Posts about: "TCMA (All)" [Posts: 279 Pages: 14]

Aerospace101
2025-06-19T14:11:00
permalink
Post: 11906054
Originally Posted by PBL
It does not follow that MCAS malfunction is a software malfunction.
As far as I know, the software functioned exactly as it was specified/required to function. The problem did not lie in the quality of the software, as you suggest. It lay in the functional requirements for the function, and the hazard analysis of those requirements, and those are manufacturer tasks.
I thought this was a very good point. There are some detailed posts discussing the TCMA patent including this post . Is it possible the TCMA software functioned exactly as specified, and the issue is input data into TCMA?

In a total electrical failure, when the system switches to emergency battery power, how are input variables like rad alt and wow switches processed? (these were inputs someone mentioned on the 747-8, have the TCMA inputs been identified yet?)

I speculate the gear truck forward tilt is a symptom of a C hydraulic failure caused by a total electrical failure around the time of VR. Once they got 10 deg nose up on the rotation, with a total electrical failure, could the FADEC receive erroneous rad alt or wow inputs, and how would TCMA handle these inputs in the transition from ground to air logic?

What is baffling is the simultaneous nature of the suspected dual engine shutdown. There is no obvious asymmetry, with the flight path or rudder movements. If the engine fuel control switches had been manually cut one at a time, there should have been some visible flightpath change or flight control response. Something happened to both engines at exactly the same time.

2 users liked this post.

bill fly
2025-06-19T15:09:00
permalink
Post: 11906100
In another Japanese incident, on Jan 17 2019, an ANA 787 suffered a double engine cut during landing at Osaka.
There is a PPRUNE thread on it. The TCMA system was discussed therein.

Both occurrences were close to the time of Ground/Air - Air/Ground transition.

Mentioned here due to not having found reference to the Osaka case in this thread.

I draw no conclusions.
mh370rip
2025-06-19T15:50:00
permalink
Post: 11906137
SLF Engineer(electrical -not aerospace) so no specialised knowledge of any kind.
The TCMA discussions on here seem clear that in normal operation the TCMA functions should not
operate in air mode and the TCMA has multiple inputs from various sensors (Rad alts, WOW sensors).
My query is to how these signals are routed to the engines, are they compared/aggregated in or routed through
the EE bays. If they are present in the EE bays then fdr's idea of a water leak at rotate into the EE bays
could generate shorts from the HV buses to the TCMA units.
Are the TCMA units designed to cope with 400V AC inputs where a low voltage input is expected.
I appreciate that the TCMA has to physically power a valve closed but applying high voltage to low voltage
logic circuitry might have unexpected consequences.

Last edited by T28B; 19th Jun 2025 at 16:10 . Reason: fdr not tdr

1 user liked this post.

CloudChasing
2025-06-19T16:10:00
permalink
Post: 11906159
Originally Posted by tdracer
The only aircraft inputs to TCMA is air/ground and thrust lever positions - everything else is the FADEC and its sensors (primarily N1). Even if air/ground was compromised somehow, it would take other issues before TCMA could possibly be activated. Possible on one engine (although remote) - but two engines at the same time - almost literally imposssible (unless of course it's software error).
The 'good' news is that even a cursory check of the FDR will indicate if TCMA activated, so we'll soon know.
Software Engineer here. IMO software glitches are more likely than mechanical failures and pilot error, and I would say increasingly more so, particularly with Boeings. I have good reasons, experience and expertise for saying this that I\x92m not going to get into here because it\x92s too long winded and will no doubt upset some people who will mistake facts for rule and let it hurt their feelings.

In 2019 I think it was, an ANA 787 had a TMCA dual engine shutdown just after landing. There was also a bug that shut down all AC power on 787s powered on for 248+ days (integer overflow causing GCU failsafe) that was supposed to be remedied on 2019. Can\x92t find any information confirming that it was implemented on all 787s. These are just two examples of software bugs. There are placed of others, and it\x92s highly likely there are ones we don\x92t know about, either in the original software or in the updates.

2 users liked this post.

CloudChasing
2025-06-19T16:52:00
permalink
Post: 11906189
Originally Posted by tdracer
TCMA - first off, I have to admit that this does look rather like an improper TCMA activation, but that is very, very unlikely. For those who don't know, TCMA is a system to shutdown a runaway engine that's not responding to the thrust lever - basic logic is an engine at high power with the thrust lever at/near idle, and the engine not decelerating. However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.
You sound like you know what you’re talking about. I’m a software engineer. I think software glitches are more common for this type of event than mechanical failures or pilot errors. It can take years before software errors are discovered.

