Posts by user "lighttwin2" [Posts: 11 Total up-votes: 18 Pages: 1]

Many GE engines - including GEnx-1B/67s - require microprocessors to be routinely replaced due to soldered joints failing after multiple cycles. There is a 2021 AD that notes "This AD was prompted by an in-service occurrence of loss of engine thrust control resulting in uncommanded high thrust" (I cannot post a link but google: 2021-25491 (86 FR 66447))

I am NOT suggesting that this specific failure mode happened here - for one thing, this would happen to one engine, not both. But on any flight it is possible that a unique set of sensor inputs to occur that are the first time any system has encountered them (example: NATS incident in 2023), and then you need failover & redundancy to keep things working.

The GE Aviation CCS system, which includes thrust management, has up to now flown for 1m flight hours without incident. It would be interesting to hear the perspectives of any engineers familiar with the system.

Presumably a dual engine shutdown under TMCA (i.e. similar to the ANA incident) would cause the RAT to deploy.

Obviously difficult to envisage what could cause an TMCA activation on both engines simultaneously given the safeguards in place (weight on wheels etc). However maybe the time delay from an erroneous TMCA activation on the runway/at rotation would lead to a loss of power 10 seconds later.

The software operates regardless of engine type and there are other triggers (not just engagement of thrust reversers, that was just the specific combination of inputs on the ANA flight). As I understand it the EEC compares the engine performance to thrust lever inputs to identify a potential runaway.

Note, the EEC module in GEnx itself is subject to periodic replacement under an AD due to risk of solder failure, but this seems unlikely to be related as would only impact a single engine.

Thank you for an excellent comment.

Two thoughts re TCMA: 1) Is it possible a false TCMA activation could have occurred just before, or concurrently with, the a/c leaving the ground, with the resulting loss of thrust and electrical power not being apparent for another (say) 10s); 2) As you say two simultaneous failures very unlikely... except that it did happen to that ANA flight, albeit during ground state.

There are a few comments along the lines of "it is incredibly unlikely that..." this is selection bias in reverse. Something incredibly unlikely has happened, and it's contained in this sample set.

To summarise some known facts about the TCMA system:

1) TCMA will shut down an engine if:

• It believes via multiple redundant sensors indicate the aircraft is on the ground
• It detects engine power in excess of that set by the thrust levers - subject to a margin to account for engine performance variation - that is determined to be a runaway condition

2) In 2019 an ANA pilot was able to confuse the TCMA by rapidly moving the thrust levers into reverse, to forward and back into reverse again. This caused both engines to shutdown.

3) Since then the TCMA should have been updated/fixed (and indeed the software will have been updated by SB since the a/c was delivered, to detect a wider range of runaway conditions)

And speculation:

4) It may be possible - given the close timings - that a TCMA activation occurred as the a/c was leaving the ground, with kinetic energy and spool down time getting the a/c from the ground to its peak height

In the recent BA LGW incident the PF reduced thrust to idle at V1, then added thrust back, then committed to a RTO. I wonder if something similar could have occurred:

• In error, PF reduces power to idle at a speed approaching V1
• Engines begin reducing power, but n1 reduces more slowly than the TCMA system is expecting (perhaps because the TCMA margin is calculated when the a/c is stationary, but at 170kt a turbofan will spool down more slowly due to the ram air / windmill effect)
• TCMA detects a runaway condition - while a/c is on the ground - and cuts off fuel via the relay circuit
• PF decides to commit to takeoff and rotates, not knowing that TCMA has already activated
• 10-15s after rotation, n1 has now dropped below minimums for electrical generation. Electrics fail, final transponder signal is sent, and RAT is deployed

Obviously this should not be possible, and there are other possibilities.

TCMA requires the a/c to believe it is on the ground (via multiple redundant inputs, both weight on wheels and radalt). I do not know if there is also a max activation speed.

I posited a potential TCMA sequence in a post timed 1804Z - speculative of course. Agree with others, it is difficult to contemplate and seems staggeringly unlikely.

On the statistics I would be wary of selection bias (in reverse). Until now this a/c type has had 1m hours without accident, so what has happened is by definition incredibly unlikely. If you attend a meetup of lightning strike survivors, it is not much use to say how rare it is to be struck by lightning (if you see what I mean).

Entirely valid to opine on the relative probability of different causes of course, just to note that by definition we are looking at an incredibly unlikely sequence of events.

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

I was not aware that we have granular ADS-B data from the a/c itself showing airspeed post rotation (rather than speed interpolated from GPS). Apologies if I have missed it. If it does show acceleration after takeoff I tend to agree with you.

