Page Links: First Previous 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 Next Last Index Page
aerobat77
June 19, 2025, 20:13:00 GMT permalink Post: 11906330 |
Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a nonsense statement?
or Are you asserting that "the system would simply ignore a cutoff command with thrust levers above idle" is a description of how the system behaves? |
EXDAC
June 19, 2025, 20:17:00 GMT permalink Post: 11906333 |
|
galaxy flyer
June 19, 2025, 20:21:00 GMT permalink Post: 11906340 |
Im pretty certain in those conditions the engines will shutdown. Haven\x92t flown the 787, but every other plane would and for good reason\x97how do you deal with an uncontrollable engine?
|
MatthiasC172
June 19, 2025, 22:06:00 GMT permalink Post: 11906425 |
TCMA restart
|
EDML
June 19, 2025, 22:23:00 GMT permalink Post: 11906444 |
ONCE AGAIN: I don't think that is what happened - it's just an example of a chain of events triggered by worn out and/or older equipment. Both failures would never happen on a new aircraft. |
AirScotia
June 19, 2025, 22:34:00 GMT permalink Post: 11906450 |
*On the ground* you get into a latched state, once TCMA deploys: after activation the relays stay latched to prevent a re-runaway. A full power reset of the affected EEC channel(s) and relay logic - normally done only at the gate - is required before fuel can flow again. So you can\x92t easily relight.
Technically, then, if TCMA deployed erroneously during takeoff, there would be no way for the pilots to restart the engines? |
Kraftstoffvondesibel
June 19, 2025, 23:16:00 GMT permalink Post: 11906475 |
If so , the likelyhood of this having anything to do with the switches, their harness, or connectors drops way down. (although most theories are dealing with statistical "impossibilities", what better time than after decades for such to occur.) The switches are double on's or 4 pole, that means they are (can be) connected to 2 different systems individually. Anyone know how that system looks? Why 2 signals? |
user989
June 19, 2025, 23:26:00 GMT permalink Post: 11906480 |
Summary of main theories
DISCLAIMER: Poster (a) is one of the (apparently quite numerous) lawyers following this thread; (b) a long-time forum lurker and aviation enthusiast who loves studying FCOMs for fun (to each his own, I guess); (c) has followed and read this thread from the start.
What I cannot do is add new theories or uncover any new facts the actual experts have not already thought of. However, since summarizing and structuring information is one thing lawyers tend to regularly do (and sometimes even do well), here is my attempt at a useful contribution to this thread: an attempt to summarize the main theories discussed here since day one (which I think hasn't been done for quite some time) in the hope that a birds-eye view will be helpful to those who have not read everything since the beginning or might even trigger some new flash of inspiration for someone more knowledgable than me. I have focused on the cons since there does not seem to be enough evidence to come to any positive conclusion. I shall try to be concise and to refrain from personal evaluations of my own. Of course, no disrespect whatsoever is intended towards all those who have contributed to this thread and to the individual theories, one or combinations of which may turn out to have led to this tragic outcome. That arguments can be made against every single theory that has been propagated seems to be the result of the highly improbable and unusual nature of this deplorable event and certainly not due to any lack of knowledge or reasoning skills in this forum. DEAR MODS: If I have distorted anything or if, meaning well, should have achieved the opposite \x96 I guess you know where the delete button is\x85 Anyway, here goes: A. Misconfiguration or wrong takeoff data Widely refuted, since
Still brought up from time to time. However, widely disregarded due to
It should be pointed out that the question of "RAT in or out" was for a while the most contentious in this thread. C. Low-altitude capture Still argued, even if refuted by many since
Various possible reasons for this have been discussed: I. Bird strike/FOD
1. Loss of electric fuel pumps
Suction feed would have provided sufficient fuel pressure.
2. Fuel contamination
No other aircraft affected, no measures taken at airport. Simultaneous flameout due to contaminated fuel very unlikely.
3. Vapour lock
Unlikely to occur in this scenario. Even if (momentarily) no sufficient fuel pressure from the center tank, the engines would have been fed by the wing tanks.
III. Improper maintenance
Unclear which maintenance measures could possibly have been performed that would have resulted in simultaneous loss of both engines. No apparent relationships between malfunctions reported by previous passengers and essential systems. IV. Large-scale electrical fault (e.g. due to water in E&E bay) The engines will continue to run if electrical power is lost. FADECs are powered independently. V. Shutdown of engines by TCMA A parallel is drawn to the ANA incident. However, this would require not only a fault in the air/ground logic but also a sensed discrepancy between T/L position (not necessarily idle) and thrust output on both engines simultaneously. VI. (Inadvertent) shutdown by flight crew
1. Spontaneous execution of memory items (fuel control switches OFF, then ON; deploy RAT) due to assumed engine malfunction
In contrast to mistakenly shutting down the wrong engine after having correctly diagnosed the problem as per SOP, this would require not only a simple error in execution but a counter-intuitive unilateral action immediately after takeoff against basic principles of SOP or CRM.
2. No indications whatsoever of an intentional shutdown for nefarious reasons
(Would also be inconsistent with the content of the alleged mayday call.)
VII.
Malfunction/mishandling of the fuel cutoff switches (most recent)
1.
Wear or improper operation of the switches, so that they do not lock but can shift back into the OFF position.
Argued to be impossible due to robust switch design, preventing switch release in any other than a locked position.
Actuation of the switches by an item placed before them which was pushed onto the switches by retarding thrust levers seems equally unlikely due to force required to pull the switches out of the locked position.
2.
Spilled drink leading to short in the wiring
Hardly conceivable that before takeoff open liquid containers would be placed anywhere where they could spill onto the pedestal.
|
Lead Balloon
June 20, 2025, 00:49:00 GMT permalink Post: 11906514 |
SLF but I think this makes sense. If pulling from takeoff thust back to idle with WoW would cause TCMA activation, we'd see engine shutdowns on every rejected takeoff.
I also wonder about this theory that one of the pilots called for reject and pulled the thrust levers back, and the other overruled him and continued the takeoff. Is this plausible? CRM aside, if max braking and spoilers are triggered in this scenario, it doesn't seem so to me. Last edited by Lead Balloon; 20th June 2025 at 00:59 . |
framer
June 20, 2025, 01:15:00 GMT permalink Post: 11906521 |
User989 thanks for a nice summary
I am at risk of turning into one of those folks who gets their mind locked on one possibility and keeps banging on about it but here goes;
2. Fuel contamination
No other aircraft affected, no measures taken at airport. Simultaneous flameout due to contaminated fuel very unlikely. 1/ No other aircraft being affected 2/ No measures taken at the airport 3/ No AD’s from the regulators 4/ No grounding of 787’s 5/ Flight profile 6/ Rat deployment etc etc I agree with your statement that dual flameout due fuel contamination is very unlikely, but we ARE dealing with something that is very unlikely. I favour the theory because an error in treating the fuel is so predictably human and simple, and a dual engine failure being related to fuel is also a simple and obvious idea, and it satisfies all we know both about the aircraft’s behaviour, and the authorities behaviour post accident. I posted a report earlier of a 787-8 powered by the same engine type have both engines roll back sub-idle within a minute of each other while airborne due to this, so we know it can happen in theory. Now……I want to be clear that I’m not saying I think I know what happened, I’m an average Joe with my hands full just flying the line, but I am a bit surprised that the idea of ‘fuel contamination specific to that airframe’ doesn’t get discussed more on this thread. Thanks again for the clear summary of discussion thus far. |
Pinkman
June 20, 2025, 01:43:00 GMT permalink Post: 11906532 |
User989 thanks for a nice summary
I am at risk of turning into one of those folks who gets their mind locked on one possibility and keeps banging on about it but here goes; If the authorities determined that the accident aircraft had been treated by maintenance for microbial growth in the fuel tanks within the last week or so, and they suspected that that procedure was carried out in a way that could result in fuel contamination, then that would explain 1/ No other aircraft being affected 2/ No measures taken at the airport 3/ No AD\x92s from the regulators 4/ No grounding of 787\x92s 5/ Flight profile 6/ Rat deployment etc etc I agree with your statement that dual flameout due fuel contamination is very unlikely, but we ARE dealing with something that is very unlikely. I favour the theory because an error in treating the fuel is so predictably human and simple, and a dual engine failure being related to fuel is also a simple and obvious idea, and it satisfies all we know both about the aircraft\x92s behaviour, and the authorities behaviour post accident. I posted a report earlier of a 787-8 powered by the same engine type have both engines roll back sub-idle within a minute of each other while airborne due to this, so we know it can happen in theory. Now\x85\x85I want to be clear that I\x92m not saying I think I know what happened, I\x92m an average Joe with my hands full just flying the line, but I am a bit surprised that the idea of \x91fuel contamination specific to that airframe\x92 doesn\x92t get discussed more on this thread. Thanks again for the clear summary of discussion thus far. Last edited by Pinkman; 20th June 2025 at 02:32 . |
cloudhawke
June 20, 2025, 02:46:00 GMT permalink Post: 11906545 |
tdracer addressed the shutoff valve operation earlier: "the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous.
The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine).
"
|
Lead Balloon
June 20, 2025, 03:41:00 GMT permalink Post: 11906563 |
I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications. |
Someone Somewhere
June 20, 2025, 04:18:00 GMT permalink Post: 11906574 |
Just so I have this clear, are you saying that the implementation of the TCMA functionality involved
no
new components being added to the pre-existing FADEC? Are you saying, in effect, that the two switch relays described in the TCMA patent application, which relays and their configuration achieves the described two channel redundancy, were already there as components or are mere depictions of what the software does itself?
I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications. It uses existing thrust-lever-angle inputs, existing N1 inputs, and (presumably) existing WoW inputs, does software stuff inside the ECU, and if necessary uses the existing overspeed cutout outputs to stop the engine. |
13 others
June 20, 2025, 04:24:00 GMT permalink Post: 11906577 |
What if it takes something to be worn/used after many years to get that kind of failure? The AI 787 was 11 years old. We have been discussing the fuel switches, but there are thousands of other parts that might contribute to such a failure in connection with some other problem.
The TWA 800 airframe was 25 years old at the time of the accident, where arced wiring was implicated in that crash. In the aftermath, industry-wide sampling of aircraft found cracked insulation on wiring, non-factory swarf added by follow-on maintenance, instances where wiring had been re-routed or manipulated in a manner that placed increased strain on looms, etc. Of course the problem with wiring-related problems is that they can produce faults that no engineer could have foreseen or have developed countermeasures for. Not to be an alarmist, but much has been written about wiring issues on the aging fleet. I tend to believe that maintenance people in earlier generations were more conscientious about their work, where now more than ever corners are cut (beginning at the factory). |
ignorantAndroid
June 20, 2025, 04:57:00 GMT permalink Post: 11906593 |
Just so I have this clear, are you saying that the implementation of the TCMA functionality involved
no
new components being added to the pre-existing FADEC? Are you saying, in effect, that the two switch relays described in the TCMA patent application, which relays and their configuration achieves the described two channel redundancy, were already there as components or are mere depictions of what the software does itself?
I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications.
That is the implication I have heard all along, particularly from tdracer's posts.
It uses existing thrust-lever-angle inputs, existing N1 inputs, and (presumably) existing WoW inputs, does software stuff inside the ECU, and if necessary uses the existing overspeed cutout outputs to stop the engine. The air/ground signal would've already been present as well. It would be needed for switching between ground idle, flight idle, and approach idle. Tdracer has discussed that as well, in past threads. |
Musician
June 20, 2025, 05:30:00 GMT permalink Post: 11906603 |
TCMA things, imagination and evidence
You may be surprised to know that TCMA doesn't require that, it just requires a differential between commanded and actual thrust.
It has never triggered during takeoff until now. Maybe it still hasn't been. We'll see. Given there is an actual example of a 787 in the wild shutting down both of it's engines when it shouldn't (ANA), I'm surprised how complacent people are that this couldn't be the cause..Software can always have weird corner failures that could never have been thought of or tested. Note that the thrust lever actuators are wired to the FADECs, and that the TCMA gets the T/L position from that. For TCMA to trigger, it has to determine that its FADEC (on that engine) failed to achieve a commanded reduction in thrust. So we're either looking at a weird, unprecedented edge case, or a FADEC failure, or both.
Just so I have this clear, are you saying that the implementation of the TCMA functionality involved
no
new components being added to the pre-existing FADEC? Are you saying, in effect, that the two switch relays described in the TCMA patent application, which relays and their configuration achieves the described two channel redundancy, were already there as components or are mere depictions of what the software does itself?
Originally Posted by
Lead Balloon
I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications.
With a MCAS crash, it required a hardware problem with an AOA sensor, used as input to a correctly working MCAS, to cause the aircraft to behave erratically. With a correctly working TCMA, I believe it'd require two hardware problems to get TCMA to shut down the engine, as there'd have to be an implausible thrust lever reading, and a FADEC/engine failure to process it within the TCMA allowed range ("contour"?). On both engines, separately and simultaneously. That leaves a software problem; it's not hard to imagine. The issue is, at this point it's just that: imagination. I could detail a possible software failure chain, but without examining the actual code, it's impossible to verify. We simply don't have the evidence. I could just as well imagine a microwave gun frying the electronics on both engines. An escaped hamster under the floor peeing on important contacts. A timed device installed by a psychopathic mechanic. There's no evidence for that, either. This process is a way to psychologically cope with the unexplained accident, but because it lacks evidence, it's not likely to identify the actual cause. We've run the evidence down to "most likely both engines failed or shut off close to rotation, and the cause for that is inside the aircraft". Since the take-off looked normal until that failure, we have no clues as to the cause hidden inside the aircraft. We need to rely on the official investigation to discover and analyse sufficient evidence. The post-crash fire is going to make that difficult. "Both engines failed or shut off close to rotation" explains all of the evidence : it explains an unremarkable take-off roll, loss of lift, absence of pronounced yaw, loss of electrical power, loss of the ADS-B transponder, RAT deployment, the noise of the RAT banging into place and revving up, emergency signs lighting up, a possible mayday call reporting loss of thrust/power/lift, and a physically plausible glide from a little over 200 ft AAL to the crash site It explains what we saw on the videos, what the witness reported, where the aircraft ended up, and the ensuing sudden catastrophe. I don't believe we have evidence for anything else right now—I'd be happily corrected on that. ----- Edit: the evidence of the crash photo with the open APU inlet door, and the main gear bogeys tilted forward, are also explained by the dual engine failure/shut off. Last edited by Musician; 21st June 2025 at 06:48 . Reason: more evidence |
Lookleft
June 20, 2025, 05:55:00 GMT permalink Post: 11906614 |
I'm not suggesting you are wrong wheelsright, my post to you was in response to posts I have made about potential fuel contamination, being removed. A central point of failure is more likely than the simultaneous shutdown by systems on two separate engines at the point at which the aircraft left the ground. If what is being speculated on is possible then all ETOPs approval should be removed and the engine manufacturers told to start again.
