Posts about: "Fuel Cutoff Switches" [Posts: 802 Pages: 41]

Isnt the first action on the FCO switch to lift it? Haven\x92t flown the 787 but every other lever-lock switch I\x92ve used worked that way.

I first didn't understand his answer as well (it was my question). In the meantime I know more about the logic: The fuel shutoff valves are not operated by the FADEC. The switches are wired directly to latching relays that drive the (latching) fuel valves. Using an additional pole of that switch the FADEC just gets the information that the switch was operated (and of course the current position). The FADEC can then e.g. execute the engine restart sequence if required.

Or simply not have paraphrased that particular exchange in the preliminary report.

More likely as with investigation reporting, they\x92re simply calling balls and strikes and really aren\x92t concerned about the conclusions readers make.

Absolutely true. I can imagine that this report is a compromise among the investigators and was issued after representatives of Boeing and the USA, were happy that they would be able to say that there were no technical issues that caused the crash and the Indian side of the investigation team that is not ready (if they will ever be...) to acknowledge that the switching off was an intentional, deliberate action.

Of course, we now have to wait and see what the investigation ultimately reveals: technical error or human intervention.

I think that in this phase of flight and situation, it's truly a masterpiece to first recognize the problem and then, with the presence of mind, reset the fuel control switches to "Run."
We don't yet know which of the two pilots did this, the PF or the PM. Nevertheless, it apparently happened in a fraction of a second.

If crew action is the root cause of this, then the above may be the "best" we, as a pilot community, can hope for.

Pardon me. I do not mean to offend you, but I think you're one of the people that wouldn't recognize a duck when it was quacking right in front of you and you probably have no experience whatsoever in manipulating those switches.
The switches were put to OFF in short succession of each other right after takeoff and only 10 seconds later they were switched back to run with about four seconds delay in between the two switches.

One loose contact at the back of the breaker panel or two? One melted circuit breaker in the consumer unit or two? Can we not just think about what we\x92re saying here. There were TWO switches. Both still worked after being cutoff.

Replicating the accident scenario in a G650 over on a another forum,

Come on... I fly the 787, and there is absolutely no way you can hit the fuel cutoff switches by accident when selecting the gear switch, for either pilot. This is absolutely ridiculous.

Having read through most of the posts in this and the other threads, and the preliminary report a few times in parts, am mystified by this:

The Preliminary Report states: "The CCTV footage obtained from the airport showed Ram Air Turbine (RAT) getting deployed during the initial climb immediately after lift-off (fig. 15). No significant bird activity is observed in the vicinity of the flight path. The aircraft started to lose altitude before crossing the airport perimeter wall."

Does this mean the RAT deployed "immediately after" in the sense of within 1 second after lift-off?

We, as a group, certainly seem to be interpreting the "immediately thereafter" in a prior paragraph to mean that the E1 and E2 fuel cutoff switches went RUN -> CUTOFF within 1 second or so after max airspeed of 180kts at 08:08:42.

The prior paragraph for quick ref:
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off."

Additionally, have to say, this PR has a few major weaknesses in it:
- no timestamp for RAT deployment, though RAT hydraulic power coming online has one; also is it for initial power or rated power?
- no timestamp for the pilot conversation about 'cutoff', though it is provided for the MAYDAY.
- no timestamps for E1/E2 Fuel Cutoff Switches going from RUN -> CUTOFF, though they're provided for CUTOFF -> RUN.

After all the analysis on PPRuNE, fuel switch failure (well, dual switch failure, at practically the same time) seems so unlikely it's no longer worthy of consideration. However, I'm still open to the idea of a failure elsewhere that may have signalled the fuel switches had transistioned from Run to Cutoff wthout physical movement of either switch. Why? Firstly, because of this (taken from the preliminary report)



The STAB cutout switches are located next to the Fuel cutoff switches. What did Air India’s on duty AME do as part of their troubleshooting? Were panels removed to gain access to the rear of the switches and wiring? What about wiring and data connections elsewhere? What may have been disconnected/disturbed as part of this process? Do the STAB cutout switches and Fuel cutoff switches share any connectors that could have been inadvertantly cross-connected? Etc. It would not be the first time that an engineer had innocently done something that later caused an accident. And I haven't read anything about possible nefarious action by a (disgruntled?) engineer - but I've seen lots of accusations directed at the pilot(s)...

Secondly, the preliminary report's version of (part of) the conversation in the cockpit -
Until proven beyond reasonable doubt I'm chosing to take the cockpit conversation at face value, because I really don't want to believe any of the following scenarios:
A) one of the pilots lied
B) one of the pilots attempted to deflect blame onto the other pilot for the benefit of the CVR
C) One of the pilots unknowingly operated the fuel cutoff switches.
D) One of the pilots deliberately operated the fuel cutoff switches.

