Page Links: Index Page
FrequentSLF
June 15, 2025, 22:08:00 GMT permalink Post: 11902892 |
What Alty posted is correct. There have always been single faults in the engine control systems that could cause uncommanded high thrust (UHT) - and such failures were considered in the safety analysis (e.g. FMEA) with the note that it wasn't unsafe as the pilot would shutdown the affected engine. Then there was a 737-200 event (JT8D engines) (1999 sounds about right - I'm thinking it was either an Egyptian operator or it happened in Egypt, but don't hold me to that) - the JT8D had an issue with excessive wear of the splined shaft that provided the N2 input into the hydromechanical fuel control. In this event, that splined shaft started slipping - causing the fuel control to think the N2 was below idle, and it keep adding fuel to try to get the N2 back above idle. This caused the engine to accelerate uncontrollably - the pilots pulled back the throttle and performed an RTO, but the engine didn't respond, and they went off the runway at low speed. Everyone evacuated safely, but the aircraft was destroyed by fire.
The FAA pointed to this accident and said we couldn't depend on crew action to shutdown a runway engine, and therefore any single failure that could result in uncontrollable high thrust was not compliant with 25.901(c) (basically says no single fault can result in an unsafe condition). This basically made every commercial airliner flying non-compliant as every turbine engine control system at that time had single faults that could cause UHT ![]() I've never been 100% comfortable with TCMA (for reasons that should be all to obvious right now), but the regulators gave us few options. BTW, during the early development of the 747-8, we didn't have a robust way of providing air/ground to the FADECs - which the FAA immediately found objectionable since they never wanted the risk of TCMA being active in-flight. I eventually came up with a design change that would provide a robust air/ground indication (it solved several issues we were confronting at the time), so that concern went away - which made the FAA very happy. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): FAA |
FrequentSLF
June 15, 2025, 23:04:00 GMT permalink Post: 11902942 |
I fully understand how that is coded, thanks to Tdracer for going in detail of DAL -A certified. However IMHO considering the unusual event, a bug on that piece of code should not be discounted.
Subjects: None |
FrequentSLF
June 17, 2025, 23:16:00 GMT permalink Post: 11904752 |
Still FLS with some decent engineering background,
Said so my apologies if is not pertinent to the discussion. I am puzzled by the TCMA logic, as shown on the patent, which of course could have nothing to do with final design, but clearly in my understanding the two FADEC channels are acting in series, therefore by design they do not need to concur to shut down the engine. Am I wrong? Subjects (links are to this post in the relevant subject page so that this post can be seen in context): FADEC |
FrequentSLF
June 20, 2025, 23:56:00 GMT permalink Post: 11907397 |
SLF here,
With what might be a stupid question, however let me ask. Why the ground logic does not incorporate the wheel up command? Subjects: None |
FrequentSLF
June 21, 2025, 22:31:00 GMT permalink Post: 11908118 |
Could the testing of TCMA logic less robust for the portion that works only when is not armed (i.e. not on ground)? I am asking this because from previous posts the ground logic needs only one signal (WoW, radio altimeter) to be true, if so is correct a faulty sensor could have armed the TCMA? That would have removed a safety layer on the system.
Subjects: None |
FrequentSLF
June 22, 2025, 00:08:00 GMT permalink Post: 11908168 |
What boggles my mind (if my understanding is correct) is that you have redundant systems that use that redundancy not to make sure that they never accidentally shut down an engine improperly but rather to make sure they never fail to shut down an engine if even one channel thinks it should.
AFAIK
engines not returning to idle have not killed anyone yet (the engine can typically be just turned off or the fire handle pulled once the crew decides they want the engine to die) but engines shutting off at a bad time are an obvious hazard.
![]() Subjects: None |
FrequentSLF
July 11, 2025, 22:22:00 GMT permalink Post: 11919906 |
I found interesting and worth of consideration the carefully wording... the report says switches 'transitioned' not 'moved' hence it does not imply a deliberate action.
Subjects: None |
FrequentSLF
July 12, 2025, 00:06:00 GMT permalink Post: 11920026 |
Respectfully, your explanation is invented from your personal experience. It does not cleanly fit the facts as provided in the report, and in fact must assume the report authors intentionally omitted all description of cycling/fiddling. It also assumes spilling and shorting that are not described anywhere.
A more straightforward explanation is that the controls were manually moved to CUTOFF. Then, seconds later they were manually and individually moved to RUN. According to the report, expected effects occurred with each "transition." "P1 Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position" "Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN" "Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN" Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Fuel (All) Fuel Cutoff Fuel Cutoff Switches RUN/CUTOFF |
Page Links: Index Page