ANA 787 Engines shutdown during landing

[flash8]

Originally Posted by Check Airman

Thanks. My question was targetted to the 737. Any practical reason to select reverse at 10ft?

As I recall possible below 20' RA on the classic (possibly 10') but in my opinion not very wise! I'd go as far as to say no practical reason whatsoever beyond get down-itus.

[Dave Therhino]

Originally Posted by Check Airman

What’s the advantage to being able to select reverse before you’re on the ground? Without checking my FCOM, I’m almost positive you can’t do that on the A320.

It allows the reverser deployment to get a head start so you can get reverse thrust right at or very shortly after touchdown.

[Dave Therhino]

Originally Posted by tdracer

...

All that being said, I'd be hard pressed to come up a scenario for how doing that could cause a nuisance TCMA trip...

There were actually two of these events on the 787/Trent - one in 2016 and one in 2019. I don't know the exact details of the 2019 event, but I assume they were very similar to the 2016 event because the conditions that could trigger the event were very limited and specific.

The 787 reverser "on ground" logic can be satisfied by two low range radio altimeters reading 5 feet or less plus a slight time delay (300 milliseconds), allowing the reverser to be commanded to deploy and reverse power to be set above idle. In the 2016 event, the crew floated the landing below the 5 foot LRRA threshold. They deployed the reversers prior to touchdown and set maximum reverse thrust. As the thrust began coming up they quickly moved the levers back to idle reverse (I suspect because they either dropped hard or anticipated dropping hard - can't remember). Once the main gear weight on wheels switches indicated on ground, the TCMA logic in the EEC was activated. Unfortunately the way it was implemented the original RR TCMA logic did not track engine commands or behavior prior to TCMA activation with weight on wheels. When it activated it saw the thrust resolver angle at idle reverse and N1 above a threshold because the engine was still in the process of decelerating following the prior accel toward max reverse, so the TCMA logic triggered a shutdown because, by the programmed logic, it detected uncommanded high thrust. Since both engines saw nearly identical conditions, they both shut down.

This condition can only occur on the ground. As far as I know at this point all of the engines have had their EEC software updated and this vulnerability was eliminated.

[tdracer]

Originally Posted by flash8

As I recall possible below 20' RA on the classic (possibly 10') but in my opinion not very wise! I'd go as far as to say no practical reason whatsoever beyond get down-itus.

I have a vague memory that the 737 uses Radio Altimeter to enable the T/R (I thought it was 5 ft., not 10, but as I noted it's a vague memory). This is different from other Boeing installations, which use Weight On Wheels (WOW) -often in combination with the Radio Altimeter - to enable the reversers. Apparently the low wing on the 737 can allow it to float in ground effect enough to prevent WOW from going true.
Dave T - really, really surprised if the 787 enables the reversers only with RA - I'd expect as a minimum that the track lock would have WOW logic. There is a reason why we don't do that on the other aircraft - RA can be fooled in heavy weather...
Then again, the 787 did a lot of 'reinventing the wheel', throwing out decades of experience on why we did some things the way we did.

[Dave Therhino]

I wasn't speculating - I saw a detailed report of the event and analysis of the cause.

[navefenix]

Yo me it looks likely to be an TCMA issue, bulleting included

[tdracer]

Assuming TCMA works as intended, it does eliminate the risk of uncommanded/uncontrolled high thrust (UHT) on the ground. There is still some risk that UHT could happen in the air during final approach - if you're less than ~100 ft. it could be pretty exciting. It's shown to be controllable, but the pilot does need to be paying attention and fly the aircraft or it could end badly. The good news is that the exposure is maybe 30 seconds per flight, and the probability of UHT is something between one in 10 million and one in 100 million flight hours, so the odds of it happening during final are astronomically high. However UHT can be caused by a single failure so we need to show it's controllable (ref 25.901(c) and 25.1309 - you can't use probability arguments for single failures that are catastrophic).

[Lead Balloon]

Just rejuvenating this thread and won't mention 'the other' event.

The double engine TCMA-directed shut down on the 787 in Osaka in 2019 was a result of the systems working 'perfectly' but in circumstances to which the TCMA was not intended to respond. Designers are aware of the almost infinite capacity of crews to inadvertently or even deliberately do ‘odd’ things with switches, knobs, levers and other controls, in combination and in quick succession, but it is almost impossible to consider the many combinations and analyse all the consequences.

