2025-06-12T22:34:00
permalink Post: 11899800
One example of fuel contamination causing a significant loss of thrust on both engines at low altitude.
But it seems extremely unlikely for contaminated fuel to impact both engines at exactly the same time, with no asymmetry and no surges or smoke.
What can cause a sudden catastrophic loss of thrust on both engines at exactly the same time?
Birds (but no apparent surges)
Inadvertent movement of the fuel cut off switches (which would be an incredible error but I suppose it could conceivably be muscle memory having done so recently after the last leg\x85weirder things have happened. Remember the 767 events of the late 80s)
Intentional shutdown of the engines (pilot suicide has happened before)
Some catastrophic electrical/FADEC/engine interface failure (which I highly doubt is feasible in a modern 1309 aircraft)
I can\x92t think of any others\x85
2 users liked this post.
2025-06-13T00:12:00
permalink Post: 11899855
From the airport CCTV video it looks to me like a normal takeoff and start of climb, until suddenly there's a loss of climb performance with no obvious upset at that point. From the picture of the wing post crash it looks like the flaps were still deployed (N.B. based on pre-accident photos that's the right wing so closest to the camera is aileron and flaps are further away, damage had me confused first time), so I'm going with loss of thrust rather than flap retraction.
From the videos from bystanders it looks like RAT deployment (both sound and zoomed in pictures) rather than thrust lever retard, and that would also explain failure to retract gear - if you are dealing with both engines out at that altitude then gear isn't your first thought. From the airport CCTV video I don't see anything that looks like bird strikes at that point in the climb i.e. no obvious flocks of birds, no smoke out of the engines, no slewing one way as one engine fails and then the other is cut by accident - plus you wouldn't cut the engine at that point, you'd climb on one engine and then sort it out.
Even fuel contamination or water build up in both tanks is likely to result in one engine failing a few seconds before the other. So I can't come up with anything other than both fuel cutoff switches that would result in loss of thrust and RAT deployment. Looking at a picture of the cutoff switches https://www.nycaviation.com/2013/08/...is-fired/30179 I don't see how they get hit by accident.
I'm confused, hope we get an FDR / CVR readout soon.
From the videos from bystanders it looks like RAT deployment (both sound and zoomed in pictures) rather than thrust lever retard, and that would also explain failure to retract gear - if you are dealing with both engines out at that altitude then gear isn't your first thought. From the airport CCTV video I don't see anything that looks like bird strikes at that point in the climb i.e. no obvious flocks of birds, no smoke out of the engines, no slewing one way as one engine fails and then the other is cut by accident - plus you wouldn't cut the engine at that point, you'd climb on one engine and then sort it out.
Even fuel contamination or water build up in both tanks is likely to result in one engine failing a few seconds before the other. So I can't come up with anything other than both fuel cutoff switches that would result in loss of thrust and RAT deployment. Looking at a picture of the cutoff switches https://www.nycaviation.com/2013/08/...is-fired/30179 I don't see how they get hit by accident.
I'm confused, hope we get an FDR / CVR readout soon.
2 users liked this post.
2025-06-13T01:31:00
permalink Post: 11899908
Having read all the posts, watched the videos and with a 30 year background interest in air safety, I have a nagging feeling that the engine fuel cut off switches were pulled just after take-off. I am not saying this with the intention of idle speculation, it is just that to me nothing else seems to make sense. To anyone disagreeing with this, I really hope you are right and I am wrong.
16 users liked this post.
2025-06-13T01:49:00
permalink Post: 11899917
Having read all the posts, watched the videos and with a 30 year background interest in air safety, I have a nagging feeling that the engine fuel cut off switches were pulled just after take-off. I am not saying this with the intention of idle speculation, it is just that to me nothing else seems to make sense. To anyone disagreeing with this, I really hope you are right and I am wrong.
2025-06-13T02:18:00
permalink Post: 11899930
Determined to be an ergonomics problem with the switch layout in the flightdeck.
Early 767s (JT9D and CF6-80A) had a supervisory "EEC" (Electronic Engine Control - Boeing still uses "EEC" to identify what most people call the FADEC on modern engines). The procedure if an EEC 'failed' was to switch both EECs off (to prevent excessive throttle stagger - unlike FADEC, the engine could operate just fine with a supervisory EEC failed).
Problem was that the EEC ON/OFF switch was located on the aisle stand - right above the fuel cutoff switches. Turned out 'muscle memory' was when the pilot reached down there, it was usually to turn the fuel ON or OFF - which is what they did. Fortunately realizing what he'd done wrong, the pilot quickly restored the switches to RUN and both engines recovered. And yes, they continued on to their destination (RAT was still deployed since there is no way to retract it in-flight).
