Posts by user "tdracer" [Posts: 84 Total up-votes: 0 Pages: 5]

A very cursory review of the FDR data will indicate if the fuel switches were cycled as a response to an engine rundown, or if the engine rundown was in response to the fuel switches being cycled.

This has all been answered in previous posts, but I'll repeat it for those you don't want to look back through something like 150 pages:

Thrust Lever Angle (TLA) is measured directly by the FADEC, using a resolver hardwired to and excited by the FADEC. Both FADEC channels have their own resolver input - on most Boeing aircraft it's a common resolver with two sets of electrically isolated windings, however on the 787 it actually uses two mechanically separate resolvers. The resolver is basically read as "sine" and "cosine" which is converted in the angle. This also makes error detection easy, using the sine squared + cosine squared relationship. Any other aircraft systems that use TLA use the TLA signal relayed back to the aircraft by the FADEC.

The fuel control switch is a two-position multiple pole 'latching' switch - you have to pull it out slightly over detent to move it between the RUN and CUTOFF positions (on other aircraft there is an interposing relay for some of the functions. not sure about the implementation on the 787). Moving the switch to cutoff sends a DC signal to both the High Pressure ShutOff Valve (HPSOV) in the fuel control and the spar valve commanding them to close. HPSOV is solenoid actuated and is near instantaneous, Spar Valve takes ~one second to change positions (yes, this is different than some other airframers that only send the signal to one valve or the other, but it's been standard Boeing design practice since the early 1970s). Both the HPSOV solenoid and the Spar Valve are designed to stay in their last commanded position if airframe power is lost. Moving the switch to CUTOFF also sends a 'reset' signal to the FADEC - meaning the FADEC will be offline for roughly one second. On the 787 (and 777 and 747-8), there is a brief pause (~0.25 seconds) before the shutdown signal is sent to the engine to allow the electrical system to reconfigure to prevent a brief interrupt of electrical power to the rest of the aircraft.

Pulling the Fire Handle does the same thing as the fuel condition switch - via separate wiring (physically isolated from the fuel switch wiring to help protect from things like rotor burst damage), with the exception of the FADEC reset (since there is no requirement to be able to restart the engine after a Fire Handle shutdown).

There is absolutely no TLA input into either the fuel conditions switch or the Fire Handle - you can shutdown the engine via either regardless of Thrust Lever Angle.

All this is standard Boeing design practice (and except for the no-break electrical power transfer) has been for at least 50 years. This is enforced by the Boeing "Design Requirements and Objectives" - DR&O - compliance with is demonstrated by an audit after the final design freeze.

OK, a couple of informed comments, again with the disclaimer that I have very little first hand knowledge of the 787.

Every single engine parameter I've seen on a DFDR readout has been recorded at 1/second (most parameters), or slower. I've never seen an engine parameter recorded at more than once/second.
The recorder doesn't do an instantaneous snapshot - it cycles through the thousands of recorded parameters. So a once second difference on the data could - in reality - be anywhere from 0.01 seconds to 1.99 seconds. If it matters, a deep dive into the avionics and FDR logic could narrow that time interval down. That being said, moving both switches to cutoff could happen in about a second. The switches make a rather distinct noise (especially if moved rapidly) so the CVR should give better resolution.

There have been instances in the past where the locking tab on the switch has been broken or 'worn down' from heavy use. But that's been seen on very high cycle aircraft - usually 737s that fly short hops. No memory of ever hearing of an issue with relatively new 787s that are - by nature - long range aircraft and don't get a lot of cycles.

On the 747-400, the fuel switches are a 'break before make' design with a distinct gap of ~0.050 seconds during a normal switch cycle (it's a long, somewhat painful story about why I know that...). I don't know the specifics of the 787, but I'd be very surprised if it's any different.

BTW, if the investigators had reason to believe the switches somehow moved on their own, I think a fleet wide inspection would have been ordered by now.

I keep coming back to my 'muscle memory' hypothesis...

