Posts about: "Fuel Cutoff" [Posts: 302 Pages: 16]

tdracer
June 29, 2025, 19:57:00 GMT
permalink
Post: 11913194
Originally Posted by Kraftstoffvondesibel
Separate would seem to be a relative term, ofcourse wires are separated in some way, but how separate? Do they share a quick connect? Are there 2 separate looms each side of the throttle installation, or are thety in some twisted bundle together. Someone on this thread claimed the fuel cut offs where inhibited if the throttles weren\x92t in idle. Is this true? If so, is this a software or mechanical system?
Can anything so closely placed together be considered separate when looking at an outlier event?

Everyone is looking for something that would shut off both engines at the exact same time. This installation could, it is the closest the 2 systems get in proximity, physically and electrically, at least and it seems we don\x92t know a whole lot about it.
Engine isolation means just that. No common wire bundles, no common connectors. You can move the fuel levers at any time - there is no lockout of any kind with respect to thrust lever position (imagine dropping something into the lever linkage that jams the thrust lever at max power - then being unable to shut that engine down?)
Obviously, since the thrust levers are placed next to each other - the separation that's available in the center console is limited, but as soon as the wiring exits that constrained area, the separation increases. Furthermore, the same engine-to-engine wiring separation also applies to channel A/B FADEC channels, as well as the fuel switch/fire handle wiring.
All these requirements are documented in the Boeing DR&O (Design Requirements and Objectives) - and there is an audit done late in the design process to insure compliance.
In short, you're barking up a tree stump - there is nothing there.
skwdenyer
June 30, 2025, 03:42:00 GMT
permalink
Post: 11913342
Originally Posted by Kraftstoffvondesibel
This has also been touched upon earlier in the thread, but it rather seems the cut-off switches are in the same LRU, in close proximity, using the same connector and goes through the same wiring harness. No one was able to say whether it works purely by digital signaling, and goes through any common software, or if it is duplicated by purely direct signaling. There might be numerous failure modes of the cut-off switch design, it is obviously very, very robust and overall sound, since dual failures here have never happened, but this is alredy an outlier event.
If we are to take the TCMA patent at face value, the fuel cut-off switches are directly-acting, not some sort of signalling protocol.

That's a pretty big "if" but here's the patent drawing:

Musician
June 30, 2025, 06:32:00 GMT
permalink
Post: 11913383
Searching the web, I found out that regulations concerning new FDR require parameter 35g "fuel cut-off lever position" to be recorded. I also found that for a 2003 event with a 757, this was recorded (as was fuel flow).

I expect that this is also true for the 787. Can anyone confirm this?

Phantom4
June 30, 2025, 09:56:00 GMT
permalink
Post: 11913487
Have the spring loaded Fuel Shut Off Valves been examined by GE on both engines???
NSEU
June 30, 2025, 13:59:00 GMT
permalink
Post: 11913644
Originally Posted by Phantom4
Have the spring loaded Fuel Shut Off Valves been examined by GE on both engines???
Why would spring loaded valves fail on both engines? The final valve in the GEnx Fuel Metering Unit (FMU) before the fuel flow meter and things like the fuel nozzles, is called the HPSOV and is spring loaded to closed, but fuel from the Fuel Metering Valve (FMV) can keep it open with minimal pressure (certainly enough presssure for engine start). Tank electric pumps and the engine-mounted, mechanically-driven two-stage pump supply fuel to the Fuel Metering Valve. During main tank pump failure, the engine mounted pump suction feeds the engine. There are altitude limitations during climb (according to the FCOM).

There are several ways that the HPSOV can close:
An EEC (engine ECU) can close the upstream Fuel Metering Valve (FMV) electronically, so the HPSOV will lose its opening pressure.
The HPSOV can be acted on by a Shutoff Solenoid Valve (which directs fuel pressure in an opposite manner to the pressure coming from the Fuel Metering Valve).

Unfortunately, the diagram I am using is truncated, and I can't see if the Shutoff Solenoid Valve is magnetically latched in its last commanded position like typical fuel shutoff valves. Nor can I see what controls it. I suspect things like the respective cockpit fire handle and fuel cutoff lever, but also EEC commands.

There is probably a copyright on the diagram, so I won't post it here. Perhaps someone can fill in the gaps for me?
adfad
July 01, 2025, 12:55:00 GMT
permalink
Post: 11914255
Originally Posted by Someone Somewhere
I believe that particular bug is fixed, though it's always possible there's other issues causing a total AC loss.