Previous event was with JT9D engines (United IIRC). In that case, only one engine recovered (second engine went into an unrecoverable stall), they simply came back around and did a single engine landing.
Realizing the ergonomic issue, the EECs were relocated to the pilot's overhead (retrofit by AD).
To the best of my knowledge, there hasn't been a repeat of an inadvertent dual engine shutdown since the EEC switches were relocated. It's also very difficult to 'accidentally' move the switches as there is a locking detent - the switch must be pulled out slightly before it can be moved to CUTOFF.
Last edited by T28B; 13th Jun 2025 at 02:22 . Reason: again, broke up the text to be reader friendly, great input!
11 users liked this post.
2025-06-13T09:03:00
permalink Post: 11900213
https://assets.publishing.service.go...211_G-POWN.pdf
One example of fuel contamination causing a significant loss of thrust on both engines at low altitude.
But it seems extremely unlikely for contaminated fuel to impact both engines at exactly the same time, with no asymmetry and no surges or smoke.
What can cause a sudden catastrophic loss of thrust on both engines at exactly the same time?
Birds (but no apparent surges)
Inadvertent movement of the fuel cut off switches (which would be an incredible error but I suppose it could conceivably be muscle memory having done so recently after the last leg…weirder things have happened. Remember the 767 events of the late 80s)
Intentional shutdown of the engines (pilot suicide has happened before)
Some catastrophic electrical/FADEC/engine interface failure (which I highly doubt is feasible in a modern 1309 aircraft)
I can’t think of any others…
One example of fuel contamination causing a significant loss of thrust on both engines at low altitude.
But it seems extremely unlikely for contaminated fuel to impact both engines at exactly the same time, with no asymmetry and no surges or smoke.
What can cause a sudden catastrophic loss of thrust on both engines at exactly the same time?
Birds (but no apparent surges)
Inadvertent movement of the fuel cut off switches (which would be an incredible error but I suppose it could conceivably be muscle memory having done so recently after the last leg…weirder things have happened. Remember the 767 events of the late 80s)
Intentional shutdown of the engines (pilot suicide has happened before)
Some catastrophic electrical/FADEC/engine interface failure (which I highly doubt is feasible in a modern 1309 aircraft)
I can’t think of any others…
I cant think of any reason for electrical failure and "no thrust" (as per statements) without any visual cues other than (a) suicide, or (b) starvation. Is there any electrical failure that can cause fuel valves to close? I dont fly Boeing, so can any Dreamliner driver explain what conditions could trigger an overspeed and auto engine shutdown (quote from Google below)? Would short runway, and hot/low QNH do it? Also, what happened to the order demanding a full power down/recycle every 51 days?
The EEC has build in protections to protect the engine. One of these protections is the Engine Overspeed Protection, when the core engine exceeds 120% the EEC shuts off the fuel to the applicable engine.
Last edited by Arrowhead; 13th Jun 2025 at 09:46 .
2025-06-13T14:18:00
permalink Post: 11900557
One has to assume that, given the seeming lack of lateral deviation from the flight path, and with no obvious yawing or rudder input visible on the videos, there's only two realistic conclusions here? Simultaneous dual engine failure of unknown cause if the RAT was indeed deployed; or flaps reduced too early leading to a stall if the RAT wasn't deployed.
Evidence in this thread would lean me toward the RAT deployed and therefore dual engine out scenario. As for the cause of that, well, only a couple of likely scenarios exist that could cause simultaneous shutdown of both engines, including mistaken or intentional use of the fuel cutoff levers.
Evidence in this thread would lean me toward the RAT deployed and therefore dual engine out scenario. As for the cause of that, well, only a couple of likely scenarios exist that could cause simultaneous shutdown of both engines, including mistaken or intentional use of the fuel cutoff levers.
Hutch
11 users liked this post.
2025-06-13T21:30:00
permalink Post: 11900926
Having read all the posts, watched the videos and with a 30 year background interest in air safety, I have a nagging feeling that the engine fuel cut off switches were pulled just after take-off. I am not saying this with the intention of idle speculation, it is just that to me nothing else seems to make sense. To anyone disagreeing with this, I really hope you are right and I am wrong.
