ANA 787 Engines shutdown during landing

[Someone Somewhere]

Originally Posted by Den2020

Hello everybody,
after reading the whole thread I wonder why it was impossible to start the engines again?! Even with the help from outside (technicians) it was not possible. Does the TCMA has this feature, not allowing to re-start the engines once activated?
Best regards

I haven't been able to find this explained anywhere.

My guess is that it's some kind of lockout where the engine will refuse to start if it's on the ground and believes it's unsafe to do so, potentially implying a maintenance reset. If you tried to start an engine with a genuinely stuck open fuel valve, you might get a fireball or a sudden acceleration up to maximum thrust, knocking the aircraft off any chocks or parking brakes.

[324906]

I understand and accept the points that someone somewhere makes. It would be interesting to to see the stats on why exceedences occur with FADEC controlled engines versus ‘steam driven’. I have from time to time pondered the Airbus ‘revolution’ of FBW. Is it possible that the’pilot proof’ aircraft simply meant that we crashed for different reasons,more related to misunderstanding or not being fully aware of the tech stuff (AFD sitems as an example) that is installed. As I said, I am a dinosaur, although not quite extinct. Please take my comments as meandering thoughts for discussion, rather than prescriptive ‘solutions’.

[Magplug]

Originally Posted by Someone Somewhere

I haven't been able to find this explained anywhere.

My guess is that it's some kind of lockout where the engine will refuse to start if it's on the ground and believes it's unsafe to do so, potentially implying a maintenance reset. If you tried to start an engine with a genuinely stuck open fuel valve, you might get a fireball or a sudden acceleration up to maximum thrust, knocking the aircraft off any chocks or parking brakes.

787 Operators NEVER power down their aircraft fully because powering it up again is a VERY long and painful process. When the crew walk away from an aircraft it is on gound power with the IRS and batteries turned off. If all engine generators unexpectedly dropped off line after landing you have a pretty dead aircraft that you might as well walk away from. The engineers will be busy for quite a while resuscitating it.

[Leonakua]

Originally Posted by tdracer

TCMA only shuts down the engine with the problem. Boeing makes of point of not cross talking information between engines to help protect engine-to-engine isolation.
The intent is not to override anything the pilots are doing, but to deal with an engine that's not responding when the thrust lever is moved to idle.

So this has been unclear to me. On TakeOff, with both in TOGA, say NUMBER TWO fails. Not yet at V1, PF retards both levers, number two because he/she knows it has Failed, and number one because he/she rejects the rotation ..


Assuming each engine is isolated from the other, Including TCMA, will both shut down independently, and "simultaneously"? Even though engine data is read as quite different? Asking if the airframe logic can suss the difference twixt legitimate
Dual shutdown and airborne dual shutdown?
Mode logic confusion... Thank you tdracer




If asked before, was the one second sample rate considered? Seems relying on steam sensors (WoW, levers discrepancy, etc) might conflict with instant FADECS??

If this is accurate, and TCMA " Does not care about acceleration, I see a problem.
Once WoW has triggered TCMA, once and done. No? Because I give TCMA. NO leeway. If it ShutDown thruston a landing, it's locked out, full stop. Eh?

Otherwise, the TCMA is piloting the aircraft...and TOGA should be right there, let alone the ability to relight...

[tdracer]

Originally Posted by Leonakua

So this has been unclear to me. On TakeOff, with both in TOGA, say NUMBER TWO fails. Not yet at V1, PF retards both levers, number two because he/she knows it has Failed, and number one because he/she rejects the rotation ..


Assuming each engine is isolated from the other, Including TCMA, will both shut down independently, and "simultaneously"? Even though engine data is read as quite different? Asking if the airframe logic can suss the difference twixt legitimate
Dual shutdown and airborne dual shutdown?
Mode logic confusion... Thank you tdracer




If asked before, was the one second sample rate considered? Seems relying on steam sensors (WoW, levers discrepancy, etc) might conflict with instant FADECS??