I read one post in here of a 747 flaps retracting on takeoff. No Master Caution, no warnings. Apparently, due to some maintenance triggering a software glitch, the computer thought reverse thrust had been activated during a take off. Whether it was still in ground mode I don’t know.

Point is, being a software glitch in TMCA has already shut down two engines on a 787, I don’t see why the same or another software glitch in TMCA or somewhere else couldn’t do the same. Hadn’t this plane just been in for maintenance?

Last edited by T28B; 19th Jun 2025 at 17:05 . Reason: Formatting assistance

4 users liked this post.

rigoschris
2025-06-19T16:54:00
permalink
Post: 11906193
Originally Posted by mh370rip
SLF Engineer(electrical -not aerospace) so no specialised knowledge of any kind.
The TCMA discussions on here seem clear that in normal operation the TCMA functions should not
operate in air mode and the TCMA has multiple inputs from various sensors (Rad alts, WOW sensors).
My query is to how these signals are routed to the engines, are they compared/aggregated in or routed through
the EE bays. If they are present in the EE bays then fdr's idea of a water leak at rotate into the EE bays
could generate shorts from the HV buses to the TCMA units.
Are the TCMA units designed to cope with 400V AC inputs where a low voltage input is expected.
I appreciate that the TCMA has to physically power a valve closed but applying high voltage to low voltage
logic circuitry might have unexpected consequences.
The TCMA runs on the FADECs (Full Authority Digital Engine Control). There is one per engine, located inside the nacelle. Each one has a dual channel design inside, to compare computations, inputs etc. and generally provide redundancy (but I don\x92t know further details on the design/logic).

The sensors and actuators related to that engine (pressure, temperature sensors, various valves etc.) are most likely directly connected to it. The two throttle position sensors per engine are also directly cabled to it according to tdracer. No idea how other inputs like WoW and RADALT are connected. The FADECs don\x92t necessarily need much else, as apparently Autopilot etc. always move the actual thrust lever.

There must also be a communication channel back to the flight recorders. No idea if it gets thrown into a comms bus or there is direct wiring.

In terms of power, each FADEC has its own alternator driven by the engine. But there\x92s a failover connection to the AC bus of the plane. Not sure if there\x92s a physical relay keeping it disconnected in normal operations.

1 user liked this post.

lancs
2025-06-19T17:24:00
permalink
Post: 11906207
Originally Posted by tdracer
... TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. ...
In software terms, they've reused an existing function to action new functionality. Raises a couple of questions: how many other functions make use of the same N2 overspeed protection functionality; what else could cause N2 overspeed, especially on two engines simultaneously, given the outcome? (Ignoring the software maintenance problems that such secondary purposing can cause later down the road.)

I read, maybe in the preceding thread, a post from a (?) chemical additive manufacturing specialist, referring to n2 speed problems caused by one of their additives incorrectly getting to a bearing (?) and creating a metallic oxide powder and subsequent issues. (Details vague as I can't find the original post - different problem domain to this though). Are there engine lubrication maintenance tasks in a roughly 2 hour turnaround?

Long time lurker, ex aerospace engineering design software engineer. Please delete if inappropriate.

[Edit: spoilling]

Last edited by lancs; 19th Jun 2025 at 18:18 .
ernst_mulder
2025-06-19T17:59:00
permalink
Post: 11906233
Originally Posted by bill fly
In another Japanese incident, on Jan 17 2019, an ANA 787 suffered a double engine cut during landing at Osaka.
There is a PPRUNE thread on it. The TCMA system was discussed therein.

Both occurrences were close to the time of Ground/Air - Air/Ground transition.

Mentioned here due to not having found reference to the Osaka case in this thread.

I draw no conclusions.
SLF, sorry

And that is the reason for my question in a previous post, at what height output from the ground proximity sensor does TCMA deem the plane is on the ground?

1 user liked this post.

CloudChasing
2025-06-19T18:05:00
permalink
Post: 11906239
Fuel valves and TCMA software updates?

Originally Posted by tdracer
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).

As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.

Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).

The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.

I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.

The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.

rigoschris
2025-06-19T18:19:00
permalink
Post: 11906247
Originally Posted by ernst_mulder
SLF, sorry

And that is the reason for my question in a previous post, at what height output from the ground proximity sensor does TCMA deem the plane is on the ground?
TCMA itself also checks the weight-on-wheel sensors, so a bad rad-alt input alone should not cause a problem.
And you need the actual deviation of actual thrust vs. commanded thrust for it to activate.

