Posts by user "tdracer" [Posts: 58 Total up-votes: 525 Pages: 3]

tdracer
2025-06-15T23:50:00
permalink
Post: 11903429
Originally Posted by EXDAC
DO-178 unless propulsion systems are for some reason different from displays and flight controls.

I have been on the fringes of dissimilar hardware and dissimilar software designs (MD-11 flight controls). Sometimes it is necessary but there is a huge overhead in both development and test.

Edit to add - Even with dissimilar processor and software the requirements for both will trace up to some common high level system requirements specification. There is a non zero probability that those top level requirement were inadequate or included an error.
Yea, I think you're right - DO-178 is aviation software - now that I think about it, DO-160 might be electro-magnetic effects (i.e. HIRF/Lightning). It's not something I need to worry about anymore so it's not something I make a point of remembering

I doubt the issue would be in top level requirements - those are pretty simple and straightforward. It's the devil of the details where an error might have occurred.

All that being said, I have a hard time with the idea that TCMA activated without a big thrust lever movement (even if you assume an issue with the air/ground indication) - and there is absolutely no reason why the thrust levers would be moved right after rotation.

tdracer has let us know that TCMA relies on inputs from three radio altimeters and two WoW switches and that at least one from each set must report on-ground.
No, what I posted was the logic for the 747-8 - I simply don't know (or at least don't remember) what the TCMA air/ground logic looks like for the 787/GEnx-1B.

Subjects: TCMA (Air-ground Logic)  TCMA (All)

1 user liked this post.

tdracer
2025-06-16T00:01:00
permalink
Post: 11903430
Originally Posted by syseng68k
FrequentSLF: I would be more suspicious of the hardware that feeds TCMA. Rad Alt sensing could be in error, but possibly more likely is the hardware that senses weight on wheels. May be position sensing microswitches, or perhaps gear oil pressure, but would assume redundancy, eg: two sensors per leg, then some sort of voting logic on the sensor set to find faulty hardware.and make a decision. Doubt if the software is at fault, but is there a delay between sensor output, and command to shutdown the enigines ?. Alluded to doubts upthread, but I think the post was deleted. Question: Should TCMA really have the absolute power to auto shutdown engines at all, without some sort of confirmation ?.
On the 747, Weight on Wheels (WoW) depends on prox sensors on the landing gear (i.e. gear compression). I don't know how that's done on the 787.
The reason we used both Radio Alt and WoW is that both can give erroneous indications on certain conditions - RA can be 'fooled' by dense rain or even really dense fog (the signals bounce off the water and falsely indicate on-ground), the prox sensor system can subject to HIRF/Lightning interference.

TCMA acts quickly, but it does require some persistence, so an input glitch won't activate it (mainly N1, which is measured every 15 milliseconds).

What sort of 'confirmation' do you have in mind - the regulator mandate that resulted in TCMA basically says we can't take credit for the flight crew.

Subjects: Gear Retraction  TCMA (All)  Weight on Wheels

1 user liked this post.

tdracer
2025-06-16T00:19:00
permalink
Post: 11903431
Originally Posted by katekebo
Question to 787 pilots or engineers familiar with this particular aircraft. Can excessive AOA cause a flame out, especially at certain throttle settings?
Inlet compliance is tested at max takeoff power settings, at AOA up to stall. This is done by performing something called a 'wind-up turn' - with the engine at max TO power and constant altitude, they keep pulling the turn tighter until the wing stalls and the aircraft falls out of the turn.
If the engine doesn't continue normal operation, that's considered a 'fail'. Plus, the engine reaction of an over-rotated inlet (inlet separation) is a surge - accompanied by big bang and a ball of flame out the back.
Nothing we know about this accident supports an over-rotation and related engine stall/surge.

Subjects: None

2 users liked this post.

tdracer
2025-06-16T01:26:00
permalink
Post: 11903432
Originally Posted by bbofh
The TCMA patent application is at: https://patents.google.com/patent/US6704630B2/en
Quite a simple system (not)
What gets your attention is the fact that you can continue to operate the aircraft without an MMEL entry when one of the two systems (per EEC) that shadow each other... is unserviceable.
As it says: "Typically the aircraft is allowed to operate for a limited period of time with just a single operative processing subsystem."
That 787 was not long out of maintenance.
As I noted previously, the FADEC is a dual channel device. It's long been the case that dispatch is allowed with a single FADEC channel failed (this goes back to the original PW4000/CF6-80C2 as installed on the 747-400 and 767.
The MMEL says something like "4 installed, 3 required" (referring to individual FADEC channels) - so you can dispatch for a short time with one FADEC channel failed. Yes, if the remaining channel of faulted FADEC fails, the engine will fail - but the FADEC reliability is such that the probability of losing the remaining channel (and hence the engine) is sufficiently small as to be acceptable.