Boeing has put the fuel control switches in more or less that same position starting with the 707 (it may go back even further). Over a billion flight cycles on 707, 727, 737, 747, 757, 767, 777, and 787 (not to mention various military installations such as the KC-135.

Wow, 5 hours from tread initiation to hamster wheel type repeating of the same theories over and over again (some already discounted by knowledgeable people).

That must be some sort of record...

Think about your question - how would the recorder know the actual switch position other than electrically? Some all-seeing electric eye in the flight deck watching the switch?
This stuff is getting absolutely silly

Ever since the two 767 events in the mid 1980's where a pilot - thinking he was activating the supervisory Electronic Engine Control switches - set both engine fuel switches to CUTOFF (fortunately at ~3,000 ft. so the engines had time to relight and recover), the FAA has mandated something called a "Quick Windmill Relight" capability. Basically - with the engine at high power - the fuel switch is set to CUTOFF, then (IIRC) ten seconds later set back to RUN. The engine must recover and produce thrust within (again, IIRC) 90 seconds. It's a very challenging test for the FADEC s/w.
I assume the 10 second pause is based on how long it took the two 767 event pilots to realize their error and return the switches to RUN.

Since some posters seem focused on the theory that the fuel control switches didn't move - just the electric output did (and as I posted earlier, the FDR only knows electrical states, there is literally no other way for the FDR to monitor the switch position).

So I did a little thought experiment. Uncommanded engine shutdowns (for all causes) are already rare - a 10-6 event. Now, during my 40 year career, I can't remember ever encountering a case where the fuel shutoff was commanded without a corresponding movement of the fuel switch. However in this industry it's a good idea to 'never say never', so let's assume it's happened. It would take something like a hot short to cause it to happen (moving the voltage from RUN to CUTOFF) since an open circuit will simply leave the valves where they were. That would put its probability way out there - something like 10-8/hr.

The left and right engine wiring is physically isolated from the other engine - nothing gets routed in common bundles between the engines. Hence there is simply no way a localized issue could affect both engine's wire bundles. So we're talking two independent events that cause the switch output to electrical change state between RUN and CUTOFF without associated switch movement. So now were out in a 10-16/hr. territory. Now, these independent events both occur a second apart - 3,600 seconds/hr., so we've just added ~8 orders of magnitude to the dual failure probability number (10-24/hr.). Now, they both somehow return to normal withing a few seconds of each other - another ~8 orders of magnitude so we're talking 10-32.

That means the probability of this happening at any time since the Big Bang is way less than one....

Space aliens look reasonable in comparison. So can we discuss things that might actually have happened?

No simulator access, but I do know this much:

One EICAS and one PFD is on the battery (most likely the left seat PFD) - they might momentarily flicker but will not 'blank'.

You get an EICAS message when you set the fuel switch to CUTOFF - something like "ENGINE X CUTOFF" (not sure of the 787 wording, but it would be something to that effect.

While I doubt the PF would be actively monitoring EICAS during TO, with the sudden audio change to the engine noise as well as the sudden loss of acceleration, I'd expect him to take a quick look at EICAS to see what the ( ) the engines are doing. Plus, if the PF was in the right seat and his PFD blanked - I'd expect him to look across to see what's on either the standby or the left seat PFC, and perhaps EICAS.

While this is thread is still deeply into hamster wheel status, there are some valuable inputs being made. I'll try to continue with that...

Thrust lever position post-accident - it takes very little force to move the thrust levers, a little more than one pound-force at the knob. I'd be very surprised if the post impact position was the same as pre-impact (and lever angle is recorded on the FDR, so the investigators know where they were). In short - the post-accident lever position is not meaningful.

Fuel condition switch position detents - if the Indian investigators had any reason to believe that a failed or inoperative detent was a contributing fact, the authorities would have ordered a fleet-wide inspection (especially since it literally takes only seconds to do the inspection - the paperwork would take many times longer than the actual inspection).

