Posts about: "Engine Shutdown" [Posts: 105 Pages: 6]

There has been a lot of discussion of the possibility that the crew shut down the wrong engine or misidentified some other problem as an engine failure, usually followed by an assertion that nobody would touch the engines before x feet. PPRuNe's own survey, at the top of this very subforum, found a really high base rate of wrong engine incidents:

• 31 per cent of the PPRuNe Population reported either having a wrong-engine incident or a close call
• 61 per cent reported witnessing one

This might be biased upwards by people who have had the experience being more likely to engage with a thread about it and to respond to the survey, although on the other hand the difference between self-reported errors and witnessed ones shows there's also some bias to under-reporting. In the light of those observations you should surely have quite a strong prior that an erroneous engine shutdown is possible.

Also, on the point about sitting on your hands to 400/1000 feet AAL, someone who has already deviated from a standard operating procedure is more likely to go on to make another mistake; that is why the procedure existed in the first place.

As a memo item, here are the survey results:

Q1. Have you ever shut off the wrong engine in the sim?
Yes: 5.4% +0.9%
No: 94.6% -0.9%

Q2. Have you ever ALMOST shut off the wrong engine in the sim?
Yes: 26% -1.0%
No: 74% +1.0%

Q3. Have you ever witnessed a colleague shut off the wrong engine in the sim?
Yes: 16% +1.0%
No: 84% -1.0%

Q4. Have you ever witnessed a colleague ALMOST shut off the wrong engine in the sim?
Yes: 45% +2.0%
No: 55% -2.0%

Link to original post

Senior Pilot

Lead Balloon:

The requirement for TCMA may have been specified by Boeing, but that doesn' t tell us who designed and built the solution in this case, though it must have been a collaborative effort between the two parties. Anyway, TCMA may be a red herring, since we still have not defined what, if any, other sources would have authority to issue an engine shutdown command

The "requirement" for TCMA was "specified" by the FAA. Manufacturers seeking certification of aeronautical products subject to the requirements then had no choice but to design and instal systems that met the FAA's certification requirements.

I'm pretty sure it's clear what "sources", other than TCMA systems if any, have "authority to issue an engine shutdown command", though it does depend on what you mean by "engine shutdown".

Lead Balloon:



“The "requirement" for TCMA was "specified" by the FAA. Manufacturers seeking certification of aeronautical products subject to the requirements then had no choice but to design and instal systems that met the FAA's certification requirements”.

I think that has already been established upthread.


“I'm pretty sure it's clear what "sources", other than TCMA systems if any, have "authority to issue an engine shutdown command", though it does depend on what you mean by "engine shutdown".”

I don’t think that is clear at all. The shutdown hypothesis, if true, both engines, makes it likely that they were commanded to do so. While the discussion has centered around the TCMA subsystem, if other subsystems have the ability to do that, they need to be defined and looked at as well.

There\x92s at least N2 overspeed protection that actually uses the same hardware as TCMA to stop the noise. There might exists crosstalk and inhibit for the N2 overspeed protection if the N2 overspeed protection has shut down the other engine. In fact it\x92s not confirmed that no such crosstalk exists in 787 TCMA system. It would complie with \x94no single fault should cause\x85\x94 certification requirements. Other than that I see no practical difference in the propability of TCMA and N2 overspeed protection to shut down both engine during take-off.

A better question would related to this accident would be have you ever shut down the wrong engine below 200 feet AGL in the sim. I strongly suspect the answer would be zero percent.

I need to correct one of my previous posts, I was going down the path of a mismanaged engine failure after V1, however it's been demonstrated to me that this aircraft will fly away on one engine even with the gear down with better than minimum climb gradient requirement. Quite astonishing actually.
That just leaves deliberate act not necessarily intentional, fuel vapour lock and automatically commanded engine shutdown.
I hope the rat is found soon so we know for sure if both engines were in fact lost.

The 787-8 landing gear retraction is primarily hydraulic, using the center hydraulic system for the main operation. However, the alternate gear extension system utilizes a dedicated electric pump to pressurize fluid from the center hydraulic system for gear extension. Obviously due its size and weight and staged retraction, the effort required to raise and stow the gear greatly exceeds that required for extension.

The main gear retraction/extension is controlled by the center hydraulic system.

It is apparent that the hydraulics failed when the engines shut down after breaking the down-locks and leaving the Main Landing gear bogeys in the tilt position, ready for a next step internal stowage and door closure (that was now never to happen). It is therefore apparent that the dual engine failure and consequent automated RAT extension was precipitated by this gear selection or retraction cycle and thus likely to be either WoW micro-switch or 5G Radar altimeter-effect associated. Due to accumulator depletion, the electric pump load would have spiked to replenish it. This may have precipitated the dual engine shutdown due to an unfiltered electrical surge affecting the Ground/Air microswitches (or a local 5G transmission affecting the RADALT) and resetting the TCMA.

