2025-06-15T06:25:00
permalink Post: 11902143
So are we now saying total loss of AC power for the RAT activation and activation of TCMA on two very independent engines for the power loss? What are the chances..
I can buy the AC power loss, but TCMA activation as well - That\x92s a stretch. TCMA is available on the ground and on approach and will activate if the engine thrust doesn\x92t follow the Thrust Lever command. On the ground it will shut the engine down (think RTO with engine stuck at T/O). On approach it will reduce the thrust if the engine doesn\x92t respond to the Thrust Lever command ala Cathay Pacific A330 (CMB - HKG) with the fuel contamination incident.
I can buy the AC power loss, but TCMA activation as well - That\x92s a stretch. TCMA is available on the ground and on approach and will activate if the engine thrust doesn\x92t follow the Thrust Lever command. On the ground it will shut the engine down (think RTO with engine stuck at T/O). On approach it will reduce the thrust if the engine doesn\x92t respond to the Thrust Lever command ala Cathay Pacific A330 (CMB - HKG) with the fuel contamination incident.
1 user liked this post.
2025-06-15T06:47:00
permalink Post: 11902155
I hate to disappoint you, but the people (like me) who design, test, and certify aircraft are not idiots. We design for failures. Yes, on rare occasion, something gets missed (e.g. MCAS), but we know that aircraft power systems sometimes fail (or suffer short term interuptions) and we design for that. EVERY VALVE IN THE FUEL SYSTEM MUST BE POWERED TO CHANGE STATE!!!! If electrical power is lost, they just stay where they are. The engine fuel valve must be powered open, and it must be powered closed. Same with the spar valve. The pilot moves a switch, that provides electrical signals to the spar valve and the engine fuel valve to open or close. It's
not
complicated and has been in use for decades.
TCMA (not TCAM) - Thrust Control Malfunction Accommodation - is a FADEC based system. It's resident in the engine FADEC (aka EEC) - the ONLY inputs from the aircraft that go into the TCMA is air/ground (to enable) and thrust lever position (to determine if the engine is doing what it's being commanded to do. The FADEC has the ability to shutdown the engine via the N2 overspeed protection system - this is separate from the aircraft run/cutoff signal, although it uses the same HPSOV to effect the shutdown. That same system is used by TCMA to shutoff fuel if it determines the engine is 'running away'.
Hint, you might try going back a few pages and reading where all this has been posted previously.
TCMA (not TCAM) - Thrust Control Malfunction Accommodation - is a FADEC based system. It's resident in the engine FADEC (aka EEC) - the ONLY inputs from the aircraft that go into the TCMA is air/ground (to enable) and thrust lever position (to determine if the engine is doing what it's being commanded to do. The FADEC has the ability to shutdown the engine via the N2 overspeed protection system - this is separate from the aircraft run/cutoff signal, although it uses the same HPSOV to effect the shutdown. That same system is used by TCMA to shutoff fuel if it determines the engine is 'running away'.
Hint, you might try going back a few pages and reading where all this has been posted previously.
I hope I never suggested you guys are idiots! I very much doubt that indeed. You cannot be idiots. Planes fly, very reliably. That's evidence enough.
Maybe my analysis is simplistic, but for someone who knows as little about the nuts and bolts that are your profession, I think I'm not doing too badly.
I believe I have made a number of worthy contributions to this thread. Maybe I'm deluded. Too bad. Fact is, over the history of modern aviation, there have been a number of serious design stuff ups that "shouldn't have happened". As far as I'm concerned, the crash of AF447 is bloody good evidence of not considering a very simple, fundamental failure, and should NEVER have happened. The thing is, that would have been sooo easy to avoid. So please, don't get on too high a horse over this.
Thanks for your information about all the fuel control valves. That's cool. Yes, my cars have numerous such systems, from the radiator grilles backward.
And you misunderstand what I meant about "complicates things". Was that deliberate? What I meant was it complicates understanding how a major electrical failure could cause the Fuel Cutoff valves to close, that's all. The valves don't close if unpowered, but if the control is via the FADEC, then what could have caused them to close?
