Posts about: "Dual Engine Failure" [Posts: 270 Pages: 14]

T28B
June 21, 2025, 17:45:00 GMT
permalink
Post: 11907933
Originally Posted by rachel1707uk
Has it been confirmed that there was a dual engine shutdown
Not confirmed . What is apparent is a (substantial) loss of thrust. That's what one can say with some certainty.
if so, why weren't people commenting on this from the videos of the incident (if the audio was good enough to detect the RAT then surely it was good enough to tell whether the engines were running).
That has already been discussed, and there has been abundant comment. Suggest you go back and review the original thread, and this one as well.
Thank you for your patience!
Thank you for your interest.
PBL
June 22, 2025, 12:43:00 GMT
permalink
Post: 11908512
Originally Posted by adfad
MCAS .... was designed entirely because a regulatory environment existed where you could extend the fuselage to the point where ...
MCAS was originally designed for the KC-46 and runs on that aircraft.

The "bigger issue", as you put it, is Boeing company organisational and engineering effectiveness. In this accident, so far, we are looking at (at least) two nominally independent phenomena that inhibited continued safe flight, and nobody has a clue yet (or maybe the investigation team does) how those phenomena can possibly have come to be.

This singular, so far inexplicable, event occurred with an aircraft with over a decade and 30 million hours of use and no previous fatal accidents. Compare that with the A320, which had 5 fatal accidents in its first decade. The Boeing 777 had one (a refuelling incident in Denver in which the fuel operator died). Boeing organisational behaviour has been the subject of two scholarly books, one extensive US Congressional report, and a lot more (most recently since January 2025). There is a lot of information, even very interesting information. What there is not in any of that information (I ask you to take my word for it) is any indication of why two working engines simultaneously suffered serious reduction of thrust shortly after unstick. That is a different topic entirely. And in my opinion it is the topic which belongs in this thread.

Last edited by PBL; 22nd June 2025 at 13:42 . Reason: Brain bit flip: said "miles", obviously meant "hours". Duuh
MaybeItIs
June 22, 2025, 23:35:00 GMT
permalink
Post: 11908907
Originally Posted by FullWings
That\x92s the nature of a common mode bug. If the software was vulnerable to Mars being in the house of Uranus, the scent of lilacs and the DOW being less than 42,000 then you\x92d expect the failure to occur everywhere when these conjoined. Same when an aeroplane\x92s systems and/or the environment present data that triggers an unplanned/unforeseen response in something like an EEC/FADEC. The experts still appear to think that this is unlikely but we have been presented with an unlikely occurrence...
I have to both agree and disagree with both this and the next post by TryingToLearn.

Yes, there may be (let's assume is) "identical" FADEC/TCMA hardware and firmware on both engines, but if the Left Engine is subject to Mars in the house of Uranus (wink wink), then the Right Engine cannot be, maybe it's Venus in the same House. This is simply because the Left engine TCMA 'contraption', I'm going to call it, is monitoring Left Engine Conditions (Shaft Speed, T/L setting / position data - Right or Wrong, and calculating and comparing accordingly against its internal map) while the opposite TCMA "device" is monitoring and calculating etc, Right Engine Conditions. There are some things in common, but (I say) it's virtually impossible for the Engine Conditions being individually monitored to be identical in both engines.

The Thrust Levers are electro-mechanical devices, almost certainly at this stage pushed by a somewhat squishy human hand, likely with a slight offset. What is the probability that those two levers are in identical positions, and even if they are, that the calibration (e.g. "zero points") of both levers are identical, and that the values they output (response slopes/curves) are exactly matching in every matching point in their individual travels? That's just one aspect, but consider the engines. They are different ages. Have different amounts of wear. They have separate fuel metering valves (or other names), separate HP Fuel pumps (and, I guess relief valves?), all also subject to wear), and each has a host of other, correspondingly paired, sensors, (maybe of different makes and certainly of different ages and different calibrations and response curves) from which each FADEC, supposedly independently of the TCMA, adjusts the fuel metering device settings and resulting engine power, and shaft RPMs follow in some other slightly non-matching way.

Sure, I would completely agree that the two engines and their calculated Throttle Lever positions to Shaft RPMs are always going to be similar during normal, matched operation, and they will very likely dance with each other, maybe one 'always' (75% of the time, say) leading during one dance (TO, say) with the other leading in dancing to a different tune (descent, say).

