Page Links: First Previous 1 2 3 Last Index Page
tdracer
2025-06-15T23:50:00 permalink Post: 11903429 |
DO-178 unless propulsion systems are for some reason different from displays and flight controls.
I have been on the fringes of dissimilar hardware and dissimilar software designs (MD-11 flight controls). Sometimes it is necessary but there is a huge overhead in both development and test. Edit to add - Even with dissimilar processor and software the requirements for both will trace up to some common high level system requirements specification. There is a non zero probability that those top level requirement were inadequate or included an error. ![]() I doubt the issue would be in top level requirements - those are pretty simple and straightforward. It's the devil of the details where an error might have occurred. All that being said, I have a hard time with the idea that TCMA activated without a big thrust lever movement (even if you assume an issue with the air/ground indication) - and there is absolutely no reason why the thrust levers would be moved right after rotation.
tdracer has let us know that TCMA relies on inputs from three radio altimeters and two WoW switches and that at least one from each set must report on-ground.
Subjects: TCMA (Air-ground Logic) TCMA (All) 1 user liked this post. |
tdracer
2025-06-16T00:01:00 permalink Post: 11903430 |
FrequentSLF: I would be more suspicious of the hardware that feeds TCMA. Rad Alt sensing could be in error, but possibly more likely is the hardware that senses weight on wheels. May be position sensing microswitches, or perhaps gear oil pressure, but would assume redundancy, eg: two sensors per leg, then some sort of voting logic on the sensor set to find faulty hardware.and make a decision. Doubt if the software is at fault, but is there a delay between sensor output, and command to shutdown the enigines ?. Alluded to doubts upthread, but I think the post was deleted. Question: Should TCMA really have the absolute power to auto shutdown engines at all, without some sort of confirmation ?.
The reason we used both Radio Alt and WoW is that both can give erroneous indications on certain conditions - RA can be 'fooled' by dense rain or even really dense fog (the signals bounce off the water and falsely indicate on-ground), the prox sensor system can subject to HIRF/Lightning interference. TCMA acts quickly, but it does require some persistence, so an input glitch won't activate it (mainly N1, which is measured every 15 milliseconds). What sort of 'confirmation' do you have in mind - the regulator mandate that resulted in TCMA basically says we can't take credit for the flight crew. Subjects: Gear Retraction TCMA (All) Weight on Wheels 1 user liked this post. |
tdracer
2025-06-16T00:19:00 permalink Post: 11903431 |
If the engine doesn't continue normal operation, that's considered a 'fail'. Plus, the engine reaction of an over-rotated inlet (inlet separation) is a surge - accompanied by big bang and a ball of flame out the back. Nothing we know about this accident supports an over-rotation and related engine stall/surge. Subjects: None 2 users liked this post. |
tdracer
2025-06-16T01:26:00 permalink Post: 11903432 |
The TCMA patent application is at:
https://patents.google.com/patent/US6704630B2/en
Quite a simple system (not) What gets your attention is the fact that you can continue to operate the aircraft without an MMEL entry when one of the two systems (per EEC) that shadow each other... is unserviceable. As it says: "Typically the aircraft is allowed to operate for a limited period of time with just a single operative processing subsystem." That 787 was not long out of maintenance. The MMEL says something like "4 installed, 3 required" (referring to individual FADEC channels) - so you can dispatch for a short time with one FADEC channel failed. Yes, if the remaining channel of faulted FADEC fails, the engine will fail - but the FADEC reliability is such that the probability of losing the remaining channel (and hence the engine) is sufficiently small as to be acceptable. Both channels can operate TCMA, so a single channel failure has not overall effect on the system. Again, 'channel out' dispatch is nothing new - it's been the case since 1989 (when the PW4000/767 entered service). Subjects: FADEC TCMA (All) |
tdracer
2025-06-16T01:58:00 permalink Post: 11903433 |
No, it doesn't.
Exploring addition of dual-path power redundancy for FADEC systems.
I'd rack this up to more AI generated nonsense. Edited to add - others have beat me to the punch...