Your explanation of how the Fuel Valves are controlled is rather simplistic too. "The pilot moves a switch, that provides electrical signals to the spar valve and the engine fuel valve to open or close." Seriously? Am I an idiot then? Is it a single pole, single throw switch? Is the valve driven by a stepper motor, or what? A DC Motor and worm drive? Does it have an integral controller? How does the valve drive know when to stop at end of travel? Would you mind elaborating, please?
1 user liked this post.
2025-06-15T07:25:00
permalink Post: 11902183
About software (and TCMA). This a/c is in service around the world since some time. I understand that, for "something bad" to happen, then two independent conditions A and B must be (incorrectly) determined to be met. By now, rather than simply saying "very very unlikely", surely there Must be actual data of how often either A or B had been triggered (incorrectly). Not just for TCMA but any other feature with multiple protections. I would be curious to learn how the knowledge of the systems is actually improved with time, and how the 'Never' probabilities change (or not).
Regarding this TCMA, from what I think I understood, (A) would be some discrepancy between commanded thrust and actual thrust (and this requires calibration based on many engine and environmental parameters) and (B) would be the Aircraft on Ground. Maybe overly simplistic but roughly true?
Regarding this TCMA, from what I think I understood, (A) would be some discrepancy between commanded thrust and actual thrust (and this requires calibration based on many engine and environmental parameters) and (B) would be the Aircraft on Ground. Maybe overly simplistic but roughly true?
2025-06-15T09:10:00
permalink Post: 11902268
TCMA requires the a/c to believe it is on the ground (via multiple redundant inputs, both weight on wheels and radalt). I do not know if there is also a max activation speed.
I posited a potential TCMA sequence in a post timed 1804Z - speculative of course. Agree with others, it is difficult to contemplate and seems staggeringly unlikely.
I posited a potential TCMA sequence in a post timed 1804Z - speculative of course. Agree with others, it is difficult to contemplate and seems staggeringly unlikely.
Any thoughts?
2025-06-15T11:27:00
permalink Post: 11902379
The lesson isn't avoiding failure. It's refusing to let failure define the outcome.
A lesson from this thread so far:
Beware acronyms which cite 'accommodation' or 'augmentation', particularly when they are not always explained or understood.
TCMA thrust control malfunction accommodation
MCAS manoeuvring characterises augmentation system
The lesson isn't avoiding failure. It's refusing to let failure define the outcome.
Beware acronyms which cite 'accommodation' or 'augmentation', particularly when they are not always explained or understood.
TCMA thrust control malfunction accommodation
MCAS manoeuvring characterises augmentation system
The lesson isn't avoiding failure. It's refusing to let failure define the outcome.
3 users liked this post.
2025-06-15T11:34:00
permalink Post: 11902390
There are a few comments along the lines of "it is incredibly unlikely that..." this is selection bias in reverse. Something incredibly unlikely
has
happened, and it's contained in this sample set.
To summarise some known facts about the TCMA system:
1) TCMA will shut down an engine if:
3) Since then the TCMA should have been updated/fixed (and indeed the software will have been updated by SB since the a/c was delivered, to detect a wider range of runaway conditions)
And speculation:
4) It may be possible - given the close timings - that a TCMA activation occurred as the a/c was leaving the ground, with kinetic energy and spool down time getting the a/c from the ground to its peak height
In the recent BA LGW incident the PF reduced thrust to idle at V1, then added thrust back, then committed to a RTO. I wonder if something similar could have occurred:
To summarise some known facts about the TCMA system:
1) TCMA will shut down an engine if:
- It believes via multiple redundant sensors indicate the aircraft is on the ground
- It detects engine power in excess of that set by the thrust levers - subject to a margin to account for engine performance variation - that is determined to be a runaway condition
3) Since then the TCMA should have been updated/fixed (and indeed the software will have been updated by SB since the a/c was delivered, to detect a wider range of runaway conditions)
And speculation:
4) It may be possible - given the close timings - that a TCMA activation occurred as the a/c was leaving the ground, with kinetic energy and spool down time getting the a/c from the ground to its peak height
In the recent BA LGW incident the PF reduced thrust to idle at V1, then added thrust back, then committed to a RTO. I wonder if something similar could have occurred:
- In error, PF reduces power to idle at a speed approaching V1
- Engines begin reducing power, but n1 reduces more slowly than the TCMA system is expecting (perhaps because the TCMA margin is calculated when the a/c is stationary, but at 170kt a turbofan will spool down more slowly due to the ram air / windmill effect)
- TCMA detects a runaway condition - while a/c is on the ground - and cuts off fuel via the relay circuit
- PF decides to commit to takeoff and rotates, not knowing that TCMA has already activated
- 10-15s after rotation, n1 has now dropped below minimums for electrical generation. Electrics fail, final transponder signal is sent, and RAT is deployed
3 users liked this post.