To me, the fact that this appears to have been an almost simultaneous dual engine failure, pretty much, for me, rules out a FADEC/TCMA firmware bug, especially as there don't seem to be any reports of even a single engine mid-air TCMA shutdown.

HOWEVER, and I want to stress this, that doesn't rule out the possibility that both TCMAs shutdown their respective engines simultaneously. Any lack of simultaneity observed would be due to those slight differences in other pieces of hardware, such as the time for one Shutoff valve to close versus the other.

As far as I know, there isn't enough information on what's actually inside those TCMA Black Boxes to say anything for sure, but here's a thought, which I think has been alluded to, or the question asked, here in one or other thread, earlier.

What does the TCMA firmware do when an engine is already running at a high power setting and TWO things occur in quick succession? I suspect this kind of event is a highly probable cause, but these two events have not occurred close enough together, or ever, before.

Imagine this: Plane taking off, Throttle Levers near Full Power, Engines performing correctly, also near Full Power, Rotation etc all normal, plane beginning to climb, positive rate achieved.

Pilot calls GEARUP. GearUp, activated.

The Gear Retract sequence begins. Due to some unforeseen or freshly occurring (maybe intermittent short or open circuit) linkage between the gear Up sequence and the WOW or Air/Ground System, the signal to both TCMAs suddenly switches to GROUND. All "good", so far, as the engine RPMs match the Throttle Lever settings and TCMA doesn't flinch. The plane could be in a Valid Takeoff sequence, so it had better not! But it does make a bit of sense. How is WOW / Air/Ground detected? Somewhere near the Landing Gear, I assume.

HOWEVER, now, a moment later, and perhaps due to a related system response, the Thrust Levers suddenly get pulled back to Idle, whether by man or Machine.

What would you expect the TCMA system to do? I would guess, fairly soon thereafter, two, independent, Fuel Cutoffs... Though I fully admit, I'm guessing based on a severe lack of knowledge of that Firmware.

Ok, no need for further explanation on that point, but I did refer to TCMA unflatteringly as a contraption, earlier. Last night (regrettably, before bed) I started looking at the TCMA Google Patent. Let's just say, so far, I'm aghast! My first impressions are bad ones. How did this patent even get approved? What I suspect here, now, is not a Firmware bug, but a serious Logic and Program Defect. But we'd have to see what's inside the firmware.

When I get more time, I'll dig deeper.
TURIN
June 29, 2025, 10:48:00 GMT
permalink
Post: 11912945
Originally Posted by MissChief
Can anyone suggest a good reason why the captain should issue a Mayday call at that point? The crew should have been extremely busy with the situation. Aviate, Navigate, Communicate is a mantra we are all familiar with. So why communicate?

Having discussed the accident with experienced pilot colleagues, we have all considered that the Egyptair 990 case offered similarities. Yet this is almost a taboo subject.

And one's suspicions are raised by the fact that Air India/Tata are keeping ICAO out of the post-crash investigation.

Incidentally, I sincerely hope that we are wrong about the possibility of a deliberate dual engine shutdown shortly after rotation.
Please read the thread. It has been discussed several times.
Sailvi767
June 29, 2025, 14:02:00 GMT
permalink
Post: 11913050
I see nothing in the video’s to suggest the aircraft was out of control. It was gliding almost exactly as you can expect from an event starting with the gear down and flaps at 5. As the aircraft nears the ground it appears there is a bit of flare to break the rate of descent. That is exactly what you would expect the pilots to do and their only course of action with a dual engine failure at low altitude.
PPRuNeUser548247
June 30, 2025, 08:28:00 GMT
permalink
Post: 11913431
We know that the right-hand GEnx-1B was removed for overhaul and re-installed in March 2025 so it was at \x93zero time\x94 and zero cycles, meaning a performance asymmetry that the FADEC would have to manage every time maximum thrust is selected. If the old engine was still on the pre-2021 EEC build while the fresh engine carried the post-Service Bulletin software/hardware, a dual \x93commanded rollback\x94 is plausible. A latent fault on one channel with the mid-life core can prompt the other engine to match thrust to maintain symmetry, leading to dual rollback.