Both channels can operate TCMA, so a single channel failure has not overall effect on the system.

Again, 'channel out' dispatch is nothing new - it's been the case since 1989 (when the PW4000/767 entered service).

Subjects: FADEC  TCMA (All)

tdracer
2025-06-16T01:58:00
permalink
Post: 11903433
Originally Posted by dragon man
I agree with you but it actually makes sense.
No, it doesn't.
Exploring addition of dual-path power redundancy for FADEC systems.
There are already 'dual-path power redundancy for FADEC' - dedicated engine driven FADEC power supply, and aircraft supplied 'backup' power. Again, there is no known way that an aircraft issue could cause the FADEC to lose power.

I'd rack this up to more AI generated nonsense.

Edited to add - others have beat me to the punch...

✈️ Immediate Safety Actions

• PPRuNe: lock thread
Have to admit, that made me chuckle

Subjects: FADEC

tdracer
2025-06-16T06:21:00
permalink
Post: 11903434
Originally Posted by DTA
Where does the logic block that takes the WoW and other inputs to generate the singe air/ground indication live? Is it somewhere that would be affected by the aircraft power systems? Could a failure in the aircraft power cause a false ground indication to be sent to the FADECs?
Repeating myself (again), but ALL the TCMA logic is resident in the FADEC. It takes aircraft inputs of air/ground (again, not familiar with the specifics of the air/ground logic used on the 787/GEnx-1B, so don't ask), thrust lever position, and what the engine is actually doing (mainly N1) to determine if the engine is 'out of control'.
The thrust lever inputs are hardwired (resolvers connected to the thrust levers, powered by the FADEC), other aircraft communications on the 787 are on an ethernet based network. Default mode for the FADEC if aircraft inputs are lost or invalid is "Air", as that is generally considered to be the 'safe' choice.
But even assuming some aircraft fault caused the FADECs to falsely believe the aircraft was 'on-ground', it would still take a pretty major error in the TCMA logic for it to actually trigger and shutdown the engine (especially lacking an associated thrust lever movement to idle). Never say never, but we're getting pretty far out on the probability tree for all these things to happen.

Subjects: FADEC  TCMA (Air-ground Logic)  TCMA (All)  TCMA (Logic)

tdracer
2025-06-16T22:01:00
permalink
Post: 11903825
Something that occurred to me after I went to bed last night: My assumption that the FDR readouts would rapidly reveal the cause may be flawed.

Let me explain.

The consensus is that both engines quit shortly after liftoff (that assumes that the RAT did in fact deploy). At least one of the data recorders has battery backup, so it should have kept functioning when all aircraft power was lost.

However...

Over the years, I've looked at lots and lots of digital flight data recorder outputs when investigating some sort of incident or other engine anomaly, So I have become rather familiar with some of the interesting characteristics of DFDR data.

On the 767 and 747-400, when you shutdown an engine and the IDG goes offline, there is a momentary 'glitch' in the electrical power system as it reconfigures for the available power source - this is why you see the flight deck displays flicker and return, and the cabin lights momentarily flicker. As a result, most of the avionics boxes 'reset' - this is quick, but it's not instantaneous. This shows up in the FDR data - sometimes as 'no valid data' for a few seconds, or as garbage readings of zero or 'full scale'. Now, looking at the FDR data, it's easy to simply disregard the data, so normally no big deal.

Starting with the 777 (and on the 787 and 747-8), this electrical power glitch was 'fixed' - there is slight delay (~quarter of a second IIRC) before the fuel cutoff signal is sent to the engine - during which the electrical system reconfiguration takes place so no more 'glitch' during a normal engine shutdown...Except whatever happened to these engines wasn't 'normal'.

