Leeham News and Analysis
There's more to real news than a news release.
Air India Flight 171 Preliminary Crash Report Is Unclear Regarding Pilot Actions
By Bjorn Fehrm
July 11, 2025, © Leeham News: India’s Aircraft Accident Investigation Bureau has issued the preliminary report of the crash of Flight 171.
The report indicates that the aircraft and flight crew were fit for flight and that the pilots were experienced, with the Captain having a total of 15,638 flight hours, including 8,596 on type, and the First Officer having 3,403 flight hours, with 1,128 on type.
The report documents the technical registration of the engine’s Fuel Cutoff switches, which transition from RUN to CUTOFF, remain at CUTOFF for 10 seconds, and then return to RUN. By then, the engine cores have slowed down below flight idle, with the engines delivering almost no thrust.
Inadequate reporting on pilot conversations and actions
The report is detailed enough on the physical events in the aircraft to understand what is happening, but it is inadequate regarding the pilots’ discussions and actions. Here is why, with excerpts from the report (which you can find here):
- After a normal rotation at 153kts with flaps in the normal 5 degress position the report states: The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off. In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
- As per the EAFR (the intact forward data and voice flight recorder) data both engines N2 values passed below minimum idle speed, and the RAT hydraulic pump began supplying hydraulic power at about 08:08:47 UTC. As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC. The APU Inlet Door began opening at about 08:08:54 UTC, consistent with the APU Auto Start logic. Thereafter at 08:08:56 UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN. When fuel control switches are moved from CUTOFF to RUN while the aircraft is inflight, each engines full authority dual engine control (FADEC) automatically manages a relight and thrust recovery sequence of ignition and fuel introduction.
- The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
- At about 08:09:05 UTC, one of the pilots transmitted “MAYDAY MAYDAY MAYDAY”. The ATCO enquired about the call sign. ATCO did not get any response but observed the aircraft crashing outside the airport boundary and activated the emergency response. The EAFR recording stopped at 08:09:11 UTC.
The above are the important bits from the preliminary report.
Here are my comments on the information in the report and what is not in the report that should have been there:
- Everything is normal in the takeoff until it’s time to command and execute “GEAR UP” at about 08:08:42 UTC. Then the Fuel Cutoff switches are moved from RUN to CUTOFF. This is with a high probability done by a person as the switches are lift-guarded and these will not accidentally BOTH jump over the guard to CUTOFF. There is no discussion in the report that this could have occurred internally in the fuel system. In fact, one pilot says to the other, “ Why did you cutoff?” meaning he has either seen the action or the position of the switches.
- The information “In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.” This is suddenly a vague and inadequate standard of information in the report. Why is the asking or responding pilot not identified (Captain as Pilot Monitoring, PM, or First Officer, Pilot Flying, PF)?
- Why is the further conversation or actions of the pilots not described after this dialogue? Putting the switches in CUTOFF is a grave action that puts the aircraft and all people at risk. It’s improbable it’s a mistake, as there is no hand movement in this area during takeoff.
- Why does it take 10 seconds to move engine No. 1’s switch to RUN and 14 seconds for No. 2 engine?? I would have had both in RUN within 5 seconds or less! To me, this indicates a problematic pilot interaction after the switches went to CUTOFF, for which we receive NO information.
There is a passing reference in the early part of the report about a recommendation to check the locking mechanism of the Fuel Cutoff switches, as these on a 737 had deteriorated. I place little value on this part, as the switches in the 787 have not had a single issue. These cannot be moved without lifting the switch from its guarded position.
I interpret the inadequate reporting on pilot conversations and the remark on checks recommended for the switch guard mechanism as the investigation attempting to muddy the clarity of the facts and mire an ugly truth in doubt.
Wild A** guess – not an accident re switches. ( Not a pilot )
Is it possible to mistake the fuel cut-off switches for the gear up lever?
But then, why do the same thing twice?
No. The Gear Handle is located on the Dashboard in front of the pilots. The fuel cutoff switches are positioned as far away as possible at the back of the throttle quadrant. No way.
Nope! Completely different lever in a different area away from the fuel switches.
“Everything is normal in the takeoff until it’s time to command and execute “GEAR UP” at about 08:08:42 UTC. Then the Fuel Cutoff switches are moved from RUN to CUTOFF. ”
The report also notes, with a photograph, that the landing gear lever was found still in the DOWN position.
The report does not tell us whether the CVY transcript records a “gear up” call immediately before the fuel cutoff switches were moved to CUTOFF. This will be something to watch for in the final report.
The gear lever and the fuel cutoff switches are in different places and require completely different actions. That said, both involve actions for which pilots do have muscle memory.
Humans – even pilots – do a lot of things by instinct rather than deliberation, particularly where the action uses muscle memory. Occasionally we find, perhaps when distracted, that we have done something daft. Fortunately such brain blips rarely have fatal consequences.
I wonder if this might have been an exception: taking at face value the exchange quoted in the report, both pilots were surprised to find that the switches had been moved to CUTOFF…
IMO not possible. You have muscle memory for actions you do in the cockpit during the sequence of flight. You don’t touch the fuel switches during flight, so no muscle memory. You do move them to the cutoff after the engine has idled for some time after gate arrival. No chance of inadvertent movement, none.
My full agreement with Bjorn. Obviously we were totally different pilot types but some things are solid.
Keep in mind this is not just a switch movement.
These are toggle locked by a mechanical stop and spring pressure to keep them in that position.
Moving one is not an action done in flight ever. Yes its an action of a dual engine failure done in the simulator (maybe).
” Moving one is not an action done in flight ever. ”
But in case of an engine fire in flight- probably… 🙂
If both switches are ever switched off in a “real fight” (at high enough altitude) seems to be a valid question.
This has been making the rounds:
Dual Eng Fail/ Stall
Condition: Engine speed for both engines is below idle.
1 FUEL CONTROL switches both CUTOFF, then RUN
2 RAM AIR TURBINE switch Push and hold for 1 second
Causes
Threats
Mitigation
– (high altitude) Fuel leak, fuel starvation, volcanic ash
– (low altitude) Birdstrike on both engines
– Startle factor, confusion arising from multiple sub systems failures
– Very high workload
– Prompt recognition of the situation & initiation of the correct memory item
It seems that “toggling off and on” the fuel switch is a proscribed procedure. If both engines are below idle in the air, it is a bad day, but there seems to be a procedure. If you are low to the ground it seems to be a desperate move. Mover who is a 787 pilot suggested that if they / he had a little more time (how much 15 – 25 seconds??) it might have worked.
I believe that needs to be amended a bit.
While normally below idle on the Shutdown, some of the concept involves a runaway engine that needs to be shutdown. No idle in that case.
As a low to ground aspect, its not an option as it takes a full power engine to zero thrust. I would guess you need 3000 feet to pull it off.
Duel engine issues requiring drastic action are pretty much unheard of. So while its a aspect, two at the same time is serious odds like .0000000000001 to the 100th.
Spool up time for a 787 engine is probably 30-40 seconds. That is from partial power when you put the throttles full forward (TOGO button).
Raw ignitions from a dead stop? 45 seconds.
Was there a relief pilot on board for this longish flight, sitting in the jump seat and close to those switches and therefore out of sight of the PF and PM?
None reported yet but the flight did not require a relief pilot.
Does not mean no jump seater.
As a former Senior Purser with Cathay Pacific, I completely agree with your point about muscle memory — it’s something we rely on extensively in aviation and in our daily lives, often without even realising it.
I’ve been wondering the same: could one of the pilots have inadvertently placed a hand on the fuel cut-off switches due to familiarity or reflex? Back when I was flying, we still had a flight engineer in the cockpit, which added another layer of oversight. I do wonder why that third person isn’t considered essential anymore, especially given the increasing complexity of systems.