Not really relevant to what you quoted though, as the scenario in question requires:
  • Engines running on centre tank fuel during takeoff while the aircraft is operating normally
    • We don't know for certain if this is the case. It seems to be but it's not something that happens on other families.
  • Then, total AC failure stopping fuel boost pumps.
  • Engines suction feed from contaminated/full-of-water wing tanks.

The aircraft has two engines and should be able to climb out on one, plus it dropped like a rock . 'Significantly degraded' thrust isn't really compatible with what we saw. You'd also expect the engines to recover pretty quickly as it leveled off.

The limitations at high altitude are primarily air/volatiles degassing out of the fuel. That's not going to be much of an issue at sea level, even if the engines are a bit higher up during rotation.
APU is a nice-to-have; it's on the MEL. If you lose all four generators, it's because of some major carnage in the electrical software/hardware and chances of putting the APU on line even if it's operating are very slim.
As an electronics and software engineer who has read the AD and related materials on the 248 day bug my understanding is that:
  1. The specific 248-day integer overflow was patched, and before the fix was rolled out, the AD required this system to by power cycled every 120 days to prevent overflow
  2. The PCU software still has the functional requirement to be able to command all AC GCUs to enter failsafe mode, this means that while the initial bug was fixed, the ability for this particular software system to command the same result is still a functional part of the architecture - presumably for safety management of the AC system
  3. This was not the first or last "software overflow error" issue in Boeing or even in the 787
Although I'm not qualified in aviation engineering I do believe from an engineering safety standpoint that this architecture creates a rare but entirely feasible scenario in which the aircraft would be without AC power for at least 30 seconds until the APU could restore it.

I do agree that the engine driven pumps should be able to provide fuel alone, the whole point of these pumps is to keep the plane flying within some limitations, high altitude is one of those limitations, I propose that there may be others based on the following:
  • Some more knowledgable people here have proposed or countered vapour lock, fuel contamination and automatic fuel cut-off theories to various degrees - even if these are not enough on their own, loss of electrical during rotation at high temperature could combine with these in a way we have not yet considered
  • Thrust is nonlinear, and while I'm not qualified to say how much loss of fuel flow or loss of thrust would be critical in this scenario we do know that it was a hot takeoff with significant weight and gear remaining down - I know others here have run sims but I don't think anyone has focused on specific thrust / fuel flow params
  • While electric fuel pumps might not be physically necessary for takeoff, my final point is: why are they required for takeoff? Is it not to mitigate cavitation, fuel sloshing at rotation, or any other kind of problem that might be relevant here?
Someone Somewhere
July 01, 2025, 13:08:00 GMT
permalink
Post: 11914265
Originally Posted by adfad
As an electronics and software engineer who has read the AD and related materials on the 248 day bug my understanding is that:
  1. The specific 248-day integer overflow was patched, and before the fix was rolled out, the AD required this system to by power cycled every 120 days to prevent overflow
  2. The PCU software still has the functional requirement to be able to command all AC GCUs to enter failsafe mode, this means that while the initial bug was fixed, the ability for this particular software system to command the same result is still a functional part of the architecture - presumably for safety management of the AC system
  3. This was not the first or last "software overflow error" issue in Boeing or even in the 787
Although I'm not qualified in aviation engineering I do believe from an engineering safety standpoint that this architecture creates a rare but entirely feasible scenario in which the aircraft would be without AC power for at least 30 seconds until the APU could restore it.
Similar failures have happened on 737s/A320s/A330s and others. I'm not denying it's possible. There's a reason it's a certification requirement for the engines not to be dependent on aircraft power. The APU is MELable and battery starts are not extremely reliable.

I do agree that the engine driven pumps should be able to provide fuel alone, the whole point of these pumps is to keep the plane flying within some limitations, high altitude is one of those limitations, I propose that there may be others based on the following:
  • Some more knowledgable people here have proposed or countered vapour lock, fuel contamination and automatic fuel cut-off theories to various degrees - even if these are not enough on their own, loss of electrical during rotation at high temperature could combine with these in a way we have not yet considered
  • Thrust is nonlinear, and while I'm not qualified to say how much loss of fuel flow or loss of thrust would be critical in this scenario we do know that it was a hot takeoff with significant weight and gear remaining down - I know others here have run sims but I don't think anyone has focused on specific thrust / fuel flow params
  • While electric fuel pumps might not be physically necessary for takeoff, my final point is: why are they required for takeoff? Is it not to mitigate cavitation, fuel sloshing at rotation, or any other kind of problem that might be relevant here?
Thrust is non-linear and complex. Reaction engines (i.e. fans, props) are generally most efficient at minimum power - lowest excess velocity. Turbine engines are generally most efficient at high power. These cancel out somewhere in the middle. With two engines at low power, you also don't have the drag from the dead engine or the drag from the rudder countering yaw.

