Posts about: "FADEC" [Posts: 231 Pages: 12]

Seconds count: That was with 10 seconds delay vs. 13 seconds for engine 2.

Time was spent with the verbal exchange, and then perhaps each pilot expected the other to put the switch back?

Anyway, the preliminary report also establishes that the aircraft had only 3-4 seconds of powered flight. (Would the gear lever be operated that early?) Everyone who saw that from the CCTV video, pat yourselves on the back.

Mayday call, dual engine failure, RAT deployment all confirmed.
TCMA was a red herring, the aircraft was firmly in air mode as the accident unfolded, and the thrust levers were at takeoff thrust the whole time.


I wouldn't put too much significance in the "01 second" since this still is close enough for an unintentional cause.

No matter what: The design and position of the fuel cut off switches is potentially prone for mishaps.

I believe the 'thrust not achieved' was that one made up by a journalist - happy to be corrected.

Sounds like #1 was restarting successfully but they just didn't have enough time for it to get back to high thrust.

#2 may or may not have eventually started successfully; the extra two seconds of no fuel meant it would be a much harder start for the FADEC.

It doesn't sound like the crew have any input on the relight process; if the switch is on, the FADECs will try anything they can to get the engines lit and accelerating ASAP. Repeatedly switching between off and on will not help this process and there are basically no other controls the crew have, especially with no other power to run the engine starters.

Consider this post with a picture of the switches in question:


They must be lifted over the detent (if installed correctly) in each direction.

Far more than double pole - I think it's 4-8 ish. See the number of wires in the above picture. A previous post in one of the earlier thread indicated that it was essentially one pole per function - HPSOV, LPSOV, FADEC signal, generator etc. I'm not sure which one the EAFR reads. If it was a single contact failure, you would expect to see disagreement between the various systems controlled by the switch. I think that's very unlikely given both 'failed' in the same way near simultaneously and 'recovered' when switched.

For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.

Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.

I'd like to say something here that might help us all understand what probably happened. It's sad, but now that we know some clear facts, I think this probably goes a long way to understanding this tragedy.

It's a bit long, but that's probably necessary. I hope you find it worth the read.

First up, I notice there's a tradition here to talk about "muscle memory". I understand it, but this is really quite the wrong term, and I think using the correct term will help clarify this a great deal. The muscles don't remember actions (at all, I think). It's part of the brain that's responsible (and I truly think that aircraft designers need to understand and take this fully into account when designing new aeroplanes/airplanes.)

The part of the brain in question is called the Cerebellum. It has been called "The Brains Brain" but again, that's inaccurate. The cerebellum is actually the brain's Automaton! Pretty close to automation, and in some ways, nearly the same.

The Cerebellum is located at the back, lower part of the brain. It looks quite different, and appears to have a stringy appearance. This part of the brain is responsible for all manner of physical (i.e. motor) actions. It is like an ECU or an EEC or a FADEC, or a GPU or all manner of sub-processing units in cars, planes, factories and so on, and I guess, in virtually all animals and humans. Basically, it is designed to take a lot of the workload off the brain itself. That's where the problem arises.

Just think about walking. You can work along without even thinking about it. In fact, if you do think about it, your walking is likely to become "unnatural". Just think about how it feels to nervously walk on stage in front of a big crowd. Am I even walking properly...? I feel like a robot! The conscious mind has taken control, and it's not as good at walking naturally as the cerebellum is. After all, it's been the one doing it, all your life.

So, think about talking, writing, signing your signature, typing, riding a bike, stirring your tea, driving a gold ball, playing a well-practised video game. Think of "Getting the hang of it" - it's the process of the cerebellum learning a new sub-routine. Slow to start, but capable of lightning fast action once learned. And some of its learning is evidently built-in from birth. Eye movement (& focussing?), for example.

So, having a cerebellum allows you to walk very successfully, while watching the traffic, talking to your companion, thinking up jokes, listening to the birds singing, etc etc. You don't need to think about it, because your cerebellum has learned since you were a toddler "How to Walk". It knows very well, and can even handle trips and especially slips. All you have to do is say "Walk to A" and the cerebellum does it, unless the thinking brain says "Hold on, stop."

This is where the term "muscle memory" comes from. Automated actions, not from muscles but from the cerebellum.