2025-06-14T01:11:00
permalink Post: 11901053
A long while ago I posted on the Rumour thread about a ban on drinks on the flight deck sent to a BA, A350 mid Atlantic. It was prompted by 2 separate instances of uncommanded unrecoverable engine shut downs due to drink spills across the fuel cut off switches. It was widely mocked by the professional pilots on here until proven to be absolutely factually correct. If we are into speculation why not a drink left on the flight deck tips on aircraft pitch up and spills across both fuel cut-switches. Just sayin
Hutch
Hutch
Last edited by T28B; 14th Jun 2025 at 01:43 . Reason: Bold is not necessary
1 user liked this post.
2025-06-14T12:04:00
permalink Post: 11901413
My next question, again I believe not discussed, is what do the 787 Fuel Cutoff switches actually do? Obviously, they cut off the fuel supplies to the engines - pretty important in engine fire and other scenarios, but goes without saying. The real question is, what do they activate (or deactivate)? I'm assuming a simple solenoid valve, which is open when powered and closed when unpowered, but of course, there will (certainly) be Electro-Mechanical or Solid-State (Electronic) relays between the switches and the (solenoid valves).
I guess the next obvious question is, is there anything else that can turn off those Fuel Cutoff Valves - a computer condition for example. I'm assuming not, but I think it needs to be considered.
Taking each switch individually, next, since this is part of an electrical circuit, and of necessity must include Electrical Relays, there is certainly at least one and in all probability two electric Power Sources involved in this circuit. One supply which passes through the switch to activate the relay, and, I'm assuming, a second, higher current and probably higher voltage supply which drives the (solenoid?) valve.
As I see it, interrupting either supply will have the same effect - if the system is wired in the Positive-Postive sense, meaning a current through the switch causes the relay to pass a current through the (solenoid). If either of these supplies is cut, the Fuel Shutoffs will shut off the fuel. So, the question is, where do these supplies come from, and under what circumstances could they be cut off?
Sure, it looks to some (myself included) like a near simultaneous cutoff of both engines, but that doesn't have to have been caused by either of the pilots. I know there is huge redundancy built into the 787 Electrical Systems, but some of the evidence is suggesting that there was something not right with the plane's electrical system. I'm also fairly sure that there will be parts and places where certain faults can take the system down, despite the redundancy. I can't say where, but it's very difficult to design a perfect system, especially where there has to be transfers between multiple potential supplies and single actuators, motors or valves.
Having spent years repairing electrical and electronic systems, I know that the most difficult of all electrical faults are the intermittent ones. And I suspect that this is at the root of this crash. An intermittent or faulty AOA sensor has "caused" (provoked) multiple famous crashes... Can't find the one I'm looking for (pre-1980, I think) as the Max AOA issues dominate.
I can cite a very personal example, which involved the electrical supply to my house. I had several computers running 24x365 so of course, ran them off a UPS, which turned out to be a very good thing. I started to notice that at certain times, the UPS would activate - it would cut in and take over the computer loads, its alarm would go off to indicate a power fault. But the power was still on! This carried on for weeks and I initially blamed the UPS. Then, I noticed that it only happened on very hot afternoons... Long story short, the fault was caused by an electrical linesman, probably 30 years earlier, failing to tighten up a joint clamp on the phase wire to our house, across the street. Heating caused expansion then movement, and the power would momentarily go off then back on, and the UPS detected this. I note that this crash was on a hot day, and maybe this plane (which I believe was repositioned for the flight), had not been operating in such high temperatures recently, meaning the problem went unnoticed.
I guess the next obvious question is, is there anything else that can turn off those Fuel Cutoff Valves - a computer condition for example. I'm assuming not, but I think it needs to be considered.
Taking each switch individually, next, since this is part of an electrical circuit, and of necessity must include Electrical Relays, there is certainly at least one and in all probability two electric Power Sources involved in this circuit. One supply which passes through the switch to activate the relay, and, I'm assuming, a second, higher current and probably higher voltage supply which drives the (solenoid?) valve.
As I see it, interrupting either supply will have the same effect - if the system is wired in the Positive-Postive sense, meaning a current through the switch causes the relay to pass a current through the (solenoid). If either of these supplies is cut, the Fuel Shutoffs will shut off the fuel. So, the question is, where do these supplies come from, and under what circumstances could they be cut off?
Sure, it looks to some (myself included) like a near simultaneous cutoff of both engines, but that doesn't have to have been caused by either of the pilots. I know there is huge redundancy built into the 787 Electrical Systems, but some of the evidence is suggesting that there was something not right with the plane's electrical system. I'm also fairly sure that there will be parts and places where certain faults can take the system down, despite the redundancy. I can't say where, but it's very difficult to design a perfect system, especially where there has to be transfers between multiple potential supplies and single actuators, motors or valves.