It is all too easy to blame one of the pilots when in reality no one outside of the official investigation may yet know what most likely happened.

Inspired by the mention in the PR about a MEL on the \x91core network\x92, I came across the polemics between Boeing and IOActive a few years ago about the alleged vulnerability of 787 core systems to outside interference (hacker attack from within a/c and/or ground), including the highly sensitive CDN module, from where also the fuel cut-off module can be accessed. It\x92s definitely not my specialty, but I thought to flag it in case someone has more informed ideas about this. To my mind it could potentially \x93outshine\x94 intentional crew action. Boeing at the time denied such options, of course. Obviously also in good faith, moreover it seems to be Honeywell &GE code anyhow, but who knows where we are 6 years on.

https://www.wired.com/story/boeing-7...ecurity-flaws/

I would stay away from assuming any intentional harm as it goes against the definition of safety I learned at Eurocontrol: Safety is the absence of unintended harm. Safety Culture and Security are so often mutually exclusive that I don't consider security considerations worthwhile in the context of aviation accidents.
Wires or wiring is mentioned twice in the report:
Considering the state of the rest of the components, with basically everything showing signs of burn damage, it will be a hell of a puzzle and very time consuming to reconstruct that and nigh impossible to find any source of error there. I was actually intrigued by the potential for FOD. But I'd imagine they would have been able to identify anything pretty easily.

While severely burnt the switches are still solidly in place and anything that was lodged in the switch housing itself would likely still be there. And I guess it would also be unlikely for FOD to equally impact both switches. I think I just talked myself out of the FOD theory.

I find option C to be at least a productive train of thought because it may provide methods of mitigation. That is after all what we're trying to achieve in discussing this kind of accident. I would expect or at least look positively on a suggestion to use the Embraer model for operating the cutoff valves. While it introduces a secondary element that may fail, requiring the Throttle Control Levers to be at idle just seems like a good idea. How is this handled by Airbus?

I cannot read the linked article. Would you please describe what you mean by "the fuel cut-off module", preferably with reference to the related aircraft schematics showing the signal paths between the fuel switches, spar valves, and engine HPSOV.

I believe it is highly unlikely that anything will occur in any of the legal - or investigatory - processes happening now or which will occur, that will meet the "proof beyond a reasonable doubt" standard.

Absolutely. The attempted reading of tea leaves to interpret what the authors may have meant beyond what they said, or what they intended to convey by not saying something else, may be fun for some, but it really contributes nothing to understanding this crash.

We know with reasonable (although not perfect) certainty that the fuel control switches were placed in CUTOFF almost immediately after rotation and were later moved back to RUN. We do not know who did that or why it was done and we don't have nearly enough information to answer those questions with any confidence.

The authors of the report have access to the full cvr. They have chosen to only release a synopsis of one fragment. Who knows what the rest of the cvr discloses but the decision to release that one fragment must be to convey an understanding...they want it known.

SLF here, but I did read all 3 threads. To me, this doesn't seem likely. But it got me thinking, what about the fuel switches being partially cross-connected left to right and right to left? If each of the 8 channels (4 for each switch) has its own connector, it could be possible. From what I understood from earlier posts, from the 4 channels of each switch, there are 2 can shut down an engine. If that's the case, assuming some cross-connection, a single switch movement might be able to affect both engines.

But, even if this were possible, there are problems with this hypothesis too. The problem would most likely be discovered during engine startup, if the engines are started one by one, not at the same time, as they probably wouldn't start unless both switches are set to RUN. And not sure how this would fit the various delays recorded on the FDR. And you still need something/somebody to move at least one of the switches after rotation to trigger the issue. Both switches being moved by the pilots still seems much more likely to me than some technical issue.

"Software faults" do not usually come out of the blue, for no particular reason. Just because it's recorded by software it doesn't mean that it's not something hardware related that triggers it. In a previous reply, not sure if in this thread, it was mentioned that the message meant that there was implausible data coming from those STAB cutoff switches, if I remember correctly. Something like a channel showing both on and off at the same time, or the other way around, or some other inconsistency. That could have been an intermittent issue, that might indeed not be reproducible with a BITE test, and just be cleared. But if the STAB cutoff switches did indeed have a problem, or one was suspected due to recurring reports, is it really so unlikely that they might try to look for some hardware issues, such as a loose connector? For the Lion Air accident involving MCAS, after repeated issues during previous flights, they did exactly that: disconnected and reconnected some connectors to check for issues, among other things.