Posts about: "Switch Guards" [Posts: 87 Pages: 5]

They don't have to be positively lifted if the detent rounded out due to wear or if the switch installed was one that the SAIB referenced with the locking feature disengaged. I can't discern a raised boss on the body of the left switch in Fig.13, page 10 of the AAIB report. I assume those switches have some internal over center locking mechanism also besides the spring on the lever that would not be needed if there was no detent. I do remember writing up a 767 switch a long time ago when the Captain noticed the detent was worn and he could shut down without lifting.

See the quotes in bold. I realise I'm clutching at straws here but if we take the released version of exchange between the pilots at face value:

Then other possibilites must be considered and we should therefore not default to assuming 'a hand was on the fuel cutoff switches'. Especially as neither of the pilots can defend themselves against such allegations.

I would suggest starting with the maintenence engineer/crew who found 'no fault' after the STAB master caution was investigated immediately prior to this tragic flight. It would not be the first time that 'maintenance' caused an incident...

Also, I urge you all to consider how many accidents have been blamed on 'pilot error' (how convenient when billion-dollar companies are at risk) only for further information to come to light that then exonerates the pilots (these stories don't usually make the front page).

Try to stay open-minded folks. The investigation has a very long way to go.

I did say, way back on18June,P26 #505,that ,as an ex-mil.Test pilot that the 2 Switches `would not pass muster` in a military aircraft.They are the most important 2 switches in the aircraft,yet they are `unguarded.` They are operated only twice per flight,`to go,or stop`.normally.yet they are easily `lifted` ,both by one hand,either way,by accident or intent.They have some kind of `guard` ,but what is required is a spring -loaded cover,could be plastic,so the switches are visible,with a lock,or they are put on a roof panel,requiring a visible gesture to operate,but still behind a proper guard.
I know that these days civil aircraft have locked cockpit doors,but military aircraft of similar types ,maybe not so.Military aircrew also wear flying suits,maybe immersion suits and lifejackets,which could foul the switches.I raise this point as it seems this is a common arrangement on B737s,possibly P-8,E-7..Pretty damn cheap.
It would be interesting if a true poll was taken,of how many incidents of either single or double switch `accidental` `OFF` selections have been made,in flight,or on the ground..

However,there is a short-term `fix` available(not in any way belittling the magnitude of this tragedy in any way); THAT the switch on the left engine is turned 90 * Right in it`s mounting for `on`; the switch for the Right engine is turned 90*Left ,in it`s mounting,for` ON`.,Or,they both could be turned 90* outwards...

In 25,000 hours I have never seen anything left on the glare shield or anywhere else during takeoff that could effect the switches. I have move those switches hundreds and hundreds of times. The one time there was an issue it was apparent quite readily. Not only do the switches have their own internal locking mechanism they also have guards on either side. I can\x92t conceive of how something could fall so precisely as to miss the guards and impact both switches causing a simo shutdown. If that did happen you would also expect it to occur at rotation not 5 seconds later.

The Indian AAIB are avoiding a German wings event I fear. Actually I was in a flight deck of a EJR today. Start / stop switches are so bloody obvious on the overhead as main switches. Guarded and easy to observe by all. Control switches that are not required as a normal action put away from hidden positions and visible to all. Embraer actually design systems logically. Speaking to a Captain today, he confirmed that if the the thrust levers of an EJR are beyond flight idle, engines cannot be shut down by then engine start/stop switches being turned off! You need to drag the thrust levers back to idle to shut them down. First thing I was taught as an airframe engineer converting to dual trade is that the fuel system of a airframe should not restrict an engine to receive fuel from a commanded input by the pilot. Throttle position should drive that logic. Not a lazy Boeing combined FADEC and SOV switch.

FADEC processes the fuel control switches as well as the throttle resolvers directly. Both dual-channel, separate and separated circuits. Additional logic between the two would have to be foolproof. Sometimes simpler is better, even if human actions can defeat it. There is no plausible explanation or expectation for cutting both switches three seconds after liftoff.

You want these switches within reach of both pilots, in a position where hands are not constantly passing over them, able to be actioned quickly, to be internally guarded (= require 2 distinct actions to move) as well as externally protected (side guards). It also seems logical to have them near the thrust levers.

Boeing have achieved all this.

It feels like it would be an error to try and redesign these switches in light of this incident. The switches operated as they were commanded.

Sorry, I have to seriously disagree, in the nicest possible way, I hope.

The switches must be accessible - Yes
They are where hands regularly pass over them - a No. As I see it, a certain expression regarding the back end of a male dog comes to mind!
Able to be actioned quickly - arguably, currently, it's much too quickly, IMHO.
Guarded - when it comes to Cerebellum (Yes, please search that word in this thread)-generated actions, that makes zero difference. When the Cerebellum has been trained and learned, it will repeat the most complex sequences you can think of - without you having to think of them. That's the REAL problem that needs to be solved.
Logical - Yes, but really No! Putting them close together can more easily result in the wrong action at times of high stress, confusion, fear, danger, urgency, whatever.