What I find most perplexing is: why isn’t there an audible alarm when such a critical switch is activated? Even cars alert us for far less serious actions — you’d expect that an aircraft, with so much at stake, would have a clear warning when fuel is cut off mid-flight.
The muscle memory thing has gotten way over the fence. Its being used out of context.
Muscle memory is triggered by a pre trained action triggered by a defined situation. Like a Batter swinging at a ball. That same batter at first base does not switch when he has a ball thrown to him. They train for all that stuff thousands of times.
The only muscle memory a pilot has or uses is on the stick or yoke for miner course adjustments.
Everything else is Peters famous PIOSE. Problem, Identify an Action, you in fact are trained to slow down and confirm.
As for the Alarm, there is. What form those alarms are and what triggers it FIRST, I do not know.
For sure the N1 and N2 engine alarms on both sides go off. The fuel system display if not up will pop up with switch and valve indicators in RED. Maybe an audible.
For never seen or trained situation, someone reacted very quickly in assimilating a Red Board and understanding or focusing on the cause of the Shutdown Switches put to OFF.
The problem with alarms is you have to sort them. In this case one of the pilots did rapidly and got it spot on right. It was in a phase of flight once done you were not going to recover from.
There is an EICAS message and a master caution. There’s not a master alarm because fuel can only be turned off by the pilots.
Makes some sense but then you can also program it as an alarm if WOW, airspeed, altitude etc is above certain limits.
Realistically the engines stopping is so quick as to be almost immediate as well.
I suspect the systems diagrams shift to or open a window on fuel system status
I continue to be impressed with the speed or recognition and response by one pilot for what was a profoundly abnormal condition.
The reality is that the pilot (most likely) who shut them off could turn them on and then shutoff again, or do other things.
Once behavior goes into abnormal, there is no logic.
While I am not fond of the term startle factor, my thought is if you were the pilot who had not touched the switches, you would be stunned.
All sort of scenarios come to mind but the pilot who did not move the switches would have been shocked.
Assume the pilot not involved in switch movement was looking at the instruments (both should have been).
Your first indicator would be an alarm and the N1 starting to wind down. You have to assimilate that for an action that should not be taking place.
Then realize it was deliberate and trying to deal with switch position back on and the pilot who had moved them.
Basically you are dealing with denial by the Switch Mover, ramping up to what to do and as Bjorn noted, what the Switch Mover was doing.
As we saw with Boeing assuming time to react was immediate and that is not true for line pilots. Maybe some, probably a lot delayed and some never recover.
Basically you are involved with someone trying to kill you and fly an aircraft.
The time I got into a spin (not intentional) I panicked and I am not panic prone.
Probably two or three full turns before I got into the calm spot, assessed and reacted (mostly correctly – kudo to Cessna all I had to do was mostly right). If I had been lower I would have been dead. In fact some luck as I did not like how the aircraft was handling that day in stalls and had gotten another 1000 feet to work with.
One thing I did, I told my brother when he started flying he needed spin training and I think every pilot should see a spin and recovery as part of their training (in small aircraft approved for spins)
Fighter pilots live in a world of emergencies and I think Sully was an example of that.
Most of us don’t live on those kind of edges.
While an obvious action to turn back to run, some pilots might well never have gotten that far past the being stunned.
Pilot error is the answer . Same as always ( 95% of the time).
The motivations arent too important but deliberate is very very rare
@Duke:
Its not error if done deliberately.
Obviously someone doing that has some kind of abnormal issue, but yes, you want to try to understand it if there are signs of that people can be aware of and prevent it.
Equally obvious the Psychedelic Episode on the A175 was well hidden.
As was pointed out, if you are having problems you can’t come forward or your career is over. Not what you want.
“In fact, one pilot says to the other, ‘Why did you cutoff?’ meaning he has either seen the action or the position of the switches.”
Maybe not. Maybe a pilot intentionally shut them off and asked the question to place blame on the other?
The non switch operating pilot is not going to be looking at the Switches. His focus is on the instruments be it PF or PM.
As the action is totally abnormal, you will see the alarms going off be it a non normal switch position and the fuel valves OFF or the N1 loss. Probably the valve position first.
You are also trained to confirm though at that phase of flight its impossible aspect.
Confirm, look at the Switches, move switches and a Bjorn has noted, what is the pilot who moved the switches doing?. Just sitting there or actively fighting you?
And its possible that the Pilot that turned those Switches off turned them back on.
When a human breakdown occurs there is no logic to it nor predicting what is next.
Maybe we finally get cockpit video recordings of cockpit into the CVR. That will help understand altitude overshoots and unstable approaches as well
Agreed and its so far past time as to be criminal on the part of those who oppose it.
The 4 seconds are the problem.If the pilots were fighting over the switches,how did one of them eventually succeed?There must be a clue in recording as to their demeanour, cooperative/uncooperative.If it was some kind of mechanical fault,wouldn’t one of the pilots have said something like “Oh!its come on again”?
First of all it is deliberate whether or not the PM of PF did it.
I don’t have a problem with the delay, I can easily see it even longer.
The Switch mover could just be sitting there denying it.
That is probably going to get clarified.
The immediate aspect is its not a 787 issue that needs action and the rest we may or may not understand when they dig into what was happening as well as back groundf leading up to it.
Why would you wait 4 seconds between turning each engine back on?
As noted, you have to see it, understand it which is unfathomable and then do something.
For the average pilot I don’t see that as anything but normal.
Boeing expecting your average pilot to have test pilot reactions would not be.
In this case I do not believer there was anything that would make any difference.
Low, stalling, thrust take time to come in even if no further interference.
wait for effect?
Not sure what you mean but as this does not happen nor trained for, the PF has nothing to go by.
He has to see the shutdown, realize its not just one switch but two switches that have moved, look down to confirm it (its how we are trained) at which point somewhere in that train, why did you do it? I am going with the PF asking the PM, it could be wrong.
Then one of the two turned the Switches back on, no matter how fast it was never going to be in time.
There is definitely a significant number of glaring omissions in this report which suggest that there is something more happening here!
Too bad they didn’t provide some graphics of N2 & N1 as a function of time. I guess we will wait.
It is mentioned that the fuel on the ground was tested but very limited amount of fuel samples could be retrieved from the APU filter and Refuel/Jettison valve of left wing. The testing of these samples will be done at a suitable facility capable of carrying out the test with the limited available quantity. Of course this is after the crash site has been contaminated by a fire truck that drove over the wing and who knows how much water was being sprayed around.
The reason that I bring the N1 & N2 RPMs up as a function of time is that there is a very slight probability that the switches were toggled for a technical reason of low thrust. The sequence and timing do not suggest that it was for a technical reason but not having that information does leave a question open.
In someways this report answers some questions and generates a number of new ones. Considering that the it was reported that the NTSB was getting upset about issues, maybe there is more to the story.
@F-82:
The report says Switches off, N1 coming down, then N1 starting to recover on one but no thrust on the other.
Its clear what happened and probably who (not answered but I suspect its there) but not why and maybe never that.
It needs to be kept in mind that ACARs would have transmitted or been transmitting so you will have confirming data and the absence of alarms is data as well.
You say probably “who” but to me the report made which switch was turned off first purposely vague (to possibly not suggest the WHO).
Personally it is hard to suggest the who.
Yes it was, they have a human factor problem and want to get the background with as little corruption in it as possible. That is my take.
Its not an omission its deliberate.
Right now who did it tells us nothing actionable. They will want to try to see if there is any indicators they did not see or realize were there.
It may or may not happen, but the effort seems to be in that direction.
Bjorn, I’m wondering if you think perhaps that part of the conversation was withheld, because it’s possibly a criminal matter?