If this is accurate, and TCMA " Does not care about acceleration, I see a problem.
Once WoW has triggered TCMA, once and done. No? Because I give TCMA. NO leeway. If it advanced thrust on a landing, it's locked out, full stop. Eh?

First off, WoW, Lever angles, etc. are not "one second' - they are basically instantaneous. Thrust lever angle is read directly by the FADEC, at the FADEC 'minor frame' update rate (not sure about the Trent, the GEnx minor frame is 15 milliseconds). Once per second is the update rate for most parameters on the FDR - it's not the update rate the avionics use. I don't know specifics of the 787, but on the 747-8 the update rate for Wow and Radio Alt was about 10 times/second - I'd expect the ethernet based network on the 787 to be faster.

Let me say this again - TCMA will only take action if the engine is not responding normally to thrust lever movements. We use flight test data to validate the rates that we expect the engine to respond to lever movements, then add ~20% margin to that. So if you do an RTO because one engine failed, TCMA won't do anything on the good engine unless the engine stays at high power after the thrust lever is retarded. It's not related to the aircraft speed or acceleration rate - it's all to do with how the engine is reacting to what the thrust lever inputs are telling it to do.

[Musician]

Originally Posted by Leonakua

So this has been unclear to me. On TakeOff, with both in TOGA, say NUMBER TWO fails. Not yet at V1, PF retards both levers, number two because he/she knows it has Failed, and number one because he/she rejects the rotation ..

Assuming each engine is isolated from the other, Including TCMA, will both shut down independently, and "simultaneously"? Even though engine data is read as quite different?

Each FADEC sees the thrust lever for its engine retarded, and will thus send its engine to idle.
IF the N2 for the engine fails to go to idle, AND the aircraft is on the ground (and slow enough?), THEN clearly the FADEC has lost control of the engine (something broke), and TCMA will cut fuel to the engine. It'll be hard for the aircraft to brake if the engine thrust does not reduce, and likely depart the runway to the side, too, so the role of TCMA would be beneficial if the conditions for it to trigger are met.
If TCMA did not trigger, then the FADECs retarded the turbines to idle as commanded.
Nothing in this process requires the right and left side to communicate with each other.

[Leonakua]

If "Lighting your "Wingman" is not "Communicating", then I've got CPR all wrong...

Besides I am referring to a "Common Core" Consultation, not a party line.
We are discussing something that should NOT have happened...you don't get there by defending what was supposed to happen...

My point is that here, TCMA WAS ENGINEERED to prevent Overboost, or throttles incorrectly misaligned. Not to second guess the crew. Crew will bounce, it happens.
QF32 could have used a precautionary shut down on #2. ANA was doing just fine.
IMO,
Should TCMA BE Transferred to cover TOC? Leave landings alone?

TCMA?? Arse about? Should it be prohibited below 10k AGL?? Like sterile cockpit. I will tell you this rotor burst at altitude could have killed every body

Overboost on the roll also, but some will live, and after rotation it is supposed to mind its own business....supposed to...

[Musician]

Originally Posted by Leonakua

My point is that here, TCMA WAS ENGINEERED to prevent Overboost, or throttles incorrectly misaligned. Not to second guess the crew.

No, TCMA was not engineered to do either of that.
When has TCMA ever second-guessed the crew?

I do not understand
* what you think happened,
* what you think should have happened,
* and how communication plays into this.

If you want any comments on this, you need to be explicit and detailed, and not talk in hints and riddles.

[TURIN]

Originally Posted by Magplug

787 Operators NEVER power down their aircraft fully because powering it up again is a VERY long and painful process. When the crew walk away from an aircraft it is on gound power with the IRS and batteries turned off. If all engine generators unexpectedly dropped off line after landing you have a pretty dead aircraft that you might as well walk away from. The engineers will be busy for quite a while resuscitating it.