Now, the problem here is that in effect, what I'm describing is, in a way, two brains. Scary thought! Even more scary when you recognise that it's virtually true.

If you take a look at the anatomy of the brain in a suitable drawing, you'll see that the cerebellum is not fully connected to and integrated with the rest of the brain. It's actually a separate sub-unit which is not even wired directly into the brain (the cerebrum, just to be confusing) itself. It's attached / wired to the rear side of the brain stem, below the Main Brain:

https://teachmeanatomy.info/neuroana...es/cerebellum/ - scroll down to Fig 1.

Those of us who understand computers, networks, data-buses and so on will immediately recognise the problem. For a start, there's a bottleneck. And a source of latency. (The perfect word for this situation.) There's also a need for multiplexing - or, you could say switching. At least, there are two possible sources of control. Just like in the cockpit! Oh No!

Having the cerebellum where it is had/has a huge survival advantage. It means it's much "closer" to all the nerves that control the muscles - so that in life-threatening emergencies, the cerebellum can get the commands out much, much faster than the conscious brain can even think of them. If you're falling, the cerebellum will have reacted even before you've had a chance to think.

I learned this one day in England. I was riding an old bike to work, accelerating at a roundabout as hard as I could push. Suddenly, at full push, the chain came off. I don't (and didn't) even remember, maybe didn't even see, what happened next. One moment, I was up on the pedal, pushing hard. Next, I was in mid-air. Seriously, I remember this. I was in mid-air on the right-hand side of the bike, looking back towards the bike still rolling along beside me as I was falling. I was already about half turned, nearly onto my back. No idea how. (I was wearing a backpack, so apparently, it was my designated crashpad.) Next, I was on the road, completely free of any entanglement with the bike. It (cerebellum) didn't manage to get my right elbow out from under (maybe deliberately) but I landed mostly on my backpack, with my elbow pinned about under my right hip. The scars have faded now, but my forearm/elbow became a brake pad... Next thing I remember was sliding along a cold but fairly smooth section of road, head craned up, looking back down the road to see if anyone was going to run me over. A brown-haired young woman in a car was coming behind me, safely, watching, slowing. I firmly believe that my cerebellum was responsible for me landing so well. Nothing broken, just some skin off my elbow. Like I say, I didn't have a chance to even think about it.

So, there's a big advantage in having a semi-autonomous processor operating in parallel, alongside the higher intellect. But every advantage seems to bring with it a downside, as I think we might all be seeing.

The downside is, given a command by the cerebrum, the cerebellum will perform it. Accidentally, unintentionally, mistakenly, prematurely, casually, give it the wrong command, and guess what?

To tell you the truth, the older I get, the more often this happens. My wife and I jokingly call it Autopilot. We're out shopping or whatever, a list of places to go, me at the wheel. A to B to C... Suddenly, we're back home, and I forgot to stop at the Drug Dealers... I jest - I mean, who would forget that! But talking is a great way to facilitate this. The cerebellum knows the way home far better than the way to the Candlestick maker, so, when lacking clear direction, evidently, it reverts to the most familiar.

Exactly what happened here, who can really say? Not me. But this article (many thanks to https://www.pprune.org/members/198630-limahotel ) for this link.

It's totally relevant, the PF the obvious cause:

https://avherald.com/h?article=48d1e3ae&opt=0

I wonder what might have been the trigger here. Sudden high stress? Why didn't the gear go up? Who should have done that? When, compared with actual events? (Might have already been answered, sorry. I've been busy! )

Ever since the two 767 events in the mid 1980's where a pilot - thinking he was activating the supervisory Electronic Engine Control switches - set both engine fuel switches to CUTOFF (fortunately at ~3,000 ft. so the engines had time to relight and recover), the FAA has mandated something called a "Quick Windmill Relight" capability. Basically - with the engine at high power - the fuel switch is set to CUTOFF, then (IIRC) ten seconds later set back to RUN. The engine must recover and produce thrust within (again, IIRC) 90 seconds. It's a very challenging test for the FADEC s/w.
I assume the 10 second pause is based on how long it took the two 767 event pilots to realize their error and return the switches to RUN.