If there is a fuel cut at high power, the engine spools down incredibly rapidly - a second or two from max power to sub-idle. Assuming the fuel cut wasn't commanded by the flight deck fuel switches, the electrical system won't know it's coming, so it can't reconfigure until after the engine generators drop offline - and you're going to get that power glitch. Nearly every avionics box on the aircraft will reset due to this electrical glitch, and the FDR isn't going to get useful data for a few seconds (and then, only from the stuff that's on the battery bus).

Whatever happened, happened quickly - it's quite possible that whatever initiated the high-power fuel cut didn't get recorded.

Last edited by T28B; 16th Jun 2025 at 22:16 . Reason: White Space Is Your Friend

Subjects: DFDR  FDR  Fuel (All)  Fuel Cutoff  Generators/Alternators  RAT (All)  RAT (Deployment)

16 users liked this post.

tdracer
2025-06-17T01:37:00
permalink
Post: 11903904
Something for everyone to keep in mind (especially in light of the apparently AI created 'news releases' that were posted in the old thread):
During an accident investigation, everyone (and I mean everyone !) associated with the investigation is under what's basically a 'gag order'. They are not to discuss what they know with anyone outside the investigation (been there, done that, hated it but obeyed).
Any and all releases of information regarding the investigation are to come from the primary investigating agency (in this case the Indian investigators).
In today's 24-hour news cycle and constant demand for information, people don't like this, but it's done for good reasons - including protecting the impartiality of the investigation.
In short, if it doesn't originate with the Indian investigation team, it's probably not worth reading.

Subjects: None

24 users liked this post.

tdracer
2025-06-17T02:43:00
permalink
Post: 11903928
Originally Posted by Lead Balloon
Back to the subject of the TCMA, in order for the four channels (A and B for engine 1 and A and B for engine 2) to be truly independent, there would have to be, for example, four, separate weight on wheels sensors and two, separate throttle position sensors per throttle. I would be extraordinarily surprised if that's what has been implemented, but will happily stand correct.
You'd be half right (or if you prefer, half wrong). Each channel of the FADEC has its own thrust lever position resolver. In other Boeing aircraft, there is a single resolver per engine, with dual electrical coils (i.e. electrically isolated but mechanically connected). But in order to go for full compliance with a (in my opinion) rather extreme FAA position regarding 'single failures' and 25.901(c), the 787 thrust lever actually has dual load paths, feeding to different thrust lever resolvers for each channel.

Subjects: FAA  FADEC  TCMA (All)  Weight on Wheels

5 users liked this post.

tdracer
2025-06-17T06:11:00
permalink
Post: 11903996
Originally Posted by Lead Balloon
Thanks tdracer and EXDAC for the info re the throttle position resolvers (and I'm aware of what is " well understood by those who specify, design, test, and certify critical aircraft systems", EXDAC). But do the separate resolver outputs involve physically separated wiring through separate looms and connectors and, if there are any earths or power connections involved, are they at separate points and, in the case of power connections, on separate busses? Duplicated, supposedly completely independent, "designed, tested and certified critical aircraft systems" occasionally have a common, single point of failure, not as a consequence of bad theoretical design but, rather, physical implementation.

And what of the weight on wheel sensor inputs to the 4 TCMA channels (2 per engine)? 4 separate sensors with 4 separated sets of wiring in different looms through different connectors?
The wiring between the two (per engine) FADEC channels is separate and isolated from each other. In the areas potentially subject to cross engine rotor burst damage, that wiring is physically separated by a considerable distance. About the only place where the Channel A and B thrust lever resolver wiring is close proximity is in the thrust lever quadrant. We've been designing FADEC aircraft for 40 years - and the requirements for isolation are detailed and well understood.

I've repeatedly posted I don't know the details of the 787/GEnx-1B FADEC air/ground logic - and I know even less about the 787 air/ground system architecture. That being said, I think the whole air/ground is a bit of a red herring - even with a false air/ground indication, it's going to take a very major flaw in the FADEC logic for TCMA to activate without several other things happening (such as the thrust levers being moved to idle - which all by itself is going to make for a bad day if it's done at rotation).

