Posts about: "Fuel Cutoff Switches" [Posts: 827 Pages: 42]

This is a constant-pressure hydraulic system, not a little hydraulic ram on a logsplitter. While I assume there are some overpressure relief valves, they're not relevant here.

It uses a variable displacement pump to maintain 5000PSI constant pressure. The swashplate angle is varied to adjust pump output flow: more devices consuming fluid, more flow to keep the pressure up. If the pumps cannot deliver enough fluid, the swashplate reaches the full flow position and the output pressure decreases until flow consumed equals flow produced. Very much like a constant-current constant-voltage power supply.

Running in that area of maximum flow is 100% expected under some conditions, especially if an engine or EDP fails and the electric demand pump is supplying a whole hydraulic system sized for the larger EDP (although I think this would be less of an issue on the 787 as the L/R systems don't do much, but the same variable-displacement pump design has been around for a LONG time including on the 737).

And again, there's a VFD between the aircraft electrical bus and the pump motor, because the pump is 400Hz and the aircraft is wild-frequency. VFDs are very very good at isolating faults unless you are actually looking at a sustained overload on one of four generators .


Virtually every bus will have a feed and one or more cross-ties or back-feeds. A failed contactor is 100% designed for and with possibly the sole exception of RAT-only flight, entirely designed around. Plus, of course, flight on batteries only or PMGs.

No bus is essential on a modern aircraft.

Boeing treats everything electric as a black box but the A380 has this beautifully overkill drawing - given both have 4x generators, 2x APU generators, and a RAT, it should not be entirely dissimilar levels of redundancy:

Note that the reason for some links having two contactors in series (e.g. BTC5/6 or BTC7) is because this is spread across two separate units, so that a fire and total loss of one leaves ~half the aircraft powered and totally flyable.


As per TDR, built into the FADEC logic.

Power-open power-close is very common in commercial/situations where you don't want to be wasting energy 24/7 and don't have a defined position for the valve/damper in case of power loss. Done a bunch of them in ductwork and electrically operated windows - your car likely has them, for example.

I guess it all depends on what you mean!

If the fuel supplies were cut off, causing the engines to stop, is that engine failure ? I'd say not, nothing wrong with the engines until they impacted the buildings etc.

No evidence of RAT deployment - but you're specifically restricting "the evidence" to a blurry amateur video. That alone is not great evidence, but why does that video exist at all? When they lift the relevant section of fuselage, RAT deployment or not is going to be fairly apparent. And Circumstantial evidence is still evidence, no?

No evidence of electrical failure? Do you know that from the downloaded Flight Data?

A thrust reduction is not an engine failure. Engine shutdown due to an action of crew (or inaction) is not a failure.

There is no evidence of an electrical failure. What evidence? A surviving passenger thought he saw flickering lights? Give me a break.

The word evidence in English has a very specific meaning.

Look for the simplest explanation here and then ask why the worldwide B787 fleet is still flying with no urgent inspection requirements from Boeing or GE. Think about that "evidence".

Hi tdracer, and thanks for your comments.

I hope I never suggested you guys are idiots! I very much doubt that indeed. You cannot be idiots. Planes fly, very reliably. That's evidence enough.

Maybe my analysis is simplistic, but for someone who knows as little about the nuts and bolts that are your profession, I think I'm not doing too badly.

I believe I have made a number of worthy contributions to this thread. Maybe I'm deluded. Too bad. Fact is, over the history of modern aviation, there have been a number of serious design stuff ups that "shouldn't have happened". As far as I'm concerned, the crash of AF447 is bloody good evidence of not considering a very simple, fundamental failure, and should NEVER have happened. The thing is, that would have been sooo easy to avoid. So please, don't get on too high a horse over this.

Thanks for your information about all the fuel control valves. That's cool. Yes, my cars have numerous such systems, from the radiator grilles backward.

And you misunderstand what I meant about "complicates things". Was that deliberate? What I meant was it complicates understanding how a major electrical failure could cause the Fuel Cutoff valves to close, that's all. The valves don't close if unpowered, but if the control is via the FADEC, then what could have caused them to close?

Your explanation of how the Fuel Valves are controlled is rather simplistic too. "The pilot moves a switch, that provides electrical signals to the spar valve and the engine fuel valve to open or close." Seriously? Am I an idiot then? Is it a single pole, single throw switch? Is the valve driven by a stepper motor, or what? A DC Motor and worm drive? Does it have an integral controller? How does the valve drive know when to stop at end of travel? Would you mind elaborating, please?

If the photo of the flaps deployed at the accident site is actually F1 not F5 or if the flaps were pushed out during impact, then this is certainly plausible. I will look for the photo but it's in the thread somewhere. Others are stating they see a gap between the wing and the flap as an argument for the flaps deployed at F5. This was after the decent started..

However, I think their reaction would likely be to apply more power. I know mine would be. But anything is possible!

