June 21, 2025, 13:01:00 GMT
permalink Post: 11907727
Without going round the hamsterwheel again does anyone have an actual reference for this? Because I've gone back through each of tdracer's very informative posts about this
see here
and there is a discrepancy in the two points he makes below in adjacent posts. Is tdracer talking about the same HPSOV valves? Can anyone confirm that with both AC power loss and and a temporary DC power loss there are no critical engine related shutoff valves that will fail safe (unpowered) in a closed position?
Hopefully tdracer will provide more detail if/when he re-joins the discussion.
June 22, 2025, 06:28:00 GMT
permalink Post: 11908303
Thanks for those two quotes. I had only used the first one in my previous reference to HPSOV operation. I have only been involved with Boeing spar valves and not any HPSOV. However, I do not see that spring shutoff when less than 300 psi is in conflict with staying open if electrical power is lost.
Hopefully tdracer will provide more detail if/when he re-joins the discussion.
Hopefully tdracer will provide more detail if/when he re-joins the discussion.
LPSOVs are motor driven sliding gate valves 28V DC from a hot battery bus.
July 10, 2025, 11:58:00 GMT
permalink Post: 11918976
787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?
The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.
If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?
Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.
The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.
If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?
Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.
July 10, 2025, 12:31:00 GMT
permalink Post: 11918989
The switch itself is 4-pole, or a double-on, double-on switch, capable of independentently signaling whrough completely isolated poles. The plot thickens. IF the switches really are involved, there is either some kind of shortcut in within the LRU/very messed up witing harness, some freak automated muscle memory thing or deliberate action.
July 10, 2025, 12:33:00 GMT
permalink Post: 11918993
Worst case, at next idle TLA, engine shuts down. I bet eyes go to cutoff switches after a scan, surely EICAS/ECAM has a Captain Obvious alert set.
Runaway RPM or locked RPM, some FADECS latch at 86 or so % N1- you'd still need TLA of idle for the cut off switch to work.
Volcanic ash, loss of all engines, desire the simultaneous FADEC reset of cycling the cutoffs- just coordinate with PM for idle TLA.
Other jets have this standard, today.
Who flies the throttles in normal? PF
Who typically performs the steps, including idle TLA of shutdown/restart in flight? PM.
Last edited by moosepileit; 10th July 2025 at 12:46 .
July 10, 2025, 12:53:00 GMT
permalink Post: 11919006
July 10, 2025, 13:33:00 GMT
permalink Post: 11919031
Just for emphasis, the fuel control switches control both the spar valve AND the shutoff inside the fuel controller at the engine. It’s not the spar valve the starves the engine of fuel it’s the HP valve. If it were only the spar valve, shut downs at the gate would take awhile.
July 10, 2025, 13:45:00 GMT
permalink Post: 11919035
Just for emphasis, the fuel control switches control both the spar valve AND the shutoff inside the fuel controller at the engine. It\x92s not the spar valve the starves the engine of fuel it\x92s the HP valve. If it were only the spar valve, shut downs at the gate would take awhile.
July 10, 2025, 13:58:00 GMT
permalink Post: 11919040
Just for emphasis, the fuel control switches control both the spar valve AND the shutoff inside the fuel controller at the engine. It\x92s not the spar valve the starves the engine of fuel it\x92s the HP valve. If it were only the spar valve, shut downs at the gate would take awhile.
July 10, 2025, 15:10:00 GMT
permalink Post: 11919084
I'm trying to mix the best of the old and the new.
Fast, erroneous, uncoordinated or nefarious- gives a way to intervene, without changing the standards.
Throttles are no longer mechanical. Keep them forward off idle and the cutoff switch does nothing.
Fire/fail/flameout/stall- PM takes the confirmed bad throttle to idle. Then, if appropriate, fuel cutoff and then continue with the fire switch that should also isolate fuel before the engine, air, hydraulics, and electrics.
Bias- I've had mechanical fuel cutoff, mechanical throttles and mechanical isolations- DC9.
Electric throttles, fuel cutoffs and mechanical isolations- C-17s and MD-11s.
Have not had all electrical on switches, throttles and electrical circuits for isolation, only- which allows for more options and unintended consequences.