In no particular order, here are some more thoughts on TCMA having caught up on the thread:

If you cut the fuel from two big engines at take-off power, there must be some delay before n2 decays below the threshold for generation (below idle n2), the generators disconnect and RAT deploys. GEnx have relatively long spool up/down times as the fan is so large (and would be exposed to 170+kts of ram air). Perhaps someone has a view on how long this would be, but I imagine it could easily be 10s or more between fuel cut off and RAT deployment. On AI171 the RAT appears to be already deployed at the beginning of the bystander video. That starts c. 13s before impact and around 17s after rotation. This does not prove anything except that the supposed shut down must have happened very close to rotation and could have happened just before rotation while the a/c was on the ground.

As a thought experiment, imagine if ANA985 in 2019 had decided to go around. The a/c rotates and is ~50 ft above the runway, suddenly both engines spooling down, very little runway left to land on and no reverse thrust available. I am struck by how similar this scenario is to AI171. This theory would require there to have been unexpected thrust lever movement in the moments before rotation - but plausibly one pilot moving to reject, followed by an overrule or change of heart - or even a simple human error such as the recent BA incident at LGW - could achieve this. This is perhaps more likely that any sensor fault that you would expect to only impact a single engine given the redundancy of systems.

Tdracer writes that a key requirement of TCMA is to identify an engine runaway in the event of an RTO, in order to allow the a/c to stop on the runway. This will have been tested extensively - it is a big leap to imagine a false activation could be triggered. It did happen on ANA985 but through a very unusual set of inputs including application of reverse (albeit this latter point may not be relevant if TCMA logic does not distinguish between the reverser being deployed or not).

Incidentally there is an assumption the TCMA software version in place on the ANA flight had already been patched and fixed on AI171. That probably is the case but I am not sure it is a known fact.

In summary I remain baffled by this tragic accident. I have not yet read anything that explicitly rules out TCMA activation and it remains a possibility due to the vanishingly small number of factors that could shut down two engines at apparently the exact same moment when they have fully redundant systems. Fuel contamination, for example, has typically impacted each engine a few minutes (at least) apart. I am also cautious (as others have pointed out) of a form of confirmation bias about Boeing software systems with four-letter acronyms.

In my mind the cause could equally well be something completely different to anything suggested on this thread, that will only become clear with more evidence. All of the above also incorporates a number of theories, i.e. that there was an engine shutdown - that are not conclusively known.

Thank you to the mods for an excellent job.

I agree with the post above (edited for brevity) - and fear the thread is getting repetitive in the absence of new information.

The only thing I would add is the limited ADS-B data I have seen shows the a/c decelerating rapidly from the first data point onwards. It is possible the shutdown occurred when the a/c was on the ground (e.g. after V1). This may seem unlikely given the distance flown, but you can do the maths - a fast a/c has a lot of stored kinetic energy.

Let me try and summarise one possible scenario and then link in some of the better posts provide evidence relating to it:

• In error, PF reduces power to idle and/or reverse at a speed after V1 (either deciding to reject, or for some unexplained reason e.g. the recent BA incident at LGW)
• Decision is changed to continue take-off, thrust levers moved to TOGA
• Let's say the thrust inputs are similar to NM985 and TCMA is triggered; and engines shut down around the time of rotation
• A/C rotates achieving a maximum speed in the region of 184kts

Relevant "ruling out" questions, with links to posts that add new information:

Q: Would the a/c have enough kinetic energy a 184kts to climb to 100-150ft agl and then reach its final position if the engines had failed at, or just, before rotation?
A: Theoretically possible - see calculation here . NB, the a/c actually flew 1.5km from the end of the runway and 2.3km from the likely point of rotation.

Q: Doesn't the forward position of the gear mean that power failed after the pilots had selected gear up?
A: Inconclusive - had hydraulic power had been lost prior to rotation, the gear could also be in this position - explanation here

Q: If the throttle levers were brought to idle during take-off, would the A/C have applied autobrake, reversers and speedbrake?
A: Yes, although there is a built in delay before reverser and speedbrake actually deploy - see here .

Q: Is the ADS-B data consistent with this scenario?
A: Yes, e.g. the Flightradar data shows the aircraft decelerating rapidly (12 knots in 4.2 seconds) from close to rotation. However, it's not clear how accurate this data is. For one, the altitude data is +/- 25 feet, second, while I was under the impression FR would have received airspeed data from the a/c sensors, this post suggests maybe not.

Q: Does TCMA activation require the thrust levers to be at idle or does it function when the thrust levels are above idle, but where the actual thrust is above that commanded?
A: No, the latter is true (i.e. idle is not required) - confirmed here - there are of course many protections against false activation

Q. Did AI171 have the same software version / logic paths as NH-985
A. Unknown. That a/c had Trent 1000s so to some extent the software is different, but we understand the TCMA logic is broadly the same regardless of engine. I have not seen a post clarifying whether the TCMA software has been updated /changed via SB since 2019 to account for this incident.

Be grateful if posters could refrain from speculative responses "e.g. I think this is unlikely because I feel x". I am not opining on how likely this sequence of events is, simply trying to summarise whether or not this theory has been ruled in or out.

I also recommend this post for a summary to read before posting. .