Posts about: "Fuel Cutoff Switches" [Posts: 802 Pages: 41]

Originally Posted by MaybeItIs

My next question, again I believe not discussed, is what do the 787 Fuel Cutoff switches actually do? Obviously, they cut off the fuel supplies to the engines - pretty important in engine fire and other scenarios, but goes without saying. The real question is, what do they activate (or deactivate)? I'm assuming a simple solenoid valve, which is open when powered and closed when unpowered, but of course, there will (certainly) be Electro-Mechanical or Solid-State (Electronic) relays between the switches and the (solenoid valves).

I guess the next obvious question is, is there anything else that can turn off those Fuel Cutoff Valves - a computer condition for example. I'm assuming not, but I think it needs to be considered.

Taking each switch individually, next, since this is part of an electrical circuit, and of necessity must include Electrical Relays, there is certainly at least one and in all probability two electric Power Sources involved in this circuit. One supply which passes through the switch to activate the relay, and, I'm assuming, a second, higher current and probably higher voltage supply which drives the (solenoid?) valve.

As I see it, interrupting either supply will have the same effect - if the system is wired in the Positive-Postive sense, meaning a current through the switch causes the relay to pass a current through the (solenoid). If either of these supplies is cut, the Fuel Shutoffs will shut off the fuel. So, the question is, where do these supplies come from, and under what circumstances could they be cut off?

Sure, it looks to some (myself included) like a near simultaneous cutoff of both engines, but that doesn't have to have been caused by either of the pilots. I know there is huge redundancy built into the 787 Electrical Systems, but some of the evidence is suggesting that there was something not right with the plane's electrical system. I'm also fairly sure that there will be parts and places where certain faults can take the system down, despite the redundancy. I can't say where, but it's very difficult to design a perfect system, especially where there has to be transfers between multiple potential supplies and single actuators, motors or valves.

Having spent years repairing electrical and electronic systems, I know that the most difficult of all electrical faults are the intermittent ones. And I suspect that this is at the root of this crash. An intermittent or faulty AOA sensor has "caused" (provoked) multiple famous crashes... Can't find the one I'm looking for (pre-1980, I think) as the Max AOA issues dominate.

I can cite a very personal example, which involved the electrical supply to my house. I had several computers running 24x365 so of course, ran them off a UPS, which turned out to be a very good thing. I started to notice that at certain times, the UPS would activate - it would cut in and take over the computer loads, its alarm would go off to indicate a power fault. But the power was still on! This carried on for weeks and I initially blamed the UPS. Then, I noticed that it only happened on very hot afternoons... Long story short, the fault was caused by an electrical linesman, probably 30 years earlier, failing to tighten up a joint clamp on the phase wire to our house, across the street. Heating caused expansion then movement, and the power would momentarily go off then back on, and the UPS detected this. I note that this crash was on a hot day, and maybe this plane (which I believe was repositioned for the flight), had not been operating in such high temperatures recently, meaning the problem went unnoticed.

Originally Posted by Alty7x7

On a typical Boeing, fuel cutoff switch would be engine shutoff command, engine FMU valve shutoff (sometimes integrated into an engine overspeed protection system), airplane spar fuel valve and ignition exciter power.

Originally Posted by appruser

Combining all the bits and pieces of info from this thread so far, IMO we can theoretically sequence it thus using the video from the left:

