CloudChasing
2025-06-19T16:10:00
permalink Post: 11906159

Quote:

Originally Posted by tdracer

The only aircraft inputs to TCMA is air/ground and thrust lever positions - everything else is the FADEC and its sensors (primarily N1). Even if air/ground was compromised somehow, it would take other issues before TCMA could possibly be activated. Possible on one engine (although remote) - but two engines at the same time - almost literally imposssible (unless of course it's software error).
The 'good' news is that even a cursory check of the FDR will indicate if TCMA activated, so we'll soon know.

Software Engineer here. IMO software glitches are more likely than mechanical failures and pilot error, and I would say increasingly more so, particularly with Boeings. I have good reasons, experience and expertise for saying this that I\x92m not going to get into here because it\x92s too long winded and will no doubt upset some people who will mistake facts for rule and let it hurt their feelings.

In 2019 I think it was, an ANA 787 had a TMCA dual engine shutdown just after landing. There was also a bug that shut down all AC power on 787s powered on for 248+ days (integer overflow causing GCU failsafe) that was supposed to be remedied on 2019. Can\x92t find any information confirming that it was implemented on all 787s. These are just two examples of software bugs. There are placed of others, and it\x92s highly likely there are ones we don\x92t know about, either in the original software or in the updates.

Subjects: Dual Engine Failure Engine Failure (All) Engine Shutdown FADEC FDR TCMA (Air-ground Logic) TCMA (All)

2 users liked this post.

CloudChasing
2025-06-19T16:52:00
permalink Post: 11906189

Quote:

Originally Posted by tdracer

TCMA - first off, I have to admit that this does look rather like an improper TCMA activation, but that is very, very unlikely. For those who don't know, TCMA is a system to shutdown a runaway engine that's not responding to the thrust lever - basic logic is an engine at high power with the thrust lever at/near idle, and the engine not decelerating. However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.

You sound like you know what you’re talking about. I’m a software engineer. I think software glitches are more common for this type of event than mechanical failures or pilot errors. It can take years before software errors are discovered.

I read one post in here of a 747 flaps retracting on takeoff. No Master Caution, no warnings. Apparently, due to some maintenance triggering a software glitch, the computer thought reverse thrust had been activated during a take off. Whether it was still in ground mode I don’t know.

Point is, being a software glitch in TMCA has already shut down two engines on a 787, I don’t see why the same or another software glitch in TMCA or somewhere else couldn’t do the same. Hadn’t this plane just been in for maintenance?

Last edited by T28B; 19th Jun 2025 at 17:05 . Reason: Formatting assistance

Subjects: Engine Over-speed (All) Engine Shutdown (Over-speed) FADEC GEnx TCMA Logic N2 Over-speed TCMA (Activation) TCMA (Air-ground Logic) TCMA (All) TCMA (Improper Activation) TCMA (Shutdown) Weight on Wheels

4 users liked this post.

CloudChasing
2025-06-19T18:05:00
permalink Post: 11906239

Fuel valves and TCMA software updates?

Quote:

Originally Posted by tdracer

Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).

As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.

Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).

The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.

Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.

In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.

I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force.

I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.

The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.

Subjects: Air Worthiness Directives FAA FADEC Fuel (All) Fuel Cut Off Switches Fuel Cutoff Fuel Pump (Engine Driven) Fuel Pumps High Pressure Shutoff Valve RAT (All) RAT (Deployment) TCMA (Activation) TCMA (All) TCMA (Improper Activation) TCMA (Logic) TCMA (Shutdown)

CloudChasing
2025-06-21T12:52:00
permalink Post: 11907720

Tankering

Quote:

Originally Posted by Feathers McGraw

I don't disagree, but I wondered if there could be a plausible reason for filling up at DEL. I am sure the investigation will consider all fuel sources used by VT-ANB in the last day or perhaps more of its operation. Not that I am pointing the finger at fuel problems, I just don't know that's all.

I\x92ve seen multiple Indian media sources say they were fully loaded with fuel and tankering. I didn\x92t bite any of them down but I\x92ve definitely seen it reported on Indian media repeatedly.

Subjects: None

CloudChasing
2025-06-21T13:31:00
permalink Post: 11907756

Tankering

Quote:

Originally Posted by Feathers McGraw

VT-ANB flew DEL-AMD, approximately 1hr 15 minutes, before its fatal departure from AMD.

Does anyone know if fuel was added at AMD or was the total fuel required to LGW already aboard on departure from DEL?

according to multiple Indian media sources, refuelling at AMD took longer than usual as the plane was fully refuelled, despite only needing 53% for the journey

Subjects: None

1 user liked this post.

