Posts by user "Someone Somewhere" [Posts: 63 Total up-votes: 0 Pages: 4]

I believe that particular bug is fixed, though it's always possible there's other issues causing a total AC loss.

Not really relevant to what you quoted though, as the scenario in question requires:

• Engines running on centre tank fuel during takeoff while the aircraft is operating normally
  • We don't know for certain if this is the case. It seems to be but it's not something that happens on other families.
• Then, total AC failure stopping fuel boost pumps.
• Engines suction feed from contaminated/full-of-water wing tanks.

The aircraft has two engines and should be able to climb out on one, plus it dropped like a rock . 'Significantly degraded' thrust isn't really compatible with what we saw. You'd also expect the engines to recover pretty quickly as it leveled off.

The limitations at high altitude are primarily air/volatiles degassing out of the fuel. That's not going to be much of an issue at sea level, even if the engines are a bit higher up during rotation.
APU is a nice-to-have; it's on the MEL. If you lose all four generators, it's because of some major carnage in the electrical software/hardware and chances of putting the APU on line even if it's operating are very slim.

Many are maintenance or production test flights. Someone commented upthread that every Boeing widebody built gets the RAT deployed on its first flight, and I imagine some maintenance procedures require it too.

ASN has a section on electrical power incidents: https://asn.flightsafety.org/asndb/cat/ACSE

In particular try these:

https://assets.publishing.service.go...009_G-EZAC.pdf
https://asn.flightsafety.org/wikibase/233343
https://asn.flightsafety.org/wikibase/219748
https://asn.flightsafety.org/wikibase/34357

The manuals suggest the 787 has even more advanced load inhibition/load shedding, shedding/recovering individual loads as required for both operational and availability reasons.

Remember the 787 uses electrics for engine start, wing anti-ice, centre hydraulics, and cabin air compressors. There's some big electrical loads.

Centre tank boost pumps are probably comparatively small, but if you can conclusively say x is not required during ground engine start , why power it?

Similar failures have happened on 737s/A320s/A330s and others. I'm not denying it's possible. There's a reason it's a certification requirement for the engines not to be dependent on aircraft power. The APU is MELable and battery starts are not extremely reliable.

Thrust is non-linear and complex. Reaction engines (i.e. fans, props) are generally most efficient at minimum power - lowest excess velocity. Turbine engines are generally most efficient at high power. These cancel out somewhere in the middle. With two engines at low power, you also don't have the drag from the dead engine or the drag from the rudder countering yaw.

Cavitating destroys pumps rapidly - someone upthread said replacing the fuel pump immediately is SOP if it has suction fed. Expect end of life in tens of hours rather than tens of thousands.

Some aircraft have switched to using jet/venturi pumps powered by returned fuel, like the A220. The electric boost pumps there are mainly for redundancy and are shut down in cruise; only one in each wing tank. Some A320s replace the centre override pumps with venturi transfer pumps.

The fire switches potentially provide that capability.

There are many types where the shutoff position is a fully aft thrust lever, past a lift-up gate. Apparently this has caused a few human-factors issues because other types use the exact same mechanism for setting reverse thrust.

I am not sure exactly where to go looking for the data, but bear in mind that total accident rates have also decreased dramatically while flight volumes have increased.

It wouldn't surprise me if solely crew-caused accidents are decreasing slightly, while mechanical/maintenance/technical failures leading to accidents have massively decreased. Crew/dispatch errors hence look far worse in comparison.

I believe the 'thrust not achieved' was that one made up by a journalist - happy to be corrected.

Sounds like #1 was restarting successfully but they just didn't have enough time for it to get back to high thrust.

#2 may or may not have eventually started successfully; the extra two seconds of no fuel meant it would be a much harder start for the FADEC.

It doesn't sound like the crew have any input on the relight process; if the switch is on, the FADECs will try anything they can to get the engines lit and accelerating ASAP. Repeatedly switching between off and on will not help this process and there are basically no other controls the crew have, especially with no other power to run the engine starters.

This is a preliminary report. It is quite detailed for a preliminary report.