Last edited by PPRuNeUser548247; 30th June 2025 at 11:43 .
skwdenyer
June 30, 2025, 12:29:00 GMT
permalink
Post: 11913592
Originally Posted by The Brigadier
We know that the right-hand GEnx-1B was removed for overhaul and re-installed in March 2025 so it was at \x93zero time\x94 and zero cycles, meaning a performance asymmetry that the FADEC would have to manage every time maximum thrust is selected. If the old engine was still on the pre-2021 EEC build while the fresh engine carried the post-Service Bulletin software/hardware, a dual \x93commanded rollback\x94 is plausible. A latent fault on one channel with the mid-life core can prompt the other engine to match thrust to maintain symmetry, leading to dual rollback.
You think the Thrust Asymmetry Protection could kick in and leave the aircraft with little to no thrust?
silverelise
June 30, 2025, 13:05:00 GMT
permalink
Post: 11913609
India's Minister of State for Civil Aviation appears to be confirming in this this interview that the cause of the accident was a dual engine failure. Which is, I think, the first vaguely official confirmation of what happened that has been released? He also confirmed that all the data from the recorders has been downloaded and is being processed by the Indian AAIB, no boxes have been sent abroad.
The 30 day deadline for the preliminary report is July 12th.
Lonewolf_50
June 30, 2025, 13:08:00 GMT
permalink
Post: 11913613
Originally Posted by The Brigadier
We know that the right-hand GEnx-1B was removed for overhaul and re-installed in March 2025 so it was at “zero time” and zero cycles, meaning a performance asymmetry that the FADEC would have to manage every time maximum thrust is selected. If the old engine was still on the pre-2021 EEC build while the fresh engine carried the post-Service Bulletin software/hardware, a dual “commanded rollback” is plausible.
A latent fault on one channel with the mid-life core can prompt the other engine to match thrust to maintain symmetry, leading to dual rollback.
Then why didn't that happen on the previous flight from Deli to Ahmedabad, or any of the previous flights since that engine install in March?
Originally Posted by silverelise
He also confirmed that all the data from the recorders has been downloaded and is being processed by the Indian AAIB, no boxes have been sent abroad.
The 30 day deadline for the preliminary report is July 12th.
Thanks for the update, and in particular that bolded bit.
Originally Posted by the linked article
Investigators still haven’t ruled out the possibility of sabotage being behind the Air India crash in Ahmedabad earlier this month that killed 274 people , according to India’s aviation minister. The Aircraft Accident Investigation Bureau (AAIB) has confirmed that the aircraft’s flight recorders – known as black boxes – will not be sent outside the country for assessment and will be analysed by the agency, said Murlidhar Mohol, the minister of state for civil aviation.l
adfad
June 30, 2025, 15:49:00 GMT
permalink
Post: 11913716
Originally Posted by silverelise
India's Minister of State for Civil Aviation appears to be confirming in this interview that the cause of the accident was a dual engine failure. Which is, I think, the first vaguely official confirmation of what happened that has been released? He also confirmed that all the data from the recorders has been downloaded and is being processed by the Indian AAIB, no boxes have been sent abroad.
The 30 day deadline for the preliminary report is July 12th.
It's hard to find a full and reliable translation of his statement but here is another snippet from Yahoo (I can't post links sorry)

The minister called the crash a \x93rare case\x94 and, referring to claims by veteran pilots and experts that a dual-engine failure may have led to the crash, said: \x93It has never happened that both engines have shut down together.\x94 \x93Once the report comes, we will be able to ascertain if it was an engine problem or fuel supply issue or why both engines had stopped functioning.
I think it's very important to define "engine failure" vs e.g., reduced thrust - BA38 for example was described as "restricted fuel flow when thrust was demanded" and there was no evidence of engine driven generator power stopping as the engines were still running at idle at impact. It's pretty clear from the available evidence that Air India lost electrical power within 20 seconds of leaving the ground, and based on the landing gear orientation theories that time may be significantly shorter <10 seconds.
fdr
June 30, 2025, 23:39:00 GMT
permalink
Post: 11913950
Originally Posted by The Brigadier
We know that the right-hand GEnx-1B was removed for overhaul and re-installed in March 2025 so it was at \x93zero time\x94 and zero cycles, meaning a performance asymmetry that the FADEC would have to manage every time maximum thrust is selected. If the old engine was still on the pre-2021 EEC build while the fresh engine carried the post-Service Bulletin software/hardware, a dual \x93commanded rollback\x94 is plausible. A latent fault on one channel with the mid-life core can prompt the other engine to match thrust to maintain symmetry, leading to dual rollback.
However, a roll back on its own to idle would not give the evidenced gear behaviour nor the RAT (I happen to concur that the RAT was deployed and probably automatically). Given the gear tilt, it is safe to assume no engine is at idle, the normal electrical systems are not functioning at all.
Fursty Ferret
July 09, 2025, 11:00:00 GMT
permalink
Post: 11918308
For what it's worth, if the fuel control switches were rapidly cycled as per the dual engine failure memory actions, the engines should both have restarted and recovered full thrust within a matter of seconds. This is part of the certification and Rolls Royce publish the procedure (unofficially) as a last-ditch attempt to recover an engine that's experiencing a locked-in surge condition.
OliTom
July 09, 2025, 11:07:00 GMT
permalink
Post: 11918314
Originally Posted by Fursty Ferret
For what it's worth, if the fuel control switches were rapidly cycled as per the dual engine failure memory actions, the engines should both have restarted and recovered full thrust within a matter of seconds. This is part of the certification and Rolls Royce publish the procedure (unofficially) as a last-ditch attempt to recover an engine that's experiencing a locked-in surge condition.
Obvious questions, Is the procedure applicable to the GEnx engines installed on the accident aircraft and I assume this only applies if you realise the control switches are what the issue is, within seconds?