The RADALT? Another plausibility? Because of the furore over a spasticated frequency allocation by the US FCC, the US FAA had finally “bought in” and declared that individual nations and their airline operators were responsible for their own 5G frequency spectrum allocations and for taking essential steps to ensure mitigation of the interference effects upon aircraft automated landings and other critical systems caused by their own national approved 5G spectrum decisions. It was admittedly a situation calling for extensive modifications to (and shielding for) the three radar altimeters fitted for redundancy considerations to all modern airliners... for Category 3 ILS approach and landing in zero/zero visibility conditions. The RADALT also features in many air-ground sensing applications. (eg the 747-8).

This was an unusual FAA “passing of the buck” to manufacturers such as Honeywell etc. (to sort out with client operators). But then again, it was not the US FCC’s right to dictate the specific 5G frequencies internationally. These spectrum allocations now vary over the wide selection of 5G phones available (and also nationally). 5G Radar Altimeters constitute a part of the ground/Air sensing that changes the TCMA from ground mode (able to fuel-chop engines) to the air mode (inhibited from doing so)... Ground activation is acceptable ...where fuel chopping of uncommanded thrust can prevent runway sideways excursions or runway length overruns. The question now becomes: “Is it more (or less) safe having an automated fuel-chopping capability on BOTH your left and right, rather than leaving it to the pilot to react via his center console fuel cut-off switches... in the unlikely event of a runaway engine after landing (or during an abandoned take-off)?

5G Frequency Variations

The frequencies of 5G phones vary nationally based on the frequency bands allocated and used by different carriers in each country. In the United States, for example, carriers such as AT&T, Verizon, T-Mobile, and others use a combination of low-band, mid-band, and high-band 5G frequencies. Low-band 5G frequencies typically range from 600 MHz to 1 GHz, mid-band 5G frequencies range from 1.7 GHz to 2.5 GHz, and high-band 5G (mmWave) frequencies start at 24 GHz and go up to 40 GHz . These frequencies are allocated by regulatory bodies such as the Federal Communications Commission (FCC) and can vary between countries based on spectrum availability and regulatory decisions. In other countries, the specific frequency bands used for 5G may differ, leading to variations in the frequencies supported by 5G phones. Additionally, the deployment of 5G networks can also influence the frequencies used, with some countries focusing more on sub-6 GHz bands while others prioritize mmWave technology.

5G interference? It may be an avenue worth exploring?

I still think that the small black area is the back of the engines visible through the small gap of the extended flaps.

Furthermore: The small hydraulik pump of the RAT only powers some of the flight controls that are powered by the center hydraulic system. The ones powered by the engine driven pumps will not work once the engine(s) failed.

Engines generally deliver hydraulics while running down, as they operate down to a much lower speed than the generators do. Useful flight control power might be available from windmilling alone (hence why the 747 didn't have a RAT until the -8). That's subject to similar speed issues to the RAT but the engines have much more inertia. The Virgin Atlantic 024 report (A340 partial-gear-up landing at Heathrow) notes an expected 25-30 seconds of useful hydraulics after engine shutdown.

This doesn't apply if the pumps are depressurised by a fire handle, or to allow easier engine relight.

Very subjective, and I agree it it could look like a slotted gap between the wing and flaps, except the shadow is confined to exactly where that spoiler pair is located. You don't see it where the rest of the flap is. It would be good to hear other opinions about what we are seeing here . Is it wing, flap, gap or spoilers?


I don't understand your point here. The RAT hydraulic powers very specific flight controls like the stab, rudder, outboard ailerons and one specific pair of spoilers - the inboard most spoilers. Have a look at this schematic (at 3:55) youtu.be/DFbOLNduutI?si=siPnQ9oHMbLgp64K&t=235 (not publishing link as it fills the frame). The spoiler pair I mentioned above (visible in the video) are only powered by L hydraulics and electrical. Assuming L hydraulics was lost by dual engine failure, then this spoiler pair can only have been electrically powered...hence the conclusion it's either powered electrically by the Battery or electrically powered by the RAT. That spoiler pair is not connected to the RAT hydraulics.

Does a Boeing 787 go from HOLD TO/GA to THR REF/VNAV SPD at 400' AGL/AAE, like older versions of the Boeing?

If so, what if the WoW stayed in ground mode, for whatever reason, how would that affect

1) Retraction of the landing gear (it didn't retract, as obvious in videos released)

2) The transition from HOLD to THR/REF at 400' (they reached just barely over 400' AGL before leveling, then descending)

I am also thinking that Air India would follow Boeing procedures in that the left seat pilot will move their right hand away from the thrust levers at V1, and thus, at 400', the thrust levers are not guarded or monitored?

Even if thrust levers were pushed forward, is there some kind of logic related to FMC and-or FADEC or other involved systems, which regardless of thrust lever position commands IDLE thrust to the engine?

