Associated links (A98H0003)
Engine shutdown systems
Engine shutdown systems description
Normal engine shutdown
The engine FMU allows for starting and shutting down the engine according to the FUEL switch position. There is one FUEL switch for each engine, located beneath the engine throttle on the ENG START panel. Each engine FUEL switch is identical in operation. The Engine 2 FUEL switch is described below.
Engine 2 FUEL switch
When the FUEL switch is selected to the ON position, 28 V DC battery bus power from CB B1-122, at position B-12 on the overhead panel, is supplied to the fuel open solenoid in the FMU through Pin A2 on the Engine 2 fuel valve open relay, R2-5087. With the activation of the fuel open solenoid, fuel from the engine-driven fuel pump is allowed to enter the FMU. The FMU is equipped with a pressure-sensitive, internal fuel shut-off valve. When the fuel shut-off valve senses a rise in fuel pressure, the valve is moved to the "fuel on" position and the ground to relay R2-5087 is removed. As the FMU shut-off valve is a hydraulically latched valve (which needs fuel pressure to move it), the valve remains in the "fuel on" position as long as fuel pressure to the FMU is present. With the loss of the ground circuit, relay R2-5087 returns to its normal, closed position, and power is removed from the FMU open solenoid valve. As no electrical power is required to hold the FMU fuel shut-off valve open or closed, the use of the relay and valve helps reduce the electrical load on the battery. A loss of electrical power to the FUEL switch with the engine running will have no effect on engine operation.
When the FUEL switch is selected to the OFF position, 28 V DC battery bus power from CB B1-122, at position B-12 on the overhead panel, is supplied to the FMU fuel close solenoid through Pin A3 on the Engine 2 fuel valve closed relay, R2-5088. Fuel is shut off to the FMU and, with a loss of fuel pressure, the internal FMU fuel shut-off valve moves to the "fuel off" position. To limit the current draw on the battery, relay R2-5088 is equipped with a five-second time delay. The current draw on the fuel valve closed relay is lower than the current draw on the FMU fuel close solenoid and, once five seconds have elapsed, the relay opens and power is removed from the fuel close solenoid. As the FMU fuel shut-off valve is a hydraulically latched valve, the valve remains in the fuel off position.
With the FUEL switch in the ON position, power from CB B1-122 is also routed to the X coil of the magnetically latching relay R2-5089, "Engine 2 FADEC Reset," located in the right overwing cabin equipment panel. This opens closed contacts C2-C3 and D2-D3 of R2-5089, removing the ground circuits to channels A and B of the FADEC EEC. When the FUEL switch is placed in the OFF position, the X coil of R2-5089 is de-energized and the Y coil of relay R5-5089 is energized, resulting in the contacts C2-C3 and D2-D3 closing, completing a circuit through the FADEC EEC to ground, resetting the FADEC.
For the FADEC to reset without moving the FUEL switch, two failures need to occur. Power has to be removed from the X coil of R2-5089 by opening the circuit and then power has to be applied to the Y coil to effect its movement to again change the contact positions. It is also possible to reset the FADEC EEC downstream of the R2-5089 relay by shorting the signal wires from R2-5089 to the FADEC EEC.
The only circuit that passed through an area of burn damage is the power wire from CB B1-122 on the overhead panel. This wire is routed out the left side of the overhead tub in wire run AML to the left overhead disconnect panel, and then down the left side into the avionics compartment in wire run AAG. The wiring for the FUEL switch is located in the thrust control module in the pedestal under the floor and is routed aft to station 1059, where it transitions above the floor to the mid overhead cabin. The opening of the power wire, or the tripping of CB B1-122, will prevent the shutdown of Engine 2 and the resetting of the FADEC EEC Channel B.
Emergency engine shutdown
The emergency shutdown of each of the three engines is accomplished through three independent ENG FIRE handles located on the flight compartment overhead centre panel. The initial movement of the handle shuts off its respective generator through a generator field disconnect switch. Further movement of the handle rotates a drum and cable assembly that mechanically shuts off the hydraulic system for the engine, by closing its respective hydraulic shut-off valve. The handle can be pulled and rotated in this position to discharge the engine fire bottles. Full movement of the Number 2 ENG FIRE handle also mechanically closes two fuel fire shut-off valves, through rotation of the drum and cable assembly. The forward fuel fire valve is located in the left wing and the aft fuel fire valve is located in the tail. Full movement of fire handle 1 or 3 shuts off the fuel to their respective engines by electrically closing the engine's fuel fire valve.
