Posts about: "TCMA (All)" [Posts: 279 Pages: 14]

Adding to your response TD, there is no time in this event where a high AOA arose prior to the final moments, around 13 seconds after the problem has occurred. AOA, intake separation is not a factor.

Going back to your prior comments on FADEC and TCMA; these are independent systems to each engine, however the event indicates a symmetric loss, and the potential of water ingress from a failed E/E sealing from the main cabin services remains a single causation that could result in multiple failures at the same moment. The last time I assessed issues in the E/E bay related to unauthorised inflight access to the fwd E/E of a B777 it was sobering how many irreversible conditions could arise. The B744 water inundation cases I was involved in were both on TO, the QF event was during deceleration. We are looking at vectors that come from outside of the normal assumptions in the SSA's, water fits that bill.

As I noted previously, the FADEC is a dual channel device. It's long been the case that dispatch is allowed with a single FADEC channel failed (this goes back to the original PW4000/CF6-80C2 as installed on the 747-400 and 767.
The MMEL says something like "4 installed, 3 required" (referring to individual FADEC channels) - so you can dispatch for a short time with one FADEC channel failed. Yes, if the remaining channel of faulted FADEC fails, the engine will fail - but the FADEC reliability is such that the probability of losing the remaining channel (and hence the engine) is sufficiently small as to be acceptable.

Both channels can operate TCMA, so a single channel failure has not overall effect on the system.

Again, 'channel out' dispatch is nothing new - it's been the case since 1989 (when the PW4000/767 entered service).

Repeating myself (again), but ALL the TCMA logic is resident in the FADEC. It takes aircraft inputs of air/ground (again, not familiar with the specifics of the air/ground logic used on the 787/GEnx-1B, so don't ask), thrust lever position, and what the engine is actually doing (mainly N1) to determine if the engine is 'out of control'.
The thrust lever inputs are hardwired (resolvers connected to the thrust levers, powered by the FADEC), other aircraft communications on the 787 are on an ethernet based network. Default mode for the FADEC if aircraft inputs are lost or invalid is "Air", as that is generally considered to be the 'safe' choice.
But even assuming some aircraft fault caused the FADECs to falsely believe the aircraft was 'on-ground', it would still take a pretty major error in the TCMA logic for it to actually trigger and shutdown the engine (especially lacking an associated thrust lever movement to idle). Never say never, but we're getting pretty far out on the probability tree for all these things to happen.

Yes. Thank you tdracer. All those postulating TCMA / FADEC faults please read and understand this clear explanation.

Then, ask yourselves which extraordinarily low probability bundle of previously unrevealed faults could spontaneously manifest themselves on both engines simultaneously.

Also ask yourselves why these faults manifested at that critical phase of flight and not during taxiing or take-off roll when some of the TCMA sensors would have been primed.

Yes. Thank you tdracer. All those postulating TCMA / FADEC faults please read and understand this clear explanation.

Then, ask yourselves which extraordinarily low probability bundle of previously unrevealed faults could spontaneously manifest themselves on both engines simultaneously.

Also ask yourselves why these faults manifested at that critical phase of flight and not during taxiing or take-off roll when some of the TCMA sensors would have been primed.

After reading tdracers informative post this morning, I too was musing: Why is all this attention being given to TCMA.

Of course, when the probable cause is profoundly unclear, our continuing distrust of latent technical systems comes to the fore .... as sadly, the shadow of MCAS still looms large in our imaginations

As discussed 40 pages earlier two possible root causes for simultaneous rollback or flameout without signatures of bird strike remain:
- Shutdown by crew
- Involuntary shutdown by aircraft’s control systems

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

tdracer:

"What sort of 'confirmation' do you have in mind - the regulator mandate that resulted in TCMA basically says we can't take credit for the flight crew"

I had just that in mind, as any automated action that could shut down both engines really should have pilot confirmation, imho, but looks like the regulators may not have considered all possible scenarios.