Last edited by rigoschris; 19th Jun 2025 at 19:06 . Reason: Punctuation
lancs
2025-06-19T18:45:00
permalink
Post: 11906260
Originally Posted by rigoschris
TCMA itself also checks the weight-on-wheel sensors, so a bad rad-alt input alone should not cause a problem…
From earlier in one of the threads, I believe the ground/air logic is a function of the airframe's processing, and fed to the FADEC/TCMA as a binary value.

It is to be noted, IIRC, that only the parameters for a 74? have been given for this air/ground relationship.

EDIT: Replace single with binary value. Binary yes/no not value say 1/0/-1 Ground/?/Air...

Last edited by lancs; 19th Jun 2025 at 20:14 .

1 user liked this post.

rigoschris
2025-06-19T19:04:00
permalink
Post: 11906277
Interesting thread towards the end, regarding the previous TCMA malfunction on landing : (pprune archived thread 617426, can\x92t post links yet)

according to Dave Therhino who claimed to have seen a detailed report, the TCMA would initialise the thrust contour logic when touching the ground. This was nominally not an issue, as the throttles and engine would be close to idle. However, if the reverser was briefly deployed right before weight on wheels, and then cancelled when the wheels touched, TCMA would see high thrust but throttles at idle and trigger.

But this was supposedly fixed and all FADECs updated. Plus, during take-off there should not be such large fluctuation in throttle position or thrust, so intermittent switching of ground-air-ground should not cause an issue.

Also, according to tdracer V2 overspeed protection cuts thrust so quickly, that if it triggered (via TCMA or whatever other reason) it was likely after the plane had lifted off the ground. I wonder though if there\x92s still enough kinetic energy to fly the profile of the incident flight with the engines cut right around rotation.

Also, would hydraulics go out so quickly, that wheels would not retract? Wonder if a faulty WoW sensor could be a contributing factor and would also not manifest itself as the wheels not retracting :thinking
MatthiasC172
2025-06-19T19:36:00
permalink
Post: 11906311
Shutdown or below flight idle?

Originally Posted by retiredCSE
I have read that TCMA can not activate unless TL set to idle . How about this made up scenario . During takeoff run close to takeoff speed PF decides to reject for ANY reason and moves TL-s to idle . PM (captain ? ). Says my airplane we are continuing and move TL-s back to full trust . TCMA triggers and shuts off the fuel . I am not implying that crew did anything wrong .
I am pretty sure that with WoW and >=85 kt a throttle being pulled to idle leads to immediate max autobrake plus speed-brake/spoilers deployment. I don’t see an option there to trigger TCMA like this but happy to learn from someone with more experience.

In the Jeju thread this forum used to analyze the haze of the engines to determine if they are only flight idle (or less) vs being shut down. Can someone with enough experience do the same here, please?

Also, a mere flight idle shouldn’t produce an N2 drop to below the VFSG limit if said VFSG can reproducibly support flight idle for significant times and even heavy loaded ground idle (under normal circumstances).

This is speculation but several have already pointed it out that while the thrust was overall and especially at the end symmetric there might have been a time window with right yaw. Could this indicate a sequential (if not staged), albeit in rapid succession “shutdown” of the engines?

1 user liked this post.

Captain Fishy
2025-06-19T20:20:00
permalink
Post: 11906336
Originally Posted by retiredCSE
I have read that TCMA can not activate unless TL set to idle . How about this made up scenario . During takeoff run close to takeoff speed PF decides to reject for ANY reason and moves TL-s to idle . PM (captain ? ). Says my airplane we are continuing and move TL-s back to full trust . TCMA triggers and shuts off the fuel . I am not implying that crew did anything wrong .
I posted a similar theory some time ago. I still think this maybe a possible cause. Hopefully it isn\x92t because if it is, it will ruin Boeing. Designing a system that has total autonomy over engine run state is hubristic to say the least.

1 user liked this post.

Bap7788
2025-06-19T20:21:00
permalink
Post: 11906338
Lower than calculated lift at Vr

Hi all,

Sorry it’s going to be a long one but seeing the level of competency here, I though it would be the perfect place to get my answers. From the precious messages read and answers received, I have a scenario to run. I am more than happy to be told wrong from point 1). I don’t have the knowledge some of you do.