Engine restart (i.e. "Quick Windmill Relight"): Even if the igniters were firing, at high power they won't actually spark (the electrical resistance or the air at several hundred psi prevents a spark) - so they won't spark until you get down somewhere near idle if you're close to sea level. Once the engine has dropped below the min idle, it takes a long time for it accelerate back to even an idle condition. At takeoff power, the compressor components get very hot - do a power cut the air coming in the compressor gets heated by the residual heat in the compressor. This in turn limits how fast you can add fuel in the burner without excessively back pressuring the compressor and causing a compressor stall. So it actually takes longer for the engine to accel to idle that it would during a normal (cold engine) start. The 5 seconds to 95% accel requirement referenced earlier is from a stable 'high' idle (we typically call it 'approach idle' since it's automatically selected when landing flaps are selected). Approach idle is ~10% N2 higher than the in-flight minimum idle, so that takes several more seconds. Bottom line, after initiating the Quick Windmill Relight, you're not going to have usable thrust for at least 30 seconds - probably closer to 60 seconds.

For all the complaining about this preliminary report, it actually goes into more detail than is typical.

BTW, my money is still on the 'muscle memory/action slip' or whatever you want to call it. I can easily imagine a scenario along the line of 'why did you turn off the fuel' - 'I didn't - oh wait - oh ...

It doesn't really matter - the FADEC will do it's best to get the engine running again regardless of the lever position - in that regard the only real difference is once the engine reaches min idle, it'll simply keep accelerating to the target N1 (or EPR). There is no need to move the thrust lever to idle to get a successful start.

There have been a few cases that I know about where the flight crew did a normal ground start with the thrust lever at mid-power, and the engine simply continues to accelerate to the 'commanded' N1 or EPR. In one case (a 777), this happened during pushback. As the engine continued to accelerate above idle, the thrust caused the aircraft to jackknife around the tug, causing the tug driver to have to dive for cover to prevent serious injury. That even happened while we were doing the development of the 747-8 - it prompted me to ask the 747 Chief Pilot if we wanted to consider a 'start inhibit' in the FADEC logic that would prevent a ground start attempt if the thrust lever wasn't at idle (ground starts only - for what should be obvious reasons). He didn't like the idea, and it went no further...

This just popped up on my news feed - seems relevant...

Amid Air India probe, US FAA, Boeing notify fuel switch locks are safe, document, sources say

Yea, I've been having similar thoughts - GE must be quietly pleased with their Quick Windmill Relight logic.
During the design phase, the GE types fought back very hard at the QWR requirement - as I've noted previously, it's a very difficult requirement to meet - and doing the actual flight testing to show compliance does significant damage to the engine (as in a several percent loss in engine efficiency). But the FAA has a very specific requirement that must be met (documented in an "Issue Paper"), and they make the rules.

More media trying to event a story. Consider this:
Each FADEC has two independent channels - if one channel has a fault that makes in incapable of controlling the engine, the other channel takes over. This happens in milliseconds - quite likely the pilots never know it happens. There are two engines.
The chances that this failure could affect both channels of both engines within a second or so is literally trillions to one.

An unresolved difference in TLA between the channels is quite unlikely - the fault detection algorithm is quite good (sine squared plus cosine squared) - but it can happen. In the old days, we'd default to the higher TLA, but since the feds became preoccupied with Uncontrollable High Thrust, we tend to select the lower value. Worst case would be to default to idle. The fuel switch discrete doesn't really get used except for engine start - if it falsely indicates shutdown (on one or both channels), the FADEC won't do anything if the engine is already running. All this will set maintenance faults - and associated EICAS Status messages (L/R ENGINE CONTROL or ENGINE C1). I doubt that would be recorded on the DFDR - it would go to the QAR but that's unlikely to survive a crash. It would also be logged in the FADEC NVM - but again no guarantee that would survive either (although when the Lauda 767 crashed due to the thrust reverser deployment, the DFDR was destroyed but the FADEC NVMs both survived - much of what we know about that crash came from the FADEC NVM.)