Your second part is correct. An unscheduled and unexpected loss of main bus power can take an age to put right.

The first part is wrong.
787s are powered down if they are not going anywhere for a while and servicing or maintenance is not required. It happens regularly.
Powering up a 787 takes longer than most legacy aircraft but it's not hours. Neither is it painful.
As long as you do it right.

[Someone Somewhere]

Originally Posted by Leonakua

If "Lighting your "Wingman" is not "Communicating", then I've got CPR all wrong...

Besides I am referring to a "Common Core" Consultation, not a party line.
We are discussing something that should NOT have happened...you don't get there by defending what was supposed to happen...

My point is that here, TCMA WAS ENGINEERED to prevent Overboost, or throttles incorrectly misaligned. Not to second guess the crew. Crew will bounce, it happens.
QF32 could have used a precautionary shut down on #2. ANA was doing just fine.
IMO,
Should TCMA BE Transferred to cover TOC? Leave landings alone?

TCMA?? Arse about? Should it be prohibited below 10k AGL?? Like sterile cockpit. I will tell you this rotor burst at altitude could have killed every body

Overboost on the roll also, but some will live, and after rotation it is supposed to mind its own business....supposed to...

I'm pretty sure you're BugBear under a different name, so I suggest you re-read and re-interpret this post again:

Spoiler

 

 

Originally Posted by Someone Somewhere

Again, you're smushing everything into one big mass of 'stuff I don't understand'. These systems are discrete, each with their own triggers and actions taken.

It is like wondering why your smoke detectors didn't save you from electric shock: they have no means to detect it, and the effect they have has no impact on the thing you wanted them to prevent. The fact that people sometimes put two or more safety devices in one box, or that they might look the same, doesn't really make a difference.

Safety systems generally detect a specified sequence of events, and then take a specified action when those events are detected.

• Smoke detector:
  • Detects smoke
  • Action: makes loud noise
• RCD/GFCI:
  • Detects unequal/residual current, indicating a possible shock
  • Action: cuts power
• Conventional circuit breaker or fuse:
  • Detects:
    • way too much current for a short time, or
    • a bit too much current for a long time (inverse curve)
  • Action: cuts power
• Surge protector:
  • Detects: excess voltage
  • Action: Draws a lot of current to limit that voltage
• TCMA (in FADEC):
  • Detects:
    • Commanded thrust (thrust lever position) low, and
    • Actual thrust from engine high, and
    • Actual thrust from engine not decreasing, and
    • On ground (WoW)
  • Action: Shut down engine by closing HP fuel valve
• Turbine/N2 Overspeed (in FADEC):
  • Detects spool spinning way too fast, at risk of rotor burst
  • Action: Shut down engine by closing HP fuel valve
• Loss of thrust lever position detection (in FADEC)
  • Detects that both thrust lever resolver signals are missing (or impossible?)
  • Action: Maintain last valid thrust setting (on some previous aircraft)
  • Action: Set engine to idle (on other previous aircraft)
  • Action: shut down engine (on 787/GEnx? Why?)
• Fire shutdown switch
  • Detects crew pulling fire handle
  • Action:
    • Disconnect generators
    • Shut off hydraulics to engine
    • Shut HP & LP fuel fuel valves
    • Shut off bleed air (not on 787)
    • Arm exinguisher squibs.

N2 Overspeed (and various equivalents) are designed to prevent a rotor burst by shutting the engine down if a particular rotor overspeeds. The Trent 900 on QF32 didn't have overspeed protection on its N2 rotor because it was thought that it was impossible for that rotor to overspeed without also overspeeding N3, which was protected. I expect that's fixed now.

Overboost is where the engine as a whole is running at too high a power setting, shortening engine life and risking failure. That's avoided by the control loops in the FADEC under normal conditions. If the FADEC thinks it's partially damaged and unable to properly determine some factors (usually sensor failures), the FADEC ends up in an alternate mode without overboost protection, which becomes the crew's problem. Overboost is a minutes problem, not a seconds or split-second problem.