✈️ Immediate Safety Actions
• PPRuNe: lock thread ![]() Subjects: FADEC |
tdracer
2025-06-16T06:21:00 permalink Post: 11903434 |
Where does the logic block that takes the WoW and other inputs to generate the singe air/ground indication live? Is it somewhere that would be affected by the aircraft power systems? Could a failure in the aircraft power cause a false ground indication to be sent to the FADECs?
The thrust lever inputs are hardwired (resolvers connected to the thrust levers, powered by the FADEC), other aircraft communications on the 787 are on an ethernet based network. Default mode for the FADEC if aircraft inputs are lost or invalid is "Air", as that is generally considered to be the 'safe' choice. But even assuming some aircraft fault caused the FADECs to falsely believe the aircraft was 'on-ground', it would still take a pretty major error in the TCMA logic for it to actually trigger and shutdown the engine (especially lacking an associated thrust lever movement to idle). Never say never, but we're getting pretty far out on the probability tree for all these things to happen. Subjects: FADEC TCMA (Air-ground Logic) TCMA (All) TCMA (Logic) |
tdracer
2025-06-16T22:01:00 permalink Post: 11903825 |
Something that occurred to me after I went to bed last night: My assumption that the FDR readouts would rapidly reveal the cause may be flawed.
Let me explain. The consensus is that both engines quit shortly after liftoff (that assumes that the RAT did in fact deploy). At least one of the data recorders has battery backup, so it should have kept functioning when all aircraft power was lost. However... Over the years, I've looked at lots and lots of digital flight data recorder outputs when investigating some sort of incident or other engine anomaly, So I have become rather familiar with some of the interesting characteristics of DFDR data. On the 767 and 747-400, when you shutdown an engine and the IDG goes offline, there is a momentary 'glitch' in the electrical power system as it reconfigures for the available power source - this is why you see the flight deck displays flicker and return, and the cabin lights momentarily flicker. As a result, most of the avionics boxes 'reset' - this is quick, but it's not instantaneous. This shows up in the FDR data - sometimes as 'no valid data' for a few seconds, or as garbage readings of zero or 'full scale'. Now, looking at the FDR data, it's easy to simply disregard the data, so normally no big deal. Starting with the 777 (and on the 787 and 747-8), this electrical power glitch was 'fixed' - there is slight delay (~quarter of a second IIRC) before the fuel cutoff signal is sent to the engine - during which the electrical system reconfiguration takes place so no more 'glitch' during a normal engine shutdown...Except whatever happened to these engines wasn't 'normal'. If there is a fuel cut at high power, the engine spools down incredibly rapidly - a second or two from max power to sub-idle. Assuming the fuel cut wasn't commanded by the flight deck fuel switches, the electrical system won't know it's coming, so it can't reconfigure until after the engine generators drop offline - and you're going to get that power glitch. Nearly every avionics box on the aircraft will reset due to this electrical glitch, and the FDR isn't going to get useful data for a few seconds (and then, only from the stuff that's on the battery bus). Whatever happened, happened quickly - it's quite possible that whatever initiated the high-power fuel cut didn't get recorded. Last edited by T28B; 16th Jun 2025 at 22:16 . Reason: White Space Is Your Friend Subjects: DFDR FDR Fuel (All) Fuel Cutoff Generators/Alternators RAT (All) RAT (Deployment) 16 users liked this post. |
tdracer
2025-06-17T01:37:00 permalink Post: 11903904 |
Something for everyone to keep in mind (especially in light of the apparently AI created 'news releases' that were posted in the old thread):
During an accident investigation, everyone (and I mean everyone !) associated with the investigation is under what's basically a 'gag order'. They are not to discuss what they know with anyone outside the investigation (been there, done that, hated it but obeyed). Any and all releases of information regarding the investigation are to come from the primary investigating agency (in this case the Indian investigators). In today's 24-hour news cycle and constant demand for information, people don't like this, but it's done for good reasons - including protecting the impartiality of the investigation. In short, if it doesn't originate with the Indian investigation team, it's probably not worth reading. Subjects: None 24 users liked this post. |
tdracer
2025-06-17T02:43:00 permalink Post: 11903928 |
Back to the subject of the TCMA, in order for the four channels (A and B for engine 1 and A and B for engine 2) to be truly independent, there would have to be, for example, four, separate weight on wheels sensors and two, separate throttle position sensors per throttle. I would be extraordinarily surprised if that's what has been implemented, but will happily stand correct.