Having spent years repairing electrical and electronic systems, I know that the most difficult of all electrical faults are the intermittent ones. And I suspect that this is at the root of this crash. An intermittent or faulty AOA sensor has "caused" (provoked) multiple famous crashes... Can't find the one I'm looking for (pre-1980, I think) as the Max AOA issues dominate.
I can cite a very personal example, which involved the electrical supply to my house. I had several computers running 24x365 so of course, ran them off a UPS, which turned out to be a very good thing. I started to notice that at certain times, the UPS would activate - it would cut in and take over the computer loads, its alarm would go off to indicate a power fault. But the power was still on! This carried on for weeks and I initially blamed the UPS. Then, I noticed that it only happened on very hot afternoons... Long story short, the fault was caused by an electrical linesman, probably 30 years earlier, failing to tighten up a joint clamp on the phase wire to our house, across the street. Heating caused expansion then movement, and the power would momentarily go off then back on, and the UPS detected this. I note that this crash was on a hot day, and maybe this plane (which I believe was repositioned for the flight), had not been operating in such high temperatures recently, meaning the problem went unnoticed.
3 users liked this post.
2025-06-14T12:43:00
permalink Post: 11901451
Even though there is no point speculating about the cause of this accident, it is the nature of the beast to have questions. As pilots (most of us at least), we do have an inquiring mindset.
My initial thoughts were an inadvertent flap retraction. But with the ‘evidence’ that has been presented over the last 48 hours, I think we can safely discard that option.
What we think we know is:
- RAT was deployed (highly possible)
- Gear was selected up, but did not operate (bogey tilted, doors remained closed)
- APU was ‘on’ (APU door open on after crash pictures)
- Flight path
Any of these observations, alone, would mean very little. However, in combination, they all point to a dual engine flameout just at/after the rotation. The aircaft has enough kinetic energy to reach roughly 150ft altitude, end then starts a shallow descent at ‘alpha max’ into the buildings ahead. The RAT deployed, APU attempted auto-start, gear was unable to retract.
I only wonder why the engines spooled down. Bird strike seems to be out of the question, so that leaves us with only a very few options, which include a software bug or a suicidal pilot (not a popular option, I understand, but we have to take all options into account).
What I don’t believe is incorrect FCU selections, since that would not explain the high AOA on impact. It also would not explain the RAT, no gear retraction or the APU inlet flap open. Another thing that is highly unlikely is any switching done by the pilots, especially RAT etc.. These airborne time is just too little, pilots usually don’t take any action below approximately 400ft, and these switches are so ‘underused’ that a pilot would not find them instantaneously in a high stress situation.
For me, a dual engine flameout seems the only possible explanation, now we only have to wait for its cause.
My initial thoughts were an inadvertent flap retraction. But with the ‘evidence’ that has been presented over the last 48 hours, I think we can safely discard that option.
What we think we know is:
- RAT was deployed (highly possible)
- Gear was selected up, but did not operate (bogey tilted, doors remained closed)
- APU was ‘on’ (APU door open on after crash pictures)
- Flight path
Any of these observations, alone, would mean very little. However, in combination, they all point to a dual engine flameout just at/after the rotation. The aircaft has enough kinetic energy to reach roughly 150ft altitude, end then starts a shallow descent at ‘alpha max’ into the buildings ahead. The RAT deployed, APU attempted auto-start, gear was unable to retract.
I only wonder why the engines spooled down. Bird strike seems to be out of the question, so that leaves us with only a very few options, which include a software bug or a suicidal pilot (not a popular option, I understand, but we have to take all options into account).
What I don’t believe is incorrect FCU selections, since that would not explain the high AOA on impact. It also would not explain the RAT, no gear retraction or the APU inlet flap open. Another thing that is highly unlikely is any switching done by the pilots, especially RAT etc.. These airborne time is just too little, pilots usually don’t take any action below approximately 400ft, and these switches are so ‘underused’ that a pilot would not find them instantaneously in a high stress situation.
For me, a dual engine flameout seems the only possible explanation, now we only have to wait for its cause.
Last edited by Senior Pilot; 14th Jun 2025 at 19:08 . Reason: Double posting of image
2025-06-14T12:56:00
permalink Post: 11901460
I asked this yesterday, and was told no. You have to pull them out before you can move them up or down. So you can't operate them if, say, your hand slips violently off the throttle lever and drops down into the switches.
3 users liked this post.
