and taken gallon after gallon not being able to tell if its fuel or water. I also agree that 57% humidity doesn't seem particularly high - its not south east Asian jungle levels - but I'm not an expert at humidity, 32Deg c at 57% humidity at 02:30 am is not going to be comfortable for me though. I looked at recent weather in DEL, and those values were at the higher end of the range.
Further, I believe the prevailing weather conditions on the ground are less important when it comes to the volume of water getting in. Fuel is cold, or gets damn cold during a 9 Hr flight. Fuel Temperature Management is an issue for our Drivers. So as the fuel is used at altitude, Air enters the tank through NACA Ducts in the outboard end of the wing. Its beneficial to maintain a slight positive pressure, amongst other things to reduce evaporation. (Added complication, there is also the Nitrogen Enrichment system due to TWA800 - but that's more about processing the air in the tank to change the properties and make it non-explosive). Then as the aircraft descends, more air enters as the air pressure increases. Its the humidity of that air in the descent that is going to determine the volume of water entering the tank and potentially the fuel. The water in the air condenses on the sides of the tank because of the cold post-flight fuel. It doesn't dissolve into the fuel, but sinks to the bottom. Ground temperature / humidity and time will likely affect how much water condenses out of that air while on the ground. There won't be a huge amount of air exchange on the ground. Likely if the AC landed at 2am, then from sunrise as the tank warmed up, there would actually be a flow out of the vents.

What Features and procedures are there to mitigate Water? I apologise if my post gave the impression that there are no mitigation processes. There are. Water is well understood in the industry.
Well for a start, Features / Design. The Aircraft has a water scavenge system. Water doesn't mix with fuel, it sinks to the bottom being about 20% denser than fuel, so at the very lowest point in the tank, the water scavenge system (Powered by the Aft Fuel Pump through a jet pump, a venturi like system) will suck up the 'fluid' at the very lowest point, where the water would collect and in Boeings words 'drip' that fluid into the path of the pump pickup inlet (but I'd describe it more as a 'squirt'). The idea being that a small amount of water injected into the fuel will be consumed by the engines harmlessly.
There is also agitation. The wing tank pumps are pretty much running constantly, from before engine startup to after engine shutdown. The pumps are quite violent to the fuel and supply more pressure then the engine could ever need. Any excess pressure is dumped right back into the tank, quite close to the pump, in a direction that would further stir up the fuel and help break up any water into suspended droplets.
This all works if there is a small amount of water in the fuel. The water scavenge pickup is right next to the pump inlet, but a bit lower. Little bits of water get managed. Looking at the pictures of the system, I'd say a couple of gallons of water would do no harm at all.
But if there was significantly more water in that tank. Guessing 10-30 + gallons, then the pump would be circulating water, or highly water rich fuel.

Then there's the suction pickup. Its in the same 'bay' as the aft fuel pump and located a little 'higher' than the pump inlet and water scavenge inlet. But also located between stringers that can separate out the settled water ( I wish I could share the pictures, but more than my job is worth ) I can imagine the suction pickup being in a pool of 'stagnant' water.

I also saw a post from Metcha about the scavenge system blocking with Algae - I don't know about that (B787 not my fleet). But possible that could aggravate things. There's also the reports of the Indian AAIB looking at the Titan Biocide incident. Its possible that might be related and could modify the theory.

Procedures - There's the (at my airline weekly I think) procedure to 'sump' the tanks. There are drain points in the tank. Valves that you can push in with a tool and fluid drains. As described earlier (and videos exist on YouTube), you drain about a gallon of fluid and examine it for water. Most often in temperate climates (my experience), there's a few 'beads' of water in the bottom of the jug, moving about like mercury. Except when there's more. Sometimes there's a clear line in the jug, half water, fuel above. And sometimes a gallon of water, that smells like fuel. You drain it until you are sure there's no water.