Remember that Airbus accident where the aircraft thought it was landing, while the pilots wanted full thrust, and they crashed into a small forest because some kind of idle is all they were afforded by the system?

If the engines of this 787 thought it was in the rollout or final part of the flare, it might also command thrust levers to idle?

This does not explain the RAT, though, unless there is some weird combination of software working against each others logic.

Had the engines failed by some really random, odd reason, like birds, fuel contamination-vapor-starvation or such, wouldn't there be at least a slight bit of roll or yaw visible? Even with TAC or whatever they have on the 787, I would think even a 1 second difference in thrust reduction between the engines, a hint of yaw or roll should be visible ...

Thoughts, especially by someone who flies the 787?

Dunno, the discussion around the switch as a failure point looks spurious to me. With that used to support the idea that a possible engine shutdown was due to the master fuel valve closing.

I don\x92t really buy that, since we don\x92t know at this stage whether the engines did in fact fully shutdown, or were commanded to spool down to idle, or other lower thrust setting, both of which would produce the same result. Thoughts ?.

If we accept that the RAT was deployed, then my understanding is that this would only occur if both engines were fully shutdown, not just reduced thrust or idle.

I thought this was a very good point. There are some detailed posts discussing the TCMA patent including this post . Is it possible the TCMA software functioned exactly as specified, and the issue is input data into TCMA?

In a total electrical failure, when the system switches to emergency battery power, how are input variables like rad alt and wow switches processed? (these were inputs someone mentioned on the 747-8, have the TCMA inputs been identified yet?)

I speculate the gear truck forward tilt is a symptom of a C hydraulic failure caused by a total electrical failure around the time of VR. Once they got 10 deg nose up on the rotation, with a total electrical failure, could the FADEC receive erroneous rad alt or wow inputs, and how would TCMA handle these inputs in the transition from ground to air logic?

What is baffling is the simultaneous nature of the suspected dual engine shutdown. There is no obvious asymmetry, with the flight path or rudder movements. If the engine fuel control switches had been manually cut one at a time, there should have been some visible flightpath change or flight control response. Something happened to both engines at exactly the same time.

Software Engineer here. IMO software glitches are more likely than mechanical failures and pilot error, and I would say increasingly more so, particularly with Boeings. I have good reasons, experience and expertise for saying this that I\x92m not going to get into here because it\x92s too long winded and will no doubt upset some people who will mistake facts for rule and let it hurt their feelings.

In 2019 I think it was, an ANA 787 had a TMCA dual engine shutdown just after landing. There was also a bug that shut down all AC power on 787s powered on for 248+ days (integer overflow causing GCU failsafe) that was supposed to be remedied on 2019. Can\x92t find any information confirming that it was implemented on all 787s. These are just two examples of software bugs. There are placed of others, and it\x92s highly likely there are ones we don\x92t know about, either in the original software or in the updates.

The bug shutting all power off after 248 continuous powered days would not have shut down running engines if my understanding is correct. The FADEC\x92s are self powered and would continue to operate as discussed in other posts.

Galaxy flyer,
UPS had a triple engine shutdown on A RR Tay engined 727. The crew got one started in the nick of time and were able to land at KORD. I know the crewmemebers.

An old post from 2004,

Dual engine failures? Or uncommanded dual engine shutdowns?

ANA NH-985, a 787-8, suffered dual uncommanded engine shutdown just after air-ground transition. That was a TCMS "feature."

Baltic BT-139 likewise, resulted in an FAA AD to upgrade FADEC software on a whole bunch of P&W engines.

It isn't unheard of. It may not have been seen at rotation before.

A good round-up of dominant themes, including this:

You may be at risk of assuming that the air/ground control logic is in some way hard-wired, as opposed to being a function of software. I don't believe we (yet) know this to be true.

We know there has been a bug in the Generator Control Unit software (an overflowing counter) that could lead to simultaneous shut down of all generators and a total loss of all AC power (the 248 days bug).

In the interests of completeness, we should perhaps also consider the possibility of some other previously-unknown software issue capable of creating an uncommanded dual engine shutdown. TCMS is the most likely candidate due to the deliberate separation of other systems from being able to achieve this outcome. The question then isn't whether there's some odd combination of input faults that would confuse TCMS into believing it were on the ground, but rather whether there's any way in which the software side could crash in such a way as to create an anomalous state within the system leading to engine failure. For instance, another overlooked software counter with an unwelcome failure mode.

Or even just a "dirty power supply" (cf all the reports of dodgy passenger-side electrics on this a/c) leading to spurious inputs and unexpected consequences.

Whatever is the cause will likely turn out to be have been a very low-probability event. But unless we have a TCMS expert who can state canonically that (say) the WoW sensor electrically disables TCMS when airborne (as opposed to merely being an input to the TCMS logic) then we cannot say with certainty that multiple inputs would have to have failed / been corrupted in order to reach the end state of this flight.