Posts about: "Dual Engine Failure" [Posts: 270 Pages: 14]

An FCOM available in the net says that the FMC doesn\x92t accept Vr entry lower than Vr min or V1 min.

Think about this accident from 100,000 feet. In other words, DON\x92T think about the specific root cause. We have almost no factual information to ponder at the moment but we can still ask a larger question: How did an experienced crew in a modern aircraft find themselves in a situation from which there apparently was no escape? Given the redundancies, fault tolerances, crew training, and engineering and operational controls present in modern aviation, how could it be that they happily took off in an airplane and flew it into an unsurvivable event just moments later?

This isn\x92t the first one either. On February 9, 2024 a Challenger 600 manuevering to final at Naples FL, (APF) lost both engines simultaneously and crashed on a highway short of the runway. The NTSB final report isn\x92t out yet so we don\x92t know that cause either, but the situation was the same. SOMEhow, a highly experienced crew found themselves in a situation from which there was apparently no escape. Whatever the cause was, how did it go un-detected until it produced an accident? (It\x92s NTSB accident number ERA24FA110. You can find that thread on PPRUNE by searching on Challenger 600. The preliminary NTSB report contains interesting readouts from the FDR. Yes, they lost both fans simultaneously.) I\x92m not suggesting these two accidents have related causes, I\x92m only observing that both crews apparently had no way out.

I\x92m asking, \x93Whatever the flaw was that initiated these events, how did it remain un-known *until* it produced an accident?\x94 We test and re-test modern aircraft for every imaginable failure mode during the design, certification, and production process. We train and re-train techs, mechanics, flight crew, and everybody else that touches the airplane to be sure a high level of performance and safety is not compromised. Think bigger. Think about \x93the system\x94 as a whole. Apparently the system missed something. What are we not seeing?

My condolences to all who were lost. Please keep in mind that except by the grace of God it could have been any one of us on that terrible day.

NASA retired, licensed since 1971.

I still consider the forward truck tilt is a massive clue to a C system Hydraulic failure prior to wheels-up, which must have been caused by loss of electrics (since C is solely electrically powered), so I am still wondering if hydraulic failure happened before or after the loss of thrust.

While thinking about the consequences of a total hydraulics failure around time of rotation (caused by a suspected dual engine failure), here is a new observation. I searched the previous threads to see if anyone lese had noticed it.





In the rooftop video, as it's just approaching the treeline, there are spoiler deflections visible just behind the engines on each wing.

With a total hydraulics failure, the pilots control column using direct wiring, will only control this spoiler pair and the stabiliser. The RAT does not control this spoiler pair (hydraulically), only the most inboard spoilers pair. Its an interesting observation because it means this spoiler pair were being deflected electrically, either by the battery or RAT. But if the RAT provides emergency C hydraulic power why didn't the RAT powered spoilers deflect instead? Does this mean the RAT was unable to provide emergency hydraulic at such low airspeed?

I think this also re-affirms the critical loss of power (dual engine failure), and rules out many other theories. It tragically lost all power, both engines, all hydraulics and electrics (apart from battery and RAT).

I am wondering if anyone else has noticed other flight control deflections?

(Tried posting link to youtube but unhelpfully frames entire video)

Water was mentioned earlier in the previous iteration of this thread, as I recall by one of the most well respected contributors on the forum and an expert in flight testing and certification issues. There have been a couple of well known incidents of flight deck screens going blank due to all sorts of electrical problems caused by water ingress into the E&E bay, fortunately in daytime vmc and not on particularly electric jets, and both I believe at rotation. The one I recall had it’s L1 door left open during a black rainstorm in Hong Kong. It’s also been said that total electrical failure can’t result in in a double engine failure on the 787, but I wonder what multiple sequelae could result from such water contamination with an aeroplane that relies so much on electrical power and software? Another very remote probability but many accidents and incidents are. I don’t even know if there was any inclement weather before this flight, maybe someone could confirm?

Just looked…..none by the looks of things so skip that theory, apologies.