2025-06-15T12:00:00
permalink Post: 11902407
What if the PF called stop just before V1and closed the thrust levers but either changed his mind or was overridden by the other pilot, who rapidly pushed the thrust levers back up. Could this trigger a TCMA intervention and subsequent dual engine shutdown as it was still on the runway at this point? Hopefully not.
2 users liked this post.
2025-06-15T12:38:00
permalink Post: 11902430
What if the PF called stop just before V1 and closed the thrust levers but either changed his mind or was overridden by the other pilot, who rapidly pushed the thrust levers back up. Could this trigger a TCMA intervention and subsequent dual engine shutdown as it was still on the runway at this point? Hopefully not.
It also doesn\x92t explaine the ADS-B data showing acceleration after lift off.
1 user liked this post.
2025-06-15T15:24:00
permalink Post: 11902551
On Aviation Herald it is stated that "Government Officials reported the aircraft had a longer than normal takeoff run and used up almost all of the 3905 meters / 1499 feet runway". That would perhaps explain the dust on one of the videos as it passed across usually undisturbed areas. However it also would fit in with the theory in post #1433 that the thrust levers may have been pulled back and hence the aircraft had a period of deceleration before the levers were the quickly pushed forward and confused the TCMA.. It could be that the accident occurred due to what happened on the runway, not the overall config thereafter.
Additionally, ADS-B data and the triangulation of the video showing the takeoff would lead you to a different conclusion.
2025-06-15T17:15:00
permalink Post: 11902643
I think it needs to be said again that pretty much anything can happen to the aircraft systems and the engines will carry on running - this is by design as they have independent FADEC and power supplies and at sea level fuel will get through without boost pumps. You could almost saw the wing off the fuselage and the engine would still produce thrust, TCMA notwithstanding.
We don\x92t know yet what actually triggered the RAT from the relatively short list but every item on it means there is a serious/critical failure(s). The flight path suggests that it was a double engine failure or shutdown (commanded or uncommanded) as anything else should have left the aeroplane in a poor state but able to climb away .
We don\x92t know yet what actually triggered the RAT from the relatively short list but every item on it means there is a serious/critical failure(s). The flight path suggests that it was a double engine failure or shutdown (commanded or uncommanded) as anything else should have left the aeroplane in a poor state but able to climb away .
Secondly, as a (now ex) glider pilot who remains extremely interested in aviation in most of its forms, this discussion has been an education and thought-provoking, as it so frequently is whenever I lurk here (usually without logging in). Thank you all for sharing your knowledge, expertise and thoughts.
To my mind the above post (especially the sentence I highlighted) is amongst the best (and most succinct) summary of what the pilots likely faced, with little to no time to resolve the situation. I cannot imagine those last few seconds and my heart goes out to them, the passengers and the many loved ones left behind. If there is any good that can come of this, it is that the cause is found quickly, with no bias, and steps are taken to ensure the same holes in the cheese cannot happen again.
7 users liked this post.
2025-06-15T17:32:00
permalink Post: 11902653
2008, a Spanair MD-82 crashed in a similar way after liftoff in Madrid.