00:18 Rotation. Normal takeoff config.
00:24 Gear up starts. per Raffael with FF.
......... FR24 ADSB last transmission (71ft, 172kt) just before runway threshold. Matches with video aircraft altitude at 1/2 wingspan.
......... ? Full power flameout leaves N2 ~ 60%; Airspeed < 200k so N2 will decay to 15% in 8-10s?
......... ? Takeoff EGT of 900C needs 25-35s to fall below 250C ?
00:27 Gear up stops. per Raffael with FF. Bogies tilted.
......... ? APU starts. 20-55s to 95%N?
......... Per 787 dual-engine fail/stall memory items, PM initiates Fuel Cutoff and Run.
00:28 Visible loss of thrust. Alt ~ 200ft using aircraft wingspan as measure.
......... Matches with eyewitness "within 5-10s ... it was stuck in the air".
......... Per 787 dual-engine fail/stall memory items, PM initiates RAT Switch for 1s. Whether auto or manual, the RAT initiates.
......... RAT "bang" heard by survivor
......... RAT coming online accounts for eyewitness "lights started flickering green and white".
......... Per 787 QRH below 1000ft, PF makes no change to Main Landing Gear and flaps, aircraft pointed straight for best glide.
00:31 Descending visibly, somewhere beyond the runway threshold. Alt ~ 200ft using aircraft wingspan as measure.
......... ? Because EGT > 250C FADEC blocks fuel (T-HOT hot restart inhibit?) so no relight though N2 > 15% ?
......... 787 glide ratio between 16:1 to 25:1 with MLG down, Flaps 5. About 15-20s and 3-5000ft of glide from 200ft?
......... Some flap accounts for the ground pictures.
00:34 ? N2 has presumably decayed to 15%, FADEC flips to X-START: airspeed outside envelope? No hope of relight now.
......... PM/PF transmits Mayday?
......... Video showing RAT deployed.
00:46 APU reaches some fraction of 95%N (APU sound accounting for survivor's perception of thrust?).
00:48 Impact. 4200ft from descent start, 3990ft from airport boundary road. 17s from visible descent start.

if this is a valid sequence, the only remaining question is why the dual-engine failure at ~200ft agl?

with condolences to the families and people affected.

Originally Posted by OPENDOOR

During the nearly two years that elapsed between AF 447 disappearing and the recovery of the flight data recorders nobody suggested that the PF might have, unwittingly, flown the aircraft, stalled, into the ocean.
AI 171 may prove to also have a totally unpredicted cause.

Originally Posted by Alty7x7

There should not be a max pre-start EGT limit in-flight - that should only occur on the ground for a pilot-initiated Autostart where the starting EGT redlines are lower than for in-flight.

In-flight, the Autorelight function should attempt to restart the engine as soon as a flameout is detected, and for an engine flaming out at high power it might catch it before it even goes sub-idle. Generally, Autorelight will continue attempting until some cutoff N2 at which time it will stop attempting, or if the pilot move the fuel switch to Cutoff. And while the EEC is still powered (via its own PMA) down to roughly 10% N2, the ignition exciters required for Autorelight do get their power from the airplane.

Originally Posted by go-around flap 15

We're all shouting each other down with two main different theories on why the aircraft lost lift so shortly after takeoff.

1) Incorrect flap retraction causing the aircraft to lose lift and unable to recover the energy in time. (Not unheard of and plenty of reports where this has happened - albeit usually not to a crash).

2) Loss of engine thrust backed up two potential pieces of evidence that back up the RAT was deployed (apparent RAT sound, potential RAT seen on low res video).

It is impossible to know which of these is the case. Considering this summary of memory items is there the potential for a combination of both theories to have taken place?

Inadvertant flap retraction by PNF leading the PF to sense a sink and loss of lift. Pushes the thrust levers forward to the firewall and still the aircraft sinks. PF looking through the HUD and so very much 'outside focused' and doesn't realise that PNF has instead moved the flaps. PF defaults to memory items for loss of thrust on both engines before PNF can realise or communicate to PF what they've done, start switches are cut off which drops the RAT and from that point they're only heading one way. This would satisfy the strongly held belief that the RAT was extended, whilst also following the more likely initial cause of an action slip by PNF starting the sequence, rather than a dual engine failure.

Originally Posted by tdracer

Another hour spent sifting through the stuff since last night (my sympathies to the mods ). A few more comments:

"Real time engine monitoring" is typically not 'real time' - it's recorded and sent in periodic bursts. Very unlikely anything was sent from the event aircraft on this flight.

Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).

As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.

Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).

The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.

Originally Posted by tdracer

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios

Originally Posted by tdracer

... The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) ...

Originally Posted by FullWings

I think it needs to be said again that pretty much anything can happen to the aircraft systems and the engines will carry on running - this is by design as they have independent FADEC and power supplies and at sea level fuel will get through without boost pumps. You could almost saw the wing off the fuselage and the engine would still produce thrust, TCMA notwithstanding.

