Posts by user "rigoschris" [Posts: 7 Total up-votes: 0 Pages: 1]

Actually, according to tdracer , each channel of the FADEC gets just one throttle resolver input, as the two resolvers are on separate wiring looms. So, the FADEC is using the dual channel feature to handle erroneous throttle position inputs. However, according to the patent at least, each channel can trigger TCMA and cut the fuel supply independently. So now we're down to only needing only one erroneous throttle signal per engine. Or one wrong interpretation of a signal, e.g. value clipping where you shouldn't (shortcircuit -> idle), some integer overflow etc.

So, from my understanding, if there is an issue with some of the throttle position sensors, the FADECs will detect a disagreement and keep the high thrust -> assume safe is "fly", whereas one of the TCMA channels might read or misinterpret throttle position close to idle. As the thrust doesn't decrease, at some point the upper bound of the falling TCMA thrust contour will be breached and the engine will be shut down.

The TCMA runs on the FADECs (Full Authority Digital Engine Control). There is one per engine, located inside the nacelle. Each one has a dual channel design inside, to compare computations, inputs etc. and generally provide redundancy (but I don\x92t know further details on the design/logic).

The sensors and actuators related to that engine (pressure, temperature sensors, various valves etc.) are most likely directly connected to it. The two throttle position sensors per engine are also directly cabled to it according to tdracer. No idea how other inputs like WoW and RADALT are connected. The FADECs don\x92t necessarily need much else, as apparently Autopilot etc. always move the actual thrust lever.

There must also be a communication channel back to the flight recorders. No idea if it gets thrown into a comms bus or there is direct wiring.

In terms of power, each FADEC has its own alternator driven by the engine. But there\x92s a failover connection to the AC bus of the plane. Not sure if there\x92s a physical relay keeping it disconnected in normal operations.

TCMA itself also checks the weight-on-wheel sensors, so a bad rad-alt input alone should not cause a problem.
And you need the actual deviation of actual thrust vs. commanded thrust for it to activate.

With such high redundancies and a large degree of isolation between the engines, if it was indeed a simultaneous dual-engine shutdown, we don\x92t know of a single hardware component that could have worn out and caused it (as far as I know)

Interesting thread towards the end, regarding the previous TCMA malfunction on landing : (pprune archived thread 617426, can\x92t post links yet)

according to Dave Therhino who claimed to have seen a detailed report, the TCMA would initialise the thrust contour logic when touching the ground. This was nominally not an issue, as the throttles and engine would be close to idle. However, if the reverser was briefly deployed right before weight on wheels, and then cancelled when the wheels touched, TCMA would see high thrust but throttles at idle and trigger.

But this was supposedly fixed and all FADECs updated. Plus, during take-off there should not be such large fluctuation in throttle position or thrust, so intermittent switching of ground-air-ground should not cause an issue.

Also, according to tdracer V2 overspeed protection cuts thrust so quickly, that if it triggered (via TCMA or whatever other reason) it was likely after the plane had lifted off the ground. I wonder though if there\x92s still enough kinetic energy to fly the profile of the incident flight with the engines cut right around rotation.

Also, would hydraulics go out so quickly, that wheels would not retract? Wonder if a faulty WoW sensor could be a contributing factor and would also not manifest itself as the wheels not retracting :thinking

This is the desired direction. You want to make sure the engine shuts down even if e.g. the wiring to the FADEC is damaged. If for whatever reason (e.g. short in one of the cables) one engine is wrongly shut down, the plane can still fly with the other engine.

It\x92s not great that they mention the SAIB in the Preliminary Report but don\x92t give any details to the state of the particular switches of this airplane.

The metal parts of the switches seem intact in the picture, so it would be easy to check if the \x93lobes\x94 in the movable and stationary parts of the switches were there. A close-up picture would lay this topic to rest.

This omission is causing a lot of speculation online.