Posts about: "RUN/CUTOFF" [Posts: 186 Pages: 10]

Not 757 - it was a 767. Second time it happened in about 12 months.

Determined to be an ergonomics problem with the switch layout in the flightdeck.

Early 767s (JT9D and CF6-80A) had a supervisory "EEC" (Electronic Engine Control - Boeing still uses "EEC" to identify what most people call the FADEC on modern engines). The procedure if an EEC 'failed' was to switch both EECs off (to prevent excessive throttle stagger - unlike FADEC, the engine could operate just fine with a supervisory EEC failed).

Problem was that the EEC ON/OFF switch was located on the aisle stand - right above the fuel cutoff switches. Turned out 'muscle memory' was when the pilot reached down there, it was usually to turn the fuel ON or OFF - which is what they did. Fortunately realizing what he'd done wrong, the pilot quickly restored the switches to RUN and both engines recovered. And yes, they continued on to their destination (RAT was still deployed since there is no way to retract it in-flight).

Previous event was with JT9D engines (United IIRC). In that case, only one engine recovered (second engine went into an unrecoverable stall), they simply came back around and did a single engine landing.

Realizing the ergonomic issue, the EECs were relocated to the pilot's overhead (retrofit by AD).

To the best of my knowledge, there hasn't been a repeat of an inadvertent dual engine shutdown since the EEC switches were relocated. It's also very difficult to 'accidentally' move the switches as there is a locking detent - the switch must be pulled out slightly before it can be moved to CUTOFF.

Do not discount the mistaken early flap retraction scenario too easily. Mull on this:

PF commanded gear up on attaining positive rate of climb, fixating on the HUD.
PM mistakenly raise flap lever from 5 to Flap 1 gate. Thrust reduced to Climb Thrust. Landing gear remained deployed. Massive loss of lift misidentified as loss of thrust. If any one pilot just had a dual engine failure scenario on a recent sim ride, brain and muscle memory would jump to loss of thrust in dual engine, prompting them to accomplish the recall memory items which called for both engine fuel control switches to CUTOFF and then RUN, and physically deployed the RAT.

There would be immediate loss of thrust with the engine taking time to recover , if at all, at such low airspeed!
The rest is left for Ppruners’ imagination.😖🥴😬

I keep reading this theory and I'm baffled. You think the PF is going to attempt a dual engine shutoff and relight during the initial climb based on a hunch that the engines have quit, all without even a sideways glance to see what N1 is or a short word with the PM?

If the photo of the flaps deployed at the accident site is actually F1 not F5 or if the flaps were pushed out during impact, then this is certainly plausible. I will look for the photo but it's in the thread somewhere. Others are stating they see a gap between the wing and the flap as an argument for the flaps deployed at F5. This was after the decent started..

However, I think their reaction would likely be to apply more power. I know mine would be. But anything is possible!

This is a very plausible scenario. Above 400 ‘ AGL, memory items.

(Sorry, Airbus here and not familiar with Boeing) Flap 5 to 1 reduction on the Boeing triggers autothrust reduction, is that correct? If so, are there any other conditions that need to be met for this to happen like being in some kind of takeoff mode? Just thinking whether this would have potential otherwise in other regimes to cause issues, discontinued approach perhaps.

Am slightly puzzled as to why if flap reduction triggering climb thrust is part of the standard logic (and presumably clean-up technique) then partial dual thrust loss wouldn\x92t be immediately recognised as the classic symptom of gear / flap retraction handling error? I presume Boeing pilots / air India are just as aware of this it as everyone else, strikes me as odd that one would immediately go into full dual EF mode. My instinctive reaction without knowing the Boeing would be to firewall both TLs, would this have worked in the early flap retraction logic scenario? Many thanks all

A loss of lift AND thrust at this critical juncture could have had caused this awful disaster. I think the data recorders have already revealed the cause but If it's this, then I don't think we will hear much anytime soon.

This doesn't make any sense. The plane was in the air for approximately 30 seconds, the plane stops climbing around 12 seconds after take off, and the noise of the RAT is heard 11 seconds before the plane crashes - even if we assume the RAT both deploys instantly and deployed the exact moment that video began recording, that only gives the pilots a 7 second window to perform an action that results in it being deployed.

There just isn't enough time for the RAT to be deployed as a result of any action by the crew, IMHO. And to demonstrate how long 7 seconds is - that's enough to say 20 words, assuming no interruptions .