Tend to be suspicious along those lines. I presume the investigation will be looking at the cockpit personnel’s psychological profiles now. That and their finances. Starting to see some similarities to pilots having some troubles.
I know in the US, if there is criminality involved, those aspects will be withheld by NTSB, so as not to compromise the simultaneous criminal investigation.
@Rob:
I think we take it at face value that they do not want the background checks any more polluted with who than they can help.
If they ID who they think or know, that person is going to be considered guilty and responses can shift when that happens.
Again it may never be known and no one has any info but you don’t want to make it any worse.
Air India seems to have had scheduling issues with Pilots recently?
=====
https://www.indiatoday.in/india/story/days-after-crash-aviation-body-orders-air-india-to-remove-3-officials-for-serious-lapses-2744144-2025-06-21
=====
In this accident, both pilots seem to have enough sleep and were well rested?
Captain / First Officer
Date of Class I Medical Exam 05 Sept 2024 04 Feb 2025
Total Flying Experience 15638:22 Hrs 3403:12 Hrs.
Total Flying Experience on Type 8596:43 Hrs 1128:14 Hrs
Total Flying Experience as PIC on Type 8260:43 Hrs 0 Hrs
Total Flying Experience during last 180 days 262:58 Hrs 233:07 Hrs
Total Flying Experience during last 30 days 56:58 Hrs 66:24 Hrs
Total Flying Experience during last 07 days 07:12 Hrs 06:10 Hrs
Total Flying Experience during last 24 hours 00:00 Hrs 00:00 Hrs
Did they do any flying in another type aircraft recently with a vastly different control setup?
I wonder if they flew through a few time zones in the last few flights? International pilots, on the wrong time zone schedule, can become zombies, if they aren’t able to manage sleep cycles properly.
No, out of Mumbai, rested
According to the records, in the last 7 days, Capt and FO has 7 and 6 hrs flying, respectively. Not terribly taxing….
I am assuming that the reports about the engine cut off switches being moved is based on information from the flight data recorders, as well as the pilots conversation.
However, how does that information get passed to the flight data recorder? Is the position of the switches independently measured in some way or is it derived from the electrical signal which is changed by the switches and if it is based on an electrical signal is that the same signal that the flight controls can also switch?
In other words, is it possible that there is any ambiguity about what was the cause of the signal that is meant to record the position of the switches?
I suspect its an aspect of the power or no power (and I have yet to see if those valves are fail safe or not, ie. no power and they go open)
I do not believe the system has any input into the Switches or the downstream actions.
Saying that with a caveat, the position is going to report into the FDR and ingitor will go on and maybe power to FASDEC.
That said, I don’t think the system has any action in this though there may be timer or an interlock that stops the ignition once N1 is sufficient.
However, regardless you are talking both engines and software is not allowed to give a command (or a single computer) to both engines even for Thrust settings.
they keep those areas isolated from each other. It came up with the MAX crashes that two different groups write the software so a single error is not in both computers (granted that is a two computer system)
Even if possible the possibility of a dual action is close to if not zero.
You might want to research the TCMA (Thrust Control Malfunction Accommodation), for systems that can shut down the aircraft engines. (they should ONLY shut down when on the ground, but, on the 787) But, on the 787, the mechanical WOW sensors have been augmented…
======================
According to
=====
https://mentourpilot.com/does-the-787-have-a-problem-with-5g-interference/
=====
“Aircraft typically rely on weight-on-wheels (WOW) sensors, to let their systems know that they are on the ground.
But in the case of the 787, it appears that the radio altimeter has a key role in the process, making 5G interference a concern.”
=====
A previous duel engine automated shutdown, on the 787, not commanded by pilots.
https://simpleflying.com/ana-dual-engine-failure-on-landing/
=====
For the 787, the WoW function is not reliant on a single sensor, it depends on the rotation of the trucks and compression of the struts, as well as the stow sensor. The radar altimeter is a safeguard that prevents activation during extension and retraction, but it doesn’t indicate WoW.
The ANA dual rollback was caused by an uneven landing, during which the thrust reverser was also deployed early, before the aircraft was fully on the ground. This generated enough transient state transition events to convince the flight computers there was asymmetric thrust, so they rolled back the throttles once the aircraft reduced below the minimum ground maneuvering speed (below which the rudder lacks authority to prevent yaw).
The attorney Mary Schaivo has been peddling a conspiracy theory to recruit clients, that AI-171 experienced a similar computer commanded rollback on takeoff. But her theory was without factual basis or merit.
The 787 has two fuel shutoff valves. There is a high-pressure engine-side valve that is under dual control of the FADEC and the fire/cutoff switches in the cockpit.
Then there is the aircraft-side low-pressure valve mounted in the pylon. That one is only under the control of the cockpit fire/cutoff switches.
The flight recorders capture data from the FADEC, and so records if it commands the high-pressure valve to close. There are also separate captures from the cockpit fire control and cutoff switches. Additionally there are captures from the valves themselves, to determine state & position.
Thus I don’t think there is any potential for ambiguity. The cutoff switches close both valves, so the effect on N1 is immediate.
I’m not sure if this TCMA is used on the 787, but, it has a schematic showing some fuel cutoff relays along with the throttle. The FAA mandated this on because of some accident on the ground where the cockpit throttle was at idle and the engines were still going strong. The FAA wanted a system to stop the engines, if 1) the plane was on the ground and 2) throttle setting was idle and 3) the engines were going strong. I think the accident that prompted this resulted in a fire on the ground. I wonder if this is too much overkill myself.
===
https://patentimages.storage.googleapis.com/11/c0/6b/6dcf993795046a/US6704630.pdf
===
That incident resulted from a complete severing of the control wiring within the pylon, in which case the engine holds its current throttle setting, as a safety of flight issue.
The engine is fully redundant, providing its own power and having the ability to draft its own fuel from the tanks. So while the crew was able to land and stop, they could not shut off the engine. It also proved resistant to all the water the firefighters could pump into it.
I believe they finally used foam, which also damaged the engine, but there was really no other choice
There are probably many ways a troubled pilot can sabotage a flight. But to just reach over and shut off the gas for no logical reason in this age of computers and AI is terrible. I would seriously think this is a design flaw. It bodes well for the argument that maybe humans are not necessarily needed in the cockpit anymore.
There are design standards for certification that require risk analysis of probable failure modes. The risk that a pilot would shut off the engines on takeoff is essentially zero, and this incident does not appreciably change those odds. And to inhibit that function would also inhibit some situations where it might be necessary.
Ultimately the crew is responsible for their actions in flight. There is no avoiding that accountability. And if I have to choose between the risk of pilot intentional error, and automation like a Robotaxi, the odds are overwhelmingly and massively in favor of the pilot.
If you ever have done programming machines, even for simple systems, the failure modes are almost endless.
You have to make decisions. A pilot can pull the thrust lever or levers back as well.
It has nothing to do with AI or automation, it has everything to do with pilots being sane.
We have 6 I can think of the top of my head that was pilot induced crash.
If there is a fire you need to be able to cut off an engine and same goes for blades off (there are now shear bolts that will break fan loose).
The Germanwings pilot just pushed it over and into the ground as did the China 737-800.
How do you determine if a pilot is sane when he gets into the aircraft?
have him/her sign a waver 🙂
( I do wonder though if one could use
something like the “I am Human” checkbox.
with AI there should be a way to detect madness )
Sorry but my gut is just not buying this whole scenario
These experienced pilots had seconds
To react
My opinion is some serious malfunction in electrical power etc n all that followed was a response
To the underlying unknown culprit
@MS:
You have multiple facts saying it occurred the way it was laid out.
Voice
Switch Position Input
Engine Reaction DATA
Other: There are also a large number of things like Gen Power inputs, loss of hydraulic pressure etc that back all that up.