This is a very plausible scenario. Above 400 ‘ AGL, memory items.

(Sorry, Airbus here and not familiar with Boeing) Flap 5 to 1 reduction on the Boeing triggers autothrust reduction, is that correct? If so, are there any other conditions that need to be met for this to happen like being in some kind of takeoff mode? Just thinking whether this would have potential otherwise in other regimes to cause issues, discontinued approach perhaps.

Am slightly puzzled as to why if flap reduction triggering climb thrust is part of the standard logic (and presumably clean-up technique) then partial dual thrust loss wouldn\x92t be immediately recognised as the classic symptom of gear / flap retraction handling error? I presume Boeing pilots / air India are just as aware of this it as everyone else, strikes me as odd that one would immediately go into full dual EF mode. My instinctive reaction without knowing the Boeing would be to firewall both TLs, would this have worked in the early flap retraction logic scenario? Many thanks all

Correct. That was the original purpose of the calculation. In addition to the sound itself having the measurable harmonic signature from other rat videos.
What this plot also does however is tell you the speed if you know the height or height if you know the speed.

The iphone used to film this were pictured somewhere, knowing the iphone model, and thus the characteristics of the camera, and the dimensions of the airplane it wouldn't be impossible to calculate height from the video imo.

Just throwing it out there if anyone sees the use and feels the call.

My personal amateur speculation still centers around the cut off switches.
I have spilled coffee and sweet tea over complex electro/mechanical switches/panels before(large format audio consoles with 8000 buttons) and seen unexpected things happen.

I am sure the switches are spectacularly well built, but they are in close proximity and thus prone to the same external factors.
Does anyone know if these two cut-off switches in such close proximity has the exact same installation, or they differentiated in some way that makes a freak failure mode in one not neccesarily affect the other the same way?

Unless the distance from the phone to the aircraft is known, it is impossible to calculate the height.

I will wager that this is absolute nonsense. The effect of pulling the power levers back to idle at rotate would be readily countered by pushing them back up again. The engines are still delivering thrust, it is a function of N1, not the lever. The lever commands where the thrust level will end up, the N1 gives the thrust output. The acceleration/thrust characteristics of these engines is not like a J52 or JT3D etc.

The proposition that is floated is that the pilot does not pull back on the control column, which he is holding onto with both hands as his seat slides backwards like a caricature of a bad Cessna 180 seat rail, that is plainly obvious from the pitch attitude of the aircraft, yet grabs lustily a double handful of thrust levers and holds onto those until meeting Ganesh in the next life?

Greek papers appear to be as rigorous and incisive in their cognition as the Daily Telegraph. Golly.

Seats: electric.
RAT deployment... presumably the hapless pilot doesn't grab the control column, or the thrust levers, just grabs both fuel control switches instead????

Do any reporters bother to read what they write?

I think it\x92s made up nonsense, but it is at least worth noting that pulling back to idle and pushing back with the wheels still on the ground is a potential TCMA trigger.

To simplify the chicken/egg:

Tdracer earlier confirmed that an airplane electrical power loss would allow engines to keep running , because 1) engines are fully-capable of suction feed operation in takeoff envelope (if boost pumps lost), and 2) the EECs are powered by their own PMAs when running and to substantially below idle (I recall roughly 10% N2). Airplane powers the EEC for ground starts, prior to PMA coming online, and as backup to the PMA after that.

Related:

Engine igniters are powered by the aircraft. So theoretical full loss of aircraft power would disable Autorelight upon a flameout. Ignitors typically don't make the cut for most-essential battery-only loads because it would also take an engine flameout, and the airplane past V1 in ground roll can fly fine on one engine that can achieve takeoff thrust.

Autorelight is relevant - if there was a single-engine failure post V1, autorelight will attempt to relight the engine, so there is no need for a pilot to try to cycle the fuel switch to reset the EEC (potentially grabbing the wrong one), or to otherwise intervene. In such a circumstance, they need to trust their training. I've heard accounts that the most likely pilot instinct in such a situation would be to push the throttle(s) forward.

Finally - there was talk earlier about accidentally cutting the fuel switches - and it was duly noted that they have to be pulled out over the detent, so very unlikely. The same cutoff effect could be achieved with the engine fire handle(s), right behind the fuel switches on the pedestal - though they are an upward pull, so also not subject to inadvertent or accidental engagement.

A loss of lift AND thrust at this critical juncture could have had caused this awful disaster. I think the data recorders have already revealed the cause but If it's this, then I don't think we will hear much anytime soon.