Contrary to my earlier surmising that any sensor measuring ‘in the air’ versus ‘on the ground’ could drive both TCMAs on the 787 to the ‘on the ground’ state, a ‘whole of aircraft’ ‘decision’ is made that the aircraft in ‘in the air’ or ‘on the ground’, taking in consideration all of the sensors and, in the case of 'disagreement', disregarding whichever of them is most likely to be erroneous. The probabilities of the 'aircraft' 'choosing' the wrong state are, consequently, extraordinarily remote. However, it does inexorably lead to at least one input common to both TCMAs, does it not? That single point is the source of the 'in the air' or 'on the ground' 'truth'. That 'truth' was true in the Osaka event, and let's hope it always will be on every aircraft.

[Pilot DAR]

Just rejuvenating this thread and won't mention 'the other' event.

Okay, but let's not have this morph into an extension of a temporarily closed thread. It's fine to discuss the technical issues, and lessons learned from the ANA engine shutdown, and please keep it there.

The mod team assures everyone, that when the time is right (our Admins decide) "the other" event will open for discussion of that event - no thread drift from here please....

[Musician]

UHT event

Originally Posted by tdracer

UHT was always assumed to be something the flight crew could address by shutting down the affected engine - but then there was an event on a 737-200.

tdracer mentioned the same event at runaway engine on B737 .

I've been trying to track this, but the best I got was a reference in a research paper on UHT that mentions a 1997 Saudia Arabian Airlines Boeing 737-200 accident, referencing NTSB Safety Recommendation A98-70 [Z] (1998). I've been unable to find the accident or the safety recommendation.

I'd be happy for any help.

[Musician]

Found it!

https://data.ntsb.gov/carol-main-pub...tails/A-98-070 is a bit meager, but https://apps.dtic.mil/sti/tr/pdf/ADA359793.pdf has facsimiles of all 1998 recommendations.

Excerpts:

Spoiler

 

 

[slast]

Trident reverser on landing - clarification

Dtype, Herod, DaveReid, topgas: for clarification and to avoid thread drift.

On the Trident the pods ONLY had reversers. It was allowable to select up to 10,000 rpm in reverse in flight for expedited descent. The NORMAL landing procedure was to select reverse IDLE in the flare. It was possible to select full reverse in the flare, and recommended to do so in some conditions such as short or wet runways - the Gripper did not have good brakes.

The reverser position was not a flight recorder parameter, at least not in the 1970s. This had some interesting consequences after a minor incident, including nearly scuppering NASA’s ASRS programme. But that’s a different story altogether and won’t be going here!

[punkalouver]

Originally Posted by tdracer

Assuming the (now deleted post) was correct, and this is an issue with TCMA when combined with an unusual T/R application, it has nothing to do with reverse before being on the ground.
TCMA - Thrust Control Malfunction Accommodation - is something Boeing came up with to address an FAA (and later EASA) concern with Uncontrollable High Thrust (UHT) on the ground. UHT is nothing new - although uncommon (probability of occurance is somewhere between 1/10 million and 1/100 million flight hours), all turbine engine installations have failures that can cause the fuel metering valve to go wide open uncommanded. FADEC has made it less likely, but the potential failure is still there.
UHT was always assumed to be something the flight crew could address by shutting down the affected engine - but then there was an event on a 737-200. Going from memory here, but I think it was 1997, it was either in Egypt or an Egyptian operator (fuzzy memory on that part). Anyway, there was an issue with the JT8D fuel control where the splined shaft that fed N2 speed to the fuel control could wear excessively and start slipping. During takeoff power set, that spline started slipping - the fuel control thought the dropping N2 meant the engine was spooling down and opened the fuel metering valve wide open. The crew saw EGT spike over redlline and aborted the takeoff, but the fuel control didn't respond when they retarded the throttles. The went off the side at low speed - no one was seriously injured or killed, but it was a hull loss.
The FAA (and later EASA) decided this meant that UHT on the ground was catastrophic and therefore every aircraft/engine combination ever built didn't comply with the regulations (25.901(c) - no single failure shall result in an unsafe condition).
It become a long and quite messy story - the FAA ended up issuing partial exemptions for aircraft then in production, but dictated that we needed to address UHT on the ground for future aircraft certs. So starting with the 777-300ER/GE90-115B, Boeing came up with TCMA. In short, when on the ground, if the FADEC determines that the engine is at high power with the throttles at/near idle, and not decelerating, TCMA will shut the engine down. For what should be obvious reasons, TCMA is only active on ground, with quite robust air/ground logic that will default to air if it's not sure.

I wonder if this was the incident.

https://asn.flightsafety.org/wikibase/324400

[AAKEE]

Originally Posted by Lead Balloon

Just rejuvenating this thread and won't mention 'the other' event.