Engine shutdown systems examination
Engines 1 and 3
The gate valve was identified through the MD-11 Engine Fuel Supply IPC illustration as coming from either the Engine 1 or the Engine 3 position (both valves have the same PN). The valve was recovered with the valve slide gate near the fully closed position. Fibrous material was noted under the edge of the slider, but was not trapped. The motor/actuator was broken off and the splined male and female drive were missing. There was a circumferential fracture at the bottom of the female spline. The fracture showed signs of shear failure at one side (around the outside surface of the remaining stub) and an impression of the male spline at the other end. The impression made by the male spline implied a bending failure, associated with a clockwise torsional rotation on the compression side. There was also some smearing and indentation of the casing alongside the shaft, 90 degrees to the bending direction of the shaft. The torsional nature of the shaft fracture and the smearing of the casing alongside the shaft indicates that the initial bending failure likely occurred when the shaft was oriented near the valve open position, and that the shaft was rotated toward the valve closed position as the shaft was broken off.
A second gate valve was recovered and identified through the MD-11 Engine Fuel Supply IPC illustration as coming from either the Engine 1 or the Engine 3 position. Only the upper portion of the valve slide gate body was recovered. The motor/actuator was broken off and the four motor/actuator attachment posts were bent over in a clockwise rotational pattern. The splined female drive and valve slide arm remained within the body, with the slide arm captured in the valve slide closed position. The clockwise rotational bending pattern on the motor/actuator attachment posts is consistent with failure of the motor/actuator in a direction that would bias the valve slide arm toward the closed position during impact. Based on the knowledge that engines 1 and 3 were operational at the time of impact (STI) and the failure mode of the valve, it is believed that the valve was in the open position at the time of impact.
The hydraulic shut-off ball valve was identified by tag as Whittaker Controls, Inc. PN 148885-1, SN 2332. The valve lever arm assembly was identified by design through the MD-11 IPC as coming from either the Engine 1 or the Engine 3 position. A section of push rod was still attached to the valve lever arm. As recovered, the ball was aligned in the valve open position, but was free to rotate. The valve position-indicator pointer attachment pin was sheared and it appears to have been forced against the open position stop. It could not be established whether the valve had moved during the impact sequence.
Engine 2
The forward fuel fire shut-off valve (located in the trailing edge of the left wing) was identified through the MD-11 IPC by a section of attached pipe, PN AAL7000-501. The mechanically operated gate-type valve was identified by tag as PN AV16A1348B, SN N60100. The valve gate was recovered in the closed position. The actuating handle, which is connected to the cable assembly through a link rod and cable drum, was broken off. The closed position stop was "overridden" by a smear that progressed past the stop by approximately 3/8 inch. The internal boss, housing the actuator lever, exhibited a heavy gouge that started midway between the open and closed stop positions, and progressed past the closed stop to the "overridden" position. This gouge indicates that the valve was most likely open at the time of impact and driven closed by impact forces.
The Engine 2 aft fuel fire shut-off valve was still attached to a piece of the tail structure. The valve was identified by tag as PN 233865-1, SN 035. The valve was removed from the structure and the valve slide gate was found in the open position. The valve body actuating arm was at the open stop position, and there was no damage to the stop plate. The end of the valve body actuating arm had broken off at the rig pin hole, from an impact that imparted a side bending load on the arm and captured the actuating arm in place. The valve slide end plate had received an impact that sheared three of its four mounting screws and twisted the plate to the side. The internal bore of the plate had a gouge from contact with the end of the valve slide, with the slide in the open position. The recovered position of the gate valve and the associated damage to the actuating arm and the valve end plate indicates that the valve was most likely in the open position at the time of impact.
The hydraulic shut-off ball valve was identified by tag as Whittaker Controls, Inc. PN 148885-1, SN 2279. The valve lever arm assembly was identified by design through the MD-11 IPC as coming from the Engine 2 position. A section of push rod was still attached to the valve lever arm. As recovered, the ball was aligned in the valve open position, but was free to rotate. The valve position-indicator pointer attachment pin was sheared, and it appears to have been forced against the open position stop. It could not be established whether the valve had moved during the impact sequence.