Examining the before-takeoff checklists seems like it would be akin to examining the re-arrangement of the deckchairs before the titanic even hit the iceberg.

The engines were switched off. Unlike Embraer, B & A have no protections stopping you switching an engine off inadvertently. From everything in the report, everything operated exactly as designed. I am not certain of how long the relight window is without windmilling speed, but +- 10 seconds seems entirely reasonable.

The outstanding question that presumably requires much more in-depth investigation of the wreckage items and CVR audio is whether:

• the cutoff switches were operated deliberately (and by who)
• the cutoff switches were operated inadvertently (and by who)
• the cutoff switches were bumped (by what) and the guards failed or weren't installed
• some electrical failure perfectly mimicked both many-pole switches being operated, then being operated again (seems unlikely)

Consider this post with a picture of the switches in question:


They must be lifted over the detent (if installed correctly) in each direction.

Far more than double pole - I think it's 4-8 ish. See the number of wires in the above picture. A previous post in one of the earlier thread indicated that it was essentially one pole per function - HPSOV, LPSOV, FADEC signal, generator etc. I'm not sure which one the EAFR reads. If it was a single contact failure, you would expect to see disagreement between the various systems controlled by the switch. I think that's very unlikely given both 'failed' in the same way near simultaneously and 'recovered' when switched.

For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.

Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.

They have a reasonably substantial pull-out gate.

Over-guarding stuff can have its own issues. People become used to operating the guard as part of normal operations, and it becomes muscle memory.

Apparently Embraer aircraft inhibit the shutoff switch if the thrust lever is above idle - if you have a stuck thrust lever, you need to use the fire shutoff.

Another option would be to have a blocking solenoid (with override button) similar to the landing gear lever while airborne or at high speed.

I believe the fuel cutoff switches are one of the exceptions to this. They are direct wired. Stab trim may well be too.

I think they're called remote data concentrators - in many cases it is a conversion from a direct digital input to a bus signal; electronics would not call it an 'analog' input unless it was actually measuring a quantitative value.

I think I have seen a previous reference that the generators are disconnected when you select the switches to cutoff (or very shortly afterwards), not when the engine actually drops below idle. That could account for a few seconds of spool down time.

That is a very good question IMHO.

The gear were never retracted on this flight, so the action being caused by gear up quietness is not feasible.

Action slip in general... technically possible, but there should still be no actions being taken other than gear up (and probably still a bit early for that).

Engines off instead of gear up is one hell of an action slip.

Industrial electrician here.

I have only seen a diagram for I think the 737. I remember there being a listing of what each pole did, but I can no longer find the post.

My expectation/speculation, though, is this:

The EAFR gets its information on cutoff switch position from the FADECs via data buses, similar to almost all other engine data. We have N2 information in the report after the engines were switched off, so clearly there are no concerns about this data not being captured.
This means that the FADEC's data of where the switches are is almost certainly the EAFR's data.

There are other poles on the switches that do other things - I think it was opening/closing the LPSOV and enabling the generators. The fourth pole in the 'cutoff' position was IIRC not used because the generators don't get a disable signal, whereas the LPSOVs are powered open in the run position and powered closed in the cutoff position.

If the switches were physically operated and in good electromechanical condition (not counting the possibly faulty gates), we would expect all four poles to operate essentially simultaneously, with the four 'run' contacts opening and the four 'cutoff' contacts closing. Not only would the EAFR pick up that the FADECs were commanded off, but also that the LPSOV closes after a short delay, and the generators drop offline before N2 drops below idle.

When the switches are moved back to run, we would likewise see the position of each LPSOV return to open.

(this does not necessarily mean that a person intentionally operated them, but that the lever actually moved).

If there was a wiring fault, contamination, or internal switch failure, we would probably not see this. Instead, you might see the LPSOV remain open despite the engine shutting down, or perhaps the FADECs trying to keep the engine running while the LPSOV has closed and shut off fuel, or the two FADEC channels receiving different run/cutoff signals - and all of this would probably happen differently on each engine (if it affected both engines at all). There is no indication of this in the report.

