Posts about: "Weight on Wheels" [Posts: 41 Pages: 3]

Presumably a dual engine shutdown under TMCA (i.e. similar to the ANA incident) would cause the RAT to deploy.

Obviously difficult to envisage what could cause an TMCA activation on both engines simultaneously given the safeguards in place (weight on wheels etc). However maybe the time delay from an erroneous TMCA activation on the runway/at rotation would lead to a loss of power 10 seconds later.

OK, another hour spent going through all the posts since I was on last night...
I won't quote the relevant posts as they go back ~15 pages, but a few more comments:

TAT errors affecting N1 power set: The FADEC logic (BTW, this is pretty much common on all Boeing FADEC) will use aircraft TAT if it agrees with the dedicated engine inlet temp probe - but if they differ it will use the engine probe . The GE inlet temp probe is relatively simple and unheated, so (unlike a heated probe) a blocked or contaminated probe will still read accurately - just with greater 'lag' to actual temperature changes.

TCMA - first off, I have to admit that this does look rather like an improper TCMA activation, but that is very, very unlikely. For those who don't know, TCMA is a system to shutdown a runaway engine that's not responding to the thrust lever - basic logic is an engine at high power with the thrust lever at/near idle, and the engine not decelerating. However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.

Fuel contamination/filter blockage: The fuel filters have a bypass - if the delta P across the filter becomes excessive, the filter bypasses and provides the contaminated fuel to the engine. Now this contaminated fuel could easy foul up the fuel metering unit causing a flameout, but to happen to two engines at virtually the same time would be tremendous unlikely.

Auto Thrust thrust lever retard - the TO lockup in the logic makes this very unlikely (it won't unlock below (IIRC) 400 ft., and even that requires a separate pilot action such as a mode select change or thrust lever movement). And if it did somehow happen, all the pilot needs to do is push the levers back up.

Engine parameters on the FDR: I don't know what exactly is on the 787 FDR with regards to engine parameters, but rest assured that there is plenty of engine data that gets recorded - most at one/second. Getting the FDR readout from a modern FDR is almost an embarrassment of riches. Assuming the data is intact, we'll soon have a very good idea of what the engines were doing

Misselection of flap, erroneous TO Performance data, dust = overrun, bird strikes\x85.all unlikely as none fit the evidence; the engines were very quiet.

The clearest bit of evidence is the RAT deployment. As someone else pointed out gear bogey position indicates Gear UP cycle had commenced.
So the most evidenced sequence of events was rotation, positive rate = gear Up; \x85.catastrophic Power Loss. Flickering cabin emergency lights and Loud bang reported by survivor (was this heard RAT deployment or another system?).

The 787 has some unique electrical/mechanical and air systems. Previous flight had issues (reported by passengers).

So the root cause of the Power failure must be down to when either the 787 gets airborne (weight on wheels switch) or when Gear selected Up. I wonder if any 787 drivers could elaborate on what electric/hydraulic/air systems are affected at the very point of wheels up or gear up ?
I\x92m wondering if the electrically powered cabin pressurisation system is affected at wheels up?

The speed at which there was a complete loss of thrust and electrical power degrading to the point of flickering lights and RAT deployment suggests to me an actual engine shutdown rather than anything linked to auto thrust or fuel contamination. There are not many things which can cause an engine to shut down: LP valves, FADEC incl TCMA, crew action\x85

Thank you for an excellent comment.

Two thoughts re TCMA: 1) Is it possible a false TCMA activation could have occurred just before, or concurrently with, the a/c leaving the ground, with the resulting loss of thrust and electrical power not being apparent for another (say) 10s); 2) As you say two simultaneous failures very unlikely... except that it did happen to that ANA flight, albeit during ground state.

TCMA requires the a/c to believe it is on the ground (via multiple redundant inputs, both weight on wheels and radalt). I do not know if there is also a max activation speed.

I posited a potential TCMA sequence in a post timed 1804Z - speculative of course. Agree with others, it is difficult to contemplate and seems staggeringly unlikely.

From tdracer
However, TCMA is only active on the ground (unfamiliar with the 787/GEnx TCMA air/ground logic - on the 747-8 we used 5 sources of air/ground - three Radio Altimeters and two Weight on Wheels - at least one of each had to indicate ground to enable TCMA). TCMA will shutdown the engine via the N2 overspeed protection - nearly instantaneous. For this to be TCMA, it would require at least two major failures - improper air ground indication or logic, and improper TCMA activation logic (completely separate software paths in the FADEC). Like I said, very, very unlikely.

This aircraft was on the ground...but there's more

It's controlled by Software and I've seen enough very weird "corner case" bugs that I discount nothing when Software is involved. I am sure there are more likely explanations why all power was lost (Assuming that was the case) but nothing would surprise me!

Given it was close to the ground at the time of failure, is it possible a problem raising the gear could allow automation to cut fuel to both engines? (According to this thread, TCMA uses weight on wheels and radar to decide if aircraft is airborne.)

I've seen nothing to confirm if or when the engines stopped providing thrust, but if you assume that it happened and that it came after the wheels left the ground then you'd also have to assume there was a pretty serious design flaw in the WOW system for it to falsely indicate weight on the wheels just because there was an issue raising the gear. It feels like kinda the same thing as assuming a serious flaw in the overall TCMA system.