Please let me first start by saying that I am not trying to incriminate anyone. Hundreds of CRMS debriefs and accidents reports show us that unfortunately sometimes, the holes in that swiss cheese just do line up. It is far too easy for any of us, seating here, to judge any of the sequences happening in a Flight Deck. Mistakes happen, regardless of training and experience. We all do mistakes, every day, in every line of work.

DISCLAIMER:
I know that the consensus is a dual engine failure due to either TCMA bug or any sort of mecanical/software/wear and tear.
I do hear a RAT (I don’t see it though) and I do find the audio analysis quite compelling. It is at the top of my list as probable cause.
I am just exploring another scenario, based on the AC’s profile and state from grainy video and poor audio.

1- Let’s assume that we do all our perf calculation correctly. Is it possible that the OPT would spit up a F15/20 take off with the conditions on the day on a 787?
2- If so, let’s say we have performances for a F15/20 TO in the FMC. Now let’s assume we select F5 for TO (not in the FMC, physically). Would there be an FMC message, or would that trigger the T/O warning on the 787? If it doesn’t, we now potentially have an aircraft on the heavy side, with already a lift penalty on a high density altitude day.
3- Please bear with me, I know so far I have made an awful lot of suppositions and assumptions. Murphy’s law dictates that what can happen will happen albeit not on the same day. As it was answered to me by someone who was obviously seeing where I was going in a previous post, it’s a lot of swiss cheese to line up.
4- Take off roll goes on, Vr F15/20 comes and we rotate at a speed lower than we should for our actual F5 setting. My buddy calls for GEAR UP, I retract flaps to F1. Another lift penalty. Is there enough thrust now, or are we then already to deep on the back end of the drag curve ?

I do understand that this is not testable in a simulator. I am asking if someone with a 787 OPT and/or FCOM and knowledge views this scenario as possible or not (especially regarding the FMC message and the T/O warning). That is all.
thanks for the help !

Last edited by T28B; 19th Jun 2025 at 22:23 . Reason: formatting assistance
AirScotia
2025-06-19T21:06:00
permalink
Post: 11906372
In the ANA 787-8 incident, I think they couldn't restart the engines in order to taxi? Is that also a feature of TCMA?
Musician
2025-06-19T21:50:00
permalink
Post: 11906413
Originally Posted by That lights normal!
Could water and/or chafing in the wiring loom \x93convince\x94 the \x93system\x94 that the AC was on the ground?
Then adjust the thrust accordingly.
You may be surprised to learn that aircraft sometimes need full thrust on the ground.
TCMA requires that the pilot pulls the thrust levers back to idle, and that the engine fails to spool down to idle as commanded. Only then will it shut off the engine (on the ground).
Pilots try to avoid pulling the thrust levers back to idle when they're taking off.
For that reason, TCMA has never triggered during take-off before.

5 users liked this post.

MatthiasC172
2025-06-19T22:06:00
permalink
Post: 11906425
TCMA restart

Originally Posted by AirScotia
In the ANA 787-8 incident, I think they couldn't restart the engines in order to taxi? Is that also a feature of TCMA?
*On the ground* you get into a latched state, once TCMA deploys: after activation the relays stay latched to prevent a re-runaway. A full power reset of the affected EEC channel(s) and relay logic - normally done only at the gate - is required before fuel can flow again. So you can\x92t easily relight.

2 users liked this post.

EDML
2025-06-19T22:17:00
permalink
Post: 11906440
Originally Posted by Musician
You may be surprised to learn that aircraft sometimes need full thrust on the ground.
TCMA requires that the pilot pulls the thrust levers back to idle, and that the engine fails to spool down to idle as commanded. Only then will it shut off the engine (on the ground).
Pilots try to avoid pulling the thrust levers back to idle when they're taking off.
For that reason, TCMA has never triggered during take-off before.
Actually TCMA will react on any significant difference between commanded thrust and actual thrust. It does not have to be idle. tdracer clarified that further up in this thread.

6 users liked this post.

AirScotia
2025-06-19T22:34:00
permalink
Post: 11906450
Originally Posted by MatthiasC172
*On the ground* you get into a latched state, once TCMA deploys: after activation the relays stay latched to prevent a re-runaway. A full power reset of the affected EEC channel(s) and relay logic - normally done only at the gate - is required before fuel can flow again. So you can\x92t easily relight.
Thanks, makes sense.

Technically, then, if TCMA deployed erroneously during takeoff, there would be no way for the pilots to restart the engines?

2 users liked this post.