Engine shutdown systems determination
Engines 1 and 3
The recovered open position of the Engine 1 or Engine 3 hydraulic shut-off valve was consistent with the open positions of the two engine fuel fire shut-off valves and the results of the engine examinations, which indicated that engines 1 and 3 were operating at the time of impact.
Engine 2
The recovered open position of the Engine 2 hydraulic shut-off valve was consistent with the open positions of the Engine 2 forward and aft fuel fire shut-off valves, in that all three valves are operated together by the engine fire handle. Pulling the engine fire handle would have closed all three valves.
Fire in the cockpit ceiling area could have resulted in damage to the engine fire cabling pulley cluster, creating enough slack in the cabling that pulling the Engine 2 fire handle would have no effect on closing the engine fuel fire and hydraulic valves. Since the valves were open, it follows that the Engine 2 shutdown could not have occurred as a result of pulling the engine fire handle.
Engine 2 was determined to have been shut down by crew activation of the Engine 2 FUEL switch, for the following reasons:
- The engine examination and FADEC information supports the shutdown of Engine 2 before the time of impact.
- Examination of the Engine 2 emergency shutdown system (forward fuel shut-off valve, aft fuel shut-off valve, and hydraulic shut-off valve) indicates that the cable-operated system could not have shut down the engine.
- The Engine 2 FADEC NVM data indicates that a re-initialization of the EEC occurred. This can only be accomplished through the FADEC reset relay, which is controlled by the selection of the engine FUEL switch (to OFF), with electrical power available from the 28 V DC battery bus.
- The engine FMU is equipped with a hydraulically latched fuel shut-off valve. No electrical power is needed to keep the FMU fuel shut-off valve open; therefore, a loss of electrical power to the engine FUEL switch would not have resulted in the shutdown of the engine.
- The assessment that the Tank 2 right aft boost pump was not running (the operation of remaining Tank 2 pumps was uncertain) is consistent with the fuel system controller in the auto mode, responding to a shutdown of Engine 2 with the Engine 2 FUEL switch. The FUEL switch is equipped with a separate set of switch contacts to signal the fuel system controller to shut down the fuel pumps in the corresponding tank.
Engine false fire warning
The ground wire for the Engine 2 fire handle lights is co-located in wire bundle AMK, which had known arcing events (Engine 2 fire detection loop "A" and high-intensity light wires). If this ground wire were to short to ground at some point along its run, then both the Engine 2 fire handle light and the Engine 2 FUEL switch light would have illuminated.
One of the two cockpit crew emergency checklists was found with fire damage to the front of Page 3 and the back of Page 2 (the checklist was recovered in the closed position). Page 3 of the checklist is the Engine Fire page. The first checklist item on the Engine Fire page is to move the throttle to idle, followed next by the movement of the engine FUEL switch to OFF. The Engine 2 FUEL switch was moved to the OFF position. The fire damage to the checklist could imply that the checklist had been opened to Page 3, and the fact that one of the first checklist action items (when dealing with an engine fire) is to move the FUEL switch to OFF, brings some credit to the theory that the crew could have been responding to an engine fire warning alert.
If the crew had shut down Engine 2 because of a fire warning indication, and had been following the checklist, then the Engine 2 fire handle should also have been pulled and at least one of two Engine 2 fire bottles discharged. Examination of the Engine 2 cable-driven fuel fire shut-off valves and the Engine 2 fire bottles revealed that the valves had not been moved nor had the fire bottles been discharged. It is not known to what extent the engine fire cable pulley cluster, in the cockpit ceiling area, was damaged by the on-board fire. If the phenolic pulleys were damaged by the fire such that the cables became slack, then it is possible that pulling the Engine 2 fire handle would have had little or no effect in closing the engine fuel fire shut-off valves (as moving the handles would only remove the slack in the cabling). However, slack in the cabling (if present), would not have prevented the crew from discharging the fire bottles. The fact that the shutdown of the engine occurred in the latter stages of the flight, just prior to impact, is consistent with the crew members having little time, in a hostile environment, to complete the engine shutdown, even if they had started that procedure.