Last edited by moosepileit; 10th July 2025 at 15:24 .
July 10, 2025, 15:55:00 GMT
permalink Post: 11919105
That functional separation exists on MD-11 (for which I see you are rated) but not for 777 and 787. The key difference is that MD-11 fire shut off valves (equivalent to Boeing spar valves) are mechanically operated but 777 and 787 spar valves are electrically operated.
Boeing chose to have both the HP and spar valves controlled by the fire handles AND the cut off switches.
July 11, 2025, 00:34:00 GMT
permalink Post: 11919310
This has all been answered in previous posts, but I'll repeat it for those you don't want to look back through something like 150 pages:
Thrust Lever Angle (TLA) is measured directly by the FADEC, using a resolver hardwired to and excited by the FADEC. Both FADEC channels have their own resolver input - on most Boeing aircraft it's a common resolver with two sets of electrically isolated windings, however on the 787 it actually uses two mechanically separate resolvers. The resolver is basically read as "sine" and "cosine" which is converted in the angle. This also makes error detection easy, using the sine squared + cosine squared relationship. Any other aircraft systems that use TLA use the TLA signal relayed back to the aircraft by the FADEC.
The fuel control switch is a two-position multiple pole 'latching' switch - you have to pull it out slightly over detent to move it between the RUN and CUTOFF positions (on other aircraft there is an interposing relay for some of the functions. not sure about the implementation on the 787). Moving the switch to cutoff sends a DC signal to both the High Pressure ShutOff Valve (HPSOV) in the fuel control and the spar valve commanding them to close. HPSOV is solenoid actuated and is near instantaneous, Spar Valve takes ~one second to change positions (yes, this is different than some other airframers that only send the signal to one valve or the other, but it's been standard Boeing design practice since the early 1970s). Both the HPSOV solenoid and the Spar Valve are designed to stay in their last commanded position if airframe power is lost. Moving the switch to CUTOFF also sends a 'reset' signal to the FADEC - meaning the FADEC will be offline for roughly one second. On the 787 (and 777 and 747-8), there is a brief pause (~0.25 seconds) before the shutdown signal is sent to the engine to allow the electrical system to reconfigure to prevent a brief interrupt of electrical power to the rest of the aircraft.
Pulling the Fire Handle does the same thing as the fuel condition switch - via separate wiring (physically isolated from the fuel switch wiring to help protect from things like rotor burst damage), with the exception of the FADEC reset (since there is no requirement to be able to restart the engine after a Fire Handle shutdown).
There is absolutely no TLA input into either the fuel conditions switch or the Fire Handle - you can shutdown the engine via either regardless of Thrust Lever Angle.
All this is standard Boeing design practice (and except for the no-break electrical power transfer) has been for at least 50 years. This is enforced by the Boeing "Design Requirements and Objectives" - DR&O - compliance with is demonstrated by an audit after the final design freeze.
Thrust Lever Angle (TLA) is measured directly by the FADEC, using a resolver hardwired to and excited by the FADEC. Both FADEC channels have their own resolver input - on most Boeing aircraft it's a common resolver with two sets of electrically isolated windings, however on the 787 it actually uses two mechanically separate resolvers. The resolver is basically read as "sine" and "cosine" which is converted in the angle. This also makes error detection easy, using the sine squared + cosine squared relationship. Any other aircraft systems that use TLA use the TLA signal relayed back to the aircraft by the FADEC.
The fuel control switch is a two-position multiple pole 'latching' switch - you have to pull it out slightly over detent to move it between the RUN and CUTOFF positions (on other aircraft there is an interposing relay for some of the functions. not sure about the implementation on the 787). Moving the switch to cutoff sends a DC signal to both the High Pressure ShutOff Valve (HPSOV) in the fuel control and the spar valve commanding them to close. HPSOV is solenoid actuated and is near instantaneous, Spar Valve takes ~one second to change positions (yes, this is different than some other airframers that only send the signal to one valve or the other, but it's been standard Boeing design practice since the early 1970s). Both the HPSOV solenoid and the Spar Valve are designed to stay in their last commanded position if airframe power is lost. Moving the switch to CUTOFF also sends a 'reset' signal to the FADEC - meaning the FADEC will be offline for roughly one second. On the 787 (and 777 and 747-8), there is a brief pause (~0.25 seconds) before the shutdown signal is sent to the engine to allow the electrical system to reconfigure to prevent a brief interrupt of electrical power to the rest of the aircraft.