If you read the thread, you would know:

The RAT was almost certainly deployed. 4 different sources.
The Flaps were not retracted. Visible at the accident site plus many other sources agreeing they were indeed down.
APU will autostart when all engine power is lost. Potentially explaining why the inlet door was open or partially open at the accident site. Mentioned in several previous posts
On a 787-8, the main bogies tilt as the 1st action of the gear retract sequence. As stated in previous posts. I don't think this happens unless gear is selected up. So the conclusion was, gear was selected up. One caveat, IIRC, there was some discussion around a failure could have caused the bogies to tilt without Gear up being selected but I don't recall the outcome.
As for the Air France remark, un-necessary IMHO. Let's respect the crews please.

Not 757 - it was a 767. Second time it happened in about 12 months.

Determined to be an ergonomics problem with the switch layout in the flightdeck.

Early 767s (JT9D and CF6-80A) had a supervisory "EEC" (Electronic Engine Control - Boeing still uses "EEC" to identify what most people call the FADEC on modern engines). The procedure if an EEC 'failed' was to switch both EECs off (to prevent excessive throttle stagger - unlike FADEC, the engine could operate just fine with a supervisory EEC failed).

Problem was that the EEC ON/OFF switch was located on the aisle stand - right above the fuel cutoff switches. Turned out 'muscle memory' was when the pilot reached down there, it was usually to turn the fuel ON or OFF - which is what they did. Fortunately realizing what he'd done wrong, the pilot quickly restored the switches to RUN and both engines recovered. And yes, they continued on to their destination (RAT was still deployed since there is no way to retract it in-flight).

Previous event was with JT9D engines (United IIRC). In that case, only one engine recovered (second engine went into an unrecoverable stall), they simply came back around and did a single engine landing.

Realizing the ergonomic issue, the EECs were relocated to the pilot's overhead (retrofit by AD).

To the best of my knowledge, there hasn't been a repeat of an inadvertent dual engine shutdown since the EEC switches were relocated. It's also very difficult to 'accidentally' move the switches as there is a locking detent - the switch must be pulled out slightly before it can be moved to CUTOFF.

If you read the thread, you would know:

The RAT was almost certainly deployed. 4 different sources.
The Flaps were not retracted. Visible at the accident site plus many other sources agreeing they were indeed down.
APU will autostart when all engine power is lost. Potentially explaining why the inlet door was open or partially open at the accident site. Mentioned in several previous posts
On a 787-8, the main bogies tilt as the 1st action of the gear retract sequence. As stated in previous posts. I don't think this happens unless gear is selected up. So the conclusion was, gear was selected up. One caveat, IIRC, there was some discussion around a failure could have caused the bogies to tilt without Gear up being selected but I don't recall the outcome.
As for the Air France remark, un-necessary IMHO. Let's respect the crews please.

I preface this post by acknowledging all the previous posts in this, and the now-closed thread, about the TCMA, in particular the excellent posts by tdracer. (Ditto the noise analyses by Kraftstoffvondesibel and First Principal.)

I also note that the primary source of the information on which I’m basing my post is the content of Boeing’s patent application which, of course, does not contain any of the actual wiring diagrams or modification details of the TCMA, even assuming it has been implemented. (I understand from the now-closed thread, that there is an unresolved question as to whether a petition for an exemption from the TCMA requirement had been successful.)

The point of my post is to get other’s thoughts on one of the design principles of the TCMA system proposed in the patent application.

The ostensibly simple and elegant concept is described in the schematic of the system at figure 1 of the patent application. A copy of figure 1 is below.

The TCMA is the part of the schematic inside the dotted box numbered 16 , sitting with the EEC (others would call it the FADEC) in the solid box numbered 18 .

The heart of the TCMA comprises two switch relays, numbered 22 and 28 in the schematic, wired in series. Each of those switch relays is controlled by its own, dedicated engine control malfunction software, identified as the blobs numbered 130 . (The patent application identifies component 34 as a dedicated processor and 32 as the diode connected to the switch relays, but that is evidently a mistake. Component 34 is the diode and I can’t find a component number 32 anywhere in the schematics.)