Again, not familiar with the specifics of the 787, but on the 747-400/-8, one pole of the fuel switch feeds EICAS - which uses it in various message logic - and sends it out to any other aircraft systems that use it. There is "Digital Flight Data Acquisition Unit) DFDAU (pronounced Daff Du) that takes all the various system digital signals, sorts them and provides them to the DFDR and QAR. The 787 has something similar to the DFDAU but I don't recall what it's called.

Not trying to be part of the on-going hamster wheel. But the discussions regarding the odds of this being pilot suicide based on historical rates are missing a very critical statistical point.
Let's just assume that rate of commercial airliner crashes due to pilot suicide is 1 in 100 million departures. Simply put, that means that if you get on a commercial aircraft to fly from point A to point B, the historical odds are that there is a 1 in 100 million chance that your flight will crash due to an intentional suicidal pilot act. However, the historical odds say that the odds of your flight crashing for any reason are several million to one. Since the turn of the century, the fatal cash rate has been something around 1 in 5 million departures.
Now, we know for a fact that the Air India 787 crashed - hence the probability of a crash for this particular flight is not 1 in 5 million - it's ONE! That means the historical odds of this crash being due to an intentional act by a pilot (i.e. suicide) is ~5%, not one in 100 million (obviously a rough number, but you get the idea).

Oh, another to consider with regard to a pilot having a monumental 'brain fart'. We don't know where the pilot's mind was at during the takeoff. Was he focused on the task at hand, or was he preoccupied with the health of his father and what he was going to do about it. About 35 years ago, my one-time fianc\xe9 left me for another guy. I was devastated. Some of my friends were worried that I might attempt suicide, but that never entered my mind. However, I was horribly distracted and my work performance suffered greatly since my mind was not on the tasks at hand. I could have easily done something really stupid that could have endangered my life - such as missing a stop sign while driving or running a red light because I wasn't paying attention.

There is a CMR on the 787 to remove and do an inspection of the thrust lever mechanisms on a periodic basis - I don't know (or at least remember) the interval, but I'd expect it to be in the 20,000-30,000 hr. range.
This is related to the FAA preoccupation with Uncontrollable High Thrust and the potential for a mechanical failure in the thrust lever mechanism to cause UHT.

As previously explained, the fuel control switches are a 'break before make' design - with a nominal gap between the two states of about 50ms.

Dani, the reason your posts regarding nearly simultaneous switch failures keep getting deleted is that this exact scenario has been repeatedly raised in the three Air India accident threads - and then thoroughly discounted and dismissed by people who - unlike you - are actual experts on the subject and/or pilots who have regularly used them. That your latest attempt to resurrect this hugely improbable scenario has remained and resulted in another 4 or 5 pages of hamster wheel discussion suggests to me that the mods have simply given up on this thread...

Something else that has been repeatedly discussed in the three threads...
While there are interposing relays, the signals to the Fuel Metering Unit shutoff valve and the Spar Valve are hardwired from the switches to the valves in question. They don't go through some computer interface that could corrupt the signals.

The answer is slightly complicated. The FADEC has the authority to move the fuel metering valve to the 'full closed' position - which also causes the High Pressure SOV to then close. However this is normally only used during engine starting, and that part of the logic is disabled once the engine is running. However, there is the overspeed protection circuit which can also close the HPSOV. TCMA uses the overspeed protection system to shutdown the engine.

The HPSOV is driven by the aircraft using 28 Vdc power from the battery bus. The FADEC isn't involved - although it does get an indication of the fuel condition switch position, but that's not used except during starting. A 'false' fuel condition switch input of Cutoff will not cause the FADEC to do anything once the engine is running.

The investigation is following the ICAO rules, and those rules don't agree with what you'd like to see.
You can bring your objections to the attention of ICAO and lobby them to change the rules, but given these rules have been in place for decades - and have generally worked quite will - I doubt there going to change them just to satisfy your curiosity.