Posts about: "Engine Shutdown" [Posts: 132 Pages: 7]

Originally Posted by tdracer

OK, another hour spent going through all the posts since I was on last night...
I won't quote the relevant posts as they go back ~15 pages, but a few more comments:

TAT errors affecting N1 power set: The FADEC logic (BTW, this is pretty much common on all Boeing FADEC) will use aircraft TAT if it agrees with the dedicated engine inlet temp probe - but if they differ it will use the engine probe . The GE inlet temp probe is relatively simple and unheated, so (unlike a heated probe) a blocked or contaminated probe will still read accurately - just with greater 'lag' to actual temperature changes.

TCMA - first off, I have to admit that this does look rather like an improper TCMA activation, but that is very, very unlikely. For those who don't know, TCMA is a system to shutdown a runaway engine that's not responding to the thrust lever - basic logic is an engine at high power with the thrust lever at/near idle, and the engine not decelerating. However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.

Fuel contamination/filter blockage: The fuel filters have a bypass - if the delta P across the filter becomes excessive, the filter bypasses and provides the contaminated fuel to the engine. Now this contaminated fuel could easy foul up the fuel metering unit causing a flameout, but to happen to two engines at virtually the same time would be tremendous unlikely.

Auto Thrust thrust lever retard - the TO lockup in the logic makes this very unlikely (it won't unlock below (IIRC) 400 ft., and even that requires a separate pilot action such as a mode select change or thrust lever movement). And if it did somehow happen, all the pilot needs to do is push the levers back up.

Engine parameters on the FDR: I don't know what exactly is on the 787 FDR with regards to engine parameters, but rest assured that there is plenty of engine data that gets recorded - most at one/second. Getting the FDR readout from a modern FDR is almost an embarrassment of riches. Assuming the data is intact, we'll soon have a very good idea of what the engines were doing

Originally Posted by Turkey Brain

At this stage, at least two scenarios seem highly plausible:

1. Technical issue

Airliners rely on air/ground logic , which is fundamental to how systems operate.

There have been numerous crashes and serious incidents linked to this logic functioning incorrectly.

Some engineering tests require the air/ground switch to be set in a particular mode. If it's inadvertently left in engineering mode—or if the system misinterprets the mode—this can cause significant problems.

• On the ground , if the aircraft is incorrectly in air mode , some systems may be unavailable—such as wheel brakes, reverse thrust, or ground spoilers.
  
• In the air , if the aircraft is mistakenly in ground mode , flaps might auto-retract, and various layers of system protection may be disabled.
  

In the case of the ANA 787, it appears the engine shutdown occurred during the landing roll, possibly when the TCMA system activated.

2. Pilot misselection of fuel control switches to cutoff

This is still a very real possibility. If it occurred, the pilot responsible may not have done it consciously—his mindset could have been in a different mode.

There’s precedent: an A320 pilot once inadvertently shut down both engines over Paris. Fortunately, the crew managed to restart them. Afterward, the pilot reportedly couldn’t explain his actions.

If something similar happened here, then when the pilots realized the engines had stopped producing thrust, pushing the levers forward would have had no effect. It’s easy to overlook that the fuel switches are in the wrong position—they're far from the normal scan pattern. And with the ground rushing up, the view outside would’ve been far more commanding.

Speaking personally, when I shut down engines at the end of a flight, I consciously force myself to operate each fuel switch independently and with full attention. I avoid building muscle memory that might lead to switching off both engines in a fast, well-practiced habit.

If this is a technical issue, I assume we’ll know soon enough.

Originally Posted by neila83

Yes indeed, the moment they pulled the gear lever, as we see the gear begin the retraction process, and then suddenly stop. Almost as if they suddenly lost power.

We can see the landing gear retraction process begin. We see the bogies tilted in the second video. We can hear the RAT. We can see the RAT. We can see the flaps extended in the video and at the crash site. There isn't actually a single piece of evidence the flaps were raised, it's just a conclusion people jumped too before evidence began to emerge.