Pulling the Fire Handle does the same thing as the fuel condition switch - via separate wiring (physically isolated from the fuel switch wiring to help protect from things like rotor burst damage), with the exception of the FADEC reset (since there is no requirement to be able to restart the engine after a Fire Handle shutdown).
There is absolutely no TLA input into either the fuel conditions switch or the Fire Handle - you can shutdown the engine via either regardless of Thrust Lever Angle.
All this is standard Boeing design practice (and except for the no-break electrical power transfer) has been for at least 50 years. This is enforced by the Boeing "Design Requirements and Objectives" - DR&O - compliance with is demonstrated by an audit after the final design freeze.
July 11, 2025, 22:26:00 GMT
permalink Post: 11919913
And indeed they are 4 pole on-on switches, but one set of poles signals the spar valve directly while the other goes to the digital systems.
July 13, 2025, 06:59:00 GMT
permalink Post: 11921065
Would not expect an FDR dedicated pole. They
might
pull the FCS position from the FADEC, since what really matters is what the FADEC receives as a command. I would expect two poles dedicated to the two circuits, one routed to each FADEC channel, and the others to the non-FADEC-reset-command functions.
The 747 has 3 poles per switch. To send signals to all the systems it needs to, splices and multi-output relays are involved. On some aircraft there are even separate power sources going to some of these poles.
July 13, 2025, 07:13:00 GMT
permalink Post: 11921074
I have a simplified 787 fuel control diagram showing 3 outputs from the fuel control levers. I suspect it represents poles. One signal goes to the EEC for "reset". One signal goes the fuel valves. Another signal goes to a Remote Data Concentrator where the signal is digitised and sent to innumerable devices (including the EEC and the FDR). That is not to say there are more. I don't see a line to the wing spar valve.
The 747 has 3 poles per switch. To send signals to all the systems it needs to, splices and multi-output relays are involved. On some aircraft there are even separate power sources going to some of these poles.
The 747 has 3 poles per switch. To send signals to all the systems it needs to, splices and multi-output relays are involved. On some aircraft there are even separate power sources going to some of these poles.
July 13, 2025, 15:35:00 GMT
permalink Post: 11921397
Since some posters seem focused on the theory that the fuel control switches didn't move - just the electric output did (and as I posted earlier, the FDR only knows electrical states, there is literally no other way for the FDR to monitor the switch position).
So I did a little thought experiment. Uncommanded engine shutdowns (for all causes) are already rare - a 10-6 event. Now, during my 40 year career, I can't remember ever encountering a case where the fuel shutoff was commanded without a corresponding movement of the fuel switch. However in this industry it's a good idea to 'never say never', so let's assume it's happened. It would take something like a hot short to cause it to happen (moving the voltage from RUN to CUTOFF) since an open circuit will simply leave the valves where they were. That would put its probability way out there - something like 10-8/hr.
The left and right engine wiring is physically isolated from the other engine - nothing gets routed in common bundles between the engines. Hence there is simply no way a localized issue could affect both engine's wire bundles. So we're talking two independent events that cause the switch output to electrical change state between RUN and CUTOFF without associated switch movement. So now were out in a 10-16/hr. territory. Now, these independent events both occur a second apart - 3,600 seconds/hr., so we've just added ~8 orders of magnitude to the dual failure probability number (10-24/hr.). Now, they both somehow return to normal withing a few seconds of each other - another ~8 orders of magnitude so we're talking 10-32.
That means the probability of this happening at any time since the Big Bang is way less than one....
Space aliens look reasonable in comparison. So can we discuss things that might actually have happened?
So I did a little thought experiment. Uncommanded engine shutdowns (for all causes) are already rare - a 10-6 event. Now, during my 40 year career, I can't remember ever encountering a case where the fuel shutoff was commanded without a corresponding movement of the fuel switch. However in this industry it's a good idea to 'never say never', so let's assume it's happened. It would take something like a hot short to cause it to happen (moving the voltage from RUN to CUTOFF) since an open circuit will simply leave the valves where they were. That would put its probability way out there - something like 10-8/hr.