Subjects: FADEC  TCMA (Air-ground Logic)  TCMA (All)

6 users liked this post.

tdracer
2025-06-17T21:41:00
permalink
Post: 11904694
Originally Posted by Lord Bracken
I was referring to CVR/FDRs in general being specialist equipment requiring specialist facilities to process. In any case, I would be very interested to find out where those from this accident are read. It appears from a post upthread there are new facilities in New Dehli that could be used. Having said that, for the EK 521 accident in Dubai the recorders were sent to the UK for analysis, despite a "flight data recorder centre" in Abu Dhabi being opened (again with much fanfare) by the UAE GCAA five years before the occurrence.
Given the number of times I reviewed DFDR data supplied by an operator after some sort of event/incident, I think most major operators have access to the equipment needed to download a healthy data recorder. So I'd be a bit surprised if Air India does not have this capability. OldnGrounded has also posted that the Indian AAIB also has that ability.

Usually when I hear of data recorders going back to the US NTSB or the recorder manufacturer, it's because the crash damage is such that specialized equipment is needed to download the data. The recorder in the tail would likely have little damage.
While the AAIB may have held off on downloading the recorders until all the major players are present, it's been several days - I'd expect everyone who matters is already there. So I think it is reasonable to believe that the investigators have done a download and have had at least a preliminary look at the data. If there is a smoking gun, they probably already know (and the longer we don't hear something regarding the rest of the 787 fleet, or at least the GEnx powered fleet, the less likely it is that they suspect a systemic problem with the aircraft and/or engine). However the proviso that I posted earlier about potential data loss/corruption due to a sudden shutdown still applies - so maybe the data simply isn't on the recorder.

As has already been posted, EMI is highly unlikely - the current cert requirements for HIRF are quite high, and due to the composite airframe construction of the 787, the lighting requirements are much higher than for conventional aluminum aircraft (the higher resistance of the composite airframe results is higher lightning induced currents).

FDR has suggested a large slug of water hitting critical aircraft electronics at rotation - it is possible that resultant electrical short circuits could falsely signal the engines that the switches are in cutoff. Highly unlikely that it would do that to both engines, but possible.
Then again, all the other plausible explanations are highly unlikely, so...

BTW, I do have a life outside PPRuNe - and I'm going to be traveling the next several days, with limited to non-existent internet access. So don't be surprised if I'm not responding posts or PMs.

Subjects: AAIB (All)  AAIB (IDGA)  DFDR  FDR  GEnx (ALL)  NTSB

16 users liked this post.

tdracer
2025-06-17T23:20:00
permalink
Post: 11904756
Originally Posted by EDML
That is not what the TCMA logic is supposed to do. Only high thrust with the thrust lever idle should trigger the TCMA.
Actually that's not quite true. Thrust far higher than what's being commanded by the thrust lever - it doesn't have to be at idle. But even with a CPU failure commanding high thrust (relative to TL position), the odds of that happening to two engines at the same time is astronomical.
BTW, I don't know if there is any 'crosstalk' of TCMA activation between engines on the 787. I know we don't do any crosstalk of other engines info on the 747-8, but the 787 is far more integrated, and the amount of data that can put on that ethernet based data bus is massive.
My knee jerk is that they wouldn't crosstalk TCMA status between engines, but the reality is I really don't know.

Subjects: EDML  TCMA (Activation)  TCMA (All)  TCMA (Logic)

8 users liked this post.

tdracer
2025-06-17T23:25:00
permalink
Post: 11904761
Originally Posted by galaxy flyer
Unless he is accredited to investigation, he doesn\x92t know. If he is accredited, he should be a great deal of trouble. It\x92s early days to be talking. I\x92ve been involved in investigations and there\x92s no talk about the investigation even to my boss or colleagues. I was in one, the only mention was to my boss that I was one, so he\x92d what I was and why I might not be available.
The gag rule is pretty much the first thing you're told when you get drawn into an investigation - and you can get in big trouble for violating it (even if inadvertent).
A Boeing management type got his hand slapped pretty hard not to long ago when he made the mistake of answering a reporter's question regarding the Alaska door plug blowout.
I was tempted to contact my friend who was my counterpart during the 787/GEnx-1B development, but I suspect he's already been contacted and is considered to be part of the investigation - so he couldn't talk to me about it anyway.

Subjects: None

3 users liked this post.

tdracer
2025-06-26T22:20:00
permalink
Post: 11911546
Originally Posted by RichardJones
Thanks for the update. S.P.
Well it's about time, they came up with something..with all the advances in computeriisation and avionics.
If I had love ones on board that aircraft I would not be happy at the delay in getting information to the public.
if I didn't know any better, i would be of the opinion there is a possible reluctance of the authorities, to release information, that they must surely be in possession of.
Satisfying the public demand for instant informational gratification is not their job - determining what happened, why, and how to prevent a future occurrence is. There is a process that they should follow, and indications are they are following it.
About the only thing you can assume from the lack of release of information is that they have not yet found anything that would suggest a systemic threat to other 787 aircraft that would require immediate corrective action or an aircraft grounding.