The crazy thing is, when the report comes out and there is no mention of flaps none of the people who have been pushing the flap theory will self reflect or learn anything. They'll think those of us who didn't buy into it were just lucky, rather than it being down to use of fairly simple critical thinking.

Originally Posted by Right Way Up

I think you need to temper your tone This is a discussion about possibilities and quite honestly nothing would surprise me. There is no "winning" result here. Just hopefully answers which will help safety in the future.

Originally Posted by Magplug

Speaking as a B787 Captain..... There is so much rubbish and stupid suggestion being written here.

This aircraft was airborne for a grand total of 22 seconds, half of which was climbing to no more than 150' aal.

- No Flaps? Due to the setup of the ECL it is physically impossible to go down the runway without some sort of take-off flap set. The T/o config warning would have been singing it's head off. Despite assertions to the contrary I have seen no video clear enough to detect a lack of flaps.

- RAT out? Almost impossible, I have seen no quality footage that definitively witnesses the RAT being out. Those who think they car hear a RAT type noise might be listening to a motorcycle passing or similar. It takes a triple hydraulic failure or a double engine failure to trigger RAT deploment. They happily went through V1 without a hint of rejected take off so as they rotated the aircraft was serviceable. These are big engines, they take a long time to wind down when you shut them down. I have never tried it however engine failure detection takes 30s or for the aircraft to react and they were not even airborne that long.
- Flaps up instead of gear? The B787 flaps are slow both in and out. Given that the 'Positive rate' call is not made the second the wheels leave the ground, a mis-selection of flaps up would not cause any loss of lift for at least 20 seconds, by which time they had already crashed. I believe the gear remained down not because of mis-selection but because of a major distraction on rotate.

Discounting the impossible, two hypotheses remain:

1. Invalid derate set through incorrect cross-checking. Trundling down the runway takes very little power to reach Vr. It is only when you rotate that you create more drag and discover that you do not have sufficient thrust vs. drag to sustain a climb. Or....
2. Put 200' as the altitude target in the FCU. Immediate ALT capture and all the power comes off. PF is still hand flying trying to increase pitch but is already way behind the aircraft.

It could be after this that Boeing are forced to review the B787 practice of exploring the very edges of the performance envelope.

Originally Posted by HumbleDeer

Default setup is left tank left engine, right tank right engine. Each engine also has two redundant pumps feeding it, meaning it can operate fully and normally on one operational engine fuel pump.

Furthermore, the engines cannot run from the center tank. There's no such thing. The center tank transfers to the outer tanks, when necessary or when running low or to resolve imbalances, either automatically or manually initated by the pilot for whatever reason. The engine fuel pumps only ever draw from their respective tank.
It is as thus impossible for the center tank being empty to cause engine shutdown unless the main tanks were also empty, in which case we would: be in a lot of trouble, shouldn't be taking off, and wouldn't have a massive orange fireball.

Originally Posted by HumbleDeer

Default setup is left tank left engine, right tank right engine. Each engine also has two redundant pumps feeding it, meaning it can operate fully and normally on one operational engine fuel pump.

Furthermore, the engines cannot run from the center tank. There's no such thing. The center tank transfers to the outer tanks, when necessary or when running low or to resolve imbalances, either automatically or manually initated by the pilot for whatever reason. The engine fuel pumps only ever draw from their respective tank.
It is as thus impossible for the center tank being empty to cause engine shutdown unless the main tanks were also empty, in which case we would: be in a lot of trouble, shouldn't be taking off, and wouldn't have a massive orange fireball.

Originally Posted by jolihokistix

Trying repeatedly to follow the whole thread plus updates but loading on the iPhone constantly jumps backwards and forwards making it a struggle to cover everything.

Two points which may or may not have relevance. One is just before the final crash, a dark-looking cover(?) flies up into the air. Could this be the first contact with sound that the surviving passenger alleges he heard?