The left and right engine wiring is physically isolated from the other engine - nothing gets routed in common bundles between the engines. Hence there is simply no way a localized issue could affect both engine's wire bundles. So we're talking two independent events that cause the switch output to electrical change state between RUN and CUTOFF without associated switch movement. So now were out in a 10-16/hr. territory. Now, these independent events both occur a second apart - 3,600 seconds/hr., so we've just added ~8 orders of magnitude to the dual failure probability number (10-24/hr.). Now, they both somehow return to normal withing a few seconds of each other - another ~8 orders of magnitude so we're talking 10-32.
That means the probability of this happening at any time since the Big Bang is way less than one....
Space aliens look reasonable in comparison. So can we discuss things that might actually have happened?
Now my operator had an incident on a 757 in cruise about 10 years ago where the spar valve closed without command. The SPAR VALVE light will probably have lit up (can\x92t remember) but the engine died. From crz thrust to no thrust in seconds.
So such things are not unknown.
July 13, 2025, 15:42:00 GMT
permalink Post: 11921402
2. If you can recall: were they able to relight the engine that went to zero thrust?
(Being at cruise altitude they had time and altitude to work with, which AI 171 crew didn't).
3. Thank you for sharing that related event.
July 13, 2025, 17:40:00 GMT
permalink Post: 11921477
Hi,
I have a couple of questions. Forgive me for being late into this thread if any of them is already discussed:
1) I just read this in a Boeing manual:
2) Looking at the incident timeline, one of the pilots takes corrective action to reswitch to RUN position 10 seconds after maximum air speed is reached and 5 seconds after RAT is deployed. Is this normal?
It's not clear however that whether their conversation is after or before the RAT is deployed.
(No visual or auditory cues in the cockpit for a critical fuel switch action? Not hearing the engines shutting down?)
3) The same pilot that turns on Engine 1's fuel switch, turns on Engine 2's switch 4 whole seconds later. Why not consecutively, right one after the other, just like they were turned off one second apart?
If only he had done so the second engine might have recovered in time as well.
4) This aircraft's TCM has been replaced in 2019 and 2023, not related to a fuel switch issue. And there had been no fuel switch defect reports since 2023. One begs to ask if there had been a fuel switch defect report back in 2023 and what was the nature of it?
Are TCM's replaced as a whole, including the switches, twice? If so, why wouldn't they install a TCM version at least in 2023 with redesigned switches (w/ enhanced locking mechanism) mentioned in the FAA SAIB? Have they installed old/used TCM's manufactured prior to 2018 SAIB?
Please note that the RH and LH GE engines of the aircraft were only installed in March 2025 and May 2025 respectively, but they were used and dating from 2013 and 2012. Is this normal for a 12 year old Boeing aircraft to change so many mission critical components?
Electronic parts somehow, but how durable are those GE engines?
Thanks,
C.A.
I have a couple of questions. Forgive me for being late into this thread if any of them is already discussed:
1) I just read this in a Boeing manual:
The fuel control switches send signals to open or close fuel valves to operate or shutdown the engines.
- They send signals to the remote data concentrators (RDC) and the spar valve start switch relays.
- The spar valve start switch relays use these signals to control the spar valve and the high pressure shut off valve (HPSOV) in the fuel metering unit (FMU).
- The RDCs send the signals to the common data network (CDN) and then to the electronic engine control (EEC) to operate the FMU fuel valves (FMV and HPSOV).
The fuel control switches have 2 positions:
- RUN
- CUTOFF.
You must pull the switch out of a detent to select a position.
There seems to be RDC's (remote data concentrators) and CDN (common data network) between those fuel switches and the fuel valves. Is there any possibility that there may have been an electronic control module or sensor fault to generate such a signal rather than mechanical switch movements?
- They send signals to the remote data concentrators (RDC) and the spar valve start switch relays.
- The spar valve start switch relays use these signals to control the spar valve and the high pressure shut off valve (HPSOV) in the fuel metering unit (FMU).
- The RDCs send the signals to the common data network (CDN) and then to the electronic engine control (EEC) to operate the FMU fuel valves (FMV and HPSOV).