TCMA shuts the engine down if it continues producing high thrust but the crew has that same engine set to/near idle. It only does this on the ground, because uncommanded high thrust in the air isn't a major hazard - there's always more sky above you, you can reduce thrust on the other engine to maintain altitude/drift down, and there's little time pressure.

TCMA doesn't care about throttle split. One engine operating and one engine stopped is a pretty big throttle split.

[tdracer]

Originally Posted by Someone Somewhere

N2 Overspeed (and various equivalents) are designed to prevent a rotor burst by shutting the engine down if a particular rotor overspeeds. The Trent 900 on QF32 didn't have overspeed protection on its N2 rotor because it was thought that it was impossible for that rotor to overspeed without also overspeeding N3, which was protected. I expect that's fixed now.

Rolls "TOS" system (Turbine Over Speed) is rather interesting - it checks for speed differences between the 'front' (compressor) and 'aft' (turbine) part of the shaft, and will shut the engine down if they differ (by more than some small tolerance). One issue with the 3 spool architecture is that bearing lubrication becomes tricky, and if the lube fails, the shaft can shear which can allow the turbine to accelerate rapidly to burst speed - faster than the normal fuel metering valve can react. This was first manifested on the RB211 - where an N1 shaft failure released the fan on an L1011 center engine - which then proceeded to try to cut the aircraft in half (fortunately it failed and they were able to land safely). This lead to the adoption of a 'fan catcher' - which worked to keep the fan pretty much in place, but then the unloaded turbine oversped and burst (happened at least once on a 747, fortunately without serious aircraft damage). This in turn lead to an N1 "TOS" - which could shutdown the engine (via the fuel control shutoff valve) in milliseconds. TOS was added to the N3 shaft when Rolls introduced the Trent series of engines, and then eventually to the N2 shaft after the QF32 event.
I don't recall now which shaft, but Rolls did an unplanned test of the TOS system on a Trent 1000 TEN engine when a shaft failed during an engineering test (it apparently worked as advertised).

BTW, GE uses a different design philosophy for a shaft failure - the turbine shaft is designed to move aft if the shaft fails, causing a clash with the fixed vanes in the turbine which slows the turbine preventing an overspeed (and the turbine case is designed to contain the resultant debris). There has been the odd shaft failure on GE engines over the years and none have resulted in a burst turbine - so apparently it works (granted, the CF6 series has had some burst turbines, but those were not the result of overspeed events).
No firsthand knowledge, but I believe the Pratt philosophy is similar to GE.

Originally Posted by Someone Somewhere

I'm pretty sure you're BugBear under a different name, so I suggest you re-read and re-interpret this post again:

That would explain a lot...

[Leonakua]

"TCMA doesn't care about throttle split. One engine operating and one engine stopped is a pretty big throttle split."

Right. So if Reverse is selected, and both are producing thrust, Both are shutdown? If reverse is selected, and only one is making power, which one is cut? IOW, are there allowable conditions for TCMA to cut both, and not be relit? Cut one, and make it continuous OEI??? Is it possible for TCMA to cut the good engine?

[Musician]

Originally Posted by Leonakua

"TCMA doesn't care about throttle split. One engine operating and one engine stopped is a pretty big throttle split."

Right. So if Reverse is selected, and both are producing thrust, Both are shutdown? If reverse is selected, and only one is making power, which one is cut? IOW, are there allowable conditions for TCMA to cut both, and not be relit? Cut one, and make it continuous OEI??? Is it possible for TCMA to cut the good engine?

TCMA only considers the one engine that the FADEC it is running on is attached to.
TCMA will only cut its engine when its throttle is at idle, but the engine won't go to idle.
If there's an engine "making power" when it should be idling, on the ground, don't you agree it should be cut?
Do you think that engine is a "good engine"?