Originally Posted by FullWings

We don\x92t know yet what actually triggered the RAT from the relatively short list but every item on it means there is a serious/critical failure(s). The flight path suggests that it was a double engine failure or shutdown (commanded or uncommanded) as anything else should have left the aeroplane in a poor state but able to climb away.

Originally Posted by BugBear

Difficult!? Maybe not. If very late the flaps were tagged stowed, and there was a simultaneous gear up command, with FlapDown command, the overload could have failed a GCS. Then it becomes a switching exercise. (Automatics).

Alarms Warnings Impacted EICAS, ETC. it happened long ago, but we know what happens when an engine driven generator quits ..first it bangs for awhile, then it burns itself up, then ...

Originally Posted by MaybeItIs

Thanks for answering the question I hadn't yet asked but wanted to confirm!

I'm still sticking with "Major Electrical Fault" as my most likely cause, and this adds to my suspicions.

As I understand it, the landing gear is raised / retracted by electric motor-driven hydraulic pump (pumps?). This/these would create a significant electrical load.

If the plane's multi-redundant electrical system has a fault which is intermittent (the worst kind of electrical issue to diagnose), and which causes the redundancy controls to go haywire (as there are, of course, electronic controls to detect failures and drive the switching over of primary and backup electrical supplies), then this fault could to triggered by a large load coming on-line. It could even be as simple as a high current cable lug not having been tightened when a part was being replaced at some stage. The relevant bolt might be only finger-tight. Enough to work 99.99% of the time between then and now... But a little bit more oxidation, and particularly, a bit more heat (it was a hot day), and suddenly, a fault.

Having worked in electronics for years, I know that semi-conductors (and lots of other components, especially capacitors [and batteries]) can also degrade instead of failing completely. Electro-static discharges are great for causing computer chips to die, or go meta-stable - meaning they can get all knotted up and cease working correctly - until they are powered off for a while. They can also degrade in a way that means they work normally a low temperatures, but don't above a certain temperature.

Anyway, there MUST be ways that the redundant power supplies can be brought down, simply because, to have a critical bus powered from a number of independent sources, there must be "controls" of some sort. I don't know how it's done in the 787, but that's where I'd be looking.

As there is a lot of discussion already about how the bogies are hanging the wrong way suggesting a started but failed retraction operation, and it's now confirmed that the retraction would normally have taken place at about the point where the flight went "pear shaped", I'm going to suggest that the two things are connected. More than that: I'll suggest that the Gear Up command triggered the fault that caused both engines to shut down in very short succession. Nothing the pilots did wrong, and no way they could have known and prevented it.

It's going to be difficult to prove though.

Originally Posted by ILS27LEFT

Best post until now in my view. We will find out very soon I think. Gear up command triggered the instant lack of fuel to both engines. I'm not sure on how the fuel flow is dependant on the power supplies on the 787 but I genuinely believe you are very very close to what might have happened here.

Originally Posted by MaybeItIs

Yes, thanks, I've seen a few comments to this effect, and I have to accept most of what you say. I understand that they have their own dedicated generators and local independent FADECs (or EECs), but I'm trying to use what I do know to attempt to figure this out. I know that there are Fuel Cutoff switches in the cockpit. Somehow, if switched to Off, these will cut off the fuel to the engines, "no matter what". Of course, even that's not true, as the Qantas A380 engine burst apparently (comment in this thread) showed.

Anyway, the thing I'm looking at is how the fuel cutoff switch function could have been activated in some other way. To me, it seems obvious that there are wires that run between the engine fuel shutoff valves and the cockpit / flight control panel (no doubt with relays etc in between). I don't know where those shutoff valves are located, but logic says they should be located in the fuselage, not out at the engines. I also don't know how those valves operate - are they solenoid valves or electro-mechanically driven? Nor do I know where the power to activate those valves comes from, but using my logic, if those valves close when powered off, such as solenoid valves typically do, then the power cannot exclusively come from the engine-dedicated generators. If it did, you'd never be able to start the engines so they could supply their own power to hold those valves open. So, there must be some power (appropriately) fed from the main aircraft control bus to activate those valves - if the rest of what I'm assuming is correct. Anyway, like I say, I don't know enough about the details at this point, but there are many more ways to activate or deactivate a circuit than by flicking a switch. Killing the relevant power supply, for example. A screwdriver across some contacts (for example), another. Shorting a wire to Chassis, maybe. Just trying to contribute what I can.