The fuel control switches have 2 positions:
- RUN
- CUTOFF.
You must pull the switch out of a detent to select a position.
2) Looking at the incident timeline, one of the pilots takes corrective action to reswitch to RUN position 10 seconds after maximum air speed is reached and 5 seconds after RAT is deployed. Is this normal?
It's not clear however that whether their conversation is after or before the RAT is deployed.
(No visual or auditory cues in the cockpit for a critical fuel switch action? Not hearing the engines shutting down?)
3) The same pilot that turns on Engine 1's fuel switch, turns on Engine 2's switch 4 whole seconds later. Why not consecutively, right one after the other, just like they were turned off one second apart?
If only he had done so the second engine might have recovered in time as well.
4) This aircraft's TCM has been replaced in 2019 and 2023, not related to a fuel switch issue. And there had been no fuel switch defect reports since 2023. One begs to ask if there had been a fuel switch defect report back in 2023 and what was the nature of it?
Are TCM's replaced as a whole, including the switches, twice? If so, why wouldn't they install a TCM version at least in 2023 with redesigned switches (w/ enhanced locking mechanism) mentioned in the FAA SAIB? Have they installed old/used TCM's manufactured prior to 2018 SAIB?
Please note that the RH and LH GE engines of the aircraft were only installed in March 2025 and May 2025 respectively, but they were used and dating from 2013 and 2012. Is this normal for a 12 year old Boeing aircraft to change so many mission critical components?
Electronic parts somehow, but how durable are those GE engines?
Thanks,
C.A.
When reading any of the data when it comes out, pay some attention to the sampling rate of the data being provided, it is quite possible to make erroneous assumptions where that is not taken into consideration. The data buses used to get data from the aircraft system to the recorder, and the recorders themselves use sequential sentences, and varyious rates.
IMHO.
July 13, 2025, 17:45:00 GMT
permalink Post: 11921482
- They send signals to the remote data concentrators (RDC) and the spar valve start switch relays.
- The spar valve start switch relays use these signals to control the spar valve and the high pressure shut off valve (HPSOV) in the fuel metering unit (FMU).
(snip)
There seems to be RDC's (remote data concentrators) and CDN (common data network) between those fuel switches and the fuel valves. Is there any possibility that there may have been an electronic control module or sensor fault to generate such a signal rather than mechanical switch movements?
- The spar valve start switch relays use these signals to control the spar valve and the high pressure shut off valve (HPSOV) in the fuel metering unit (FMU).
(snip)
"They send signals to the remote data concentrators (RDC) and the spar valve start switch relays."
Nothing in what you quoted says or implies that the RDC is in the fuel valve control path.
Edit to add - The RDC is in the path that feeds fuel switch position to the flight data recorder. Any error in that path could make the recorded switch position disagree with the actual switch position. It cannot change the state of the fuel valves and it cannot cause the engines to stop producing thrust.
July 14, 2025, 21:09:00 GMT
permalink Post: 11922503
Again, not familiar with the specifics of the 787, but on the 747-400/-8, one pole of the fuel switch feeds EICAS - which uses it in various message logic - and sends it out to any other aircraft systems that use it. There is "Digital Flight Data Acquisition Unit) DFDAU .... that takes all the various system digital signals, sorts them and provides them to the DFDR and QAR. The 787 has something similar to the DFDAU but I don't recall what it's called.
The other 2 contact sets feed latching relays (again driven each coil independently by dropping to GND at the switch) that then drive spar valves and reset signals to the FADEC Channels. (and more).
So - for the benefit of those that hang on to the 'possibility' of electrical gremlins and 'ghost' switch signals.
Each switch has 4 mechanically separated 'channels' - 2 of which do electromechanical things to the engines through separate paths, the other 2 feed through independent paths the FDR and the rest of the computer systems. The results of the electromechanical actions also feed back to the FDR.
Thus the readout from the EAFR will PROVE that the switches MUST have been PHYSICALLY MOVED.
And - I'm nervous to challenge you tdracer - there's quite the authority gradient and I know I'm at the bottom end, but I can't let this fly...
Its 'Deefer Doo'. Fight me.