Last edited by OliTom; 9th July 2025 at 11:24 .
Propellerhead
July 09, 2025, 12:32:00 GMT
permalink
Post: 11918361
Originally Posted by Fursty Ferret
For what it's worth, if the fuel control switches were rapidly cycled as per the dual engine failure memory actions, the engines should both have restarted and recovered full thrust within a matter of seconds. This is part of the certification and Rolls Royce publish the procedure (unofficially) as a last-ditch attempt to recover an engine that's experiencing a locked-in surge condition.
Not sure about this. I don\x92t think the loss of thrust on both engines memory items were envisaged to be done after liftoff. It\x92s way outside the ram air start envelope. The engines would spool down fairly quickly at that low airspeed. Procedures to the operator are written by Boeing, not the engine manufacturer. And there is no procedure official or otherwise to recover a single surging engine - you either run it surge and stall free at a lower thrust or shut it down.
V1... Ooops
July 09, 2025, 16:26:00 GMT
permalink
Post: 11918497
There has been discussion recently about a procedure that involves moving the fuel switches to CUTOFF and then back to RUN following a dual engine failure.

Attached is an image of a page from the Air India 787 Training Manual that discusses this procedure.

I am submitting this without comment or opinion.


Magplug
July 09, 2025, 16:57:00 GMT
permalink
Post: 11918527
Propellerhead You are correct, a low level altitude capture would back off the throttles as the FMA goes into ALT. However the FD would drop unexpectedly as would the engine noise as the throttles rolled back..... So in what world would that prompt you to call for the dual engine failure checklist rather than firewalling the throttles? This was discussed about 75 pages ago.... It makes good reading
tdracer
July 09, 2025, 18:20:00 GMT
permalink
Post: 11918562
Originally Posted by Propellerhead
One thing that I remember from when I was a simulator TRI/TRE on a Boeing was that as an instructor you get very used to operating critical
switches rapidly without following any procedure, in order to set the sim up for a single engine landing etc. When I was then line flying next I had to guard against doing the same thing in the real aircraft.
Muscle memory is a strange and (usually) wonderous thing. It allows us as humans to perform amazing things without actually thinking about what we are doing. Professional Athletes have perfected this to a high art, but the rest of us do things using muscle memory on a regular basis. Back when I was still racing, I happened to look down at my hands on the steering wheel in fast, bumpy corner, and I was simply amazed at the large, rapid steering inputs that I was making to compensate for the bumps - with absolutely zero conscious thought. Muscle memory at its best.

However, it can also bite us. The Delta dual engine shutdown during takeoff from LA (referenced way back when in the 1st accident thread) was caused by muscle memory - the pilot reached down to set the EEC switches (located near the fuel On-Off switches) but muscle memory caused him to do something else - set both fuel switches to OFF. Fortunately, he quickly recognized his error, placing the switches back to RUN and the engines recovered in time to prevent a water landing (barely).