I didn't read that thread, but having flown the aircraft (challenger 600 type), I believe the consensus is that the Captain reaching underneath the thrust levers to actuate the flaps can (and has) resulted in the "triggers" on the back of the thrust levers being engaged- if this is done while the FO is bringing the thrust to idle, it can result in going below the idle stop to cutoff. In other words, the engines were inadvertently shut down.

But I agree that the complete, simultaneous loss of thrust on both engines has to be an astronomical probability, and the cause is going to be interesting to say the least.

I also agree that any one of us could be put in a horrible position within seconds that would be very hard to recover from- the older I get and the more hours I spend in the air, this starts to spend more time in one's consciousness, unfortunately.

BTW calling the crew " highly experienced" is a bit of a stretch IMO, the Captain certainly was, but 1100 hours isn't even enough for an ATP in most countries. For all we know it was not a factor, of course.

PS, what is an SLF??

The 787-8 landing gear retraction is primarily hydraulic, using the center hydraulic system for the main operation. However, the alternate gear extension system utilizes a dedicated electric pump to pressurize fluid from the center hydraulic system for gear extension. Obviously due its size and weight and staged retraction, the effort required to raise and stow the gear greatly exceeds that required for extension.

The main gear retraction/extension is controlled by the center hydraulic system.

It is apparent that the hydraulics failed when the engines shut down after breaking the down-locks and leaving the Main Landing gear bogeys in the tilt position, ready for a next step internal stowage and door closure (that was now never to happen). It is therefore apparent that the dual engine failure and consequent automated RAT extension was precipitated by this gear selection or retraction cycle and thus likely to be either WoW micro-switch or 5G Radar altimeter-effect associated. Due to accumulator depletion, the electric pump load would have spiked to replenish it. This may have precipitated the dual engine shutdown due to an unfiltered electrical surge affecting the Ground/Air microswitches (or a local 5G transmission affecting the RADALT) and resetting the TCMA.

The RADALT? Another plausibility? Because of the furore over a spasticated frequency allocation by the US FCC, the US FAA had finally “bought in” and declared that individual nations and their airline operators were responsible for their own 5G frequency spectrum allocations and for taking essential steps to ensure mitigation of the interference effects upon aircraft automated landings and other critical systems caused by their own national approved 5G spectrum decisions. It was admittedly a situation calling for extensive modifications to (and shielding for) the three radar altimeters fitted for redundancy considerations to all modern airliners... for Category 3 ILS approach and landing in zero/zero visibility conditions. The RADALT also features in many air-ground sensing applications. (eg the 747-8).

This was an unusual FAA “passing of the buck” to manufacturers such as Honeywell etc. (to sort out with client operators). But then again, it was not the US FCC’s right to dictate the specific 5G frequencies internationally. These spectrum allocations now vary over the wide selection of 5G phones available (and also nationally). 5G Radar Altimeters constitute a part of the ground/Air sensing that changes the TCMA from ground mode (able to fuel-chop engines) to the air mode (inhibited from doing so)... Ground activation is acceptable ...where fuel chopping of uncommanded thrust can prevent runway sideways excursions or runway length overruns. The question now becomes: “Is it more (or less) safe having an automated fuel-chopping capability on BOTH your left and right, rather than leaving it to the pilot to react via his center console fuel cut-off switches... in the unlikely event of a runaway engine after landing (or during an abandoned take-off)?

5G Frequency Variations

The frequencies of 5G phones vary nationally based on the frequency bands allocated and used by different carriers in each country. In the United States, for example, carriers such as AT&T, Verizon, T-Mobile, and others use a combination of low-band, mid-band, and high-band 5G frequencies. Low-band 5G frequencies typically range from 600 MHz to 1 GHz, mid-band 5G frequencies range from 1.7 GHz to 2.5 GHz, and high-band 5G (mmWave) frequencies start at 24 GHz and go up to 40 GHz . These frequencies are allocated by regulatory bodies such as the Federal Communications Commission (FCC) and can vary between countries based on spectrum availability and regulatory decisions. In other countries, the specific frequency bands used for 5G may differ, leading to variations in the frequencies supported by 5G phones. Additionally, the deployment of 5G networks can also influence the frequencies used, with some countries focusing more on sub-6 GHz bands while others prioritize mmWave technology.

