Posts about: "Fuel Cutoff Switches" [Posts: 802 Pages: 41]

In the last 48 hours I have personally placed four (4) B787 fuel control switches from RUN to CUTOFF.
And as I did so, I had to think of this accident.
I struck me that in my personal way of operating in a cockpit environment, the switching of these fuel control switches is SO deliberate.

Even for me, a regular airline commander. It struck me that I simply can not fathom or believe the scenario wherein a collegue of mine can \x93accidentally\x94, as a slip of mind, place those switches in a position they don\x92t belong.
And I don\x92t buy the failure of one switch, or it\x92s wiring, on the most critical moment in flight.
Let Alone Both At The Same Time.

There are ways to have gates that can be closed in either position (and are perhaps spring-closed), but either they are going to be left open, are a PITA to operate a switch single-handedly, or operating the guard will become part of the muscle memory for operating the switch.

I would agree but what do you imply then?

They are usually such nice sharks.

What is known so far certainly does defy logic but I struggle with the brain fart idea. Firstly (noting that the initial report does not mention positive rate or gear up calls) I can’t see any action cue for the PM to do anything at all at the time the switches were moved to CUTOFF. If some sort of random disorientation action is postulated then you’d have to ask why did it occur at that critical moment and not 30 seconds earlier or 30 seconds later?

Secondly, I can’t be the only one who has operated a control and then perceived an unexpected set of visual, audible or physical responses from something unrelated and instantly thought WTF have I just done followed by an immediate re-check of that action? Although the initial report is notable for what it does not say I can’t see the flat denial of any action is what would be expected given the plethora of cues in that cockpit following the operation of the switches.

Quote:

Originally Posted by YYZjim

The preliminary report narrows things down a lot but not as much as it could have done. The report will have been approved by several people. What we see is their consensus. Why did they choose this version?

I agree that the Preliminary Report will have been a very carefully chosen synopsis, but I don't think it precludes a system behaviour that might or might not even be categorised as either an electrical or mechanical malfunction, as such.

Consider that the Preliminary Report only references the CVR contents to indicate one crew querying why he (the other) cutoff, and the other denying it. Clearly very pertinent data to this investigation, so I'm not ruling out both of the crew being sincere, until I understand the aircraft system better.

If the cutoffs weren't triggered by the crew moving the switches, then the most likely thing was that both FADECs encountered a situation that invoked cutoff, practically at the same moment. That might suggest that the data from independent Run/Cutoff switches via independent poles that possibly route via a PIP or PIPs to various RDCs and in turn the CCS (which means these paths have a common mode) resulted in data to both FADECs "failing" in a critical manner simultaneously.

The only CCS vulnerability I'm aware of is what happens if the CCS is kept powered for 51 days, shortly after which, the Time Manager data integrity for ARINC 664 messages is compromised, possibly only considered critical n conjunction with a CDN Switch failure. AD 2020-06-14 therefore requires a maintenance action of cycling the CCS power at least once every 25 days.

Two such omitted, or incorrectly executed maintenance actions in a row would have to happen for that known issue to be relevant. Perhaps there is some other input in the CCS system that influences both lanes of data to the FADECs for the Cutoff to be triggered, but I'm not aware of such.

If the data to both FADECs became good again around the same time (perhaps no longer Stale Data, or an alternative source selected, or other mechanism), and given the unavailability of APU power at this point, might Engine 1 restart be initiated first, and might Engine 2 restart be triggered 4 seconds later by the FADECs? Is that possible without the crew cycling the switches?

Regarding AD 2020-06-14, which was approved quickly, Boeing subsequently offered revised wording, which changed "may" to "will", see FAA Docket 2020-0205-0004, but as it did not alter the maintenance action, it was not adopted. A fuller description of possible consequences was in FAA Docket 2020-0205-0001_content, but it was quite wide ranging, and didn't attempt to characterise specific aircraft systems behaviour.

For anyone wanting more information on the CCS, in the context of that Airworthiness Directive, I recommend reading A Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Airworthiness Directive at IOActive.

As a non-professional pilot, please accept that my knowledge of much beyond the CCS is patchy, but I welcome this scenario being critiqued.

Thank you for your time, and I'm just donning my hard hat and flack jacket.

I have flown B777 and B787 and have operated these switches many times. They are solid secure switches that need a deliberate action to move.
My thoughts, without any weighting or inference are that they were:
1. moved deliberately to shutdown the engines
2. moved unintentionally and ended up shutting down the engines
Airlines focus on many safety topics, one of which is action slips.
Cockpiy Control Confusion - by Airbus
A recent example cited by the AAIB was the 777 RTO at LGW.
The only time that both fuel control switches are switched off together (and not immediately switched back on - Double Engine Failure) is at the end of the flight once parked on stand. This is a very familiar, routine action that pilots do with probably little thought. I have heard of some very odd action slips by some very experienced pilots. In this instance maybe the cue for the action was gear up? It could fit the timeline.

This has been discussed to death previously. I suggest looking for tdracer's excellent insights into FADEC design and implementation. From the beginning we've been discussing various very rare types of circumstances. Based on the preliminary report we can now lay most of those to rest.

Which actually brings me to this one because I would like to ask for a bit of clarification: By "fuel switch discrete" are you referring to the Fuel Control Switches discussed in the preliminary report?
I would assume from your statement, that if a mismatch in the NC/NO signal on the switch was detected the FADEC would not direct the Fuel Cutoff Valves to close (as far as the types you are familiar with are concerned), is that correct?