I don't believe I owe you anything, I believe this is done adequately previously and has already taken up enough time on this thread. I am of the opinion that we have shown the RAT being deployed satisfactory enough to be of use for speculation in this thread. I find repeated comments about the bad video being the only evidence a bit disrespectful, though. Even from a mere physicist. It is based on a spectrogram over time. The source file shows audio up to about 16 kHz, it is unknown whether this limitation is in the file format (ie. 32kHz sampling rate) or microphone. Doesn't matter much. The frequencies above 16kHz is not important in this context as it is not where the sound energy is anyway. The audio will have been lossy data compressed, but it does not affect these prominent properties of the audio. It does make me hesitant to draw conclusions from the parts of the spectrum with more broadband noise and several intersecting sounds. Noise floor suggests 16 bit sampling depth. Spectral resolution? N/A All samples are included. The spectrogram covers the entire frequency range recorded, It shows comparatively the same overtones of the fundamental expected from the technical specifications of the 2 bladed RAT running at it's intended RPM, the doppler characteristics fits completely with a reasonable range of passing speeds and distance to the passing source plotted out. Compareatively, All the harmonics are identical both in pitch and seperation to a recording of a known B787 landing with RAT deployed, while the Doppler fall shows a longer time frame in the landing video taken from a further distance. As expected. The overtones easily discernable in this recording falls in the 220-2700Hz range. Below that, there is other noise centered around 150Hz, which gradually fades towards the end of the recording. This, as far as I can find in available information, fits with an idling or even windmilling B787 engine, but this is not conclusive. This falls in a range of the spectrum where there are other noise sources and the signal/noise is low and of a broader band characteristic, these masking frequencies is where the lossy data compression might play tricks, so I do not weigh that heavily. Recordings of landing B787 without the RAT, shows none off the same characteristics, and completely lack the tonal components and exact overtones shown with the RAT deployed. More importantly, compared to videos of B787s taking off with normal take off thrust, the latter shows distinct tonal elements, but with very different overtones,, both in separation and composition, again possible to relate to known quantities of the rotational speed and elements of the engine at high power. The AI recording shows none of this.

The latest techniques let us separate such things as reverbration from the source, when superimposing the reverberation/ambience and background noise of the AI crash urban environment on the clean, dead open field recording of the known B787 w/rat, they do indeed sound exactly the same to this very skilled and experienced listener. Although this is not courtesy of the computer analysis. It is just another angle of confirmation.

All in all, i think this source audio is excellent. The source is an iphone, their mems based microphones, although noisy shows great spectral balance and is comparable to basic measurement microphones of professional application. There is plenty of information to analyse from in this sample.

And again, I can't see it in the video either, and until I put on some really expensive headphones and fired up the software I was of a different opinion. I bowed to the science.

Edit: I took an extra look, I am prepared to say the fall off at slightly above 16kHz is from the original recording, this is probably a limitation in the microphone, as it is not a hard cut-off before a 16kHz Nyquist frequency as it would be with a 32kHz sampling rate, there is dither noise from 16-20kHz fitting with the source being 16 bit.

I agree with your analysis about RAT. The source is usable, although far from the original quality.

The cut-off at 16 kHz is typically caused by lossy audio compressions (AAC), not the microphone. In this case, the audio was compressed two times (first the iPhone, then the Twitter). A microphone does not simply cut all frequencies above the certain point.

Also, this audio content is Mono (the same signal on both channels) - an additional loss of information, if the original recording was Stereo.

There have been many speculations about latent threats in systems\x92 design. If you can easiliy come up with some possible latent threat, what are the changes that not a one professional person designing, testing and certifying it couldn\x92t figure it out? Or it was ignore if recognised?

Without any 787 knowledge, I would assume two discreet signals from respective Engine Fuel Switch to each FADEC channel, possibly with other redundancies. Or other solution that is at least as robust.

If decrease in thrust not by transition to climb thrust due to early inadvertent flap retraction and pilot action on fuel control switches from accomplishing dual engine failure memory items, then fuel cavitation /fuel fumes lock may be a cause. Just saying.

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

This doesn't make any sense. The plane was in the air for approximately 30 seconds, the plane stops climbing around 12 seconds after take off, and the noise of the RAT is heard 11 seconds before the plane crashes - even if we assume the RAT both deploys instantly and deployed the exact moment that video began recording, that only gives the pilots a 7 second window to perform an action that results in it being deployed.

There just isn't enough time for the RAT to be deployed as a result of any action by the crew, IMHO. And to demonstrate how long 7 seconds is - that's enough to say 20 words, assuming no interruptions .

If you read the thread, you would know:

The RAT was almost certainly deployed. 4 different sources.
The Flaps were not retracted. Visible at the accident site plus many other sources agreeing they were indeed down.
APU will autostart when all engine power is lost. Potentially explaining why the inlet door was open or partially open at the accident site. Mentioned in several previous posts
On a 787-8, the main bogies tilt as the 1st action of the gear retract sequence. As stated in previous posts. I don't think this happens unless gear is selected up. So the conclusion was, gear was selected up. One caveat, IIRC, there was some discussion around a failure could have caused the bogies to tilt without Gear up being selected but I don't recall the outcome.
As for the Air France remark, un-necessary IMHO. Let's respect the crews please.