Probably the most massive electrical failure was on a test 787 going into San Antonio (Texas US). It took down the entire electrical system.
The engines as intended continued to run as they are independent. RAT deployed and they got minimum instruments and controls back .
Nothing in the data on AI 171 shows anything remotely like that happening.
TCMA ahs a separate circuit that overrides the Fuel Switches. So only 2
options here: TCMA went to work. This should have happened on ground. Unknown why. (But I guess the ANA shutdown on landing was a surprise). Or one of the pilots moved both switches to cutoff within 1 second !
I also think that the Auto Relight function could be responsible for the restart attempt. (Once the TCMA fault cleared). As I understand the relight will not happen until N1 and EGT has been reduced under a certain value. This could explain the 4 seconds between the “restart” attempts.
TCMA cannot explain the engines running normally until the cutoff switches were thrown.
Also the 4 seconds are between the switches being restored to the run position. The FADEC manages relight, the pilots would restore the switches ASAP.
In this case the first relight attempt by the FADEC was successful on the #1 engine, but although ignition ocurred in the #2 engine, it did not successfully relight on the several attempts by the FADEC.
Successful here is defined by arresting the deceleration of the engine spools and reversing it to acceleration.
Rob, Could the TCMA be triggered after takeoff, if the air/ground mode was taking it’s readings from the LRRA (gear down, or in transit mode, with trucks forward as some have mentioned)? And the Radar altimeter still thinking it was on the ground, either by 5G interference or this issue
=====
https://www.aviacionline.com/faa-issues-airworthiness-directive-for-boeing-787-dreamliners-due-to-autothrottle-and-radio-altimeter-issues
=====
the thottles were found in the aft (idle) position per the preliminary report, the engines were at full takeoff .. so what was the TCMA reading for ground/air mode? and could it at that low altitude have a false LRRA radar altimeter readings? The physical WOW senssors ‘should’ be reading air mode .. but, it seems like quite a complex decision tree for the air/ground mode ..
Good question…
What signal is actually observed by the FDR ?
Obviously this is NOT the switch position but some sort of signal. Is it possible this signal to be jammed by something making the same effect that an action on the switch ? After all, in electrical cockpit, signals are all generated/processed.
Indeed — very valid questions.
Essentially, the FDR is giving us derived information.
Claes’ comment about video recording in the cockpit is pertinent in this context — preferably at least 8K, andd from multiple angles.
Indeed — very valid questions.
Essentially, the FDR is giving us derived information: it’s recording an electrical signal — not a mechanical switch position.
Also, regarding the cockpit conversation: is the querying pilot reacting to a direct observation, an indirect observation, or an assumption?
Claes’ comment about video recording in the cockpit is pertinent in this context — preferably at least 8K, and from multiple angles.
Issue is explained above. Ambiguity in the flight recorder data is not possible.
Of course it’s possible.
Any time an electrical device seeks to record the state of a mechanical device, there’s the possibility of error.
This is because electrical signalling can be influenced by extraneous factors that have nothing to do with the mechanical device being monitored.
Examples: crosstalk, EM interference, arc-over.
Getting into esoteric arguments sloths over the issue.
Failing to accept that they have done cross checks that confirm the data.
In theory one switch position movement could be wrong. Not two, not two and back on again. Backed up by the data on N1 and N2 from the engines.
Backed up by data on timing. Backed up by data on valves positions and FASDEC status.
Delving into technical conspiracy theories is nothing more than a false path.
Good point! Are the sensors that detect whether the fuel switches are in the “on” or “off” position located right within the switches themselves, or elsewhere? For example, at the other end of the circuit (at the fuel solenoids/valves that control the fuel feed)? Just curious.
1] If those sensors are located within the switches, yes, definitely one of the pilots physically moved the switches.
2] If sensors are located downstream from the switches, for example in the avionics bay below the cockpit, or at the fuel supply points, then other possibilities (sabotage) can come into play. For example, a PLC (programmable logic controller) can be introduced into the circuit to go through the timed fuel cutoff /restart steps sequentially, and both pilots would be caught unawares, and be helpless to do anything about it. A PLC with an embedded angle sensor and/or accelerometer can be programmed to stay dormant until becomes activated, for example, at the 5th takeoff, etc. The plane would crash, but the blame would be on the pilots because the FDR would have recorded the sensor output, not any physical movement of the switches.
The switches have 4 sets of contacts. At least 2 sets are recorded in the FDR. Another set is recorded in the FADEC EECM.
It’s improbable that if all the contacts are recorded with a state change at the same time, that the switch was not thrown.
Plane-Folk ,
Well , it was obviously a mechanical or human brain malfunction . Unfortunately it appears to be the latter ! 😕
Horrible tragedy but yes.
is this the 2025/06/12 timeline as of 2025/07/11?
08:07:33 UTC Air India Flight 171 Boeing 787 cleared for takeoff
08:07:37 UTC on runway, starting takeoff roll
08:08:35 UTC at takeoff Speed
08:08:39 UTC Liftoff & in the air
08:08:42 UTC at 180 Kts (would have been time for GEAR UP)
08:08:43 UTC estimated Engine 1 Left Cutoff
08:08:44 UTC estimated Engine 2 Right Cutoff
cockpit voice recorder one pilot asks the other
“Why did you cut off?” other pilot says “I didn’t”
08:08:47 UTC RAT hydraulic pump begins
08:08:52 UTC Engine 1 Switch to RUN
08:08:54 UTC, APU Inlet Door opens Auto Start logic?
08:08:56 UTC Engine 2 Switch to RUN
08:09:05 UTC mayday
08:09:11 UTC crash
a metal stop-lock mechanism must be intentionally lifted to change
their position & the report did not specify how the switches moved
2018 FAA bulletin SAIB NM-18-33 warned do not
“disengage” fuel control switch lock mechanism
The switches moved because someone lifted them up and moved them to Shutdown.
Not stated is who. While not likely there could have been a 3rd person in the cockpit.
The bulletin is an advisory and I have no idea why they would put something like that out without an action (switches were built wrong or installed wrong). Probably that would be found quickly.
”2018 FAA bulletin SAIB NM-18-33 warned do not
“disengage” fuel control switch lock mechanisn”
How do you do that?
IMU it is a sprung liftring on the toggle.
Pull, change position, release.
(issue I could envision is the liftring does not return into its retainer position. … )
for the interested, the Honeywell DS as used on 787:
https://eu.mouser.com/datasheet/2/187/honeywell_hwscs06627_1-1735572.pdf
Maybe its time to install a disable feature in those switches, when certain flight parameters are met? Can only be enabled when something occurs (engine fire, flameout etc).
And that opens up a whole arena of not being able to do what is needed when.
Do you disable the throttles? Yoke or stick?
Airbus has envelope protections, but the computers can be turned off.
As noted, I have done machinery programs. For something simple, there are a large number of branches of what other systems do or do not do. None of them are life safety, most are not equipment safety.
You can also have a computer just fly the aircraft, and good luck with the programing.
They might be able to set up some contingency to prevent what happened.
But I tend to think, if this happened on an Airbus A350, most of this discussion would be moot, and we would accept that this was Pilot Error.
Good point.
As I understand it the A350 has a single shutoff for both engines.
Hmmm.
Later down there is a discussion but I think Engine Shutdown/RUN switches belong someplace else, not that it had any aspect in this crash.
The report seems to purposely leave it a bit vague with regard to which switch is first in the sequence!
“ the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec.”
It makes one wonder why this was made purposely unclear as exact time stamps could have been used. The only rationale would be to not suggest who did it.
It is unfortunate as one engine successfully relit and one didn’t! Clearly in this case a few seconds counted.
I read it as 1 shutdown first and 2 a second latter. We will know at some point for sure.