Cavitating destroys pumps rapidly - someone upthread said replacing the fuel pump immediately is SOP if it has suction fed. Expect end of life in tens of hours rather than tens of thousands.

Some aircraft have switched to using jet/venturi pumps powered by returned fuel, like the A220. The electric boost pumps there are mainly for redundancy and are shut down in cruise; only one in each wing tank. Some A320s replace the centre override pumps with venturi transfer pumps.
DTA
July 09, 2025, 19:05:00 GMT
permalink
Post: 11918581
Originally Posted by PJ2
For info only - re-post of lever-lock fuel-switch design:




B787 Fuel Control Switches -
A bit of a pedantic point, but the locking lever in the photo above is not the right action for the fuel cut off switches on the 787. The switch above has two locked positions and a biased further position. You could say ON-OFF-BIASSED. There are some photos earlier in the thread (assuming they are still there) of the correct Honeywell switch and its gate.

Edit: And here it is:


PJ2
July 09, 2025, 21:34:00 GMT
permalink
Post: 11918651
Originally Posted by DTA
A bit of a pedantic point, but the locking lever in the photo above is not the right action for the fuel cut off switches on the 787. The switch above has two locked positions and a biased further position. You could say ON-OFF-BIASSED. There are some photos earlier in the thread (assuming they are still there) of the correct Honeywell switch and its gate.
Edit: And here it is:
Many thanks, DTA.
For those unfamiliar with cockpit controls in general, I\x92ll leave my \x93schematic\x94 image to show the principle of \x93lift-and-move\x94 the toggle vice just pushing the toggle in a desired direction.
Cheers,
PJ2

Last edited by PJ2; 9th July 2025 at 21:45 . Reason: for context
Lead Balloon
July 10, 2025, 08:26:00 GMT
permalink
Post: 11918827
Originally Posted by cLeArIcE
It is not inconceivable to me that a human being who THINKS they've had a dual engine failure at possibly the worst time imaginable (correctly or incorrectly) and has not taken the time to confirm, or take it all in and has immediately launched into memory items. I could certainly foresee one being rather startled by the energy state and the rapidly approaching buildings.
I'm not saying that this happened to this crew but it certainly could happen to someone. People do weird !!!! under high stress. There is an initial "oh !!!!, what's going on" then the training kicks in. Often at super fast rate and the challenge becomes slowing it all down.
The bloody master warning on the Airbus for smoke in the forward Lav used to get me everytime. Was always at night over the ocean too.
It\x92s also not inconceivable that a human being who KNOWS they\x92ve had a dual engine failure at the worst time has immediately launched into memory items. Those memory items include \x91cycling\x92 the fuel cut off switches\x85

moosepileit
July 10, 2025, 11:42:00 GMT
permalink
Post: 11918961
787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?

The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.

If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?

Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.

Last edited by moosepileit; 10th July 2025 at 11:53 .
island_airphoto
July 10, 2025, 11:53:00 GMT
permalink
Post: 11918969
Originally Posted by moosepileit
787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?

The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.

If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?
You do not want a condition where you can't shut the fuel off when you need to because some condition is not met.
TBL Warrior
July 10, 2025, 11:58:00 GMT
permalink
Post: 11918976
Originally Posted by moosepileit
787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?

The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.

If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?

Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.





Yes, switch directly controls spar valve (fuel supply) position - no fuel - no fire.