2025-06-14T13:40:00
permalink Post: 11901495
Fuel cutoff switches
My next question, again I believe not discussed, is what do the 787 Fuel Cutoff switches actually do? Obviously, they cut off the fuel supplies to the engines - pretty important in engine fire and other scenarios, but goes without saying. The real question is, what do they activate (or deactivate)? I'm assuming a simple solenoid valve, which is open when powered and closed when unpowered, but of course, there will (certainly) be Electro-Mechanical or Solid-State (Electronic) relays between the switches and the (solenoid valves).
I guess the next obvious question is, is there anything else that can turn off those Fuel Cutoff Valves - a computer condition for example. I'm assuming not, but I think it needs to be considered.
Taking each switch individually, next, since this is part of an electrical circuit, and of necessity must include Electrical Relays, there is certainly at least one and in all probability two electric Power Sources involved in this circuit. One supply which passes through the switch to activate the relay, and, I'm assuming, a second, higher current and probably higher voltage supply which drives the (solenoid?) valve.
As I see it, interrupting either supply will have the same effect - if the system is wired in the Positive-Postive sense, meaning a current through the switch causes the relay to pass a current through the (solenoid). If either of these supplies is cut, the Fuel Shutoffs will shut off the fuel. So, the question is, where do these supplies come from, and under what circumstances could they be cut off?
Sure, it looks to some (myself included) like a near simultaneous cutoff of both engines, but that doesn't have to have been caused by either of the pilots. I know there is huge redundancy built into the 787 Electrical Systems, but some of the evidence is suggesting that there was something not right with the plane's electrical system. I'm also fairly sure that there will be parts and places where certain faults can take the system down, despite the redundancy. I can't say where, but it's very difficult to design a perfect system, especially where there has to be transfers between multiple potential supplies and single actuators, motors or valves.
Having spent years repairing electrical and electronic systems, I know that the most difficult of all electrical faults are the intermittent ones. And I suspect that this is at the root of this crash. An intermittent or faulty AOA sensor has "caused" (provoked) multiple famous crashes... Can't find the one I'm looking for (pre-1980, I think) as the Max AOA issues dominate.
I can cite a very personal example, which involved the electrical supply to my house. I had several computers running 24x365 so of course, ran them off a UPS, which turned out to be a very good thing. I started to notice that at certain times, the UPS would activate - it would cut in and take over the computer loads, its alarm would go off to indicate a power fault. But the power was still on! This carried on for weeks and I initially blamed the UPS. Then, I noticed that it only happened on very hot afternoons... Long story short, the fault was caused by an electrical linesman, probably 30 years earlier, failing to tighten up a joint clamp on the phase wire to our house, across the street. Heating caused expansion then movement, and the power would momentarily go off then back on, and the UPS detected this. I note that this crash was on a hot day, and maybe this plane (which I believe was repositioned for the flight), had not been operating in such high temperatures recently, meaning the problem went unnoticed.
I guess the next obvious question is, is there anything else that can turn off those Fuel Cutoff Valves - a computer condition for example. I'm assuming not, but I think it needs to be considered.
Taking each switch individually, next, since this is part of an electrical circuit, and of necessity must include Electrical Relays, there is certainly at least one and in all probability two electric Power Sources involved in this circuit. One supply which passes through the switch to activate the relay, and, I'm assuming, a second, higher current and probably higher voltage supply which drives the (solenoid?) valve.
As I see it, interrupting either supply will have the same effect - if the system is wired in the Positive-Postive sense, meaning a current through the switch causes the relay to pass a current through the (solenoid). If either of these supplies is cut, the Fuel Shutoffs will shut off the fuel. So, the question is, where do these supplies come from, and under what circumstances could they be cut off?
Sure, it looks to some (myself included) like a near simultaneous cutoff of both engines, but that doesn't have to have been caused by either of the pilots. I know there is huge redundancy built into the 787 Electrical Systems, but some of the evidence is suggesting that there was something not right with the plane's electrical system. I'm also fairly sure that there will be parts and places where certain faults can take the system down, despite the redundancy. I can't say where, but it's very difficult to design a perfect system, especially where there has to be transfers between multiple potential supplies and single actuators, motors or valves.
Having spent years repairing electrical and electronic systems, I know that the most difficult of all electrical faults are the intermittent ones. And I suspect that this is at the root of this crash. An intermittent or faulty AOA sensor has "caused" (provoked) multiple famous crashes... Can't find the one I'm looking for (pre-1980, I think) as the Max AOA issues dominate.