5G interference? It may be an avenue worth exploring?

Very subjective, and I agree it it could look like a slotted gap between the wing and flaps, except the shadow is confined to exactly where that spoiler pair is located. You don't see it where the rest of the flap is. It would be good to hear other opinions about what we are seeing here . Is it wing, flap, gap or spoilers?


I don't understand your point here. The RAT hydraulic powers very specific flight controls like the stab, rudder, outboard ailerons and one specific pair of spoilers - the inboard most spoilers. Have a look at this schematic (at 3:55) youtu.be/DFbOLNduutI?si=siPnQ9oHMbLgp64K&t=235 (not publishing link as it fills the frame). The spoiler pair I mentioned above (visible in the video) are only powered by L hydraulics and electrical. Assuming L hydraulics was lost by dual engine failure, then this spoiler pair can only have been electrically powered...hence the conclusion it's either powered electrically by the Battery or electrically powered by the RAT. That spoiler pair is not connected to the RAT hydraulics.

I thought this was a very good point. There are some detailed posts discussing the TCMA patent including this post . Is it possible the TCMA software functioned exactly as specified, and the issue is input data into TCMA?

In a total electrical failure, when the system switches to emergency battery power, how are input variables like rad alt and wow switches processed? (these were inputs someone mentioned on the 747-8, have the TCMA inputs been identified yet?)

I speculate the gear truck forward tilt is a symptom of a C hydraulic failure caused by a total electrical failure around the time of VR. Once they got 10 deg nose up on the rotation, with a total electrical failure, could the FADEC receive erroneous rad alt or wow inputs, and how would TCMA handle these inputs in the transition from ground to air logic?

What is baffling is the simultaneous nature of the suspected dual engine shutdown. There is no obvious asymmetry, with the flight path or rudder movements. If the engine fuel control switches had been manually cut one at a time, there should have been some visible flightpath change or flight control response. Something happened to both engines at exactly the same time.

Software Engineer here. IMO software glitches are more likely than mechanical failures and pilot error, and I would say increasingly more so, particularly with Boeings. I have good reasons, experience and expertise for saying this that I\x92m not going to get into here because it\x92s too long winded and will no doubt upset some people who will mistake facts for rule and let it hurt their feelings.

In 2019 I think it was, an ANA 787 had a TMCA dual engine shutdown just after landing. There was also a bug that shut down all AC power on 787s powered on for 248+ days (integer overflow causing GCU failsafe) that was supposed to be remedied on 2019. Can\x92t find any information confirming that it was implemented on all 787s. These are just two examples of software bugs. There are placed of others, and it\x92s highly likely there are ones we don\x92t know about, either in the original software or in the updates.

In software terms, they've reused an existing function to action new functionality. Raises a couple of questions: how many other functions make use of the same N2 overspeed protection functionality; what else could cause N2 overspeed, especially on two engines simultaneously, given the outcome? (Ignoring the software maintenance problems that such secondary purposing can cause later down the road.)

I read, maybe in the preceding thread, a post from a (?) chemical additive manufacturing specialist, referring to n2 speed problems caused by one of their additives incorrectly getting to a bearing (?) and creating a metallic oxide powder and subsequent issues. (Details vague as I can't find the original post - different problem domain to this though). Are there engine lubrication maintenance tasks in a roughly 2 hour turnaround?

Long time lurker, ex aerospace engineering design software engineer. Please delete if inappropriate.

[Edit: spoilling]

The bug shutting all power off after 248 continuous powered days would not have shut down running engines if my understanding is correct. The FADEC\x92s are self powered and would continue to operate as discussed in other posts.

To continue with some more speculation (hopefully not idle!) one of the areas I haven\x92t seen much discussion on is maintenance errors. Clearly all aircraft are under a continuous regime of maintenance, whether scheduled or unplanned. In my time long ago we had many specialist technicians on hand to deal with most eventualities, time was always of the essence, but there was a strict process of checking and sign-offs for every bit of technical work carried out. OK, it was the military, but I can\x92t imagine it\x92s much different today in the civil world.