I don’t think it made any difference as they needed 60,000 lbs of thrust from one or both engines and they were probably 40 seconds from that on ignite.
Gear is still down, flaps are still down, high drag and stalling.
Thanks for this Bjorn. Had I read the report before your article I would have comme to the exact same conclusion. I think we may be facing a similar scenario here than the one I have imagined from the start for Malaysia Airlines Flight 370.
Yep, that would be one. China 737-800 3 (?) years ago. Germanwings. One in Indonesia as I recall. Egyptair 767.
Honestly, this preliminary report leaves too many unanswered questions.
The sequence of events is clear — normal takeoff, then both fuel cutoff switches are moved to CUTOFF one second apart. But there’s barely anything about what the pilots were actually doing or thinking.
Those switches are lift-guarded. You can’t just hit them accidentally — and certainly not both at once. So that raises serious questions. The CVR records one pilot asking, “Why did you cutoff?” and the other replying, “I didn’t.” But we’re not told who said what — captain or FO — or what happened afterward. That’s a big gap.
Also, why did it take 10 seconds for engine 1 and 14 seconds for engine 2 to be put back to RUN? That seems way too long in an emergency. Any experienced crew would react instantly.
Finally, the mention of “better switch guards” feels like a distraction. These are already protected — that’s not where the problem lies.
I hope the final report is more transparent, especially regarding cockpit actions and CRM. Right now, it feels like something’s being softened or omitted.
@pascal:
I am assuming you are asking to understand. A lot of this is already stated.
Going from the top, the preliminary report is not a deep detailed report. In fact there is a lot more information in this one than there is in a lot of them that often just state facts we know (souls on board, souls on ground, how many of each died, date etc).
They actually did a fantastic job of reporting what was needed at this time. The Engine Control Switches were moved and it was deliberate.
That is critical for all involved, its not a 787 issue. Its now into the area of a Human issue.
Obviously they want a free access to both pilots past without a mark that says X pilot was the one that moved the switches.
Often we simply do not know, but if it is knowable the aviation community needs to know what to look for if its possible to detect.
As for the time lag, been there, done that, got T shirts. Someone in the cockpit just did the unbelievable. You have no training, you have no response, nothing in the simulator to go on.
You have to see the alarms, understand what they are telling you, then get over the hurdle those alarms are impossible, then do something about the alarms.
Note that is Engine 1 and then 2 shutdown and its Engine 1 and then 2 put back to the Run position.
One last point, even once the Switches were moved back to Run, there was never a chance that they could recover. Spool up time is easily 10 seconds and probably 30 from a full Shutdown state.
Pilots are trained in aircraft failures, they are not trained in dealing with a pilot for whatever reasons doing insane actions in the cockpit.
An item of note is the Gear Handle position.
It was found in the down position.
However, the throttles were found in the Idle position and the FDR reported they were in the flight positions, ie takeoff thrust full.
If the throttles could be knocked back in the crash the landing gear lever could have been as well as I do not believe that his a pull lock on it (maybe should)
A lot not stated but the obvious fact of deliberate action on the engine Shutdown Switches is the key, not an aircraft or an engine issue.
Of further note and no explanation is that Engine 1 was shutdown first, it also was the one that was moved to Run position first.
Speculation would be its the normal sequence as done by the Captain.
The locking mechs on the switches could have worn out and due to the thrust and 30 deg attitute of the aircraft during climb the switches could have gone into the down (off) position – a remote possibility
Fleet mechanics have weighed in on this, in other forums. They have never seen one of these switches malfunction without being physically broken (which has sometimes happened). However for this aircraft there were no reports of any problems with the switches. Nor has there ever been a report of an uncommanded change of state. There are many thousands of these switches in daily service.
The failure mentioned above, would also require BOTH switches to be worn and in-operative.
That’s not very likely…
Bingo. And 30 degrees is an exaggeration. Somewhere around 12 deg pitch up, it looks steeper and feels steeper but is not.
One Swithc is remotely possible, two, no. Two withing a second of each other, no.
Also note that the switches then stayed up after being put up through a crash that wracked the throttles back to idle position (which is why all data is used not a single bit as that is totally misleading)
“FAA flagged fuel control switch issue on Boeing jets in 2018”
“According to the report, Federal Aviation Administration (FAA) Special Airworthiness Information Bulletin (SAIB) No. NM-18-33, issued in December 2018, flagged potential disengagement of the fuel control switch locking feature in Boeing aircraft, including the B787-8 fitted with similar part numbers.
“This Special Airworthiness Information Bulletin (SAIB) is to advise registered owners and operators of The Boeing Company Model 717-200 airplanes; Model 737-700, -700C, -800, and -900ER series airplanes; Model 737-8 and -9 airplanes; Model 747-400, -400D, -400F, -8, and -8F series airplanes; Model 757-200, -200CB, -200PF, and -300 series airplanes; Model 767-200, -300, -300F, -400ER, and -2C series airplanes; Model 787-8, -9, and -10 airplanes; Model MD-11 and MD-11F airplanes; and Model MD-90-30 airplanes of the potential for disengagement of the fuel control switch locking feature,” the report said.”
“”If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown,” it added.”
https://timesofindia.indiatimes.com/india/advisory-not-mandatory-did-faa-flag-fuel-control-switch-issue-on-boeing-jets-in-2018-what-ai-171-probe-report-says/articleshow/122399618.cms
” time gap of 01 sec”
How does one have to read this?
usually you’d write “1 sec” if one second apart.
So is this presentation meant to indicate zero to one second?
( what is the (time) granularity for recording the fuel switch state? )
Can the switches be set to one position
without assured lock of the liftring on the toggle?
Are the fuel switches spring loaded towards “off”?
The switches are not spring loaded to either position. They have a normal snap action toggle that doesn’t favor either side. The spring is only in lifting the handle over the center detent.
If the spring is disengaged or the handle is stuck in the up position, so that it clears the detent, then it functions as an ordinary toggle switch with no lock.
The switches stayed in the up/run position on impact, which would imply they were locked. The AAIB should be able to confirm their operation.
I’ve used this type of switch in designs.
( demand for positive action for on and off
contrast with the red plastic tab cover for switches
which is positive action for on but not for off)
Never seen one with a “block locking” feature.
But you can block the locking shroud with lint.
No, you use those switches each and every start and stop.
Anything mechanical can break. If it does its a Red Tag and aircraft is going no where until fixed.
And that is just one, not two.
“The Boeing 787 uses spring-loaded locking mechanisms on its fuel control switches to prevent accidental movement. The switches installed on VT-ANB (Part No. 4TL837-3D) were referenced in FAA SAIB NM-18-33 (2018), which warned that these switches might be installed with the locking feature disengaged, making them susceptible to unintended movement due to vibration, contact, or quadrant flex.”
https://www.outlookindia.com/national/air-india-ai171-a-preliminary-report-that-raises-more-questions-than-it-answers
Irrelevant, its not an AD.
This aircraft is 12 years old? Sheese
Thats the ‘locking feature’ not the switches themselves.
Would you describe could be a maintenance feature ”these switches might be installed with the locking feature disengaged’
Someone still has to flick the switch
Does that align with the following:
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52* UTC. The APU Inlet Door began opening at about 08:08:54 UTC, consistent with the APU Auto Start logic. Thereafter at 08:08:56* UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN.
Approx four seconds between ‘transition’ of fuel cutoff switch of the Engine 1 and Engine 2.
Do we know if the cockpit conversation was in English or in Hindi?
It would be unfortunate to have to rely on translations.
“I did not do so” sounds stiff and formal under the circumstances…it’s not what a native English speaker would say…
English as spoken in India differs from usage as in GB or the US.
( differences in expression, Hmm, slightly “oldschool” ? would that fit ?)