You raise another interesting point: "TCMA notwithstanding". Could you elaborate, please? What will happen if the TCMA system, which apparently also has some degree of engine control, loses power? The problem with interlinked circuits and systems is that sometimes, unexpected things can happen when events that were not considered actually happen. If one module, reporting to another, loses power or fails, sometimes it can "tell" the surviving module something that isn't true... My concern is where does the power to the Fuel Cutoff switches come from? Are there relays or solid-state switches (or what?) between the Panel Switches and the valves? If so, is the valve power derived from a different source, and if so, where? Are the valves solenoids, open when power applied, or something else? What is the logic involved, between switch and valve?

Would you mind answering these questions so I can ponder it all further, please? If I'm wrong, I'll happily say so.

Originally Posted by lucille

What\x92s the usual time frame for the release of preliminary data and report from the FDR and CVR? Is it around 6 months?

I guess if no directives come from Boeing or the FAA in the next 2 weeks, it can be presumed that a systems failure from which recovery was impossible was unlikely.

Originally Posted by bakutteh

Massive loss of lift misidentified as loss of thrust. If any one pilot just had a dual engine failure scenario on a recent sim ride, brain and muscle memory would jump to loss of thrust in dual engine, prompting them to accomplish the recall memory items which called for both engine fuel switches to OFF and then RUN, and physically deployed the RAT.

Originally Posted by Someone Somewhere

Gear and flaps are both hydraulic, and the hydraulic pumps typically act as effective fault-containment - a hydraulic failure or excess load doesn't result in excess demand on the electric side; the pump just starts to run out of output flow/pressure.

Originally Posted by Someone Somewhere

In addition, the 787 has four main generators and I believe the switching is segregated into at least two controllers, on top of the four separate generator control units.

Originally Posted by Someone Somewhere

And again, electrical failure should not cause engine failure - consider QF32 where the wiring to the engine was mostly severed and they had to drown it with a fire truck.

Originally Posted by Someone Somewhere

It's not. Boost pumps should be more-or-less unnecessary at sea level.

Originally Posted by Someone Somewhere

I believe the valves are almost all bi-stable power-open power-close. When not powered, they remain in the last commanded position.

The valves are located in the spar (hence being called 'spar valves'. The fuel tank is immediately above the engine so it is a very short pipe for suction feeding. Tail mount engines are potentially a different story...

Originally Posted by MaybeItIs

Okay! Many thanks for that! Of course, it very much complicates the picture, and I'm very puzzled as to how the Fuel Cutoff Switches and Valves operate. Apparently, the TCAM system shuts off an errant engine on the ground at least, but my concern is not with the software but the hardware. It obviously has an Output going into the Fuel Shutoff system. If the TCAM unit loses power, can that output cause the Cutoff process (powered by the engine-dedicated generator) to be activated? I guess that's the $64 billion question, but if MCAS is any example, then: Probably!

Originally Posted by MaybeItIs

Ok, thanks for clarifying. Of course, an overload will simply cause the hydraulic pressure relief valves to activate. There will be a moderate increase in motor current when bypassing, but the electrical side should be fully able to cope with that. Should be! I'm suggesting here that there was a fault somewhere in the electrical supplies that effectively derated some part of it, and that maybe the GearUp load was too much for it on this occasion.

Originally Posted by Icarus2001

No evidence of engine failure

No evidence of RAT deployment from a poor image.

No evidence of electrical failure.

The teams of lawyers in the UK representing 53 grieving families will be working over the weekend to sign up said families to a class action.

​​​​​​​This is going to get messy.
​​​​​​​