Another question, maybe a complete red herring: Is the TCMA a completely self contained module with it's own processor and software, (possibly the best option) or is it part the FADEC software package, perhaps just a task in a real time multitasking system ?. If the latter, that would open a whole rabbit warren of possibilities.

From all the evidence thus far, it looks like the RAT did deploy, plus other data, which means there was likely a complete electrical power failure. The idea that all four generators and controls would fail at once doesn't make sense, so that doesn't leave much else as the next step.

the answer to that was already provided earlier

I preface this post by acknowledging all the previous posts in this, and the now-closed thread, about the TCMA, in particular the excellent posts by tdracer. (Ditto the noise analyses by Kraftstoffvondesibel and First Principal.)

I also note that the primary source of the information on which I’m basing my post is the content of Boeing’s patent application which, of course, does not contain any of the actual wiring diagrams or modification details of the TCMA, even assuming it has been implemented. (I understand from the now-closed thread, that there is an unresolved question as to whether a petition for an exemption from the TCMA requirement had been successful.)

The point of my post is to get other’s thoughts on one of the design principles of the TCMA system proposed in the patent application.

The ostensibly simple and elegant concept is described in the schematic of the system at figure 1 of the patent application. A copy of figure 1 is below.

The TCMA is the part of the schematic inside the dotted box numbered 16 , sitting with the EEC (others would call it the FADEC) in the solid box numbered 18 .

The heart of the TCMA comprises two switch relays, numbered 22 and 28 in the schematic, wired in series. Each of those switch relays is controlled by its own, dedicated engine control malfunction software, identified as the blobs numbered 130 . (The patent application identifies component 34 as a dedicated processor and 32 as the diode connected to the switch relays, but that is evidently a mistake. Component 34 is the diode and I can’t find a component number 32 anywhere in the schematics.)

Each relay switch and its controlling software is described as a ‘channel’, one A and one B. Both channels run continuously, monitoring throttle position (36 in the schematic) versus engine data fed from ARINC data bus lines (46 in the schematic) and “dedicated input sensors” not shown in the schematic. Those sensors presumably detect things like weight on wheels and perhaps RADALT.

This design is said to achieve redundancy, because if only one ‘channel’ detects the engine is producing excessive thrust while the throttle is set to idle, that channel will set its switch relay to CUTOFF and that is enough to change the state of the high pressure fuel shut off valve (58 in the schematic). No more motion lotion. In the words of the patent application: Both channels are “always actively monitoring engine function and independently have the capability of shutting down the engine.”

That arrangement wrinkled my crusty old avtech brow. In my mind – and this is why I’m seeking other’s thoughts – the advantage of redundancy arising from the two channels, either or both of which can shut the engine down, is not without risk. If it is possible for one of the channels to have some ‘glitch’ or hardware failure such that it does not detect an actual out of envelope condition justifying immediate shut down, with the other channel detecting the condition and shutting the engine down, it inexorably follows – does it not – that it is possible for one (or both) of the channels to have a ‘glitch’ or hardware failure that results in a shut down when there is no out of envelope condition?

Further, even if there are completely separate, duplicated sensors telling each channel things like the position of the throttle and whether or not there is weight on wheels, there remains the possibility of a combination of sensor failures/disconnects resulting in one channel being ‘convinced’ that an out of envelope condition exists, with a consequential cutoff of fuel to the engine.

I of course acknowledge the valid observations made about the remote probabilities of these kinds of glitches and failures.

I’ve heard rumours that there was much resistance to the mandating of TCMA systems. Having seen many, many strange faults caused by random shorts, open circuits, liquid ingress and other foreign objects, I can understand why there was that resistance. Every time you add something to a system and that added thing has electronic components and software and electrical connections and data inputs, you add risk of that thing malfunctioning or working perfectly but with erroneous inputs. In this case, there are effectively two added new things: two channels, each one of which has the ability to shut off the motion lotion to the engine to which they are strapped.

I make no comment on whether TCMA systems, if fitted, have anything to do with this tragedy.

