Posts about: "Fuel Cutoff Switches (detent)" [Posts: 66 Page: 4 of 4]¶

Well actually... There was a common problem with those switches. It was the topic of a rather old Airworthiness Directive and discussed extensively. Going off memory alone it was possible for the detents to be misaligned or otherwise damaged preventing the switches from correctly latching into either locked position.
As per the AD they _should_ have been replaced. It _should_ have been impossible for any switches with the issue to still be used on an aircraft over a decade after the AD. But maybe Air India just decided to not follow that AD? Or maybe there is a small subset of 787's where they didn't? And what the hell did they check last year when they supposedly went over all their 787's and inspected that very set of switches?!
I'm baffled and a bit speechless right now...

If the detent is misaligned/damaged enough the upper stable position may not be fully reachable and the switch might instead rest in a pseudo stable position prone to collapse due to vibration or other outside forces.

> The FAA issued Special Airworthiness Information Bulletin (SAIB) No. NM-18-33 on December 17, 2018, regarding the potential disengagement of the fuel control switch locking feature. [...] Both fuel control switch were found in the \x93RUN\x94 position.

So correction first: It wasn't an Airworthiness Directive, it was just an SAIB, but also the above is the only information provided by the preliminary report. Notably they did not comment in any way on the state of the guard/detent.
I'd not dismiss this event so out of hand. After the 171 crash every single pilot flying for Air India surely has heard that those switches are blamed, right? For any of them to be willing to faff around with those seems alarming and, for me at least, points to possible normalization of deviance. It may be practice for them to not treat these switches as a potential flight safety issue.

I really, really want to see a better report on this.

I imagine one way for this to be true would be if the lever has some wiggle room, such that the teeth on it can move sideways past the teeth on the base, and then stick in that position where the lever is up and the flanks of the teeth are still touching. In that position, you could flip the switch back off without overcoming the detent. But if you operate the switch properly, with no sideways force, and seat the lever correctly in the ON position, then it'd be secure. That fits with the part of the press release about telling the pilots how to operate these switches properly.

Obviously I have no idea if this is true. I just want to give an example of how that switch might be operated one way to be unsafe, and another way to be safe. I'd really want to see Boeing's take on this, and not a third-hand press release that went from Boeing to Air India engineering to ??? to the ministry. It may say something impossible that differs from the possible thing the engineers actually found.

This should never be allowed to happen again. As things stand it's entirely possible it could. I would hope the final report will recommend a re-think as to how this critical system could be improved to prevent miss use or failure.

Any mention of modifications have received pushback because operators cite how long Boeing have been doing it this way without any serious issues.

I feel that standpoint incredibly ill-advised given that the situation could be improved to negate single point failure or deliberate action, or at least determine which had occurred.

Previous discussions on here relating to either relocating or guarding the switches has been dismissed by most as unnecessary, which I can understand, as it would probably add little in the way of increased safety.

I'm no designer of aircraft systems, but reading this continued discussion about springs, detents latching wiggling and misplaced pressure, I'm astonished this whole incident exclusively involves only one mundane yet important component.

My point really is
1 engine cut-off should not be possible at 100ft elevation.
2 A single switch malfunction should not shut down engine(s)

There are two teeth on the switch body and two teeth on the plunger that is pulled up to unlatch the switch. There is not enough room for a tooth on the plunger to fit between the switch toggle and the mating tooth on the switch body. It would require the toggle axle pin to break to allow that, allowing the toggle to fall off and the plunger with it.

Clearly the design of the latch requires that it move from one position to another position with some applied forces. Absent some clarification of what the pilot(s) did or observed, their statement matches the way the switch is supposed to function.

" However, applying external force in an incorrect direction caused the switch to move easily from RUN to CUTOFF, due to the angular base plate allowing slip when pressed improperly with finger or thumb.\x94

The problematic part of the statement is that there is nothing that says what they think the incorrect direction is. But, if one wants it to move it must be pushed in a direction that is incorrect for it to remain locked in position. It is almost certain that if one pushes towards the opposite position from the current locked one and, at the same time uses the friction from that push, one can pull the plunger up and disengage the lock.

Is that what they meant by "incorrect direction"? Who, besides them, know what they meant?

THIS!!! While there is attention paid to factors to help prevent pilot mistakes, every safety analysis pretty much assumes that a pilot it not going to intentionally endanger an aircraft.
The Boeing fuel switch design is beautiful in its simplicity. A toggle switch - with detents to discourage unintentionally movement - hardwired directly from the switch to the engine with just an interposing relay. Further, the actual devices on the engine that turn the fuel ON or OFF are of a design that - if they lose power - they simply stay where they are. This latest theory that a problem with the aircraft electrical system caused it to lose electrical power and the lack of aircraft power caused the engines to shutdown was ridiculous from the start. That simply cannon happen.
When we started working on ETOPS, we looked at the historical rate for various shutdown causes and literally assigned design requirements that various systems had to stay below those rates.
For example, in the engine controls arena, we were allowed something like 2 shutdowns per million hours for engine control faults (I don't recall the exact number, but it was on that order or magnitude). Switch failures would fall under controls, but the historical rate of switch failure caused shutdowns is small enough that the overall rate would be vanishingly small.