There’s no point in wondering what would fit as the actual conversation wasn’t given in the first place. The only thing the report does is to describe that one crew member asked about it and the other denied. We don’t know the language nor the exact wording.
Spot on and we don’t have to.
They got the basic fact of what happened.
They are not looking for a tech issue and going off on those tangents is just putting stuff on a screen. It add a negative to any understanding.
It does not matter. What matters is the Switches were moved, it was deliberate and its now in the human factors arena, not a 787 or Engine arena.
It never mentioned that was the literal transcription, the report says “The other pilot responded that he did not do so.”. It’s merely a description. People are now filling in that the reply was something like “I didn’t” but nobody actually knows.
Is there a path forward, in today’s highly computerized environment, where a feature is installed that would require the agreement of both pilots, to shut off the fuel to the engines?
There are many flight protection devices installed today (more so in Airbus aircraft) that will not allow the pilots to do certain things.
Can those switches be disabled, after the aircraft has reached ~50 knots, which would require both pilots agreeing (maybe a switch too far apart for one pilot alone to initiate) BUT…would be enabled during certain circumstances.
1) Aircraft detects a fire in an engine, or another engine
anomaly, single pilot authority restored
2) If a pilot leaves the flight deck (bathroom break), thrust, fuel and yoke control remain as is and ‘locked’ until he returns
3) An override of the system, restoring full one-pilot control – in the case of an incapacitated pilot, requires the permission of a 3rd crew member. Maybe a pin pad, inside the cockpit door?
If memory serves, this is the 3rd time (Egyptair, Germanwings) that this (allegedly) has happened.
I know that there would be huge pushback from pilots, but is it time for video cameras in the cockpit, as well?
With the ability of satellites today, how about continually uploading FDR and CVR data to a data hub, so that finding the black boxes is no longer an impediment to an investigation?
One issue with safeguards is that they increase complexity.
complexity (more hardware/software involved )
increases failure probability.
Agreed.
Perhaps it it time to move those switches away from the throttle quadrants, put on an overhead panel and have a safety cover installed on top of them, as an added safety feature?
Lets put them in the Biffie in the back of the Aircraft behind a locked safe.
@ Frank P
Excellent comment.
Far too easy to (inadvertently) do something with very far-reaching consequences.
Actually as mentioned above, there are design standards for certification that are based on risk assessment. This is not an actionable risk. The odds beforehand were essentially zero, and the odds afterwards remain essentially zero. So it’s highly unlikely this will be considered a design issue.
You cannot subtract accountability from the crew function, nor would you want to do that. It’s not a solution.
Certification standards change all the time — because we’re frequently confronted by effects that were previously discounted.
Shifting balances of probabilities.
There is no shift in probability, that is the point.
Probabilities shift all the time, as new data becomes available.
It’s intrinsic to the whole concept of probability, which is calculated based on the relative sizes of solution spaces.
Rob is correct.
People are arguing all sort of aspect.
‘
You want to see conundrum, look up Airbus and the Sao Paolo crash all around thrust reversers and spoilers and what can activate when.
Airbus does the same thing with cutoff switches.
What is being presented is removing all controls from the cockpit. You can’t trust the pilots and the only way to ensure anything is to remove the controls.
Will they reconsider the possibility of recording cockpit footage after this case? I know there’s a lot of resistance to this idea, especially from pilots’ unions, but it might be necessary. (Note: Please excuse my “Google” English)
You came across just fine.
I have long advocated for video. Protect it the same as CVR. Yes I was a pilot (still am, not current)
It was the definitive thing that sorted out that Shuttle Cock space plane crash. They recorded the deployment of the control, video confirmed he did it early.
Keep in mind for all the jumpers here, that action was part of the sequence, it was done early but it was going to be done. No one knows why he did it against all training but he did.
Thanks!
I also believe there are no longer any reasons to justify not installing cameras in the cockpit. Some opponents often claim that installing cameras would “disrespect” pilots’ privacy. However, in many professions, workers are filmed throughout their workday.
Agreed. CVR is protected unless an incident. Then the need to know overides privacy.
I was subject to spot breathalyzer and drug tests.
Many of the areas I worked had cameras.
If this were a suicide, it seems to be a strange way to do it. The suicide sets himself up for a slow view of the ground coming up followed by what could be a survivable crash but ending in burning to death. At that altitude, don’t both pilots have better ways to cause their death such as pushing down on the yoke? But a third person in the cab might see the fuel switches and see it as the way to go since they can’t get to the controls as easily.
Indeed.
Very odd set of affairs.
“cut off fuel”
decisive no recourse action.
“push on Yoke.”
other crew member will fight against that action.
or the suicider can just stop the action.
there is a wiring diagram around on a.net.
looks like quite a bit of intermediary linkage
from switch toggle to effected action.
(would be interesting to know at what point in the effector chain the recorder tap is located )
Looks like pilots’ associations in India are not happy with the pilot blaming currently going on:
“Reacting to the report, a pilots’ association issued a sharp statement criticising the direction of the investigation. “We are surprised at the secrecy surrounding these investigations. Suitably qualified personnel have not been included in this crucial probe,” the statement read.
“It added that the mention of a technical bulletin on possible fuel switch gate malfunctions points to a mechanical issue being overlooked. “The investigation seems to presume pilot error, and we strongly object to this line of thought,” the association said, further questioning why the report was circulated to the media without a signatory.”
It appears that instead of putting the gear up, after achieving a positive climb rate, one of the pilots inadvertently turned the fuel cutoff switches off. The CVR should show something along the lines of flying pilot “positive rate / gear up” and then a response of “gear up” by the other pilot.
Three seconds after the aircraft transitioned from ground mode to air mode the fuel cutoff was noted by the black box data recorder. So, the TCMA (Thrust Control Malfunction Accommodation) doesn’t sound like it’s in the picture, with the 3 second lag. This will be verified when the full
readout of the black box data recorder is released, as the TCMA signal should be printed out as one of the parameters. I assume that some human factors people will be brought on board the investigation, to try and determine why a pilot went from muscle memory circuit
of ‘gear up’ to his ‘turn off engine’ muscle memory circuit. Did the flying pilot say something other than “positive rate / gear up”? Was there a distraction of some type on takeoff that brought the pilots mind out of normal takeoff sequencing? I certainly hope it was an inadvertant memory lapse and not an intentional action of the pilot. Either way, the human factors experts will have to do their best to figure it out. Unless this becomes a trend, I’d rather not see any reengineering of the aircraft. Only one other time, that I’ve heard of has a pilot cut off fuel accidently to an aircraft in the air.
“… one of the pilots inadvertently turned the fuel cutoff switches off…”
Or the switches moved of their own accord (e.g. due to vibration), per the 2018 FAA warning (see above).
As unlikely as that might seem, it’s still a possibility until such time as it has been specifically eliminated.
Pilots’ associations in India are stressing this point, and expressing disapproval of the default pilot blaming currently occurring.
A large “bump” causing both swtiches at once to be thrown? No other evidence of a ‘bump’.
There would be more instances of fuel cutoff’s in bumpy weather recorded. This was at the time of ‘gear up’. So, one of the pilots should be reaching for the gear lever. Until the full inforation on the flight data recorder is published, I think the accidental muscle memory argument seems the most believable. Somehow, the hand went for the fuel cutoff sequence in memory, rather than the gear up sequence. Something distracted him, or he was thinking about something else and his automatic memory sequence flipped from gear up to shut down plane. If this was the case, trying to reconstruct what was going through his mind at that second will be more than a little difficult. I think some ‘go-pro’ camera’s in the cockpit would be a great idea, as long as they are strictly used only for accident and safety purposes.
(1) “Vibration” is not the same as “bump”.
(2) The landing gear lever is nowhere near the fuel cutoff switches.