Could 'that much' water have condensed in the tank? Well - There's the question. I guess the basis of the theory is that on descent into DEL, the wing tanks picked up some very humid air, which settled water into the tanks through the night. Then, as the theory I posited must work, the wing pumps must have circulated and suspended that water into the fuel.
By design, the water from the CDG-DEL arrival should have been consumed in the DEL-AMD Sector. But desperately clinging to defending my theory (I appreciate this is a hole), lets assume that at DEL the pumps were running for a long time. Lets assume that the pumps allowed the water to be dispersed within the tank prior to being used through the engines. Then - in the DEL-AMD sector, the wing tanks could have picked up more water.

How much water would cause a sustained flameout? I never posited a sustained flameout. I posited a significant reduction in thrust. Listening back to the rooftop video, which at first we were all listening for evidence of RAT, there's also a rhythmic pop-pop-pop of engines struggling. I think the engines were running, albeit badly. Heavily water contaminated fuel will do that. It doesn't have to be 100% water. Just enough water to make the engine lose thrust. Your 2 gallons per second figure assumes the engine running at full flow. I'm not a figures man, I'll not challenge that, I do recall flowmeters at max thrust spin like crazy. But an engine struggling due to a high perrcentage of contamination, is that using 2 gal/sec? or just trying to? What happens if there is e.g. 20% water in the fuel?

There are also reported incidents of engine flameout / thrust reduction that have all happened at altitude. Incidents that have been recovered due to the altitude and time available. I Posited that the engines would have eventually regained full thrust once the contamination worked though. But 30 seconds of rough engine is very different at 40,000 feet than it is at 100 feet.

The theory also relies on a second part - the electrical failure. That the electrical failure causes the fuel supply to switch, a few seconds after the failure. We go, at the point of electrical failure from a pumped centre tank supply to a sucked wing tank supply. It takes time for that different fuel to reach the engine.

Ive written enough and am tired. Must stop now.

Yeah, some fuel samples make you go "Whaaat?" And then you keep draining fuel to see how much is in there, and you call up the Maintenance Control folks and tell them "We have a bad sample out here, call those idiots at the fuel farm..."
I like the cut of your jib.
Not sure if you are right, and not familiar enough with 787 to check the fuel flow logic, but a friend of mine dead-sticked a single engine trainer into a field due to water in the fuel ... 20 minutes after takeoff.
It could have happened earlier.

SLF Engineer (electrical - not aerospace) so no special knowledge

Perceived wisdom may be applicable in normal circumstances but not when all the holes line up.

For example I've seen it quoted many times that the engine FADECs are self powered
by the engines, the TCMAs-whether part of the FADEC or a separate unit, similarly self contained
within the engine. The perceived wisdom seems to be that there is no common single fault
which can take out both engines.

And yet we're also told that the TCMA function can only function in ground mode and receives ground-air
signals from a combination of inputs from Rad Alts and WOW sensors.
There is therefore a connection from the central EE bay to the engine.

Yes I'm sure the Rad/Alt and WOW sensor processing will use different sensors for each side and powered from different
low voltage buses.
However as an analogy, in your house your toaster in the kitchen may be on a separate circuit from the water heater in
the bathroom, each protected by a fuse at the main switchboard. In normal operation a fault in one cannot affect the other.
However a lightning strike outside the house can send much higher voltages than normal operation throughout the entire
system and trash every electrical appliance not physically disconnected at the time.

Now I'm not suggesting the aircraft was hit by lightning but FDR has proposed a single event, buildup from a water leak entering
one of the EE bays at rotate. It would be possible for one or more of the HV electrical buses to short so that all the low voltage
buses go high voltage. I have no knowledge of how the FADEC / TCMA systems connect to or process the Ground-Air signals but
there is a single fault mechanism whereby high voltage could be simultaneously and inappropriately applied to both engine control systems.
It would be unfortunate if this failure mechanism did cause power to be applied to drive the fuel shut off valve closed.

Since the likelihood is that we're looking at a low probability event then perceived wisdom about normal operations and fault modes
might not be applicable.

The equipment on RAT/battery is limited:


(from the online 2010 FCOM)


(from the maintenance training )

The 787 battery fire report says the two recorders are on the left and right 28VDC buses. I don't think those get powered on RAT by the looks of it. I would wager you get whatever is on the 235VAC 'backup bus', plus the captain's and F/O's instrument buses via C1/C2 TRUs. You won't get all of that (like the F/O's screens) because the 787 energises/de-energises specific bits of equipment, not just whole buses.