I say they need a major, i.e. Total redesign.

But one of the big problems is that these two switches are used at least a couple of times on every flight. So, they are true Cerebellum Fodder.

However, here's one suggestion. The modern plane is full of sensors, interlocks and logic devices. Use them a bit smarter, I say!

When the plane is on the ground, allow the Fuel Switches to be turned On and Off without debate. But using Air/Ground and /(or?) WoW, when the plane is in the air, the process must be made markedly different. At the very LEAST, make them properly guarded, so a flap must be lifted to action them. And as soon as the flap gets lifted in flight, a very loud alarm and maybe a light is triggered. Then, everybody knows, no need for guessing. Until you or your fellow pilot presses the Confirm button somewhere nearby, the switches can't be moved - or are disabled, or something.

If you don't regularly use this procedure, the Cerebellum won't be so likely to Run It Automatically in a panicked rush. The different process from what you did just at the start of the flight will trip up the cerebellum somewhat, and trigger the Higher Brain to start thinking...: "What? Is this correct?"

How about this?

Subsequent thoughts: The Confirm button would only remain live for a short period, say 3 seconds, during which time, you can operate the switch. Then it resets.
Another idea: Leave the Fuel Cutoff switches right where they are, as they are. But, when in Flight, totally disable them. Alarm if moved. Put the In-Flight Shutoff switches in the overhead panel, with the same kind of aural/visual Confirmation-required warning system permanently operative.

P.P.S. That may not be enough, maybe there needs to be a Takeoff speed transition added - i.e. Before Rotate. Maybe just after V1?

From the CVR, the switch position was noticed, questioned, and with understanding selected to Run; the crew apparently had a quick understanding of what would be a very surprising situation - startle, mind numbing, thought restricting conditions.

It is reported that P2 was handling; in this case the Captain might guard the thrust levers until V1, moving his hands away, but not onto the control wheel - rearwards, … thence with cuffed sleeve …

A speculative scenario of inadvertent switch operation of 'unguarded' switches.

A combination of most unlikely - unbelievable factors, which came together at that time. Yet such rarities and combinations litter the wreckage of past accidents; and with hindsight they were 'normal'.
Normal SOP for P2 takeoff; errant switches escaped SAID checks - 'normal' for that aircraft.

If the switches were inadvertently moved, the realisation, even subconsciously, might support the apparent quick understanding and action.

… waiting for: a report on the condition of the cutoff switches condition wrt guarded operation …

If the guards to the stab trim switches were left open by maintenance, I could see a situation in which muscle memory might lead to closing the adjacent fuel control switches. This would also explain the "I didn't do it response", as he believed he was merely closing the guards instead.

Three points,

1. One previous poster who was a test pilot stated that the Boeing switches were unguarded, and as such, wouldn’t pass military standards. I flew 4 Military aircraft in the USAF, and none of them had guarded switches or covers over the start /stop switches. They were all toggle type levers or solenoid operated buttons. Perhaps he was referring to RAF aircraft.

2. As far as the previous issue with the Stab Trim. Those switches are guarded and covered, however! I find it hard to believe any stab trim runaway would be detected so early in the flight. I’ve had a runaway stab trim in a 757 and it took a while to diagnose it and finally disconnect the errant trim module. The first indication was the aircraft required more trimming than normal. Nothing one can detect 10 seconds into a flight.

3. I’ve been flying Boeings for over 30 years, (727,757,767) with similar fuel control switches and I can’t think of a single time it was loose, slipped, or faulty.

That status message is quite common.
When trouble shooting, it normally resets through a BITE test. I don't remember ever having to touch the stab cut off switches as part of line trouble shooting. The aircraft is on a turnaround, if the test doesn't clear the message further trouble shooting may be lengthy, most airlines would want the aircraft dispatched in accordance with the MEL.
Deactivating the relevant transducer involves entering the stab bay, disconnecting a plug and writing up the deferral.
If it's true, as someone above suggested, that the aircraft was signed off an hour before departure, that is not last minute by the way, then I would guess that the BITE test cleared the message.

tdracer, thank you.

I have watched the nonsense posted about 'that is a bad design' as regards the fuel switches and have bitten my tongue.

It's a sane and rational design choice unless one is a default Boeing basher.