(3) Regarding muscle memory: there’s zero reason to do anything with the fuel switches in the course of a normal flight. They are used in an engine fire and/or when the plane has pulled up to to the de-boarding position.
Engine vibrations as well
There has never been a recorded instance of the switches moving of their own accord. That is a massive projection from the statement of the service bulletin, which only indicates it could be a possibility.
This is an example of the possibility vs probability fallacy. All that is equally possible, is also equally probable. Which is false.
If FAA or EASA thought this was a probable event, it would have been an AD rather than an SB. Instead they issued the SB as a precaution. It was not mandatory, which is why Air India never carried it out.
“There has never been a recorded instance of the switches moving of their own accord”
There’s a first time for everything.
The Tacoma Narrows bridge had never collapsed — until it collapsed.
All possibilities need to be considered — particularly when the subject of a previous FAA warning.
That might be uncomfortable for Boeing, but it’s good for the public.
This is a fundamental misunderstanding of statistics.
There ar tens of thousands if these switches being used multiple times per day, around the world, in billions of events. if there was any likelihood at all that the switches could move on their own, it would have surfaced long ago. It’s improbable in the extreme.
And if there was in fact a probability, FAA and EASA would be all over it. Yet there is no response to this incident, and no claim that the switches moved, or even could move.
Perfect understanding of statistics.
Just because something hasn’t happened before doesn’t mean that it can’t happen.
As the sample size increases, so does the chance of particular phenomena manifesting themselves.
Getting struck by lightning tomorrow — less likely.
Getting struck by lightning in the next 10 years — much more likely.
Nope. As horrible as the MAX crashes were, factor it into 737 flights and they statistically are not relevant.
It was a glaring data point in MAX flights but it is rapidly being dropped down.
Abalone is present spurious arguments.
Tacoma narrows was cocked and loaded and baked in to fail. All it needed was the wind trigger which then occurred.
These fuel shutoff switches are used in thousands of Boeing aircraft.
So now its, not only one failed but two failed when one has never failed.
Bizzare
Huge disrespect to the Indian Authorities,
@RD:
You really ran into technical conspiracy theory on that one.
There is no muscle memory associated with that action on takeoff and in fact any Shutoff Switch work is deep inside other procedures.
Spiraling into a HMI wildness does nothing. Using buzz words like Human Factors does nothing.
The only human factors in involved are one of two human beings who did actions that we may well never know why or understand because if you did, you would be deemed (rightfully) insane at that moment (though you could also be lucid the next and put the Switches back to Run. )
There is not logic because there is no logic.
Similar to no matter you go, there you are. Word salad et al.
Good point! I think this muscle memory hypothesis is important to consider. I found this because I have had the same thought. Until this report, the gear down was used as a clue to a problem before positive rate. Now we know positive rate was achieved. We don’t know if it was called. So what’s the new explanation for the gear down? Perhaps a pilot was suicidal. Or maybe he just made a mistake. I know it sounds crazy. But it must be considered. If we find out PF called gear up a second before cutoff, that strengthens the muscle memory hypothesis.
Maybe it’s time to put the safety of passengers ahead of pilot privacy. I have a nagging feeling we will never know exactly what happened, and that as well as every crash investigation could have been enhanced if we had video in the cockpit.
Agreed 100%.
Unacceptable that we have another all-lives-lost crash so quickly after the Jeju one, without a *clear* account of what happened.
Dito for MH370 and China Eastern 5735.
Even with legitimate accidents, we have to infer so many things from context where a video could easily show what happened.
Actions that don’t make a sound, attention to instruments that will not register of FDR.
The only reason not to put them in the cockpit is because you are afraid of what you might see.
Agreed again, 100%.
Audio-only is absolutely primitive in this day and age. We have video surveillance all around us — time to have it in the cockpit also.
@Casey:
Fully on board and maybe this will lend to the case and get it done finally.
I did read that AI had it in the cockpit and active but that could well be wrong. So far its not been repeated.
To the repetitive statements above that ambiguity in the flight recorder data is possible, it’s not.
In this case, the recorder has the data from multiple (4) sets of contacts inside of each fuel cutoff switch, the state of the valve actuators, and the position of the valves.
The data design is to allow the isolation of actions and errors. Further transients and glitches leave traces in the data, and would not be isolated to just one circuit.
Again this is the possibility vs probability fallacy. All things are possible but not all things are probable. And the designers take into consideration things that are probable.
Any electrical signal being transmitted from point to point is subject to potential corruption.
Whole books and courses are based upon this fundamental concept.
Trying to dismiss it as “impossible” shows poor engineering acumen.
Improbable is an entirely different matter. But, in a crash investigation, probability is subordinate to possibility.
Again this is the possibility vs probability fallacy. Just because you can imagine it as a possibility, does not make it in any way probable within the actual system.
If flight recorder data were not redundant and reliable, they would be useless.
However if you don’t acknowledge the fallacy, and you don’t understand it’s embedded in the premise of your statements, then you will see any possibility as also being probable. Which seems to be your perspective, but in this case, it is not.
Again: whole textbooks written on the subject of signal corruption.
Just because the phenomenon is inconvenient to a particular narrative does not merit its dismissal.
If you don’t understand the basic premise here, there is nothing more I can say to persuade you.
If you want to stand in opposition to the regulators and the facts on this, that’s your privilege.
@Rob:
Clearly he does not think of it as learning but presenting an agenda.
Its a shame but there it is.
I should add understanding as well.
If it was signal corruption , what moved the mechanical switches- as the pilots commented on that.
It seems that this random ‘noise’ corrupted the two separate fuel cut-off signals to different engines on different wings some seconds apart.
This is a different corruption on crash of China Easter FL 5735
‘On 19 May 2025, in response to an open government information request, the CAAC said that it decided not to release an annual interim investigation report to the public because releasing the report might “endanger national security and societal stability’
@Duke:
You are attempting to interject logic into Abalone. I predict you will fail.
The stone carving has been done, its now etched in.
Those circuit may not even be on a data bus. As a safety measure they could be hard wired.
Granted that is how I would do it and I am also attempting to interject logic here.
FASDEC will be on a data bus, separate ones and of course that can roll back power if the logic interlocks are ignored.
Keeping on going, another bizzare assumption is hash does something when in fact processor system are configured to ignore anything other than commands. But there I go again.
According to textbooks in String Theory we can step between universes.
Having worked with problem data lines, it can stop data moving, it does not invent commands.
And if you want to jump into single point of failure:
“Airbus just has one master switch for the engine. ”
I don’t know if that is true but in this case, old tech works as a cross check on movement of two not one devices.
Also note that Lock (or detnet0) issue has not been reported on any aircraft for one let alone two since the AB.
This is a quote and I have no knowledge if its true or not.
“Martin also criticised the omission of cockpit camera footage in the report. “The Boeing 787 is equipped with cameras that record pilot actions. Why hasn’t this footage been mentioned?”
just info
AI 171 Crash: Ex-Air India Pilot Speaks Out! Decodes What Might Have Gone Wrong With London-Bound Jet: OPED
https://www.eurasiantimes.com/ai-171-crash-ex-air-india-pilot-decodes-why-airbus/
As much wrong withing that while some is right.
Despite the angles we saw, it was a normal takeoff with normal rotation and initial flight.
Gear is not up as the Switches were turned off before that.
We do not know for sure about the gear as that is not a latched handle and it could have been flipped down the way the throttle were knocked to Idle position in the crash.
Engine control switch position is a serious clue as they latch and they are in the position FDR reports. Not a given but if the throttle got knocked back a loose switch would likely have as well.
Its obvious the Shutdown Switch movement was deliberate even if the pilot who did it was mentally incapacitated (all the range of human aspects including a stroke)
As its unfahomalb its equally possible he turned them back on as well. I won’t read anything into that aspect other than is a horrible human tragedy on so many levels.