Losing recorder power looks entirely expected.


400VAC/540VDC (+-270V) is not really known for blowing past input protection in the same way as actual HV or lightning. I would expect some optocouplers and/or transformers to be both present and adequate. There's definitely some big MOVs scattered around the main 235VAC buses.

Weight on wheels appears to go into data concentrators that go into the common core system (i.e. data network).

Presumably there is a set of comms buses between the FADECs and the CCS to allow all the pretty indicators and EICAS alerts in the cockpit to work. The WoW sensors might flow back via that, or via dedicated digital inputs from whatever the reverse of a data concentrator is called (surely they have need for field actuators other than big motors?). Either way, left and right engine data should come from completely different computers, that are in the fwd e/e bay (or concentrators/repeaters in the wings, maybe) rather than in with the big power stuff in the aft e/e bay.

I have to both agree and disagree with both this and the next post by TryingToLearn.

Yes, there may be (let's assume is) "identical" FADEC/TCMA hardware and firmware on both engines, but if the Left Engine is subject to Mars in the house of Uranus (wink wink), then the Right Engine cannot be, maybe it's Venus in the same House. This is simply because the Left engine TCMA 'contraption', I'm going to call it, is monitoring Left Engine Conditions (Shaft Speed, T/L setting / position data - Right or Wrong, and calculating and comparing accordingly against its internal map) while the opposite TCMA "device" is monitoring and calculating etc, Right Engine Conditions. There are some things in common, but (I say) it's virtually impossible for the Engine Conditions being individually monitored to be identical in both engines.

The Thrust Levers are electro-mechanical devices, almost certainly at this stage pushed by a somewhat squishy human hand, likely with a slight offset. What is the probability that those two levers are in identical positions, and even if they are, that the calibration (e.g. "zero points") of both levers are identical, and that the values they output (response slopes/curves) are exactly matching in every matching point in their individual travels? That's just one aspect, but consider the engines. They are different ages. Have different amounts of wear. They have separate fuel metering valves (or other names), separate HP Fuel pumps (and, I guess relief valves?), all also subject to wear), and each has a host of other, correspondingly paired, sensors, (maybe of different makes and certainly of different ages and different calibrations and response curves) from which each FADEC, supposedly independently of the TCMA, adjusts the fuel metering device settings and resulting engine power, and shaft RPMs follow in some other slightly non-matching way.

Sure, I would completely agree that the two engines and their calculated Throttle Lever positions to Shaft RPMs are always going to be similar during normal, matched operation, and they will very likely dance with each other, maybe one 'always' (75% of the time, say) leading during one dance (TO, say) with the other leading in dancing to a different tune (descent, say).

To me, the fact that this appears to have been an almost simultaneous dual engine failure, pretty much, for me, rules out a FADEC/TCMA firmware bug, especially as there don't seem to be any reports of even a single engine mid-air TCMA shutdown.

HOWEVER, and I want to stress this, that doesn't rule out the possibility that both TCMAs shutdown their respective engines simultaneously. Any lack of simultaneity observed would be due to those slight differences in other pieces of hardware, such as the time for one Shutoff valve to close versus the other.

As far as I know, there isn't enough information on what's actually inside those TCMA Black Boxes to say anything for sure, but here's a thought, which I think has been alluded to, or the question asked, here in one or other thread, earlier.

What does the TCMA firmware do when an engine is already running at a high power setting and TWO things occur in quick succession? I suspect this kind of event is a highly probable cause, but these two events have not occurred close enough together, or ever, before.

Imagine this: Plane taking off, Throttle Levers near Full Power, Engines performing correctly, also near Full Power, Rotation etc all normal, plane beginning to climb, positive rate achieved.

Pilot calls GEARUP. GearUp, activated.

The Gear Retract sequence begins. Due to some unforeseen or freshly occurring (maybe intermittent short or open circuit) linkage between the gear Up sequence and the WOW or Air/Ground System, the signal to both TCMAs suddenly switches to GROUND. All "good", so far, as the engine RPMs match the Throttle Lever settings and TCMA doesn't flinch. The plane could be in a Valid Takeoff sequence, so it had better not! But it does make a bit of sense. How is WOW / Air/Ground detected? Somewhere near the Landing Gear, I assume.