There are two sets of two switches near to each other (see the photos and figures further up) that are important (one due to fuel, one due to a primary flight control, the horizontal stab). They are protected from inadvertent movement in two different ways based on their physical proximity.
1) Stab (influencing) switches use the covered guard. (The Horizontal Stab is a primary flight control).
2) The fuel switches are stopped from casual movement by the design of that switch (which has been discussed to death) unless you pull out then them move them to the other position.

See how this works, folks who don't fly?

Stab switches: uncover, then move. Two steps.
Fuel switches: pull out, then move. Two steps.
They look different and they feel different.

Given their proximity, the designers (who have to deal with ergonomics) provided both a visual and a tactile clue that they are different, and what switch your fingers are touching or trying to move.

Will that choice guarantee that some idiot won't activate a wrong switch?
No, it won't, because you can't idiot proof everything ... the universe will always provide a bigger idiot.

But it does offer two, not one, cues to "wait, what switch am I about to activate?" for the trained user and is thus a sound design choice. Yes, pilots do undergo training for how to use all of the switches in the cockpit/flight deck.
Really.
Not kidding about this.
(Have I ever moved a wrong lever or switch? Yes).

Oh, by the way, those who have posted here who fly the 737, 757, 767, 777, and 787, have affirmed the operation and usefulness of the fuel switches. IIRC one of our 777 flyers pointed out that his captain had written up one such switch since it wasn't working right.

Yes, friends on PPRuNe, you can know how they work and if they are worn, or feel as though they are not working correctly. You can do the write up and the maintenance team can replace the switch (or fix it, or replace the quadrant, yadda yadda).
As noted by others, those switches are used on every flight.
You'll know how it should feel/work, and if it doesn't feel or work correctly you make mention of that to the engineers/maintenance crew (depending on which side of the pond you are on).

The Bulletin from several years ago does not prevent normal maintenance, and write ups, from happening on a routine basis (as with various other things on aircraft that get written up).

I had three switch design and placement factors explained to me - visual, tactile, and positional - over 40 years ago when I was going through blind cockpit checks prior to getting initially qualified in the SH-2F.
As I flew other aircraft I would notice various choices made as regards all three factors. (A fascinating sub topic of its own, but I'll stop there).

I thus say to DiffTailShim, and whatever test pilot from the UK posted his noise: no, you are wrong.
The design decision is sound.
That Embraer did/does it differently (which is cool, there is more than one way to peel an onion ) has little or nothing to do with this accident.

One could argue that their proximity might have an impact, but that would require evidence that something to do with the Stab Switches was involved in this event.
So far, that vague mention of a write up from a previous flight about a stab light gives us a tenuous thread, but not a lot to work with.

Someone had posted a short clip of a simulator session where the captain did just that, and the PF then moved his hands immediately towards the switches, and the captain moved his hand back to guard them so that the PF now had to deal with the dual engine failure. I don't remember what their head movements were, and the post got lost in a hamsterwheel purge.

I've mentioned PACE before, it stands for "probe alert challenge emergency", more at https://psychsafety.com/pace-graded-assertiveness/ , or search pprune. It's a scale of assertiveness, and if there's an "authority differential", as in a junior F/O vs. a senior captain, it becomes more difficult the further you move up the scale. Hence the need for CRM.
I'd put "Why did you turn the engines off?" at the "probe" level, "What the h*ll do you think that you're doing?" at the challenge level, and reaching down to put them back would be the highest level. So I think whether someone would be capable of doing that depends on cockpit dynamics and training.

No! I can think of 2 occasions when there will be only one pilot on the flight deck, in the case of incapacitation there would be no way to shut the engines down.
I would be more inclined to go with a guarded switch so that there are 3 intentional movements to shut an engine down, that's probably still an overkill.

Perhaps thrust lever must be at flight Idle.

The problem with the switches with hinged covers is that they have a single, "safe" position when they're covered. But the fuel switch is safe at CUTOFF when parked, and safe at RUN when the aircraft is operating, so that won't work.

There are ways to have gates that can be closed in either position (and are perhaps spring-closed), but either they are going to be left open, are a PITA to operate a switch single-handedly, or operating the guard will become part of the muscle memory for operating the switch.

With Airbus it is required. However, I cannot speak about Boeing's operating philosophy.

To quote from Airbus' Flight Crew Training Manual:

In flight, the PF and PM must crosscheck before any action on the following controls:

‐ ENG MASTER lever (With Boeing this would be the fuel cut-off switches)

‐ IR MODE selector

‐ All guarded controls

‐ Cockpit C/Bs.

Since we have had a few 787 qualified pilots contributing lately, hopefully one of them can clear up whether or not that's standard in their checklists / SOPs, etc.

Not all, of course, but I absolutely do think that most investigators in roles such as the ones we are discussing are professionals who would and do resist improper influence. Immune? No, none of us are. Guarded against? Yes, that's what professionals with integrity do every hour of every working day.