Each relay switch and its controlling software is described as a ‘channel’, one A and one B. Both channels run continuously, monitoring throttle position (36 in the schematic) versus engine data fed from ARINC data bus lines (46 in the schematic) and “dedicated input sensors” not shown in the schematic. Those sensors presumably detect things like weight on wheels and perhaps RADALT.

This design is said to achieve redundancy, because if only one ‘channel’ detects the engine is producing excessive thrust while the throttle is set to idle, that channel will set its switch relay to CUTOFF and that is enough to change the state of the high pressure fuel shut off valve (58 in the schematic). No more motion lotion. In the words of the patent application: Both channels are “always actively monitoring engine function and independently have the capability of shutting down the engine.”

That arrangement wrinkled my crusty old avtech brow. In my mind – and this is why I’m seeking other’s thoughts – the advantage of redundancy arising from the two channels, either or both of which can shut the engine down, is not without risk. If it is possible for one of the channels to have some ‘glitch’ or hardware failure such that it does not detect an actual out of envelope condition justifying immediate shut down, with the other channel detecting the condition and shutting the engine down, it inexorably follows – does it not – that it is possible for one (or both) of the channels to have a ‘glitch’ or hardware failure that results in a shut down when there is no out of envelope condition?

Further, even if there are completely separate, duplicated sensors telling each channel things like the position of the throttle and whether or not there is weight on wheels, there remains the possibility of a combination of sensor failures/disconnects resulting in one channel being ‘convinced’ that an out of envelope condition exists, with a consequential cutoff of fuel to the engine.

I of course acknowledge the valid observations made about the remote probabilities of these kinds of glitches and failures.

I’ve heard rumours that there was much resistance to the mandating of TCMA systems. Having seen many, many strange faults caused by random shorts, open circuits, liquid ingress and other foreign objects, I can understand why there was that resistance. Every time you add something to a system and that added thing has electronic components and software and electrical connections and data inputs, you add risk of that thing malfunctioning or working perfectly but with erroneous inputs. In this case, there are effectively two added new things: two channels, each one of which has the ability to shut off the motion lotion to the engine to which they are strapped.

I make no comment on whether TCMA systems, if fitted, have anything to do with this tragedy.

My profound condolences to the families and friends of those killed or injured. My thoughts also go out to the many people who will be agonising over the potential causes and responsibility for it. And thanks to those who are working out the causes.

...

Question to avionics specialists again. Below is the main drawing of the TCMA subsystem, included in the patent document . I can't stop scratching my head about the link I have circled in red in the center of the image. AFAICS, this link shunts the internal RUN path of TCMA entirely : the RUN signal is supplied by the RUN contact of relay assembly 52, then goes through the common and RUN contacts of relay 22, then goes through the common and RUN contacts of relay 28, then exits TCMA subsystem 18 by wire 124, and... we're back to square 1, because of the link. So TCMA subsystem 18 doesn't actually control the OPEN relay 118 of the HPSOV, only the CLOSED relay 100, and in the case where relay 22 and/or 28 are activated, both coils of HPSOV could even be energized at the same time.

Obviously enough, this isn't a real circuit diagram, but shouldn't this link be removed from the patent drawing?


Odd link in TCMA patent drawing

Good catch. When I quickly scanned the drawing, I stopped when I realized that it wouldn't tell me how the function actually works in the real world \x97 pretty normal for patent applications. Unless I misunderstand (it happens), I think you're right. That link doesn't make sense.

I perfectly understand that there is much talking about TCMA here.
There is no direct evidence of what caused the crash but several indirect evidences point towards a near simultaneous shutdown of both engines without any visual clue of a catastrophic mechanical mishap. This leads to suspecting near simultaneous fuel starvation of both engines.
As the purpose of TCMA is shutting down the High Pressure Shut-Off Valve (HPSOV) and thus the fuel feed of an engine, it's normal to collect information on TCMA, on how it works, and on what data feeds it.

However, I hardly understand why there is no similar discussion about the spar valves and the systems that control their opening and closure.

I understand that the B787 spar valves are located in the MLG well, or at least are maintained from within that well.
If the engine shutdown happened when the gear retraction was commanded, that's a location commonality (although it's very unlikely that a mechanical problem happened in both wells at the same time).
Also I understand that there are several systems that command the opening or closing of the spar valves:
- opening: "Engine control panel switch" set to "START", or "Fuel control switch" set to "RUN"
- closing: "Engine fire handle" pulled out. (I wonder if "Fuel control switch" set to "CUTOFF" also closes the spar valve).
Are there direct wires running from these controls to the valves or is there a pair of control units receiving these signals and controlling the valve actuators?
If the latter is true, where are these control units? I guess that the likely location is the aft EE bay. Are they beside each other?