I can cite a very personal example, which involved the electrical supply to my house. I had several computers running 24x365 so of course, ran them off a UPS, which turned out to be a very good thing. I started to notice that at certain times, the UPS would activate - it would cut in and take over the computer loads, its alarm would go off to indicate a power fault. But the power was still on! This carried on for weeks and I initially blamed the UPS. Then, I noticed that it only happened on very hot afternoons... Long story short, the fault was caused by an electrical linesman, probably 30 years earlier, failing to tighten up a joint clamp on the phase wire to our house, across the street. Heating caused expansion then movement, and the power would momentarily go off then back on, and the UPS detected this. I note that this crash was on a hot day, and maybe this plane (which I believe was repositioned for the flight), had not been operating in such high temperatures recently, meaning the problem went unnoticed.
2 users liked this post.
2025-06-14T20:48:00
permalink Post: 11901821
Another hour spent sifting through the stuff since last night (my sympathies to the mods
). A few more comments:
"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
). A few more comments:
"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
67 users liked this post.
2025-06-14T21:27:00
permalink Post: 11901855
Another hour spent sifting through the stuff since last night (my sympathies to the mods
). A few more comments:
"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
). A few more comments:
"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
5 users liked this post.
2025-06-14T22:17:00
permalink Post: 11901893
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios
2025-06-14T22:34:00
permalink Post: 11901910
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
Am I right in saying, from a mathmatical perspective, that dual engine flame out due biocide overdose would be more likely than a TCMA activation shutting down the engines? Considering we have examples of engines reducing to idle within seconds of each other in the past, but we have no examples of airborne TCMA issues I would have thought this to be the case. Likewise, nefarious intent also appears more likely statistically than a TCMA issue.
I have high-school level statistics under my belt so I pose that as a question for people much smarter than myself.
2025-06-14T23:20:00
permalink Post: 11901949
... The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) ...
5 users liked this post.
2025-06-15T00:54:00
permalink Post: 11902008
I think it needs to be said again that pretty much anything can happen to the aircraft systems and the engines will carry on running - this is by design as they have independent FADEC and power supplies and at sea level fuel will get through without boost pumps. You could almost saw the wing off the fuselage and the engine would still produce thrust, TCMA notwithstanding.
Anyway, the thing I'm looking at is how the fuel cutoff switch function could have been activated in some other way. To me, it seems obvious that there are wires that run between the engine fuel shutoff valves and the cockpit / flight control panel (no doubt with relays etc in between). I don't know where those shutoff valves are located, but logic says they should be located in the fuselage, not out at the engines. I also don't know how those valves operate - are they solenoid valves or electro-mechanically driven? Nor do I know where the power to activate those valves comes from, but using my logic, if those valves close when powered off, such as solenoid valves typically do, then the power cannot exclusively come from the engine-dedicated generators. If it did, you'd never be able to start the engines so they could supply their own power to hold those valves open. So, there must be some power (appropriately) fed from the main aircraft control bus to activate those valves - if the rest of what I'm assuming is correct. Anyway, like I say, I don't know enough about the details at this point, but there are many more ways to activate or deactivate a circuit than by flicking a switch. Killing the relevant power supply, for example. A screwdriver across some contacts (for example), another. Shorting a wire to Chassis, maybe. Just trying to contribute what I can.
You raise another interesting point: "TCMA notwithstanding". Could you elaborate, please? What will happen if the TCMA system, which apparently also has some degree of engine control, loses power? The problem with interlinked circuits and systems is that sometimes, unexpected things can happen when events that were not considered actually happen. If one module, reporting to another, loses power or fails, sometimes it can "tell" the surviving module something that isn't true... My concern is where does the power to the Fuel Cutoff switches come from? Are there relays or solid-state switches (or what?) between the Panel Switches and the valves? If so, is the valve power derived from a different source, and if so, where? Are the valves solenoids, open when power applied, or something else? What is the logic involved, between switch and valve?
Would you mind answering these questions so I can ponder it all further, please? If I'm wrong, I'll happily say so.
We don\x92t know yet what actually triggered the RAT from the relatively short list but every item on it means there is a serious/critical failure(s). The flight path suggests that it was a double engine failure or shutdown (commanded or uncommanded) as anything else should have left the aeroplane in a poor state but able to climb away.
1 user liked this post.
2025-06-15T02:36:00
permalink Post: 11902060
Difficult!? Maybe not. If very late the flaps were tagged stowed, and there was a simultaneous gear up command, with FlapDown command, the overload could have failed a GCS. Then it becomes a switching exercise. (Automatics).