(First, I've read the whole thread, and most of the content in the previous threads, though they are obviously of less relevance in some areas now.)
This notion has caused me some concern, since seeing at least one very similar remark when I read the other threads (possibly by the same poster, though?).
It seems extremely undesirable for TCs to end up habituated to taking actions like this without thought. I wonder if it creates a case for the sim setups being performed by non-flying personnel?

Meanwhile, I read the prelim report. The English is generally fairly good but I note multiple mistakes/typos, and some oddities. One such oddity is that the timestamp of the second cutoff switch change isn't listed explicitly anywhere I can find, but instead just a relative time: "gap of 01 second". To write "1" as "01" like this invites speculation that it's a typo for 0.1; this is unlikely, given the polling frequency mentioned by some posts above, but nonetheless seems odd. (I am aware that Indian conventions differ from those in US/UK English, including placement of commas in large numbers, but I don't think this is such a case.)
Another indication to suggest it hasn't been proof-read very effectively: the FADEC is also described as a "... Dual ..." instead of "... Digital ...".

I see pages of deliberation on the physical position of the switches, but I have not seen a single post on how the signal from these switches is actually routed and processed. I have no knowledge of 787 systems, but I rather suspect that the signal is fed into the FADEC or some intermediate processor rather than directly opening/closing the fuel pumps relay switch ... ? Similarly the switch position signal is I presume captured and processed by a separate system which then writes it to the FDR. Anyone in the know whether there is any possible failure mode of the electronics that would simultaneously send the cutoff signal to FADEC and result in an OFF position for the switch at the same time without any actual physical movement of the switch ?

The Indian AAIB are avoiding a German wings event I fear. Actually I was in a flight deck of a EJR today. Start / stop switches are so bloody obvious on the overhead as main switches. Guarded and easy to observe by all. Control switches that are not required as a normal action put away from hidden positions and visible to all. Embraer actually design systems logically. Speaking to a Captain today, he confirmed that if the the thrust levers of an EJR are beyond flight idle, engines cannot be shut down by then engine start/stop switches being turned off! You need to drag the thrust levers back to idle to shut them down. First thing I was taught as an airframe engineer converting to dual trade is that the fuel system of a airframe should not restrict an engine to receive fuel from a commanded input by the pilot. Throttle position should drive that logic. Not a lazy Boeing combined FADEC and SOV switch.

FADEC processes the fuel control switches as well as the throttle resolvers directly. Both dual-channel, separate and separated circuits. Additional logic between the two would have to be foolproof. Sometimes simpler is better, even if human actions can defeat it. There is no plausible explanation or expectation for cutting both switches three seconds after liftoff.

Would not expect an FDR dedicated pole. They might pull the FCS position from the FADEC, since what really matters is what the FADEC receives as a command. I would expect two poles dedicated to the two circuits, one routed to each FADEC channel, and the others to the non-FADEC-reset-command functions.

I'm guessing they use a separate set of contacts to electrically isolate the FADEC wiring from the flight recorder wiring. Which would seem like a good idea.

The 1 second is consistent with the fuel control switch sampling rate. I wouldn't read too much into that, it is anywhere from simultaneous to 2 seconds within the sampling rate. (The sampling used to be 1Hz for that discrete). The FADEC will give better information on the exact time that the engines fuel was shut off.

There is one known inadvertent shutdown with this type of switch, on a B744, many years ago, when the Rosen visor fell from the upper sun visor rail when being relocated. That managed to turn off 1 fuel switch.

The report is quite comprehensive for an interim report, and it does not draw any conclusions as yet as to how or why the fuel control discrete is recorded as OFF, however, it is troubling. I would reserve opinion until there is a clear spectral analysis that shows the selection of the fuel switches off, and then back on.

As to the time to react, the crew in this case if unaware of the causation will have a fair recognition time to assimilate the information that is presented, and then to determine that the cause is the switches being off is going to take some time to process, discover the system status and respond, if that is what happened. I remain concerned with liquid ingress to the control system, giving a change in the sensed switch position rather than the selected position. That is looking like a long shot, but then this event is way outside of the normal box.

Industrial electrician here.

I have only seen a diagram for I think the 737. I remember there being a listing of what each pole did, but I can no longer find the post.

My expectation/speculation, though, is this:

The EAFR gets its information on cutoff switch position from the FADECs via data buses, similar to almost all other engine data. We have N2 information in the report after the engines were switched off, so clearly there are no concerns about this data not being captured.
This means that the FADEC's data of where the switches are is almost certainly the EAFR's data.