But at some point software decisions converge to a single point, a single decision, to simplify for instance the subroutine where all of the decisions have been taken to trigger an output (a shutdown signal, for instance). And if, again for instance, you accidentally jump into this subroutine (whether because of buffer overflows or mistakes in the preceding logic), then you can trigger the output incorrectly.

Of course you can have two or three systems that are coded by different teams, using different languages, running in different hardware, even if they are fed from the same sensors, as long as you have many sensors (as tdracer has indicated, 5 inputs on the 747 for instance - although only needing 2 to be true does seem to reduce that margin for error somewhat).

If these two or three systems all have to send independent signals to the downstream hardware (the engine in this case) and the engine requires more than one signal to take the dangerous action like shutdown, then you're more protected, but that doesn't seem to be how the 787 works from the descriptions here by the experts like td and fdr. But please correct me if I'm wrong on that.

Its hard to imagine how else you could simultaneously cut both engines any other way, as tdracer said, other than human action or by software command. And software command means software failure. So information and discussion about exactly how redundant the software that takes this decision is would seem a good direction to move this discussion in. Is it truly only redundant 'internally' to itself, the module that sends this message to the engines? We heard about the 32 bit overflow bug that can shutdown engines - is it really that hard to believe that it has no other similar bugs when that one slipped through the testing?

I assume the dual engine shutdown due to engine overspeed. Could the case occur with increased thrust manually in the end of takeoff phase?

NARRATOR:

The donks were dead....

Any thoughts?
​​​​​​​

Keeping track of this thread is tiring - again, my sympathies to the mods, as tiring as I find it, it must be far worse for them )
Apologies for a few terse posts last night, but a couple of inane posts (by a usual suspect) really set me off. I've never used the 'ignore' function, but I may need to revisit that.

I posted this previously, but it was about 70 pages ago, so I understand not going back that far, or forgetting that tidbit amongst all the noise.
In short, I'm not familiar with the specific air/ground logic on the 787/GEnx-1B - the logic I posted (3 radio altimeters, 2 Weight on Wheels, at least one of each must indicate 'on-ground) is for the 747-8 (which I'm intimately familiar with). I have a vague recollection of a discussion with my GEnx-1B counterpart 10 or more years ago that suggested that the 787 was not as complex as the 747-8, but I don't recall any details. Basic FADEC logic (BTW, as someone else noted - it's "Full Authority", not "Autonomous") is to default to 'air' if in doubt, as it's considered to be 'safer'.
The only real hardware in the TCMA system is the N2 overspeed shutdown system - which goes through a BITE style functional test on every engine start. Everything else is in software - with the only aircraft inputs being Air/Ground and thrust lever position.

As I've posted previously, the FADEC is powered by a dedicated Permanant Magnet Alternator (PMA) - aircraft power is used only as a backup for starting or if the PMA fails. If the FADEC determines it is running on aircraft power with engine running (i.e. the PMA has failed), it sets a 'No Dispatch" fault message.

Retired RAF avionics technician, PPL / Glider pilot with ~ 700 hrs. VC10 double EFATO survivor.

The TCMA system should be inhibited when Air / Ground logic is in Air mode.
I understand that it has Inputs from RadAlt, Weight on Wheels, etc.
This airframe was reported to have had a history of significant electrical / electronic problems, including on the prior inbound flight.
There may have been water ingress in the E&E bay, likely causing corrosion or other damage.
Chafed or damaged wiring / cable insulation within looms is possible. Including the landing gear microswitches.
The landing gear may have been interrupted in the cycle.
BOTH engines are reported to have shut down, so whatever happened is a system common to both engines.
TCMA failing at the moment of gear retraction appears to fit with the available evidence.

FrequentSLF: I would be more suspicious of the hardware that feeds TCMA. Rad Alt sensing could be in error, but possibly more likely is the hardware that senses weight on wheels. May be position sensing microswitches, or perhaps gear oil pressure, but would assume redundancy, eg: two sensors per leg, then some sort of voting logic on the sensor set to find faulty hardware.and make a decision. Doubt if the software is at fault, but is there a delay between sensor output, and command to shutdown the engines ?. Alluded to doubts upthread, but I think the post was deleted. Question: Should TCMA really have the absolute power to auto shutdown engines at all, without some sort of confirmation ?.

On the 747, Weight on Wheels (WoW) depends on prox sensors on the landing gear (i.e. gear compression). I don't know how that's done on the 787.
The reason we used both Radio Alt and WoW is that both can give erroneous indications on certain conditions - RA can be 'fooled' by dense rain or even really dense fog (the signals bounce off the water and falsely indicate on-ground), the prox sensor system can subject to HIRF/Lightning interference.

TCMA acts quickly, but it does require some persistence, so an input glitch won't activate it (mainly N1, which is measured every 15 milliseconds).

What sort of 'confirmation' do you have in mind - the regulator mandate that resulted in TCMA basically says we can't take credit for the flight crew.

According to the MMEL available on the FAA website there are 8 air/ground sensors on the main gear. Two tilt sensors and two compression sensors on each strut. Can be dispatched with just one tilt sensor and one compression sensor working on each side.