Subjects: FAA FADEC TCMA (All) Weight on Wheels 5 users liked this post. |
tdracer
2025-06-17T06:11:00 permalink Post: 11903996 |
Thanks tdracer and EXDAC for the info re the throttle position resolvers (and I'm aware of what is "
well understood by those who specify, design, test, and certify critical aircraft systems", EXDAC). But do the separate resolver outputs involve physically separated wiring through separate looms and connectors and, if there are any earths or power connections involved, are they at separate points and, in the case of power connections, on separate busses? Duplicated, supposedly completely independent, "designed, tested and certified critical aircraft systems" occasionally have a common, single point of failure, not as a consequence of bad theoretical design but, rather, physical implementation.
And what of the weight on wheel sensor inputs to the 4 TCMA channels (2 per engine)? 4 separate sensors with 4 separated sets of wiring in different looms through different connectors? I've repeatedly posted I don't know the details of the 787/GEnx-1B FADEC air/ground logic - and I know even less about the 787 air/ground system architecture. That being said, I think the whole air/ground is a bit of a red herring - even with a false air/ground indication, it's going to take a very major flaw in the FADEC logic for TCMA to activate without several other things happening (such as the thrust levers being moved to idle - which all by itself is going to make for a bad day if it's done at rotation). Subjects: FADEC TCMA (Air-ground Logic) TCMA (All) 6 users liked this post. |
tdracer
2025-06-17T21:41:00 permalink Post: 11904694 |
I was referring to CVR/FDRs in general being specialist equipment requiring specialist facilities to process. In any case, I would be very interested to find out where those from this accident are read. It appears from a post upthread there are new facilities in New Dehli that could be used. Having said that, for the EK 521 accident in Dubai the recorders were sent to the UK for analysis, despite a "flight data recorder centre" in Abu Dhabi being opened (again with much fanfare) by the UAE GCAA five years before the occurrence.
Usually when I hear of data recorders going back to the US NTSB or the recorder manufacturer, it's because the crash damage is such that specialized equipment is needed to download the data. The recorder in the tail would likely have little damage. While the AAIB may have held off on downloading the recorders until all the major players are present, it's been several days - I'd expect everyone who matters is already there. So I think it is reasonable to believe that the investigators have done a download and have had at least a preliminary look at the data. If there is a smoking gun, they probably already know (and the longer we don't hear something regarding the rest of the 787 fleet, or at least the GEnx powered fleet, the less likely it is that they suspect a systemic problem with the aircraft and/or engine). However the proviso that I posted earlier about potential data loss/corruption due to a sudden shutdown still applies - so maybe the data simply isn't on the recorder. As has already been posted, EMI is highly unlikely - the current cert requirements for HIRF are quite high, and due to the composite airframe construction of the 787, the lighting requirements are much higher than for conventional aluminum aircraft (the higher resistance of the composite airframe results is higher lightning induced currents). FDR has suggested a large slug of water hitting critical aircraft electronics at rotation - it is possible that resultant electrical short circuits could falsely signal the engines that the switches are in cutoff. Highly unlikely that it would do that to both engines, but possible. Then again, all the other plausible explanations are highly unlikely, so... BTW, I do have a life outside PPRuNe - and I'm going to be traveling the next several days, with limited to non-existent internet access. So don't be surprised if I'm not responding posts or PMs. Subjects: AAIB (All) AAIB (IDGA) DFDR FDR GEnx (ALL) NTSB 16 users liked this post. |
tdracer
2025-06-17T23:20:00 permalink Post: 11904756 |
BTW, I don't know if there is any 'crosstalk' of TCMA activation between engines on the 787. I know we don't do any crosstalk of other engines info on the 747-8, but the 787 is far more integrated, and the amount of data that can put on that ethernet based data bus is massive. My knee jerk is that they wouldn't crosstalk TCMA status between engines, but the reality is I really don't know. Subjects: EDML TCMA (Activation) TCMA (All) TCMA (Logic) 8 users liked this post. |
tdracer
2025-06-17T23:25:00 permalink Post: 11904761 |
Unless he is accredited to investigation, he doesn\x92t know. If he is accredited, he should be a great deal of trouble. It\x92s early days to be talking. I\x92ve been involved in investigations and there\x92s no talk about the investigation even to my boss or colleagues. I was in one, the only mention was to my boss that I was one, so he\x92d what I was and why I might not be available.