But of course mistakes happen occasionally, leading generally to nothing worse than a cancelled sortie, or less commonly for the aircraft\x92s built-in redundant systems to \x91kick in\x92 or be switched in. On the ground the fault might be on the MEL, in the air a diversion might be necessary. And this was decades ago. What I\x92m leading to is this; on an ultra modern commercial airliner such as the 787, what possible maintenance error could cause such a catastrophic event as happened to AI 171?

We understand the right engine was replaced 3 months ago, and doubtless there have been other regular, routine activities necessitating disturbance of engine, avionic and other systems. One could imagine perhaps an electronic piece of equipment (we called them LRUs) not being fully located in its housing, ditto for plugs and connectors, and such equipment apparently working correctly at the time but failing at a later time. There are anecdotal stories of AirIndia 171 on earlier flights having air conditioning and in-flight entertainment issues. And we don\x92t know what, if any, maintenance/repairs were done immediately before the last flight.

But isn\x92t all this irrelevant, given that, we are told, the 2 engines and controls are uniquely independent of each other and will continue to work in the presence of aircraft major electrical and hydraulic system failures?

In summary, and assuming accidental rather than deliberate, there seems to be no way that double engine failure could result from maintenance error?

Hi all,

Sorry it’s going to be a long one but seeing the level of competency here, I though it would be the perfect place to get my answers. From the precious messages read and answers received, I have a scenario to run. I am more than happy to be told wrong from point 1). I don’t have the knowledge some of you do.

Please let me first start by saying that I am not trying to incriminate anyone. Hundreds of CRMS debriefs and accidents reports show us that unfortunately sometimes, the holes in that swiss cheese just do line up. It is far too easy for any of us, seating here, to judge any of the sequences happening in a Flight Deck. Mistakes happen, regardless of training and experience. We all do mistakes, every day, in every line of work.

DISCLAIMER:
I know that the consensus is a dual engine failure due to either TCMA bug or any sort of mecanical/software/wear and tear.
I do hear a RAT (I don’t see it though) and I do find the audio analysis quite compelling. It is at the top of my list as probable cause.
I am just exploring another scenario, based on the AC’s profile and state from grainy video and poor audio.

1- Let’s assume that we do all our perf calculation correctly. Is it possible that the OPT would spit up a F15/20 take off with the conditions on the day on a 787?
2- If so, let’s say we have performances for a F15/20 TO in the FMC. Now let’s assume we select F5 for TO (not in the FMC, physically). Would there be an FMC message, or would that trigger the T/O warning on the 787? If it doesn’t, we now potentially have an aircraft on the heavy side, with already a lift penalty on a high density altitude day.
3- Please bear with me, I know so far I have made an awful lot of suppositions and assumptions. Murphy’s law dictates that what can happen will happen albeit not on the same day. As it was answered to me by someone who was obviously seeing where I was going in a previous post, it’s a lot of swiss cheese to line up.
4- Take off roll goes on, Vr F15/20 comes and we rotate at a speed lower than we should for our actual F5 setting. My buddy calls for GEAR UP, I retract flaps to F1. Another lift penalty. Is there enough thrust now, or are we then already to deep on the back end of the drag curve ?

I do understand that this is not testable in a simulator. I am asking if someone with a 787 OPT and/or FCOM and knowledge views this scenario as possible or not (especially regarding the FMC message and the T/O warning). That is all.
thanks for the help !

DISCLAIMER: Poster (a) is one of the (apparently quite numerous) lawyers following this thread; (b) a long-time forum lurker and aviation enthusiast who loves studying FCOMs for fun (to each his own, I guess); (c) has followed and read this thread from the start.