Subjects: None

19 users liked this post.

tdracer
2025-06-28T18:29:00
permalink
Post: 11912617
Originally Posted by MaybeItIs
But installing lavatories directly above EE Bays? Who's the genius...? .
Every commercial airliner I've ever been on - with the exception of a short-range regional jet (only lav in the back) - has at least one lav immediately aft of the flight deck. Especially post 9/11, putting the most forward lav any further back would become a nightmare when the pilots need to relieve themselves (presumably, they expect the pilot to be able to 'hold it' on a short range regional jet).
And every commercial airliner I'm familiar with has the prime electronics bay below the flight deck - for what should be obvious reasons.

There is absolutely nothing unusual about the 787 arrangement in this regard.

Subjects: Water Ingress

5 users liked this post.

tdracer
2025-06-29T04:00:00
permalink
Post: 11912775
Originally Posted by MaybeItIs
Yes, that was fairly much my point. The "Dream" was supposed to be revolutionary, "all" electric..., but it doesn't take a genius to copy an old, out-dated layout.

I see nothing wrong, everything right with the Main EE Bay being under the cockpit. It's the obvious place. But underneath a leak-prone lav? Even the plumbing fittings are problematic, often leaky. Water above, Electricity below... What do we anticipate? Time is the real issue here. We have two showers in our house. A few years on, both started leaking... It's not rocket science.

How can we have innovation and improvement without I & I? The more I learn...
So how are you going to allow the pilot to relieve themselves - while maintaining post 9/11 security - without a lav up front?

Subjects: None

2 users liked this post.

tdracer
2025-06-29T18:07:00
permalink
Post: 11913157
Originally Posted by Kraftstoffvondesibel
This has also been touched upon earlier in the thread, but it rather seems the cut-off switches are in the same LRU, in close proximity, using the same connector and goes through the same wiring harness. No one was able to say whether it works purely by digital signaling, and goes through any common software, or if it is duplicated by purely direct signaling. There might be numerous failure modes of the cut-off switch design, it is obviously very, very robust and overall sound, since dual failures here have never happened, but this is alredy an outlier event.
Again, disclaimer that my direct knowledge of the 787 specifics is limited, standard Boeing design practice is that all engine wiring is segregated between engines (and were practical, between FADEC channels).
The fuel switches are located adjacent to each other; however all the wiring would be separate.

Subjects: FADEC  Fuel (All)  Fuel Cutoff

7 users liked this post.

tdracer
2025-06-29T19:57:00
permalink
Post: 11913194
Originally Posted by Kraftstoffvondesibel
Separate would seem to be a relative term, ofcourse wires are separated in some way, but how separate? Do they share a quick connect? Are there 2 separate looms each side of the throttle installation, or are thety in some twisted bundle together. Someone on this thread claimed the fuel cut offs where inhibited if the throttles weren\x92t in idle. Is this true? If so, is this a software or mechanical system?
Can anything so closely placed together be considered separate when looking at an outlier event?

Everyone is looking for something that would shut off both engines at the exact same time. This installation could, it is the closest the 2 systems get in proximity, physically and electrically, at least and it seems we don\x92t know a whole lot about it.
Engine isolation means just that. No common wire bundles, no common connectors. You can move the fuel levers at any time - there is no lockout of any kind with respect to thrust lever position (imagine dropping something into the lever linkage that jams the thrust lever at max power - then being unable to shut that engine down?)
Obviously, since the thrust levers are placed next to each other - the separation that's available in the center console is limited, but as soon as the wiring exits that constrained area, the separation increases. Furthermore, the same engine-to-engine wiring separation also applies to channel A/B FADEC channels, as well as the fuel switch/fire handle wiring.
All these requirements are documented in the Boeing DR&O (Design Requirements and Objectives) - and there is an audit done late in the design process to insure compliance.
In short, you're barking up a tree stump - there is nothing there.

Subjects: FADEC  Fuel (All)  Fuel Cutoff

12 users liked this post.