Alarms Warnings Impacted EICAS, ETC. it happened long ago, but we know what happens when an engine driven generator quits ..first it bangs for awhile, then it burns itself up, then ...
Alarms Warnings Impacted EICAS, ETC. it happened long ago, but we know what happens when an engine driven generator quits ..first it bangs for awhile, then it burns itself up, then ...
Thanks for answering the question I hadn't yet asked but wanted to confirm!
I'm still sticking with "Major Electrical Fault" as my most likely cause, and this adds to my suspicions.
As I understand it, the landing gear is raised / retracted by electric motor-driven hydraulic pump (pumps?). This/these would create a significant electrical load.
If the plane's multi-redundant electrical system has a fault which is intermittent (the worst kind of electrical issue to diagnose), and which causes the redundancy controls to go haywire (as there are, of course, electronic controls to detect failures and drive the switching over of primary and backup electrical supplies), then this fault could to triggered by a large load coming on-line. It could even be as simple as a high current cable lug not having been tightened when a part was being replaced at some stage. The relevant bolt might be only finger-tight. Enough to work 99.99% of the time between then and now... But a little bit more oxidation, and particularly, a bit more heat (it was a hot day), and suddenly, a fault.
Having worked in electronics for years, I know that semi-conductors (and lots of other components, especially capacitors [and batteries]) can also degrade instead of failing completely. Electro-static discharges are great for causing computer chips to die, or go meta-stable - meaning they can get all knotted up and cease working correctly - until they are powered off for a while. They can also degrade in a way that means they work normally a low temperatures, but don't above a certain temperature.
Anyway, there MUST be ways that the redundant power supplies can be brought down, simply because, to have a critical bus powered from a number of independent sources, there must be "controls" of some sort. I don't know how it's done in the 787, but that's where I'd be looking.
As there is a lot of discussion already about how the bogies are hanging the wrong way suggesting a started but failed retraction operation, and it's now confirmed that the retraction would normally have taken place at about the point where the flight went "pear shaped", I'm going to suggest that the two things are connected. More than that: I'll suggest that the Gear Up command triggered the fault that caused both engines to shut down in very short succession. Nothing the pilots did wrong, and no way they could have known and prevented it.
It's going to be difficult to prove though.
I'm still sticking with "Major Electrical Fault" as my most likely cause, and this adds to my suspicions.
As I understand it, the landing gear is raised / retracted by electric motor-driven hydraulic pump (pumps?). This/these would create a significant electrical load.
If the plane's multi-redundant electrical system has a fault which is intermittent (the worst kind of electrical issue to diagnose), and which causes the redundancy controls to go haywire (as there are, of course, electronic controls to detect failures and drive the switching over of primary and backup electrical supplies), then this fault could to triggered by a large load coming on-line. It could even be as simple as a high current cable lug not having been tightened when a part was being replaced at some stage. The relevant bolt might be only finger-tight. Enough to work 99.99% of the time between then and now... But a little bit more oxidation, and particularly, a bit more heat (it was a hot day), and suddenly, a fault.
Having worked in electronics for years, I know that semi-conductors (and lots of other components, especially capacitors [and batteries]) can also degrade instead of failing completely. Electro-static discharges are great for causing computer chips to die, or go meta-stable - meaning they can get all knotted up and cease working correctly - until they are powered off for a while. They can also degrade in a way that means they work normally a low temperatures, but don't above a certain temperature.
Anyway, there MUST be ways that the redundant power supplies can be brought down, simply because, to have a critical bus powered from a number of independent sources, there must be "controls" of some sort. I don't know how it's done in the 787, but that's where I'd be looking.
As there is a lot of discussion already about how the bogies are hanging the wrong way suggesting a started but failed retraction operation, and it's now confirmed that the retraction would normally have taken place at about the point where the flight went "pear shaped", I'm going to suggest that the two things are connected. More than that: I'll suggest that the Gear Up command triggered the fault that caused both engines to shut down in very short succession. Nothing the pilots did wrong, and no way they could have known and prevented it.
It's going to be difficult to prove though.
In addition, the 787 has four main generators and I believe the switching is segregated into at least two controllers, on top of the four separate generator control units.
And again, electrical failure should not cause engine failure - consider QF32 where the wiring to the engine was mostly severed and they had to drown it with a fire truck.
Best post until now in my view. We will find out very soon I think. Gear up command triggered the instant lack of fuel to both engines. I'm not sure on how the fuel flow is dependant on the power supplies on the 787 but I genuinely believe you are very very close to what might have happened here.