What I cannot do is add new theories or uncover any new facts the actual experts have not already thought of. However, since summarizing and structuring information is one thing lawyers tend to regularly do (and sometimes even do well), here is my attempt at a useful contribution to this thread: an attempt to summarize the main theories discussed here since day one (which I think hasn't been done for quite some time) in the hope that a birds-eye view will be helpful to those who have not read everything since the beginning or might even trigger some new flash of inspiration for someone more knowledgable than me. I have focused on the cons since there does not seem to be enough evidence to come to any positive conclusion.

I shall try to be concise and to refrain from personal evaluations of my own. Of course, no disrespect whatsoever is intended towards all those who have contributed to this thread and to the individual theories, one or combinations of which may turn out to have led to this tragic outcome. That arguments can be made against every single theory that has been propagated seems to be the result of the highly improbable and unusual nature of this deplorable event and certainly not due to any lack of knowledge or reasoning skills in this forum.

DEAR MODS: If I have distorted anything or if, meaning well, should have achieved the opposite \x96 I guess you know where the delete button is\x85

Anyway, here goes:

A. Misconfiguration or wrong takeoff data
Widely refuted, since

• rotation, takeoff and initial climb seem normal;
• likely extreme errors would have been required to have such tragic effect (the fuel tanks should have been only about half full, so not close to MTOW);
• there is strong evidence that at least some flaps were extended for takeoff (post-crash photo, perhaps also visible in video from behind)

B. Flaps retracted post-takeoff instead of gear
Still brought up from time to time. However, widely disregarded due to

• the fact that with two working engines an inadvertent flap retraction should easily be recoverable, even with gear down;
• strong indications that hydraulic and electric power were lost (audible/visible indications of RAT extension, survivor statement, lack of engine noise, position of MLG bogies).

For a while, the forward tilt of the bogies as first part of the retraction cycle was seen as additional evidence that the gear had been selected up. However, it has been pointed out that the forward tilt and the opening of the gear doors occur almost simultaneously so that it seems unlikely that hydraulic power was lost in the split second between bogie tilt and gear door actuation. It is now assumed the forward tilt of the bogies was merely a consequence of the hydraulic power loss.
It should be pointed out that the question of "RAT in or out" was for a while the most contentious in this thread.

C. Low-altitude capture
Still argued, even if refuted by many since

• inconsistent with apparent loss of hydraulic/electric power;
• PF would have been flying manually (however, A/T reaction would have been unexpected for the PF);
• should have been recoverable (unless one assumes that the crew (a) remained unaware of the changed FMA annunciations although alerted by the unexpected FD commands; and (b) was so startled that an A/T thrust reduction was not noticed and corrected, even though the PF was apparently sufficiently alert not to follow the FD commands).

D. Loss of both engines at or shortly after rotation
Various possible reasons for this have been discussed:

I. Bird strike/FOD

• Would have to have occurred simultaneously due to lack of rudder/aileron input indicating symmetric thrust.
• No remains/traces on runway, no visual indications (flocks of birds, flames, structural engine damage).

II. Fuel-related III. Improper maintenance
Unclear which maintenance measures could possibly have been performed that would have resulted in simultaneous loss of both engines. No apparent relationships between malfunctions reported by previous passengers and essential systems.

IV. Large-scale electrical fault (e.g. due to water in E&E bay)
The engines will continue to run if electrical power is lost. FADECs are powered independently.

V. Shutdown of engines by TCMA
A parallel is drawn to the ANA incident. However, this would require not only a fault in the air/ground logic but also a sensed discrepancy between T/L position (not necessarily idle) and thrust output on both engines simultaneously.

VI. (Inadvertent) shutdown by flight crew VII. Malfunction/mishandling of the fuel cutoff switches (most recent)

A good round-up of dominant themes, including this:

You may be at risk of assuming that the air/ground control logic is in some way hard-wired, as opposed to being a function of software. I don't believe we (yet) know this to be true.

We know there has been a bug in the Generator Control Unit software (an overflowing counter) that could lead to simultaneous shut down of all generators and a total loss of all AC power (the 248 days bug).