A Boeing management type got his hand slapped pretty hard not to long ago when he made the mistake of answering a reporter's question regarding the Alaska door plug blowout. I was tempted to contact my friend who was my counterpart during the 787/GEnx-1B development, but I suspect he's already been contacted and is considered to be part of the investigation - so he couldn't talk to me about it anyway. Subjects: None 3 users liked this post. |
tdracer
2025-06-26T22:20:00 permalink Post: 11911546 |
Thanks for the update. S.P.
Well it's about time, they came up with something..with all the advances in computeriisation and avionics. If I had love ones on board that aircraft I would not be happy at the delay in getting information to the public. if I didn't know any better, i would be of the opinion there is a possible reluctance of the authorities, to release information, that they must surely be in possession of. About the only thing you can assume from the lack of release of information is that they have not yet found anything that would suggest a systemic threat to other 787 aircraft that would require immediate corrective action or an aircraft grounding. Subjects: None 19 users liked this post. |
tdracer
2025-06-28T18:29:00 permalink Post: 11912617 |
And every commercial airliner I'm familiar with has the prime electronics bay below the flight deck - for what should be obvious reasons. There is absolutely nothing unusual about the 787 arrangement in this regard. Subjects: Water Ingress 5 users liked this post. |
tdracer
2025-06-29T04:00:00 permalink Post: 11912775 |
Yes, that was fairly much my point. The "Dream" was supposed to be revolutionary, "all" electric..., but it doesn't take a genius to copy an old, out-dated layout.
I see nothing wrong, everything right with the Main EE Bay being under the cockpit. It's the obvious place. But underneath a leak-prone lav? Even the plumbing fittings are problematic, often leaky. Water above, Electricity below... What do we anticipate? Time is the real issue here. We have two showers in our house. A few years on, both started leaking... It's not rocket science. How can we have innovation and improvement without I & I? The more I learn... Subjects: None 2 users liked this post. |
tdracer
2025-06-29T18:07:00 permalink Post: 11913157 |
This has also been touched upon earlier in the thread, but it rather seems the cut-off switches are in the same LRU, in close proximity, using the same connector and goes through the same wiring harness. No one was able to say whether it works purely by digital signaling, and goes through any common software, or if it is duplicated by purely direct signaling. There might be numerous failure modes of the cut-off switch design, it is obviously very, very robust and overall sound, since dual failures here have never happened, but this is alredy an outlier event.
The fuel switches are located adjacent to each other; however all the wiring would be separate. Subjects: FADEC Fuel (All) Fuel Cutoff 7 users liked this post. |
tdracer
2025-06-29T19:57:00 permalink Post: 11913194 |
Separate would seem to be a relative term, ofcourse wires are separated in some way, but how separate? Do they share a quick connect? Are there 2 separate looms each side of the throttle installation, or are thety in some twisted bundle together. Someone on this thread claimed the fuel cut offs where inhibited if the throttles weren\x92t in idle. Is this true? If so, is this a software or mechanical system?
Can anything so closely placed together be considered separate when looking at an outlier event? Everyone is looking for something that would shut off both engines at the exact same time. This installation could, it is the closest the 2 systems get in proximity, physically and electrically, at least and it seems we don\x92t know a whole lot about it. Obviously, since the thrust levers are placed next to each other - the separation that's available in the center console is limited, but as soon as the wiring exits that constrained area, the separation increases. Furthermore, the same engine-to-engine wiring separation also applies to channel A/B FADEC channels, as well as the fuel switch/fire handle wiring. All these requirements are documented in the Boeing DR&O (Design Requirements and Objectives) - and there is an audit done late in the design process to insure compliance. In short, you're barking up a tree stump - there is nothing there. Subjects: FADEC Fuel (All) Fuel Cutoff 12 users liked this post. |