Final report Spanair
.Main cause: The pilots did not configure the airplane according to checklist and took of with zero flaps and slats. Contributing: previous maintance was disabling RAT heating (MEL if not flying into icing conditions) which somehow inhibited electrically the takeoff configuration warning. I am not implying in the least that such a thing happended to this Air India crash. I just mention it as a proof that some *minor* quirks can contribute to an accident (i.e. disturb FADEC, TCMA logic, you name it) . Modern aircraft software logic is even more complex than the wired logic of an MD-82. But still: all "IF so and so THEN so and so " code can produce weird results if the conditions are corrupted or delayed by data communication lags. And according to a witness, there were some electrical quirks on the previous flight and possibly some maintenance thereafter. Again not implying any wrongdoing.
2025-06-15T19:03:00
permalink Post: 11902726
I'd phrase it differently: the frequency (and harmonics) of the noise are consistent with it being a RAT. If you then assume that it was a RAT and infer distance and speed curves from the Doppler variation, you get plausible values for an aircraft. But the two things are somewhat linked so you can't really treat the second thing as confirmation of the first. (FWIW, I'm personally quite satisfied that it was indeed a RAT on the audio.)
4 users liked this post.
2025-06-15T19:23:00
permalink Post: 11902745
I will wager that this is absolute nonsense. The effect of pulling the power levers back to idle at rotate would be readily countered by pushing them back up again. The engines are still delivering thrust, it is a function of N1, not the lever. The lever commands where the thrust level will end up, the N1 gives the thrust output. The acceleration/thrust characteristics of these engines is not like a J52 or JT3D etc.
The proposition that is floated is that the pilot does not pull back on the control column, which he is holding onto with both hands as his seat slides backwards like a caricature of a bad Cessna 180 seat rail, that is plainly obvious from the pitch attitude of the aircraft, yet grabs lustily a double handful of thrust levers and holds onto those until meeting Ganesh in the next life?
Greek papers appear to be as rigorous and incisive in their cognition as the Daily Telegraph. Golly.
Seats: electric.
RAT deployment... presumably the hapless pilot doesn't grab the control column, or the thrust levers, just grabs both fuel control switches instead????
Do any reporters bother to read what they write?
The proposition that is floated is that the pilot does not pull back on the control column, which he is holding onto with both hands as his seat slides backwards like a caricature of a bad Cessna 180 seat rail, that is plainly obvious from the pitch attitude of the aircraft, yet grabs lustily a double handful of thrust levers and holds onto those until meeting Ganesh in the next life?
Greek papers appear to be as rigorous and incisive in their cognition as the Daily Telegraph. Golly.
Seats: electric.
RAT deployment... presumably the hapless pilot doesn't grab the control column, or the thrust levers, just grabs both fuel control switches instead????
Do any reporters bother to read what they write?
2 users liked this post.
2025-06-15T20:10:00
permalink Post: 11902783
TCMA is on both the Trent 1000 and GEnx-1B 'basic' - it was required for certification. There is no reason for TCMA to be listed in the MMEL as the only 'functional' portion is the via the electronic overspeed protection system (which is required for dispatch - no MEL relief) - the rest is software resident in the FADEC.
Where does that piece of software reside by the way?
2025-06-15T20:33:00
permalink Post: 11902800
TCMA
It was assumed for decades that in the event of uncontrollable high thrust (UHT) that the pilot would cut the fuel. Until there was a UHT event (1999?) on the takeoff roll and the crew - in an RTO - rode it all the way down and off the runway without cutting fuel. TCMA is primarily about the RTO scenario (throttle back to idle), and after that fleet event it became a requirement for FAA Part 25 certification.
2025-06-15T21:03:00
permalink Post: 11902838
Would be interesting to understand more about the exact definition of TCMA’s “on the ground“ and some more detailed insight into its implementation (only one or more WoW’s or multiple sensing?… is there a switch on the gear added? …is there an ALT/AGL check?.. how is implementation split over HW/FW/SW? … ).
Also, how could external factors impact that sequence to run.
Appreciating your previous answers (as usual).
Also, how could external factors impact that sequence to run.
Appreciating your previous answers (as usual).