HOWEVER, now, a moment later, and perhaps due to a related system response, the Thrust Levers suddenly get pulled back to Idle, whether by man or Machine.

What would you expect the TCMA system to do? I would guess, fairly soon thereafter, two, independent, Fuel Cutoffs... Though I fully admit, I'm guessing based on a severe lack of knowledge of that Firmware.

Ok, no need for further explanation on that point, but I did refer to TCMA unflatteringly as a contraption, earlier. Last night (regrettably, before bed) I started looking at the TCMA Google Patent. Let's just say, so far, I'm aghast! My first impressions are bad ones. How did this patent even get approved? What I suspect here, now, is not a Firmware bug, but a serious Logic and Program Defect. But we'd have to see what's inside the firmware.

When I get more time, I'll dig deeper.

This is some news:


Civil Aviation Murlidhar Mohol interviewed

From the link above:
The minister called the crash a "rare case". "It has never happened that both engines have shut down together," he said

So they have no clue even with both recorders read out, why both engines shut down at the same time.

Sabotage on the electrical fuels shut down:
Would require detailed knowledge about the wire routing, which is independent for both engine sides, so any "device" would be difficult to get into the electric harness. I would rule that out, unless they find foreign devices wired in on the wreck, because there are way simpler methods to get an airliner down.

Fuel contamination:
There is no smoke, no puff, nothing visible on the exhaust. Both engines went from clean burning to immediate shut down at the same time within less than a second. I think that is close to impossible with any method of fuel contamination you can come up with. There ist always some mixture you would burn and the less perfect burn rate would show as smoke. At take off you have something around 5kg per second fuel burn rate per engine, so you have to come up with non combustible "fuel" in this rate on the exact time on both engines.
Highly improbable.

I find it very disconcerting that with downloaded recorders the investigators seem to have no clue how and why the dual engine shut down happened. How can they be sure that this unrecoverable problem was/is limited to the AI171 flight.

This has also been touched upon earlier in the thread, but it rather seems the cut-off switches are in the same LRU, in close proximity, using the same connector and goes through the same wiring harness. No one was able to say whether it works purely by digital signaling, and goes through any common software, or if it is duplicated by purely direct signaling. There might be numerous failure modes of the cut-off switch design, it is obviously very, very robust and overall sound, since dual failures here have never happened, but this is alredy an outlier event.

Again, disclaimer that my direct knowledge of the 787 specifics is limited, standard Boeing design practice is that all engine wiring is segregated between engines (and were practical, between FADEC channels).
The fuel switches are located adjacent to each other; however all the wiring would be separate.

Well, to be fair, the poster who posts next after this post did explain this with good clarity earlier on in the thread.

It may be work reading back before you post, but it's more work expecting posters to repeat what they have offered before. I know that this is a very long series of posts, but all technical topics have been touched on by now, so please do search back, and assure that what you're thinking to post is actually new information. The moderator team are now deleting posts which resurrect previously dispostioned theories, without providing any new thoughts - just to keep between the guardrails on this one.

Engine isolation means just that. No common wire bundles, no common connectors. You can move the fuel levers at any time - there is no lockout of any kind with respect to thrust lever position (imagine dropping something into the lever linkage that jams the thrust lever at max power - then being unable to shut that engine down?)
Obviously, since the thrust levers are placed next to each other - the separation that's available in the center console is limited, but as soon as the wiring exits that constrained area, the separation increases. Furthermore, the same engine-to-engine wiring separation also applies to channel A/B FADEC channels, as well as the fuel switch/fire handle wiring.
All these requirements are documented in the Boeing DR&O (Design Requirements and Objectives) - and there is an audit done late in the design process to insure compliance.
In short, you're barking up a tree stump - there is nothing there.

If we are to take the TCMA patent at face value, the fuel cut-off switches are directly-acting, not some sort of signalling protocol.

That's a pretty big "if" but here's the patent drawing: