Posts about: "GEnx (ALL)" [Posts: 28 Pages: 2]

Furr
June 20, 2025, 11:50:00 GMT
permalink
Post: 11906887
Originally Posted by soarbum
Engineer not a pilot. Experience in analog front ends, A2D and R2D conversion and embedded systems generally but no specific knowledge of the 787 or GEnx.



Thanks to tdracer's explanation on TMCA (albeit 747 not 787), we know that TMCA is a logic block within the FADEC whose only external inputs are a logic signal fron the aircraft that indicates whether it is on the ground or not and throttle position as determined by two independent resolvers per throttle side.

The logic would seem to be something of the form
If (G AND (N2>A OR N2>B)) Then CutOffFuel()
where G is true when the aircraft is on the ground,
A is an envelope defined by throttle resolver channel A and
B is an envelope defined by throttle resolver channel B







" A logic signal from the aircraft" sounds like a single failure could provide step 1 of TMCA shutting down both engines.
Step 2 being set throttle to zero.

As an engineers and not a pilot, it seems that momentarily setting throttle back to zero and back to full might be done to attempt to clear thrust problems, thus causing TMCA to shut down both engines.
Anyone know enough to say whether this is plausible?
TryingToLearn
June 21, 2025, 23:11:00 GMT
permalink
Post: 11908143
I read the whole threads, keeping my hands on the mousewheel so far since I'm not a pilot, just a EE / safety / systems engineer.
The hamsterwheel ist spinning a lot here, and of course it could be anything including some VHDL FPGA code line or a broken RAM cell in a cheap memory bar within the computer it was compiled with. Anything is possible, but to be honest: development processes, if followed, are usually pushing the probability to a level where it becomes pure theory. BOSCH uses FPGA+\xb5C on the brake control box of cars. They sold 100 millions of those, used 4000h each (car lifetime) without error, with less strict development process. Most errors are made on requirement level, not code.

Also, so far there is no evidence I've seen regarding the 'chicken-egg' problem, did the engines fall below idle (fuel, stall...) and this caused an electrical blackout (-> battery, RAT...) or did an EE problem cause the engines to reduce thrust (FADEC, SW bug...). And where is the common cause in all this?
There has to be a systematic error common to both engines, an external failure affecting both or a dependent fault with one affecting the other within seconds. This is the only thing I think everyone agrees here. And I refuse to beleave the external failure or dependent fault was sitting in the cockpit.
I think it is something not common to every aircraft type for the last 50 years.
So I started searching and found a candidate.

I read myself into the EE architecture of this unique 'bleed-less' design and it's megawatt powergrid since this is the part where I may be able to contribute (and I'm most curious about). Generators on the 787 are >250kW instead of <100kW each and there are two per engine instead of just one. In fact, they can go up to 516 kW and shear off the gearbox at >2200Nm (equal to >2 MW, per generator).
https://www.easa.europa.eu/en/downloads/7641/en (page 11)
So while on any other aircraft the generator is more like the dynamo on your bicycle, those generators are massive (x10).
The gearbox is connected to the HP shaft (N2) on the GEnx. I learned from Wikipedia that RR moved this gearbox to the IP shaft on the Trend 1000. And RR is happy that the A330neo Trend 7000 uses bleed air and less load on the gearbox, since this maintains stability on the HP shaft at light load (also Wikipedia).
Those generators are not in phase and frequency sync, or in other words: If you parallel them, they fight each other, it's like a short. They will almost block if this is not handled by the control box if possible (or some melting fuse blows at some point).
787 electrical system - variable frequency generators?
Somehow I find it hard to believe that they are not able to disturb the engines despite that everyone here so far is claiming that there is no way an electrical problem could influence them because FADEC has it's own supply. I read that one is sufficent to start the engine, usually both are used.
In my mind I find lot's of ways this could influence both engines simultanously. If just the BTBs on the 230V grid got some humidity (hot, no AC, water cooling...) and went up in one big arc (I think they made them semiconductor relays, too).
Could those gearboxes and engines handle 4500Nm / almost 5 MW on each HP shaft, applied within a fraction of a second without any problem?
Or if the engines were in a condition not far from compressor stall, one was stalling and 400kW load jumped from one engines generators to the other...
I did some rough estimation and one of the generators could push N2 below idle in a second or less without fuel just with its normal 250kW load (just inertia).
This is one point which is unique to this airplane model, so maybe worth a closer look.

I know that those engines are burning at >100MW at full power, but how fragile in the balance between compressor load and this one turbine stage on the HP shaft / N2, without the inertia of a 2.8 meter fan? This is just out of my background, any thermodynamic expert here?
Of course I also have no insight in SW and communication within the control boxes, how much they are talking to each other, delaying/ramping load redistribution etc. If FADEC recognizes a flameout, could it instantly command the generators to cut the load, even above idle rpm?

I would assume that some fuel contamination, valve blockade, even compressor stall would pop up slower. But such a generator could kick in within milliseconds.

As a safety guy I learned that one tends to look first at things one is familiar with (SW, HW, mechanics, pilot behaviour, maintainance, depending on one's profession) and in the end it's often the interface and dependent faults within which are not carefully considered (e.g. takeoff situation vs. thermodynamics vs. mechanics vs. power generation vs. humidity vs. generator control...) together with transient behaviour. It was the same with MCAS (safety culture vs. pilot training vs. SW design (repeated action) vs. single AOA input vs. bird strike probability close to ground vs. trim loading/blockade vs. stickshaker noise/distraction).
In fact, I was trying to find information on all those systems and directly found slides on how the engines and generators could be simulated and the power grid tested in a HIL (hardware in the loop) environment. My experience from automotive is that such simulated environments are often far from reality and HIL environment programming finished after the product is already at the customer. But of course its far easier and cheaper to apply and test faults there. But then, some programmer programms what he thinks the reaction of the engine would be.
This 'bleed-less' design was some massive change in airplane EE architecture with hugh consequences on the whole airplane design and extremely hard to fully analyze.

I'm just asking questions and hope that we all learn a lot and this was fully considered or just not an issue. It's just an aspect I found worth mentioning and not only spinning the wheel.

PS: I doubt it was TCMA. The air/ground decision is done in a different box, evaluating 5 inputs in a 1/3 and 1/2 decision according to this discussion. This is then safely sent to the FADEC (as one input) and combined with the thrust lever position and N2. But if the thrust lever position is sensed (redundant and direct) close to idle, you do not need TCMA or ground mode to expect reduced thrust.
fdr
June 22, 2025, 00:10:00 GMT
permalink
Post: 11908171
Originally Posted by T28B
Not confirmed . What is apparent is a (substantial) loss of thrust. That's what one can say with some certainty.
The available video and trajectory information are quite conclusive that both engines stopped producing thrust within 12 seconds of the main wheels leaving the ground. Had partial power of any level remained, the aircraft impact would have been further away from the departure end of the runway. The NE end camera shows by using transit sightings against identifiable structures, that the failure occurred while the aircraft was still within the airport boundary area. The energy state of the aircraft at that time trades off to impact at the correct time and place.

On departure at these weights the aircraft would have some assumed temperature thrust reduction from max available on the GEnx -1B70, Unless they were carrying lead, they were around 30,000 or more below the limit weight for a flaps 5 TO. At that weight, around 440k lbs, they would have had a fair OEI climb gradient on one engine, certainly a positive gradient with the gear down, so they lost more than 50% of total thrust. There is no yaw or roll, or inputs to counter a yaw or roll moment so the aircraft was symmetrical at all times, that means losing absolutely no less than 50% of total available thrust at that point on each engine. At 50% reduction. the aircraft would have continued a positive gradient with the gear down and the flaps at the TO setting. It did not, it decelerated at around 1meter sec, or 0.1g deceleration for just maintaining level flight, but it also had to descend and that was worth around 0.05g as well. Instead of having any positive thrust margin, the guys were needing to descend to balance the decrement in thrust of around 0.15g, and that means it has negligible to no thrust from the engines. The full analysis takes more effort as the AOA has increased over the 15-20 seconds to impact, which is increasing the drag of the aircraft rapidly towards the end. For the first 5-10 seconds however, it is not such a great change, but it is still increasing.

In level flight, the aircraft would accelerate level at around 0.3-0.4g gear down with both engines running at max chuff. Lose one, and you are back to 0.05-0.1g or so. These guys had far less than one engine remaining, gravity was all that they had going for them.

To that end, there is no requirement to have the EAFR readout of the N1, N2, FF, or EGT, the video shows they had no puff going worth a darn. That is basic back of the envelope physics and anyone who does aircraft performance testing would be able to get that answer straight from the video without using a calculator, by the time they had watched the video a couple of times in replay.

I have no qualms on stating that the engines are not operating, the RAT, gear tilt are consistent with the dynamics of the aircraft. This is far simpler to determine the energy state than that of the B738W at Muan, the lack of early video required a couple of iterations of the kinetic energy of the aircraft at Muan to end up with a probable flight path, and most likely estimate of the thrust remaining for those most unfortunate souls.

regards,


FDR

Last edited by fdr; 22nd June 2025 at 15:01 .
NSEU
June 30, 2025, 13:59:00 GMT
permalink
Post: 11913644
Originally Posted by Phantom4
Have the spring loaded Fuel Shut Off Valves been examined by GE on both engines???
Why would spring loaded valves fail on both engines? The final valve in the GEnx Fuel Metering Unit (FMU) before the fuel flow meter and things like the fuel nozzles, is called the HPSOV and is spring loaded to closed, but fuel from the Fuel Metering Valve (FMV) can keep it open with minimal pressure (certainly enough presssure for engine start). Tank electric pumps and the engine-mounted, mechanically-driven two-stage pump supply fuel to the Fuel Metering Valve. During main tank pump failure, the engine mounted pump suction feeds the engine. There are altitude limitations during climb (according to the FCOM).

There are several ways that the HPSOV can close:
An EEC (engine ECU) can close the upstream Fuel Metering Valve (FMV) electronically, so the HPSOV will lose its opening pressure.
The HPSOV can be acted on by a Shutoff Solenoid Valve (which directs fuel pressure in an opposite manner to the pressure coming from the Fuel Metering Valve).

Unfortunately, the diagram I am using is truncated, and I can't see if the Shutoff Solenoid Valve is magnetically latched in its last commanded position like typical fuel shutoff valves. Nor can I see what controls it. I suspect things like the respective cockpit fire handle and fuel cutoff lever, but also EEC commands.

There is probably a copyright on the diagram, so I won't post it here. Perhaps someone can fill in the gaps for me?
OliTom
July 09, 2025, 11:07:00 GMT
permalink
Post: 11918314
Originally Posted by Fursty Ferret
For what it's worth, if the fuel control switches were rapidly cycled as per the dual engine failure memory actions, the engines should both have restarted and recovered full thrust within a matter of seconds. This is part of the certification and Rolls Royce publish the procedure (unofficially) as a last-ditch attempt to recover an engine that's experiencing a locked-in surge condition.
Obvious questions, Is the procedure applicable to the GEnx engines installed on the accident aircraft and I assume this only applies if you realise the control switches are what the issue is, within seconds?

Last edited by OliTom; 9th July 2025 at 11:24 .
87guy
July 09, 2025, 12:33:00 GMT
permalink
Post: 11918362
Originally Posted by OliTom
Obvious questions, Is the procedure applicable to the GEnx engines installed on the accident aircraft and I assume this only applies if you realise the control switches are what the issue is, within seconds?
Yes, the procedure is the same with the GEnx engines. No difference between the two when it comes to that situation.
MaybeItIs
July 09, 2025, 12:35:00 GMT
permalink
Post: 11918363
Originally Posted by OliTom
Obvious questions, Is the procedure applicable to the GEnx engines installed on the accident aircraft [...]?

Another question if I may? I've tried searching but find the search function quite perplexing! Anyway, didn't find this answered.


From other posts here, it's clear that the Cutoff switches have a mechanical locking system which requires the switch handles to be pulled outwards to disengage the lock, before they can be moved to Cutoff.


Question is, to a pilot who knows these switches, can both these switches be easily operated in this fashion in unison, i.e. I guess, with one hand, so that they are both unlocked and moved to off together? I imagine that would be quite difficult to do (unless that's what everyone routinely practices), so the result would not be simultaneous.
Senior Pilot
July 20, 2025, 18:33:00 GMT
permalink
Post: 11925921
The full Flight Global article; those here who chose to put PPRuNe and themselves at risk of legal action by their accusations and emotive language may like to reflect and be more accurate in their contributions to this professional pilots forum in future.

US safety chief supports India’s Aircraft Accident Investigation Bureau in urging media to avoid ‘premature narratives’ about the 12 June disaster that killed 260 people

The head of the US National Transportation Safety Board (NTSB) has criticised recent news stories about the 12 June crash of an Air India Boeing 787-8, aligning with a statement from India’s Aircraft Accident Investigation Bureau (AAIB).

“Recent media reports on the Air India 171 crash are premature and speculative,” NTSB chair Jennifer Homendy said on 18 July. “India’s Aircraft Accident Investigation Bureau just released its preliminary report. Investigations of this magnitude take time.”

Homendy does not specify which media reports she takes issue with.

In recent days, The Wall Street Journal and Reuters, citing unnamed sources familiar with US officials’ assessment of evidence, reported that audio from the crashed jet’s cockpit voice recorder indicates the captain had moved the fuel control switches to the “CUTOFF” position. The reports said that the first officer was the pilot who asked why the switches had been moved.

A source who is also familiar with aspects of the investigation confirms that information to FlightGlobal.

Investigators have not released information to support such a scenario.

Jennifer Homendy Alaska briefing-c-NTSB

NTSB chair Jennifer Homendy warns against “speculative” media reports

The 787-8 was operating flight 171 from Ahmedabad to London Gatwick airport. It crashed shortly after taking off, killing 241 of 242 people aboard and 19 people on the ground.

The AAIB’s 11 July preliminary report said that about 3s after taking off, the two cockpit fuel control switches – each controls fuel to one of the jet’s two GE Aerospace GEnx turbofans – were switched to the “CUTOFF” position. The switch for the left-side engine moved first, with the right-side switch moving within about 1s.

The turbofans then lost thrust. One of the two pilots – the report did not specify which – asked the other why he moved the switch; the other then denied doing so.

Starting 10s after the switches were set to “CUTOFF”, both were switched back to “RUN”, causing the turbofans to begin restarting, but not in time to prevent the jet from crashing.

The 787’s flight data recorder noted the moment the actual physical switch moved to the “CUTOFF” position and then when it moved back to the “RUN” position, a source tells FlightGlobal. Those moments were plotted on a graph showing engine thrust falling off after the switches were moved to “CUTOFF”, and then returning after they were moved to “RUN”.

Because that data reflects the physical movement of the switch, a loss of fuel caused by another problem elsewhere in the 787’s electrical system is unlikely, the source says.

The Federal Aviation Administration on 11 July issued a Continued Airworthiness Notification to the International Community (CANIC) saying that the AAIB’s “investigation to date has found no urgent safety concerns related to the engines or airplane systems of the Boeing Model 787-8”.

On 17 July, the AAIB issued an “Appeal”, saying, “It has come to our attention that certain sections of the international media are repeatedly attempting to draw conclusions through selective and unverified reporting”.

“Such actions are irresponsible… We urge both the public and the media to refrain from spreading premature narratives that risk undermining the integrity of the investigative process,” it adds. “The AAIB appeals to all concerned to await publication of the final investigation report.”

Citing that document, the NTSB’s Homendy said on 18 July, “We fully support the AAIB’s public appeal… and will continue to support its ongoing investigation”.

The AAIB’s preliminary report also notes that the FAA issued a Special Airworthiness Information Bulletin in December 2018 about a “locking feature” within fuel control switches on several Boeing models, including 787s. The locking feature is a safety device that requires the switches be lifted before being transitioned. It involves raised nubs that the switch must transition over.

Boeing fuel control switch

A fuel control switch similar to that found on Boeing 787s, showing that the switch must transition over raised bumps

That 2018 bulletin warned about potential “disengagement” of the locking feature, which could allow the switches to “be moved between the two positions without lifting”, potentially causing “inadvertent” engine shutdown.

Though the FAA recommended inspections, its bulletin concluded that issue was “not an unsafe condition that would warrant airworthiness directive”.

The FAA reiterated that position in its 11 July CANIC, saying the fuel control switch design does not pose “an unsafe condition”.

Though the AAIB’s report cited the issue, it drew no link between it and the crash