Secondly the cost of aviation fuel seems to be comparatively more expensive in India than either Japan (leg before) or the UK (following leg). Would this effect refuelling procedures within India, supposing a company directive to save when possible?

(Frequent long-haul passenger.)

Originally Posted by bcpr

Ex petroleum lab technician and tank farm sampler here. We would occasionally get fuel samples from crashed aircraft to test for contamination. One test was for water and sediment/microorganism sludge.

In this accident, fuel contamination continues to be dismissed as a cause, because no other aircraft have reported issues. But there has been no discussion regarding the airport's fuel storage, transfer, or filtration systems. Water and sediment naturally settles at the bottom of fuel storage tanks. If this aircraft received fuel drawn from the bottom of a storage tank, in the absence of a proper filtration system, it\x92s possible that it was contaminated. The next aircraft may have received fuel from a different storage tank with good fuel.

Originally Posted by nachtmusak

There are more data messages than that, which FR24 shared on the day of the accident and which have been posted a few times in this thread. I'm pretty sure there's also been a comparison of this + previous flights posted in this thread that shows that while the coverage at the airport itself is spotty, it's reasonable to expect further messages to have been received before impact.

Not sure how permanent the content at this URL is, but here's a link to FR24's update which has a CSV with all frames received https://www.flightradar24.com/blog/f...rom-ahmedabad/

Originally Posted by SpaceQuality

Also a newcomer here, but an experienced private pilot, Software Engineer with a degree in Aerospace Computer Science and former Head of Quality for Satellites and Interplanetary Missions. We have already seen bad software solutions and the results thereof in the 737 MAX accidents, which makes me wonder, if the TCMA can reach a state, where unintended engine shutdown is possible.

There is one system implemented in the 787, that has the authority to shut down the engines, based on software subsystem decision. Interestingly - according to the description in the patent below - the same TCMA software package determines the shutdown decision, in both redundant subsystems.

Excerpt from the Patent:
"Malfunctions in aircraft power plant thrust control systems can result in uncontrollable high engine power levels that are potentially hazardous or catastrophic for aircraft operation. A particularly hazardous situation is when a thrust control system failure results in one of the aircraft's engines continuing to operate at a high power condition and not responding to a throttle command to reduce power during takeoff, approach or landing. Typically, when this failure mode occurs, the actual thrust either increases to a significantly higher than commanded thrust and/or remains at a high level when the thrust levers are set for low thrust....

In one preferred embodiment the present invention is directed to a system and method for detecting and correcting a thrust control malfunction in an aircraft engine. The system includes an electronic engine control (EEC) unit that includes a first processing subsystem and a second processing subsystem, and a thrust control malfunction accommodation (TCMA) circuit included in the first processing subsystem and the second processing subsystem. Additionally, the system includes a TCMA software package executed by the first processing subsystem and the second processing subsystem, thereby providing redundant execution of the TCMA software package.

The method of the present invention compares the engine's actual power level with a threshold contour defined by the TCMA software package. When the TCMA software package determines that a thrust control malfunction has occurred, based on the engine's power level exceeding the threshold contour, the engine is shut down by the TCMA circuit.
The present invention is still further directed to an electronic engine control (EEC) unit configured to detect and correct an aircraft engine thrust control malfunction using an active-active functionality. The EEC includes a first processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs, and a second processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs."

Just my 20 cents

Originally Posted by A320 Glider

Just to confirm.
The 787 is an aircraft which likes to, performance wise, use all of the available runway for takeoff. Sometimes you can be sat in the 787 and as you are rolling down the runway, you start wondering if Rotate has been called or not. It loves taking up all of the runway.

Nevertheless, there are some interesting speculations over on X. One guy even claimed the Captain was in the lavatory during the accident...

Many people have noted what appears to be the RAT deployed in the video footage suggesting dual engine failure. Possible wrong engine shutdown? But who diagnoses and actions an engine failure and shutdown below 400ft?