Contrary to my earlier surmising that any sensor measuring ‘in the air’ versus ‘on the ground’ could drive both TCMAs on the 787 to the ‘on the ground’ state, a ‘whole of aircraft’ ‘decision’ is made that the aircraft in ‘in the air’ or ‘on the ground’, taking in consideration all of the sensors and, in the case of 'disagreement', disregarding whichever of them is most likely to be erroneous. The probabilities of the 'aircraft' 'choosing' the wrong state are, consequently, extraordinarily remote.

We can be sure that a single sensor can not be certified when it comes to catastrofic failure, for example that both engines quit in flight (IFSD).

From CS25, there’s a link from the engine installation paragraf to this:
§ 25.1309 Equipment, systems, and installations.

The airplane systems and associated components, evaluated separately and in

relation to other systems, must be designed and installed so that they meet all of the

following requirements:

(1) Each catastrophic failure condition—

(i) Must be extremely improbable; and

(ii) Must not result from a single failure.

[Lonewolf_50]

As I read through tdracer's post (quoted by punkalover) and then your post AAKEE, I will observe that 'catastrophic' for the FAA cite you made is within the context of airworthiness, while a hull loss might be seen as 'catastrophic' (despite nobody being hurt in that incident) by the bean counters.

[AAKEE]

Originally Posted by Lonewolf_50

As I read through tdracer's post (quoted by punkalover) and then your post AAKEE, I will observe that 'catastrophic' for the FAA cite you made is within the context of airworthiness, while a hull loss might be seen as 'catastrophic' (despite nobody being hurt in that incident) by the bean counters.

I thought I wouldn’t need to bore thread followers with all the regulation text, but, this is the appropriate text from the Advisory Circular ( AC ):

7.2.2.3.2 Nevertheless, some failures within airplane systems common to multiple engines may cause a catastrophic multiple engine thrust loss. These should be assessed by the applicant to ensure that they meet the “no singlefailure” and “extremely improbable” criteria of §§ 25.901(c) and 25.1309(b), as well as the engine-to-engine isolation criteria of § 25.903(b). Systems to be considered include, but are not limited to:

From how I read this, and how the basical principle for certification according to FAR/CS25 and 29 you should not be able to certify a system that from a single failure ends up in a catastropic failure.

The designer needs to make a System Safety Assessment and would need to find that the single sensor could end up with both engines lost in flight. Which could not be accepted of course.

[Musician]

Originally Posted by punkalouver

I wonder if this was the incident.

https://asn.flightsafety.org/wikibase/324400

No, it's not. Please see my post above, click [+] to see excerpts from the NTSB writeup.
https://asn.flightsafety.org/asndb/324137

Originally Posted by AAKEE

From how I read this, and how the basical principle for certification according to FAR/CS25 and 29 you should not be able to certify a system that from a single failure ends up in a catastropic failure.

Unless the FAA grants an exemption.
https://downloads.regulations.gov/FA...tachment_1.pdf

[Lead Balloon]

To be clear, I'm not suggesting the 'in the air' / 'on the ground' signal is a single point of failure for both TCMAs. There would, of course, also have to be a sufficiently large 'mismatch' between measured thrust lever positions compared with measured thrust. An erroneous 'on the ground' signal just enables the TCMAs in circumstances in which they are not intended to be enabled.

My understanding - been wrong many times before and will happily stand corrected - is that idle is only one of the measured thrust lever positions at which TCMA is designed to activate shutdown if the measured thrust is ‘too high’. Apparently there’s an ‘envelope’ of measured thrust lever positions versus measured thrust, outside of which the TCMA will activate (in the ‘on the ground’ state). Consequently, it is possible for TCMA to activate shutdown (if it believes it’s on the ground) when the measured thrust position is ‘more’ than idle, provided the delta with measured power is big enough for long enough. How far advanced the measured thrust lever position may be with potential for the delta with measured power to still activate TCMA shut down? Dunno.

I mention this because I - and know others - are still trying to sort out the implications the various main landing gear truck positions and main door positions after take off in a 78. Maybe there's a weird failure mode in the undercarriage system that keeps the aircraft logic - or at least for the purposes of some systems - 'on the ground'.

[Musician]

Originally Posted by Lead Balloon

To be clear, I'm not suggesting the 'in the air' / 'on the ground' signal is a single point of failure for both TCMAs.

Well, it certainly wasn't a failure here, the aircraft was well and good on the ground.
The danger in shutting an engine down is sudden asymmetric thrust in a critical situation, but even that didn't happen because both engines shut down.

[krismiler]

Murphy's Law - If it can go wrong, it will go wrong.

The more things that need to go wrong at the same time, the less likely it is that something will happen. However on this occasion, all the holes lined up. This accident will probably turn out to have a root cause and a chain of systemic failures which completed the chain.