My profound condolences to the families and friends of those killed or injured. My thoughts also go out to the many people who will be agonising over the potential causes and responsibility for it. And thanks to those who are working out the causes.

...

Unless I've missed another one, the relevant petition was for a time limited exemption for TCMA for the GEnx-1B. It was granted. See attached . Nope. Uploads failing. See here:

https://downloads.regulations.gov/FA...tachment_1.pdf

https://downloads.regulations.gov/FA...tachment_1.pdf

I haven't yet been successful in finding the details of the solution that would have brought TCMA for that engine into compliance by the 2018 deadline requested and granted.

This is one of the reasons for the valid theoretical points about probabilities not necessarily being valid as a matter of practicality. It's entirely reasonable to argue that, for example, the probabilities of a weight on wheels sensor failing at the same time as a throttle position sensor are vanishingly remote. But try predicting what will happen if a cup of coffee is spilt over a control console, or a piece of loose swarf in a connector shorts unrelated system wires or...

The scenarios are nearly infinite and it is impossible to predict the consequences of all of them.

Back to the subject of the TCMA, in order for the four channels (A and B for engine 1 and A and B for engine 2) to be truly independent, there would have to be, for example, four, separate weight on wheels sensors and two, separate throttle position sensors per throttle. I would be extraordinarily surprised if that's what has been implemented, but will happily stand corrected.

You'd be half right (or if you prefer, half wrong). Each channel of the FADEC has its own thrust lever position resolver. In other Boeing aircraft, there is a single resolver per engine, with dual electrical coils (i.e. electrically isolated but mechanically connected). But in order to go for full compliance with a (in my opinion) rather extreme FAA position regarding 'single failures' and 25.901(c), the 787 thrust lever actually has dual load paths, feeding to different thrust lever resolvers for each channel.

Well, I was looking at the drawings of the MD-11 thrust control module and there certainly are two sensors on each thrust lever. The sensors are implemented as a dual resolver on a common shaft. This level of redundancy is well understood by those who specify, design, test, and certify critical aircraft systems.

Edit - tdracer posted as I was typing. It seems 787 has even greater sensor separation.

And a sensor per channel per engine for actual thrust, and sensor inputs in addition to WoW switches to validate on-ground state (perhaps radio altimeters, as described by tdracer for some of the 74s, which I misread as 787s). I, too would be surprised \x97 stunned \x97 if all of that had been implemented. I really want to know what exactly was implemented, and when and in which specific airplanes/engines. What I expect, though, is that when we learn all of that, we'll decide that it really is exceedingly unlikely that TCMA shut down those engines in Ahmedabad the other day. But it sure looks like something did.

WHEN something catastrophic happens, like dual engine failure, that then creates a query about any "duality" between two standalone systems that really should have nothing whatsoever in common... except the PF.
Nothing in common? Is that really the case for the 787-8 in the Air India 787 crash?
Look at these three TCMA-related links in the order presented and note the proforma prescriptive caveats in the first two:

https://downloads.regulations.gov/FA...tachment_1.pdf
https://downloads.regulations.gov/FA...tachment_1.pdf
https://patents.google.com/patent/US6704630B2/en

TCMA is designed to detect and accommodate single failures within the EEC/FADEC, preventing a failure from jeopardizing the safe operation of the aircraft.
Implementation:
It involves implementing specific software changes within the engine's control system (EEC).
Regulation:
After some incidents, the design change was mandated by regulators, with a deadline for production aircraft by December 31, 2018, and a retrofit plan for existing aircraft.
Boeing 787 Application:
The TCMA feature is specifically relevant to the 787-8 equipped with GEnx-1B engines, but it may also be applicable to other 787 variants using the same engine type.