Originally Posted by wokawoka

777 Driver for a legacy here.

This is a 10 hr ish sector. Would there not be a 3rd crew on this? There definitely is in my outfit for that length.

I was of the belief of flap mis-selection as I have seen in the past. However, with video fly past noise, the sound spectral analysis, I am happy to be convinced that the RAT was out.

There are only a few scenarios where this happens - electrical malfunction would not cause the engine to shutdown. However the engines shutting down would cause the electric malfucntion depowering the BUS' which activates the RAT. This is a billion to one chance. Can't see it happening.

Originally Posted by cncpc

Gear pins?

Originally Posted by Mr Optimistic

From tdracer
However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.

Originally Posted by SpaceQuality

Also a newcomer here, but an experienced private pilot, Software Engineer with a degree in Aerospace Computer Science and former Head of Quality for Satellites and Interplanetary Missions. We have already seen bad software solutions and the results thereof in the 737 MAX accidents, which makes me wonder, if the TCMA can reach a state, where unintended engine shutdown is possible.

There is one system implemented in the 787, that has the authority to shut down the engines, based on software subsystem decision. Interestingly - according to the description in the patent below - the same TCMA software package determines the shutdown decision, in both redundant subsystems.

Excerpt from the Patent:
"Malfunctions in aircraft power plant thrust control systems can result in uncontrollable high engine power levels that are potentially hazardous or catastrophic for aircraft operation. A particularly hazardous situation is when a thrust control system failure results in one of the aircraft's engines continuing to operate at a high power condition and not responding to a throttle command to reduce power during takeoff, approach or landing. Typically, when this failure mode occurs, the actual thrust either increases to a significantly higher than commanded thrust and/or remains at a high level when the thrust levers are set for low thrust....

In one preferred embodiment the present invention is directed to a system and method for detecting and correcting a thrust control malfunction in an aircraft engine. The system includes an electronic engine control (EEC) unit that includes a first processing subsystem and a second processing subsystem, and a thrust control malfunction accommodation (TCMA) circuit included in the first processing subsystem and the second processing subsystem. Additionally, the system includes a TCMA software package executed by the first processing subsystem and the second processing subsystem, thereby providing redundant execution of the TCMA software package.

The method of the present invention compares the engine's actual power level with a threshold contour defined by the TCMA software package. When the TCMA software package determines that a thrust control malfunction has occurred, based on the engine's power level exceeding the threshold contour, the engine is shut down by the TCMA circuit.
The present invention is still further directed to an electronic engine control (EEC) unit configured to detect and correct an aircraft engine thrust control malfunction using an active-active functionality. The EEC includes a first processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs, and a second processing subsystem for unilaterally monitoring engine operation and shutting down the engine when a thrust control malfunction occurs."

Just my 20 cents

Originally Posted by Icarus2001

A thrust reduction is not an engine failure. Engine shutdown due to an action of crew (or inaction) is not a failure.

There is no evidence of an electrical failure. What evidence? A surviving passenger thought he saw flickering lights? Give me a break.

The word evidence in English has a very specific meaning.

Look for the simplest explanation here and then ask why the worldwide B787 fleet is still flying with no urgent inspection requirements from Boeing or GE. Think about that "evidence".

Originally Posted by Icarus2001

Brilliant, now what is your point? Are you suggesting a double engine failure, a roll back to idle thrust or an incorrectly set AAI causing VNAV level off and a thrust reduction. You can only choose one.

For the team pointing to the RAT out as a failure indicator, it could have been deployed by the crew after the initial reduction in climb performance. I am not convinced it is deployed but it really does not make a convincing argument for any type of failure.

For the children on holiday, yes I fly transport category jets, current on two types.
​​​​​​​

Originally Posted by Icarus2001

Assuming GE receive data from these engines in flight, a massive failure would prompt a swift communication from GE. Or a massive electrical issue could put Boeing on edge and also prompt urgent inspections on their aircraft.