)
Apologies for a few terse posts last night, but a couple of inane posts (by a usual suspect) really set me off. I've never used the 'ignore' function, but I may need to revisit that.
I posted this previously, but it was about 70 pages ago, so I understand not going back that far, or forgetting that tidbit amongst all the noise.
In short, I'm not familiar with the specific air/ground logic on the 787/GEnx-1B - the logic I posted (3 radio altimeters, 2 Weight on Wheels, at least one of each must indicate 'on-ground) is for the 747-8 (which I'm intimately familiar with). I have a vague recollection of a discussion with my GEnx-1B counterpart 10 or more years ago that suggested that the 787 was not as complex as the 747-8, but I don't recall any details. Basic FADEC logic (BTW, as someone else noted - it's "Full Authority", not "Autonomous") is to default to 'air' if in doubt, as it's considered to be 'safer'.
The only real hardware in the TCMA system is the N2 overspeed shutdown system - which goes through a BITE style functional test on every engine start. Everything else is in software - with the only aircraft inputs being Air/Ground and thrust lever position.
As I've posted previously, the FADEC is powered by a dedicated Permanant Magnet Alternator (PMA) - aircraft power is used only as a backup for starting or if the PMA fails. If the FADEC determines it is running on aircraft power with engine running (i.e. the PMA has failed), it sets a 'No Dispatch" fault message.
12 users liked this post.
2025-06-15T21:35:00
permalink Post: 11902865
It was assumed for decades that in the event of uncontrollable high thrust (UHT) that the pilot would cut the fuel. Until there was a UHT event (1999?) on the takeoff roll and the crew - in an RTO - rode it all the way down and off the runway without cutting fuel. TCMA is primarily about the RTO scenario (throttle back to idle), and after that fleet event it became a requirement for FAA Part 25 certification.
The FAA pointed to this accident and said we couldn't depend on crew action to shutdown a runway engine, and therefore any single failure that could result in uncontrollable high thrust was not compliant with 25.901(c) (basically says no single fault can result in an unsafe condition). This basically made every commercial airliner flying non-compliant as every turbine engine control system at that time had single faults that could cause UHT
. A consequence of this was everyone was effectively prevented from certifying any further engine control changes since we couldn't show compliance with 25.901(c) (even if the change actually improved safety). The FAA and EASA were forced to issue partial exemptions for all existing aircraft/engine combinations, with the stipulation that they wouldn't certify any new engines that didn't address UHT. A working group was put together at Boeing to come up with some way to comply - and they eventually came up with TCMA , only active on the ground since UHT was only considered unsafe when on the ground - first incorporated on the GE90-115B/777-300ER/200LR.
I've never been 100% comfortable with TCMA (for reasons that should be all to obvious right now), but the regulators gave us few options.
BTW, during the early development of the 747-8, we didn't have a robust way of providing air/ground to the FADECs - which the FAA immediately found objectionable since they never wanted the risk of TCMA being active in-flight. I eventually came up with a design change that would provide a robust air/ground indication (it solved several issues we were confronting at the time), so that concern went away - which made the FAA very happy.
23 users liked this post.
2025-06-15T22:08:00
permalink Post: 11902892
What Alty posted is correct. There have always been single faults in the engine control systems that could cause uncommanded high thrust (UHT) - and such failures were considered in the safety analysis (e.g. FMEA) with the note that it wasn't unsafe as the pilot would shutdown the affected engine. Then there was a 737-200 event (JT8D engines) (1999 sounds about right - I'm thinking it was either an Egyptian operator or it happened in Egypt, but don't hold me to that) - the JT8D had an issue with excessive wear of the splined shaft that provided the N2 input into the hydromechanical fuel control. In this event, that splined shaft started slipping - causing the fuel control to think the N2 was below idle, and it keep adding fuel to try to get the N2 back above idle. This caused the engine to accelerate uncontrollably - the pilots pulled back the throttle and performed an RTO, but the engine didn't respond, and they went off the runway at low speed. Everyone evacuated safely, but the aircraft was destroyed by fire.