[Leonakua]

Yes. If the plane bounces, it has not landed. In less than three seconds all four translating cowls could shut and Toga would be two seconds away. So, yes.... TCMA can NOT be programmed to frustrate or foul a feasible escape maneuver.
With respect, Leo
(During a landing, if a pilot initiates a go-around after having already deployed the thrust reversers, they must first manually stow the reverse levers before the TOGA switches can be effectively used or the forward thrust levers advanced.) GEnx. Do cascade reversers actually reverse thrust? Or, divert N1 sideways.

[TURIN]

Cascade vanes are angled to direct the thrust forward. It's not completely in reverse but enough to be effective.

[Pilot DAR]

Hello Posters,

I have moved this thread here to the Tech Log, as it is an older event which has become an entirely technical discussion.

Pilot DAR

[Vessbot]

It's only “rollback and shutdown” if it comes from the Seattle region of Washington, otherwise it's just sparkling engine failure.

[Leonakua]

You Tube

Vessbot
Not Engine Failure .....Extraneous software intrusion....

[eckhard]

787s are powered down if they are not going anywhere for a while and servicing or maintenance is not required. It happens regularly.
Powering up a 787 takes longer than most legacy aircraft but it's not hours. Neither is it painful.
As long as you do it right.

At BA, we normally didn’t power down between flights, however:

there was a problem discovered by Boeing, that if a 787 wasn’t powered down after a certain period of time (128 days?), there could be problems. So, the engineers had a schedule of “de-powering” each tail number on one of the occasions that it passed through LHR with sufficient turn-round time.

I had some status messages once at MEX which the engineers couldn’t clear, even though the originating fault had been fixed. After much head-scratching and liaison with London, the answer was to completely de-power the aircraft, leave it dark for 20 minutes, and then carefully power-up again.

Unfortunately, it was night, so all passengers had to be offloaded. Not normally a problem but we had 35 wheelchair users on board, so it took a while….

​​​​​​​But it worked!

[Someone Somewhere]

Originally Posted by Leonakua

Yes. If the plane bounces, it has not landed. In less than three seconds all four translating cowls could shut and Toga would be two seconds away. So, yes.... TCMA can NOT be programmed to frustrate or foul a feasible escape maneuver.
With respect, Leo
(During a landing, if a pilot initiates a go-around after having already deployed the thrust reversers, they must first manually stow the reverse levers before the TOGA switches can be effectively used or the forward thrust levers advanced.) GEnx. Do cascade reversers actually reverse thrust? Or, divert N1 sideways.

• Airbus and Boeing both state that once thrust reversers have been selected, you are committed to landing. Failure of reversers to stow occurs, especially as reversers are usually locked out (stow or retract) while airborne. If you leave the ground with a reverser deployed, it will not stow until you return to the ground. So you are potentially trying to do a go around with one engine stuck in auto-idle with the doors open causing high drag.
  • Obviously some pilots break this rule.
  • https://www.smartcockpit.com/downloa...ision-to-stop/ (other source linked as Airbus Safety First seems to be down)
  • https://studylib.net/doc/26150546/th...irbus-safety-f... (other source linked as Airbus Safety First seems to be down)
  • https://www.faa.gov/lessons_learned/...cidents/C-FPWC
  • AF777 TOGA after thrust reverser deployment
  • This applies even to aircraft long predating TCMA, and I think is mostly due to the protections added after the Lauda 767 crash.
• The classic case for when TCMA would be critical is if you attempted to deploy or stow a reverser and the engine returned to full power uncommanded. You could then have one engine in full forward thrust and one engine in full reverse thrust. TCMA would activate to ensure that the engine is either a) doing what you ask it to, b) at idle because the reverser has failed, or c) shut down because the FADEC can't return the engine to idle.

See this video for an example of why you don't try to go around after reverse is selected. This is a 767, without TCMA. Once off the ground, the reversers cannot deploy or stow and are stuck where they are, with the engine stuck at auto-idle because the reversers are not in the commanded position.

You Tube