These are not your basic light switch where the load is either powered or not powered. They're four switches ganged together and operated in unison, and each channel powers either thing A or thing B. If you have both or neither A & B powered (for longer than the ~50ms that the switch takes to move between positions), this is a fault that should be visible in the EAFR data in some/many cases. Think valves being displayed in orange as 'position unknown'.

If all run contacts opened, and all cutoff contacts closed, the switch moved from run to cutoff .

I don't know whether they analysed the EAFR data in this much detail yet, but coupled with a potential click sound on the CVR, I think there's going to be very very little doubt at the end of the investigation whether the switches physically moved or not, and I strongly expect they did.

There's a reasonably substantial thread touching on that here: I'm starting to think automation may be the answer

My take is that removing the authority to crash the plane is something that's necessary for single pilot operations. That means crew can't disable both engines, or all generators, or all transponders (MH370), or put the plane into unrecoverable situations. That's a very very short summary.

Incidents like this (potentially) imply that it may be necessary for two-pilot operations too.

We don't have definitive data on this AFAIK . There's some level of speculation and guesswork.

Either shutting fuel valves or commanding the FADECs off will shut down the engines - the redundancy is not in the desired direction here.

Not when shutting down engines after arriving at the gate?

As SLF, a 1-2 second gap between engines shutting down seems pretty typical, assuming no single-engine taxi. To the point where switching both off at once could easily be a single learnt routine.

I suspect they thought that stating the switches had been replaced twice since the bulletin was published would dispel such concerns.

I think in the Jeju thread, it was noted that one of the transponders was on an AC bus and the other was on the standby bus. If they had been using the other transponder (swapped each flight), then we would have had ADS-B for the full flight.

Assuming the 787 is similar, perhaps the aircraft was broadcasting ADS-B for the full flight (with the transponder running off main battery/RAT power) but the reception was marginal, resulting in no reception until just after liftoff and no reception once they start to sink again.

I have not seen this specifically addressed, so would this same timing be expected if the engine flamed out (e.g. due to extreme rain ingestion) and continuous ignition (not present on the 787, but auto-ignition does the same thing) brought the engine back?

If the restriction to getting the engine relit earlier (well above idle N2) is only the spark gap, I am somewhat surprised that beefier igniters, perhaps with high/low voltage settings (for emergency/normal use), are not used. Compressed air is a reasonable insulator, but it's nowhere the oil, SF6, or vacuum that HV operators use in tight spaces.

Bigger igniters might mean you can spark the fuel at ~70% N2 at which point you're presumably seconds away from having thrust again, and don't do the significant engine damage associated with I assume EGT exceedances from scheduling high fuel to ramp N2 rapidly with already-hot parts.

I suggested early on that the loss of centre hydraulic pressure caused the gear to return to a 'natural'/neutral tilt. That's looking likely.

They were outside the windmilling envelope (too slow), so with no combustion, the engines were decelerating. There's a narrow window where the engines are still spinning fast enough to light off and re-accelerate (it looks like 2 missed this), but per TDR above, not so fast that they can't be lit.

You can spin up the engines in three ways: starter motor (electric or pneumatic, depending on type), windmill (but at low speeds, the RPM given by a windmill won't be enough), or the inertia of the already spinning engine. Quick relight I believe is predominantly inertia.

Korea has made CCTV mandatory in operating theatres .

I work in a facility where cameras outnumber staff on site roughly 3:1.

Various forms of public transport (trains, buses, trams, I assume many boats) have ubiquitous external, internal, and in at least some cases driver facing CCTV.

Plant control rooms (including power stations, dams, and chemical facilities) have ubiquitous CCTV.

Driver-facing cameras with alerting and KPIs for events like speeding, hard braking, phone usage/distracted driving, and fatigue detection are becoming increasingly common for fleet vehicles, thanks largely to hefty insurer discounts. That's not just heavy trucks but things like HVAC installers, linemen, and ambulances.

I suspect anyone who thinks this will never happen in aviation is being rather optimistic.

CVR is likely what was meant.