It is conceivable that a pilot - reaching down to the center console to adjust something unrelated - could have muscle memory cause him to turn the fuel off to both engines. While all new engines are tested for "Quick Windmill Relight" - i.e. the fuel switch is set to CUTOFF with the engine at high power - and the engine must recover and produce thrust withing a specified time (memory says 60 or 90 seconds) - it takes a finite amount of time for the engines to recover (spool down after a power cut at high power is incredibly fast - plus moving the switch to CUTOFF causes a FADEC reset, which means it won't do anything for ~ 1 second). Doing that at a couple hundred feet and the chance that an engine will recover and start producing thrust before ground impact is pretty much zero
Subsy
July 09, 2025, 19:23:00 GMT
permalink
Post: 11918592
Originally Posted by tdracer
Muscle memory is a strange and (usually) wonderous thing. It allows us as humans to perform amazing things without actually thinking about what we are doing. Professional Athletes have perfected this to a high art, but the rest of us do things using muscle memory on a regular basis. Back when I was still racing, I happened to look down at my hands on the steering wheel in fast, bumpy corner, and I was simply amazed at the large, rapid steering inputs that I was making to compensate for the bumps - with absolutely zero conscious thought. Muscle memory at its best.

However, it can also bite us. The Delta dual engine shutdown during takeoff from LA (referenced way back when in the 1st accident thread) was caused by muscle memory - the pilot reached down to set the EEC switches (located near the fuel On-Off switches) but muscle memory caused him to do something else - set both fuel switches to OFF. Fortunately, he quickly recognized his error, placing the switches back to RUN and the engines recovered in time to prevent a water landing (barely).

It is conceivable that a pilot - reaching down to the center console to adjust something unrelated - could have muscle memory cause him to turn the fuel off to both engines. While all new engines are tested for "Quick Windmill Relight" - i.e. the fuel switch is set to CUTOFF with the engine at high power - and the engine must recover and produce thrust withing a specified time (memory says 60 or 90 seconds) - it takes a finite amount of time for the engines to recover (spool down after a power cut at high power is incredibly fast - plus moving the switch to CUTOFF causes a FADEC reset, which means it won't do anything for ~ 1 second). Doing that at a couple hundred feet and the chance that an engine will recover and start producing thrust before ground impact is pretty much zero
It would be a lot more conceivable if the pilot had been practicing this action in a simulator recently.

It's ironic that cognitive science arguably started with 'The Cambridge Cockpit'; an attempt to make sense of, and mitigate, pilots doing this sort of thing when tired, stressed and so on. This kick started an ergonomics revolution which appears to have come full circle. Now we have cognitive science offering Bayesian accounts of neural function that might explain how innocent but unfortunate priming of 'muscle memory' when practicing for emergencies could, almost predictably, lead to this sort of complex, protection overriding, error.

As non consciously executing a complex, well practiced, but unintended, action is a fairly common experience in less critical situations, I'm surprised that there isn't already a more effective ergonomic fix than the safety switches fitted.

Last edited by Subsy; 9th July 2025 at 21:58 .
FullWings
July 09, 2025, 21:50:00 GMT
permalink
Post: 11918657
Originally Posted by Magplug
Propellerhead You are correct, a low level altitude capture would back off the throttles as the FMA goes into ALT. However the FD would drop unexpectedly as would the engine noise as the throttles rolled back..... So in what world would that prompt you to call for the dual engine failure checklist rather than firewalling the throttles? This was discussed about 75 pages ago.... It makes good reading
Not to mention the thrust lever positions would be correct for the amount of power. Thinking further, it would have been manual flight and if it was a low-level acquire, you should get SPD | TO/GA | ALT or SPD | LNAV | ALT and you\x92d get the autothrottle trying to keep whichever is greater of minimum manoeuvring speed or what\x92s in the IAS window (most likely V2). None of that looks or feels like engine failure - like has been said multiple times, if the engines are running at a decent power setting and you need more thrust, the dual engine failure checklist is not the place to start when you can just push the TLs forward for a better result?

AirScotia
July 09, 2025, 23:20:00 GMT
permalink
Post: 11918695
Originally Posted by V1... Ooops
There has been discussion recently about a procedure that involves moving the fuel switches to CUTOFF and then back to RUN following a dual engine failure.

Attached is an image of a page from the Air India 787 Training Manual that discusses this procedure.

I am submitting this without comment or opinion.

Nobody seems to have discussed this. If I'm reading it right (and I'm not a pilot), it seems to be suggesting that in the event of a dual engine failure, a restart should be attempted while the engine still has high RPM? It also seems to be indicating that fuel switch resetting should be attempted if the restart has failed to start the engine?