The first two links are respectively the request for and FAA affirmation/approval for a GENx-1b software system called TCMA (Thrust Control Malfunction Accommodation). TCMA is the system that precludes High Uncommanded Thrust (HUT) after touchdown by fuel-chopping the engines. It is designed to avoid runway departures. One input is power-lever position. It's then fair to say that (additionally) Air/Ground sensing is quintessentially vital (as to when the system is "armed" and can do this fuel-chop). The third link is the complex description (with diagrams) of the patent application's design functionality of TCMA.
FROM THE 3rd link above:
"​​​​​​The method of the present invention compares the engine's actual power level with a threshold contour defined by the TCMA software package. When the TCMA software package determines that a thrust control malfunction has occurred, based on the engine's power level exceeding the threshold contour, the engine is shut down by the TCMA circuit." It is also notable that it says within the 3rd link that "Typically the aircraft is allowed to operate for a limited period of time with just a single operative processing subsystem."
That Air India 787 was not long out of maintenance.
We are then motivated to ask "what dictates the Air/Ground sensing". Is it just a Weight-on-Wheels microswitch or a RADAlt? (or both? or triplicated micro-switches?). We may then ask: "Did Air India implement the post-5G changes to their RADAlts that concentrated on maintaining their auto-land capability (in the face of 5G interference with RADAlts?) I seem to recall that the FAA's dictums on this pointed out that it was an individual nation's responsibility to both control their 5G frequency spectrums and implement changes to Radar altimeters that would work interference-free in critical phases of flight. What has the Indian regulator done in this regard as the responsible entity? The whole shemozzle, starting with the US Federal Communications Commission (FCC) spectrum allocations, was an ongoing fight between the telecom giants and their getting their new mobile tech to market.

So where are we going with this line of causal reasoning? The only commonality/duality between left and right engines is the software driving the TCMA as monitored by the TCMA software incorporated in each engine's EEC. Most pundits have identified the gear-tilt as evidence that only the centre electrically-driven pump can do the gear-tilt if the engines' other two hyd systems are suddenly both in QUIT mode (which accords also with the instant RAT deployment and loud noise heard by the sole survivor) - and an ensuing transition from climb-out to a deadly sinking and commensurate attitude change for speed maint.
My unavoidable conclusion is that the selection of gear UP and the breaking of the gear downlocks (and WOW sensing and energization of the RADALTs) called upon the TCMA to fuel-chop the engines (via the TCMA functionality in each engine's EEC).
We could start by looking at the No Break Power Transfer (NBPT) tech used in modern airliners. This has led to Gen Control Panel meltdowns in 777's due to GEN contact meltdown. I know of one instance when a 773 was reduced to a RAT only landing enroute and another where a disastrous MEC fire occurred after start on pushback at LHR. A description of the systems glitch often experienced is at the following link. It's quite apparently a "gear-up" hiccup with potential damning consequences for smooth TCMA operation. As to be seen in the quality videos, a fuel-chop provides no real clue (such as engine failure/smoke/fire classically does). An uncommanded "reset" of the two engine's TCMA's upon gear retraction (link below) is trackable to be the sought after "duality" leading to a "both simultaneously quit" engine failure. These momentary electrical glitches and instant "resets" are described in the two links below. Food for reasoned thought?

https://tinyurl.com/yn5ce4tz

https://tinyurl.com/3kkh6n3d

Thanks. Do we know that these are monitored by TCMA for air/ground state and if so, do we know the logic used to make a determination based on those inputs? Alternatively, do you know where we should be looking for those answers?

One comment here, and maybe I am mis-understanding your comment, but the landing gear only operates via the center hydraulics. It does not matter whether the Left/Right engine driven hydraulic systems are operative or not. The RAT will only pressurize the primary flight control portion of the center hydraulics.
No idea. I only got that info from the Master MEL on the FAA website. According to the MMEL the aircraft can be dispatched as long as there is one of each type sensor working on each main gear. (AIs MEL could be more restrictive)

Thanks again. Yes, I checked the MMEL too. It also says that the aircraft may be dispatched with one of two TCMA functions operational . Edit: dragon6172 has pointed out that the cited MMEL entry for TCMA applies to Rolls Royce engines, so not relevant here.