|
Furr
June 20, 2025, 07:31:00 GMT permalink Post: 11906655 |
If power failed first?
If power failed first,
What happens to TCMA sensors like Weight on Wheels? Radio altimeter? Is there one Weight on Wheels per engine? Is there one radio altimeter per engine? If not, why not? Are the TCMA sensors directly powered as part of FADEC? If not, why not? Is it possible that there was a noticeable loss of thrust caused by loss of fuel pumps and the pilot responded by cycling thrust to zero and back, trying to clear the problem, inadvertently triggering the TCMA? |
soarbum
June 20, 2025, 10:01:00 GMT permalink Post: 11906794 |
Engineer not a pilot. Experience in analog front ends, A2D and R2D conversion and embedded systems generally but no specific knowledge of the 787 or GEnx.
I like everyone else have no evidence that TMCA played a role but given that it is one of the few systems with the ability to cut fuel to the engines, here are some thoughts on how signal processing could have extended the window of when TMCA could bite. In particular, I'm looking at the time immediately after the nose lifts up when something may have physically shifted onboard. I'll phrase it as a number of questions but realise that the few people who can answer may not be able to for now. Thanks to tdracer's explanation on TMCA (albeit 747 not 787), we know that TMCA is a logic block within the FADEC whose only external inputs are a logic signal fron the aircraft that indicates whether it is on the ground or not and throttle position as determined by two independent resolvers per throttle side. The logic would seem to be something of the form If (G AND (N2>A OR N2>B)) Then CutOffFuel() where G is true when the aircraft is on the ground, A is an envelope defined by throttle resolver channel A and B is an envelope defined by throttle resolver channel B Q1: Am I correct in that assumption that when on the ground, overspeed with respect to EITHER resolver A OR resolver B can trigger TMCA? We have been told that the logic (ie true or false) signal G is determined from the Weight-on-wheels sensors and the RadALT. It is reasonable to suppose that the designers still wanted TMCA to function after a hard landing where some landing gear components had failed. Q2: When the nosewheel lifts off but the MLG is still on the ground and RadALT is close to ground, will G still be true? Next, it is common when data fusing multiple inputs that there is a desire to clean up a signal before it is sampled digitally. This can remove effects such as switch bounce. The inclusion of low pass filters or hysteresis will generally add a propogation delay. Q3: Is there a slow filter (Tc>=1s) in the ground/air logic which could have caused a slight delay before G became false after takeoff further extending the opportunity of TMCA to activate? Q4: Does TMCA act almost instantly or does it wait for the fault condition to stay asserted for a period of time before acting? At that point, the total energy of the system would have comprised of the kinetic energy of the aircraft travelling at Vr, the rotational inertia of the engines and the potential energy of whatever fuel is beyond the cutoff valves. Q5: Would this total energy have been sufficient to get the aircraft 100ft into the air? It would still need a mechanism for at least one throttle input to each FADEC to misbehave at the same time. Resolvers are fed with an excitation signal to the rotor and take back two orthogonal signals (Cos and Sin) from stator windings. Usually, the excitation comes directly from the resolver-to-digital (R2D) circuit but sometimes an external signal source is used. I would hope that in an aircraft system, each channel would be kept independent of everything else. Q6: Does the excitation signal for the 4 throttle resolvers (2 per side) come from 4 independent (internal) sources? My last thought for a single point of failure between both throttles would be a short between two wires or connection points carrying resolver signals, one from each side. Whether this could be caused by swarf wearing within a wiring loom, a foreign object moving about, crushed wires or even stretching of adjacent wires, I have absolutely no idea. Q7: Do resolver signals from left or right, either channel A or B, run next to each other in a loom at any point? |
Page Links: First Previous 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 Next Last Index Page