CloudChasing 2025-06-19T16:10:00 permalink Post: 11906159	Quote: Originally Posted by tdracer The only aircraft inputs to TCMA is air/ground and thrust lever positions - everything else is the FADEC and its sensors (primarily N1). Even if air/ground was compromised somehow, it would take other issues before TCMA could possibly be activated. Possible on one engine (although remote) - but two engines at the same time - almost literally imposssible (unless of course it's software error). The 'good' news is that even a cursory check of the FDR will indicate if TCMA activated, so we'll soon know. Software Engineer here. IMO software glitches are more likely than mechanical failures and pilot error, and I would say increasingly more so, particularly with Boeings. I have good reasons, experience and expertise for saying this that I\x92m not going to get into here because it\x92s too long winded and will no doubt upset some people who will mistake facts for rule and let it hurt their feelings. In 2019 I think it was, an ANA 787 had a TMCA dual engine shutdown just after landing. There was also a bug that shut down all AC power on 787s powered on for 248+ days (integer overflow causing GCU failsafe) that was supposed to be remedied on 2019. Can\x92t find any information confirming that it was implemented on all 787s. These are just two examples of software bugs. There are placed of others, and it\x92s highly likely there are ones we don\x92t know about, either in the original software or in the updates. Subjects: Dual Engine Failure Engine Failure (All) Engine Shutdown FADEC FDR TCMA (Air-ground Logic) TCMA (All) 2 users liked this post.
CloudChasing 2025-06-19T16:52:00 permalink Post: 11906189	Quote: Originally Posted by tdracer TCMA - first off, I have to admit that this does look rather like an improper TCMA activation, but that is very, very unlikely. For those who don't know, TCMA is a system to shutdown a runaway engine that's not responding to the thrust lever - basic logic is an engine at high power with the thrust lever at/near idle, and the engine not decelerating. However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely. You sound like you know what you’re talking about. I’m a software engineer. I think software glitches are more common for this type of event than mechanical failures or pilot errors. It can take years before software errors are discovered. I read one post in here of a 747 flaps retracting on takeoff. No Master Caution, no warnings. Apparently, due to some maintenance triggering a software glitch, the computer thought reverse thrust had been activated during a take off. Whether it was still in ground mode I don’t know. Point is, being a software glitch in TMCA has already shut down two engines on a 787, I don’t see why the same or another software glitch in TMCA or somewhere else couldn’t do the same. Hadn’t this plane just been in for maintenance? Last edited by T28B; 19th Jun 2025 at 17:05 . Reason: Formatting assistance Subjects: Engine Over-speed (All) Engine Shutdown (Over-speed) FADEC GEnx TCMA Logic N2 Over-speed TCMA (Activation) TCMA (Air-ground Logic) TCMA (All) TCMA (Improper Activation) TCMA (Shutdown) Weight on Wheels 4 users liked this post.
CloudChasing 2025-06-19T18:05:00 permalink Post: 11906239	Fuel valves and TCMA software updates? Quote: Originally Posted by tdracer Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring). As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level. Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC). The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight. Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident: 1) TCMA activation shutdown the engines or 2) The fuel cutoff switches were activated. I literally can come up with no other plausible scenarios. In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive. I\x92m sure this is wrong; was looking for confirmation. I read somewhere that the 787 keeps the fuel valve open by an electric driven actuator, and closes it by spring force. I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break. The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem. Subjects: Air Worthiness Directives FAA FADEC Fuel (All) Fuel Cut Off Switches Fuel Cutoff Fuel Pump (Engine Driven) Fuel Pumps High Pressure Shutoff Valve RAT (All) RAT (Deployment) TCMA (Activation) TCMA (All) TCMA (Improper Activation) TCMA (Logic) TCMA (Shutdown)
CloudChasing 2025-06-21T12:52:00 permalink Post: 11907720	Tankering Quote: Originally Posted by Feathers McGraw I don't disagree, but I wondered if there could be a plausible reason for filling up at DEL. I am sure the investigation will consider all fuel sources used by VT-ANB in the last day or perhaps more of its operation. Not that I am pointing the finger at fuel problems, I just don't know that's all. I\x92ve seen multiple Indian media sources say they were fully loaded with fuel and tankering. I didn\x92t bite any of them down but I\x92ve definitely seen it reported on Indian media repeatedly. Subjects: None
CloudChasing 2025-06-21T13:31:00 permalink Post: 11907756	Tankering Quote: Originally Posted by Feathers McGraw VT-ANB flew DEL-AMD, approximately 1hr 15 minutes, before its fatal departure from AMD. Does anyone know if fuel was added at AMD or was the total fuel required to LGW already aboard on departure from DEL? according to multiple Indian media sources, refuelling at AMD took longer than usual as the plane was fully refuelled, despite only needing 53% for the journey Subjects: None 1 user liked this post.

Posts by user "CloudChasing" [Posts: 5 Total up-votes: 7 Pages: 1]