The report states:
So this would then mostly preclude the possibility of one or both switches being faulty electrically.

The report then states:
There is a 10 second gap between cutting fuel and re-enabling it and a 4 second gap between switches during re-enabling. Is there a mechanical reason why these switches would be slower to operate in either direction? There are obviously reasons such as startle factor and stress that might negatively affect the speedy operation of switches by anyone, but I am nonetheless curious if this might not be a pointer to some sort of mechanical issue after all, such as asymmetric wear or FOD.

It is also part of the evacuation drill, as practiced regularly during recurrent training in the simulator. If a high stress situation had developed after V1, a "brain fart" may have resulted in the deliberate but unintended switch selection.

One of the initially discussed variants was inadvertent operation of the Fuel Cutoff Switches instead of putting up the landing gear. There was some pushback against that idea based on the position of the landing gear. As far as I recall the observed position of the landing gear was ultimately deemed to be caused by loss of hydraulics, and not as caused by interruption of the raising operation, making it fully compatible with the preliminary report. It's curious that the report does not mention the positive rate and gear up call out, either for its absence or it being made. It does note that the landing gear lever was in the down position, which isn't unusual for a severe event just after V2 but also in line with the theory.

With what we know now from the preliminary report that option seems to be a good candidate as the source of initiation for an action slip. Both the PF instead of calling Gear Up Action Slipping and operating the Cutoff Switches, or the PM instead of calling Positive Rate doing so would fit that scenario and timeline.

For the action slip theory, while worth of considering, I have one question. That is that both switches are reported to be moved to CUTOFF at practically the same time, quote "within 0.1 seconds". You can not move those switches one after the other in 0.1 seonds (grip one, pull it, move it, let loose , grip the other one ...).

Question: is it an often encountered practice when arriving at the stand, to shut-down both engines simultaneously? The switch design seems to try to prevent simultaneous action. But we are humans, right?

Why this is relevant. Because if normally you do two actions, maybe with 2..5 seconds gap between them. It would be unlikely that you would shut down both engines instead of gear up. One, yes, on a bad strange day, but not both of them. Except ... you got a habit and always Cut-Off both engines in one single go.

I'm not 100% sure I'd be able to see the other pilot hand on the fuel switches during rotation tbh. I may be able to detect movement, nothing more than that.

One thing worth mentioning is that many years ago I used to buy surplus electronics and had a switch very similar to the one used as a fuel switch. The only difference was that they one I had required to to twist and pull before you switched it, compared to the Boeing ones that you just pull before switching.

The point is it was easy to balance the switch between the "off" and "on" positions, where a simple push in either direction would then pop it into a latched position, either "off" or "on" depending which way you pushed it.

In this middle "unlatched" position I seem to remember the switch was on.

With Airbus it is required. However, I cannot speak about Boeing's operating philosophy.

To quote from Airbus' Flight Crew Training Manual:

In flight, the PF and PM must crosscheck before any action on the following controls:

‐ ENG MASTER lever (With Boeing this would be the fuel cut-off switches)

‐ IR MODE selector

‐ All guarded controls

‐ Cockpit C/Bs.

The fuel switches were switched off with a gap of 1 second (allowing for 1Hz sampling, between 0 and 2 seconds).
They were switched back on, about 10 seconds later, with a gap of 4 seconds (between 3 and 5 seconds).
What might account for the much slower switch on, especially given the serious nature of the situation?

Since we have had a few 787 qualified pilots contributing lately, hopefully one of them can clear up whether or not that's standard in their checklists / SOPs, etc.

One possilble reason (of many) is that the switches were turned off by someone who was otherwise unoccupied but they were turned on by someone who was busy trying to fly an airplane. Unless there was some deliberate effort to gum them up or damage them, I can't imagine mechanical faults suddenly appearing in the switch locking mechanisms right at that moment.

Both gear and flap retraction requires upward movements of the lever while the fuel control switch requires a downwards movement to select Cutoff. And in the case of say gear or flap retraction, only one lever movement is required. In this case both switches were commanding cutoff within 1 second of each other.

With this in mind, the muscle memory / fatigue theory is difficult to understand. I would find it easier to accept if only one FCS was accidentally selected to Cutoff.

Theoretically we can't exclude the pilot cutting off the fuel, is same person asking the other pilot if he did cut off fuel..
(On tech ops there is a discussion on cockpit camera's. )

One thing to keep in mind in the midst of the discussion of brain farts and the notion that no experienced captain would ever do that : A medical issue impairing brain function can strike out of the blue, even in an individual who is perfectly healthy, both mentally and physically. A mini stroke is just one of many possibilities. So it is quite conceivable that the captain did indeed move the cutoff switches, and then denied it, and yet nobody is to blame , not even the captain himself, because there is no way the problem could have been detected before it arose. Highly unlikely? Yes, but then this whole accident was highly unlikely to begin with.
(Not a pilot, nor a medical expert. I am getting back on dry land before the sharks appear.)

The authors of the preliminary report would surely have known that the report as drafted would raise strong suspicions of an intentional act by one of the pilots to shut off the fuel switches. If the investigators had evidence that would indicate that it was not (or may not have been) a deliberate act (from for example the rest of the verbal exchanges between the pilots) then surely they would have included such information in the report in order to avoid such a conclusion from being drawn by the reading public. This suggests that there is no such evidence.