Hi

This got me thinking, looking at the engine mounted shutoff valve (HPSOV) in ATA 76, I see that its operated by three sources

• FADEC, as discussed in a number of posts above
• RUN / CUTOFF switch
• engine fire control panel

I have a hard time believing the pilots would have touched the engine fire controls under such conditions (obviously they are highly trained for engine failure before Vr), but am I correct when I say that the behavior of the plane systems closely resembles what would happen if the engine fire signal was triggered?

• engine fuel spar and high-pressure valves would be cutoff (obviously)
• hydraulics pump would be depressurized and shutoff from the circuit
• electrical generators would be disconnected

We wouldn't be talking about this flight had this occured on a single engine, so I believe this should had happened on both at about the same time.

Looking at ATA26 the engine fire control panel is energized by the hot battery bus (HOT BB). Is it credible that a failure of the hot battery bus (for example due to damage or liquid ingress in the P300 panel ) could lead to this situation?

The idea is to set the switch to CUTOFF and then to ON as that resets the FADEC (the circuit that controls the engine) and hopefully clears any issues it might have. The hope is that the turbine is still rotating fast enough for the FADEC to restart it. I believe this works the same as the auto-relight feature.
The turbine rotation would also provide the electrical power for that.

Do a thread search on "detent" to learn more about the construction of these switches than you ever wanted to know.
There's also a section on them in paulross 's https://paulross.github.io/pprune-th...171/index.html , but it may not be up to date. (Still a great resource, though.)

Unfortunately the wikipost linking to it is gone, presumably a victim to the recent forum changes.

There has been discussion recently about a procedure that involves moving the fuel switches to CUTOFF and then back to RUN following a dual engine failure.

Attached is an image of a page from the Air India 787 Training Manual that discusses this procedure.

I am submitting this without comment or opinion.

Muscle memory is a strange and (usually) wonderous thing. It allows us as humans to perform amazing things without actually thinking about what we are doing. Professional Athletes have perfected this to a high art, but the rest of us do things using muscle memory on a regular basis. Back when I was still racing, I happened to look down at my hands on the steering wheel in fast, bumpy corner, and I was simply amazed at the large, rapid steering inputs that I was making to compensate for the bumps - with absolutely zero conscious thought. Muscle memory at its best.

However, it can also bite us. The Delta dual engine shutdown during takeoff from LA (referenced way back when in the 1st accident thread) was caused by muscle memory - the pilot reached down to set the EEC switches (located near the fuel On-Off switches) but muscle memory caused him to do something else - set both fuel switches to OFF. Fortunately, he quickly recognized his error, placing the switches back to RUN and the engines recovered in time to prevent a water landing (barely).

It is conceivable that a pilot - reaching down to the center console to adjust something unrelated - could have muscle memory cause him to turn the fuel off to both engines. While all new engines are tested for "Quick Windmill Relight" - i.e. the fuel switch is set to CUTOFF with the engine at high power - and the engine must recover and produce thrust withing a specified time (memory says 60 or 90 seconds) - it takes a finite amount of time for the engines to recover (spool down after a power cut at high power is incredibly fast - plus moving the switch to CUTOFF causes a FADEC reset, which means it won't do anything for ~ 1 second). Doing that at a couple hundred feet and the chance that an engine will recover and start producing thrust before ground impact is pretty much zero

It would be a lot more conceivable if the pilot had been practicing this action in a simulator recently.

It's ironic that cognitive science arguably started with 'The Cambridge Cockpit'; an attempt to make sense of, and mitigate, pilots doing this sort of thing when tired, stressed and so on. This kick started an ergonomics revolution which appears to have come full circle. Now we have cognitive science offering Bayesian accounts of neural function that might explain how innocent but unfortunate priming of 'muscle memory' when practicing for emergencies could, almost predictably, lead to this sort of complex, protection overriding, error.

As non consciously executing a complex, well practiced, but unintended, action is a fairly common experience in less critical situations, I'm surprised that there isn't already a more effective ergonomic fix than the safety switches fitted.