There are other poles on the switches that do other things - I think it was opening/closing the LPSOV and enabling the generators. The fourth pole in the 'cutoff' position was IIRC not used because the generators don't get a disable signal, whereas the LPSOVs are powered open in the run position and powered closed in the cutoff position.

If the switches were physically operated and in good electromechanical condition (not counting the possibly faulty gates), we would expect all four poles to operate essentially simultaneously, with the four 'run' contacts opening and the four 'cutoff' contacts closing. Not only would the EAFR pick up that the FADECs were commanded off, but also that the LPSOV closes after a short delay, and the generators drop offline before N2 drops below idle.

When the switches are moved back to run, we would likewise see the position of each LPSOV return to open.

(this does not necessarily mean that a person intentionally operated them, but that the lever actually moved).

If there was a wiring fault, contamination, or internal switch failure, we would probably not see this. Instead, you might see the LPSOV remain open despite the engine shutting down, or perhaps the FADECs trying to keep the engine running while the LPSOV has closed and shut off fuel, or the two FADEC channels receiving different run/cutoff signals - and all of this would probably happen differently on each engine (if it affected both engines at all). There is no indication of this in the report.

These are not your basic light switch where the load is either powered or not powered. They're four switches ganged together and operated in unison, and each channel powers either thing A or thing B. If you have both or neither A & B powered (for longer than the ~50ms that the switch takes to move between positions), this is a fault that should be visible in the EAFR data in some/many cases. Think valves being displayed in orange as 'position unknown'.

If all run contacts opened, and all cutoff contacts closed, the switch moved from run to cutoff .

I don't know whether they analysed the EAFR data in this much detail yet, but coupled with a potential click sound on the CVR, I think there's going to be very very little doubt at the end of the investigation whether the switches physically moved or not, and I strongly expect they did.

I have a simplified 787 fuel control diagram showing 3 outputs from the fuel control levers. I suspect it represents poles. One signal goes to the EEC for "reset". One signal goes the fuel valves. Another signal goes to a Remote Data Concentrator where the signal is digitised and sent to innumerable devices (including the EEC and the FDR). That is not to say there are more. I don't see a line to the wing spar valve.

The 747 has 3 poles per switch. To send signals to all the systems it needs to, splices and multi-output relays are involved. On some aircraft there are even separate power sources going to some of these poles.

This is the desired direction. You want to make sure the engine shuts down even if e.g. the wiring to the FADEC is damaged. If for whatever reason (e.g. short in one of the cables) one engine is wrongly shut down, the plane can still fly with the other engine.

Quote from 2025-06420.pdf
AD 2021-15-05 requires initial and repetitive replacement of the full authority digital engine control (FADEC) integrated circuit (MN4) microprocessor.

The MN4 is part of the FADEC in the engine, the probability of both engines having identical unrelated failures at the same time is very unlikely.

Edited: I see katekebo has already raised this as very unlikely

It doesn't really matter - the FADEC will do it's best to get the engine running again regardless of the lever position - in that regard the only real difference is once the engine reaches min idle, it'll simply keep accelerating to the target N1 (or EPR). There is no need to move the thrust lever to idle to get a successful start.

There have been a few cases that I know about where the flight crew did a normal ground start with the thrust lever at mid-power, and the engine simply continues to accelerate to the 'commanded' N1 or EPR. In one case (a 777), this happened during pushback. As the engine continued to accelerate above idle, the thrust caused the aircraft to jackknife around the tug, causing the tug driver to have to dive for cover to prevent serious injury. That even happened while we were doing the development of the 747-8 - it prompted me to ask the 747 Chief Pilot if we wanted to consider a 'start inhibit' in the FADEC logic that would prevent a ground start attempt if the thrust lever wasn't at idle (ground starts only - for what should be obvious reasons). He didn't like the idea, and it went no further...

Thanks, makes sense. It was the above note that confused me.

More media trying to event a story. Consider this:
Each FADEC has two independent channels - if one channel has a fault that makes in incapable of controlling the engine, the other channel takes over. This happens in milliseconds - quite likely the pilots never know it happens. There are two engines.
The chances that this failure could affect both channels of both engines within a second or so is literally trillions to one.