Kraftstoffvondesibel
July 10, 2025, 12:31:00 GMT
permalink
Post: 11918989
Originally Posted by TBL Warrior
Yes, switch directly controls spar valve (fuel supply) position - no fuel - no fire.
Thank you so much for that particular schematic, it confirms the direct link between the switches and the fuel cut off without software in between.
The switch itself is 4-pole, or a double-on, double-on switch, capable of independentently signaling whrough completely isolated poles. The plot thickens. IF the switches really are involved, there is either some kind of shortcut in within the LRU/very messed up witing harness, some freak automated muscle memory thing or deliberate action.
paulross
July 10, 2025, 13:04:00 GMT
permalink
Post: 11919015
AI171 Thread by Subject

I have rebuilt the site that organises this thread by subject here: https://paulross.github.io/pprune-th...171/index.html

Changes:
  • Built the thread up to July 10, 2025, 12:31:00
  • Add subjects: Relight, 51 Day Issue, Fuel Cutoff Switches (detent), ICAO, Fuel Cutoff Switches, Memory Items, Annex 13, Simulation Scenarios.
  • Various technical fixes should give a better/more accurate presentation.
Project is here: https://github.com/paulross/pprune-threads
Raise issues here https://github.com/paulross/pprune-threads/issues or PM me.
EXDAC
July 10, 2025, 13:45:00 GMT
permalink
Post: 11919035
Originally Posted by galaxy flyer
Just for emphasis, the fuel control switches control both the spar valve AND the shutoff inside the fuel controller at the engine. It\x92s not the spar valve the starves the engine of fuel it\x92s the HP valve. If it were only the spar valve, shut downs at the gate would take awhile.
Agreed, but that knowledge does nothing to convince anyone that TLA is not involved in the response to fuel cut off.
moosepileit
July 10, 2025, 15:10:00 GMT
permalink
Post: 11919084
Originally Posted by EXDAC
What is the basis for that statement? Hasn't it been stated, more than once, that thrust lever position has no influence on control of the spar valves?
The "Spar valves" ahould be on the fire levers/switches. FADECS/Pylons on the cutoff switches.

I'm trying to mix the best of the old and the new.

Fast, erroneous, uncoordinated or nefarious- gives a way to intervene, without changing the standards.

Throttles are no longer mechanical. Keep them forward off idle and the cutoff switch does nothing.

Fire/fail/flameout/stall- PM takes the confirmed bad throttle to idle. Then, if appropriate, fuel cutoff and then continue with the fire switch that should also isolate fuel before the engine, air, hydraulics, and electrics.

Bias- I've had mechanical fuel cutoff, mechanical throttles and mechanical isolations- DC9.

Electric throttles, fuel cutoffs and mechanical isolations- C-17s and MD-11s.

Have not had all electrical on switches, throttles and electrical circuits for isolation, only- which allows for more options and unintended consequences.



Last edited by moosepileit; 10th July 2025 at 15:24 .
Pilot DAR
July 10, 2025, 16:26:00 GMT
permalink
Post: 11919126
Throttles are no longer mechanical. Keep them forward off idle and the cutoff switch does nothing.
This statement has been questioned earlier. Moosepileit, would you please cite the authoritative information supporting this statement? Is the EEC considering throttle position while "deciding" whether to allow a fuel cut off switch action to be completed (engine fuel valve powered to "off position) as switched by a pilot?
inbalance
July 11, 2025, 20:30:00 GMT
permalink
Post: 11919765
From the Report:
The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.

In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
The other pilot responded that he did not do so.





KSINGH
July 11, 2025, 20:40:00 GMT
permalink
Post: 11919771
- fuel cut offs were found in the RUN position

- on take off roll both engines lost power as the fuel cut offs went from RUN to cutoff

- CVR recorded one pilot asking why they had gone to CUTOFF

- within 10 seconds the fuel cutoff was moved back to RUN

-RAT was deployed, APU had begun auto start

- 32 seconds after Vr the MAYDAY was called



This should also dispel a lot of the comments about AAIB-India, Indian culture in general and general competence. For a preliminary report this is far more thorough and extensive than what would normally be expected and they\x92ve kept Boeing, GE, FAA and investigators from US, UK, Canada and Portugal in the loop from the start



They have also clarified why it took so long to do the EAFR download- because of the extensive damage they had to source specialist equipment from the NTSB that only arrived on the 23rd of June (they downloaded on the 24th) so all that talk of a \x91coverup\x92 is pretty embarrassing now

of course the big question is why/how those switches were commanded into cutoff in the first place the exact sequence at Vr is the most critical, there hasn\x92t been much scrutiny at all that I can see in the Indian/international media of the personal
background of the flight deck crew which has happened in other suspected pilot initiated disasters in the past, I guess this is an avenue investigators will have been doing themselves