Yes, thanks, I've seen a few comments to this effect, and I have to accept most of what you say. I understand that they have their own dedicated generators and local independent FADECs (or EECs), but I'm trying to use what I do know to attempt to figure this out. I know that there are Fuel Cutoff switches in the cockpit. Somehow, if switched to Off, these will cut off the fuel to the engines, "no matter what". Of course, even that's not true, as the Qantas A380 engine burst apparently (comment in this thread) showed.
Anyway, the thing I'm looking at is how the fuel cutoff switch function could have been activated in some other way. To me, it seems obvious that there are wires that run between the engine fuel shutoff valves and the cockpit / flight control panel (no doubt with relays etc in between). I don't know where those shutoff valves are located, but logic says they should be located in the fuselage, not out at the engines. I also don't know how those valves operate - are they solenoid valves or electro-mechanically driven? Nor do I know where the power to activate those valves comes from, but using my logic, if those valves close when powered off, such as solenoid valves typically do, then the power cannot exclusively come from the engine-dedicated generators. If it did, you'd never be able to start the engines so they could supply their own power to hold those valves open. So, there must be some power (appropriately) fed from the main aircraft control bus to activate those valves - if the rest of what I'm assuming is correct. Anyway, like I say, I don't know enough about the details at this point, but there are many more ways to activate or deactivate a circuit than by flicking a switch. Killing the relevant power supply, for example. A screwdriver across some contacts (for example), another. Shorting a wire to Chassis, maybe. Just trying to contribute what I can.
You raise another interesting point: "TCMA notwithstanding". Could you elaborate, please? What will happen if the TCMA system, which apparently also has some degree of engine control, loses power? The problem with interlinked circuits and systems is that sometimes, unexpected things can happen when events that were not considered actually happen. If one module, reporting to another, loses power or fails, sometimes it can "tell" the surviving module something that isn't true... My concern is where does the power to the Fuel Cutoff switches come from? Are there relays or solid-state switches (or what?) between the Panel Switches and the valves? If so, is the valve power derived from a different source, and if so, where? Are the valves solenoids, open when power applied, or something else? What is the logic involved, between switch and valve?
Would you mind answering these questions so I can ponder it all further, please? If I'm wrong, I'll happily say so.
Anyway, the thing I'm looking at is how the fuel cutoff switch function could have been activated in some other way. To me, it seems obvious that there are wires that run between the engine fuel shutoff valves and the cockpit / flight control panel (no doubt with relays etc in between). I don't know where those shutoff valves are located, but logic says they should be located in the fuselage, not out at the engines. I also don't know how those valves operate - are they solenoid valves or electro-mechanically driven? Nor do I know where the power to activate those valves comes from, but using my logic, if those valves close when powered off, such as solenoid valves typically do, then the power cannot exclusively come from the engine-dedicated generators. If it did, you'd never be able to start the engines so they could supply their own power to hold those valves open. So, there must be some power (appropriately) fed from the main aircraft control bus to activate those valves - if the rest of what I'm assuming is correct. Anyway, like I say, I don't know enough about the details at this point, but there are many more ways to activate or deactivate a circuit than by flicking a switch. Killing the relevant power supply, for example. A screwdriver across some contacts (for example), another. Shorting a wire to Chassis, maybe. Just trying to contribute what I can.
You raise another interesting point: "TCMA notwithstanding". Could you elaborate, please? What will happen if the TCMA system, which apparently also has some degree of engine control, loses power? The problem with interlinked circuits and systems is that sometimes, unexpected things can happen when events that were not considered actually happen. If one module, reporting to another, loses power or fails, sometimes it can "tell" the surviving module something that isn't true... My concern is where does the power to the Fuel Cutoff switches come from? Are there relays or solid-state switches (or what?) between the Panel Switches and the valves? If so, is the valve power derived from a different source, and if so, where? Are the valves solenoids, open when power applied, or something else? What is the logic involved, between switch and valve?
Would you mind answering these questions so I can ponder it all further, please? If I'm wrong, I'll happily say so.
The valves are located in the spar (hence being called 'spar valves'. The fuel tank is immediately above the engine so it is a very short pipe for suction feeding. Tail mount engines are potentially a different story...
What\x92s the usual time frame for the release of preliminary data and report from the FDR and CVR? Is it around 6 months?
I guess if no directives come from Boeing or the FAA in the next 2 weeks, it can be presumed that a systems failure from which recovery was impossible was unlikely.
I guess if no directives come from Boeing or the FAA in the next 2 weeks, it can be presumed that a systems failure from which recovery was impossible was unlikely.
1 user liked this post.