The FAA pointed to this accident and said we couldn't depend on crew action to shutdown a runway engine, and therefore any single failure that could result in uncontrollable high thrust was not compliant with 25.901(c) (basically says no single fault can result in an unsafe condition). This basically made every commercial airliner flying non-compliant as every turbine engine control system at that time had single faults that could cause UHT
. A consequence of this was everyone was effectively prevented from certifying any further engine control changes since we couldn't show compliance with 25.901(c) (even if the change actually improved safety). The FAA and EASA were forced to issue partial exemptions for all existing aircraft/engine combinations, with the stipulation that they wouldn't certify any new engines that didn't address UHT. A working group was put together at Boeing to come up with some way to comply - and they eventually came up with TCMA , only active on the ground since UHT was only considered unsafe when on the ground - first incorporated on the GE90-115B/777-300ER/200LR.
I've never been 100% comfortable with TCMA (for reasons that should be all to obvious right now), but the regulators gave us few options.
BTW, during the early development of the 747-8, we didn't have a robust way of providing air/ground to the FADECs - which the FAA immediately found objectionable since they never wanted the risk of TCMA being active in-flight. I eventually came up with a design change that would provide a robust air/ground indication (it solved several issues we were confronting at the time), so that concern went away - which made the FAA very happy.
The FAA pointed to this accident and said we couldn't depend on crew action to shutdown a runway engine, and therefore any single failure that could result in uncontrollable high thrust was not compliant with 25.901(c) (basically says no single fault can result in an unsafe condition). This basically made every commercial airliner flying non-compliant as every turbine engine control system at that time had single faults that could cause UHT
. A consequence of this was everyone was effectively prevented from certifying any further engine control changes since we couldn't show compliance with 25.901(c) (even if the change actually improved safety). The FAA and EASA were forced to issue partial exemptions for all existing aircraft/engine combinations, with the stipulation that they wouldn't certify any new engines that didn't address UHT. A working group was put together at Boeing to come up with some way to comply - and they eventually came up with TCMA , only active on the ground since UHT was only considered unsafe when on the ground - first incorporated on the GE90-115B/777-300ER/200LR.
I've never been 100% comfortable with TCMA (for reasons that should be all to obvious right now), but the regulators gave us few options.
BTW, during the early development of the 747-8, we didn't have a robust way of providing air/ground to the FADECs - which the FAA immediately found objectionable since they never wanted the risk of TCMA being active in-flight. I eventually came up with a design change that would provide a robust air/ground indication (it solved several issues we were confronting at the time), so that concern went away - which made the FAA very happy.
2 users liked this post.
2025-06-15T22:27:00
permalink Post: 11902909
The TCMA doesn't do a lot. That makes it a lot easier to make sure that it works correclty.
That is how most embedded systems work.
2 users liked this post.
2025-06-15T22:40:00
permalink Post: 11902919
My understanding is that GE uses an automated coding system that takes logic diagrams of what we want the s/w to do and turns that into the s/w code - again don't know details (my expertise is engine control and engine/aircraft interface - not s/w development).
The FADEC is a dual channel device (most of the sensors are also duplicated between channels), but both channels use the same s/w (Rolls did a thing many years ago where the channels used different s/w - it was mess and caused all sort of problems - I don't think anyone else has tried that since).
FADEC software is classified as "Design Assurance Level A" (aka DAL 'A') - flight critical - same thing as FBW software. There are specific requirements for the creation, testing, and certification of DAL A software and it's quite exhaustive (those requirements are documented in an FAA/EASA approved s/w requirements document (DO-160 IIRC). Yes, it is possible for something designed and certified to DAL A to have 'bugs' (and yes it has happened), although those 'bugs' have nearly always been traced to requirements errors - not the actual incorporation of those requirements.
It's also worth noting that the GEnx-1B has millions of hours of operation. Nothing is 'impossible' - even a 10-9 event will happen given enough opportunities - but the odds are very low of it happening.
Then again, all of the plausible explanations for dual engine power loss that would explain this accident are of a very low probability.
11 users liked this post.