In the interests of completeness, we should perhaps also consider the possibility of some other previously-unknown software issue capable of creating an uncommanded dual engine shutdown. TCMS is the most likely candidate due to the deliberate separation of other systems from being able to achieve this outcome. The question then isn't whether there's some odd combination of input faults that would confuse TCMS into believing it were on the ground, but rather whether there's any way in which the software side could crash in such a way as to create an anomalous state within the system leading to engine failure. For instance, another overlooked software counter with an unwelcome failure mode.

Or even just a "dirty power supply" (cf all the reports of dodgy passenger-side electrics on this a/c) leading to spurious inputs and unexpected consequences.

Whatever is the cause will likely turn out to be have been a very low-probability event. But unless we have a TCMS expert who can state canonically that (say) the WoW sensor electrically disables TCMS when airborne (as opposed to merely being an input to the TCMS logic) then we cannot say with certainty that multiple inputs would have to have failed / been corrupted in order to reach the end state of this flight.

User989 thanks for a nice summary
I am at risk of turning into one of those folks who gets their mind locked on one possibility and keeps banging on about it but here goes;
If the authorities determined that the accident aircraft had been treated by maintenance for microbial growth in the fuel tanks within the last week or so, and they suspected that that procedure was carried out in a way that could result in fuel contamination, then that would explain

1/ No other aircraft being affected
2/ No measures taken at the airport
3/ No AD’s from the regulators
4/ No grounding of 787’s
5/ Flight profile
6/ Rat deployment etc etc

I agree with your statement that dual flameout due fuel contamination is very unlikely, but we ARE dealing with something that is very unlikely. I favour the theory because an error in treating the fuel is so predictably human and simple, and a dual engine failure being related to fuel is also a simple and obvious idea, and it satisfies all we know both about the aircraft’s behaviour, and the authorities behaviour post accident.
I posted a report earlier of a 787-8 powered by the same engine type have both engines roll back sub-idle within a minute of each other while airborne due to this, so we know it can happen in theory.

Now……I want to be clear that I’m not saying I think I know what happened, I’m an average Joe with my hands full just flying the line, but I am a bit surprised that the idea of ‘fuel contamination specific to that airframe’ doesn’t get discussed more on this thread.
Thanks again for the clear summary of discussion thus far.

TCMA is simply a bit of software in the FADECs, so it has the same separation as everything else. There's no inter-engine interaction when it comes to TCMA.

This is technically possible, but of course the FADECs would have the ability to shut down the engines anyway, even if TCMA didn't exist. If there's a software bug, it could involve TCMA but it could easily be somewhere else.

Like I mentioned above, there's no communication between engines wrt TCMA. Therefore a software bug is plausible, but any kind of transient hardware malfunction can be essentially ruled out.

TCMA can't be disabled electrically. It's just software, and all of the hardware involved serves other functions which are still needed while in the air. For example, the FADECs would command the HPSOV closed in case of N2 overspeed. That would have the exact same effect as TCMA.

Fuel guy here. I've been "sitting on my hands" as requested by the mods but I will bite on that. Because dual engine failure is a "common mode fault" contamination is one of simplest explanations. Forget wax, think sediment, water or misfuelling. The only reason this has been discounted in favour of an electromechanical/software fault is that there is no yaw, i.e. both engines ran down at the same time at more or less the same rate, and would have to have been fed from the same tank (so the contaminated fuel reaches the engines at EXACTLY the same time on each side - is that even possible?). Its a stretch but I suppose it is possible, however the retention samples should have been tested by now. I would be interested in confirmation that they were taken and tested. I would also want to know if there is a "hot hydrant" system at AMD or if there are bowsers and if any maintenance had been done (think Cathay at Surabaya). But honestly, the fuel supply chain is usually rigorous...[edit: I have just seen a Reddit post pointing to a major construction project involving the fuelling facilities at Ahmedabad...will try to find out more...]

It has been a week, and the recorders were recovered within two days. Contamination would have been found and almost certainly made public by now. A government statement yesterday asked people not to speculate on sensitive matters and whatever it was appears to need more time and deeper investigation. I am old and patient, so I have no problem with shut up and wait.