WOW is not a mechanical lock. It has a number of aspects and Rob has noted and that included when and how thrust revers and spoilers can be deployed.
More than one incident has resulted in time delays in what happens when.
To flip it around to an opposite action when none of it has to do with the Shutdown switches.
You shutdown the engines and you just have had all the requirements of RAT deploying.
That is absurd.
The only allowance I see is if the RAT pre deployed, but that can be done via pilot action as well. I won’t rule it out as I do not have the event timing.
He is spewing nonessential in the Airbus assertion pilots have control, they do not. In fact Boeing has full override and Airbus pilots cannot.
Accident rates for both types of approach as virtually the same.
Airbus logic has failed before and Boeing has failed as well with their own logic but both fail.
Clearly thats written just before the prelim accident report came out – so makes it worthless
I went back and saw that. You have to wonder why he would have even written it.
Is it possible to tell from the recorded sounds in the cockpit if the gear lever was or was not moved, or if the fuel cutoff switches were moved?
I doubt it.
What you can tell is the Data recording of what position they were in.
Assuming CVR is good, you can hear if the PF called for gear up. Sans video it won’t tell you it was moved up. It could have been Shutdown Switches were moved instead.
What is clear is the Shutdown/Run switches (both) were moved to OFF.
You build the evidence and you don’t jump on something like the throttles in idle with all data says they were not as well as the parameters for what was going on and when with the engines that confirms that.
You don’t have to look too hard to find articles indicating that Indian national pride is a factor here.
A German pilot can go berko and it’s quickly accepted,the Indian press seems to have an inferiority complex and takes offence that the “western” media can even hint that the crew might have caused this disaster.God only knows what happened to the Chinese 737.
However, I am confident that the Indian investigators will eventually disclose the probable cause amongst all of the implausible options
@Grubbie:
When racist views have been a major part of your recent history, yes you are going to be sensitive to that. Its not something I have had to face or deal with but many of our citizens have (and yes I have had those conversations with them and it can be an is chilling).
What we can be is understand the reaction and accept it is not correct.
I am impressed with the Indian AHJ getting this out which quells the 787 issue.
Yea ll the spinners take the data set to weird corners and fail to realize or don’t care this is a preliminary report and its done its job. Sorted it to the direction of cause.
I am sure all Boeing pilots with those switches are now going to be extra vigilant on the switches and any issues with them regardless of them not being the underlying cause.
It may prevent an inadvertent engine shutdown.
Some Indian aviation safety experts are even pointing to the pilot sabotage hypothesis as the possible ugly truth based on the fuel switches position https://www.ndtv.com/india-news/air-india-plane-crash-report-aviation-expert-flags-pilot-suicide-angle-amid-air-india-crash-probe-8864239 However, a basic profile outline of Captain Sumeet Sabharwal brings out that he was in his mid-50s, was not married and was living with his 88 year old father. Post crash news reports on him further reveal that he was almost on the verge of taking a break from flying to care for his ailing father. Even his neighbours confirmed that he was often seen walking with his father in his residential society lawn.
https://www.hindustantimes.com/trending/pilot-sumeet-sabharwals-last-promise-to-ailing-father-before-air-india-crash-wanted-to-quit-flying-and-come-home-101749812628348.html
This fact about him is a clear contradiction to the pilot sabotage hypothesis as why would a person so deeply attached to a parent contemplate and undertake a suicidal act. The flying officer Clive Kunder too had a very regular psychographic profile hailing from a financial well to do family with parents settled in Australia. Further, he was about to get married in August this year. https://indianexpress.com/article/business/air-india-171-pilots-captain-sumeet-sabharwal-first-office-clive-kunder-mumbai-10122662/
Lastly, the pilots actually veered the aircraft away from a highly populated residential block, after they issued the mayday call, to minimize loss of lives. Why would someone on a hypothetical suicidal mission, owing to presumed psychological issues, do a sane act like that. It’s again a contradiction. Maybe someone beyond the pilots, but from Air India internally, could have tampered with the fuel switches setting before the pilots boarded the 787. However, the pilots would have seen that as part of pre-flight checks for sure…
A seriously depressed person is very hard to read from the outside. Their brain chemistry becomes very heavily weighted toward the negative. If you don’t believe anyone cares or will help you, then you don’t talk about your problems or internal feelings with other people.
That’s why talk therapy is effective, other people can identify the negative weighting that you cannot perceive yourself, and present a more hopeful and optimistic viewpoint.
Most of us engage in talk therapy all the time with our friends and family. Humans are social because it’s an evolutionary strength that counterbalances our ability to imagine negative outcomes. It’s not so negative if other people are surrounding you to help.
However if a person becomes isolated, then that mechanism is missing and the negativity can spiral. Especially if the perception is that the people closest to them either won’t or can’t help. It doesn’t matter if that is even true or not.
That person is at risk for harming themselves or others. Almost all the school shooters fall into that category. What seems irrational to us, is rational to them within the distorted mindset they have developed. But it may be completely invisible from the outside.
Aerobuff presents the classical phrases and it does not cover this situation let alone any other one.
Flip the script around, a man is looking at a huge change in his life into one of the saddest depressing situations in dealing with an aged parent.
How each of us internalizes the life situations should never be attributed onto anyone else, you can only speak for yourself and only if introspective. Equally no one knows until they are faced with any given situation, predict all you want, human beings are not predictable.
We also get the noble pilots steered the aircraft away. If anything it deviates left a bit and hit more buildings when there was some park of some sort to the right.
They had no control and there was no intentional right or left deviations stated. If it moved off trajectory as determined by Engine 1 shutdown first. It might have come back a shade right as Number 1 engine is starting to respond to re-light. That is purely speculative.
FDRs will have all control movements and other than an estimate of how nose up it was, no trajectory data. No controls data was released. We don’t know but we will know eventually.
Its possible one of the pilots tried but its more probable of no control nor altitude to do anything with regardless.
To clarify, I was just making general observations based on school training for active shooters. I wasn’t speaking about any specific circumstances for this case.
That training was partly on evasion, but more importantly on the psychological profile, and the fact that you can’t necessarily spot an impending action. People are generally surprised when it happens.
However there are methods of prevention. The staff was encouraged to look for isolation behaviors, kids that were excluded and not participating in class or school activities. The emphasis was on inclusion, giving them welcoming social opportunities so they don’t view others in the school as targets or as irrelevant lives. That can make a difference in arresting a negative spiral.
Regarding TransWorld’s comment on the Captain’s psychological profile, it does not factor in the vast cultural differences between the Collectivist cultures of the East and the Individualistic cultures of the West. In the Eastern cultures, it is not considered a burden to take care of an ailing parent and is rather considered as a responsibility as familial bonds are relatively much stronger than in the West (no disrespect here) providing a much stronger social & psychological support. Since the crash happened in India, we have to apply the Eastern cultural lenses to analyze the context and put the narrative into perspective. Seemingly, there’s more at play here despite the fuel switches evidence being stacked against and pointing towards the pilots.
Fair enough and I concur in regards to different cultures. I expressed it in terms of my culture and am in no way or should assess theirs.
Human beings do things and no culture is exempt.
Culture wise I heard the same argument in regards to Egyptian 767 but the Egypt Government who refused the findings. Did not happen, against Arab culture etc. You could interpret the CVR two ways which is another reason for Video.
That said, the FDR showed FO with full down input and the Captain with full up.
It was clear what happened, and again you always use corroborating data in the flight path of the aircraft reflected exactly what the FDR said the input were doing.
I do not have the answer but if the Throttle control quadrant includes the Engine control switches (shutdown/run) its been replaced twice.
“The scrutiny of maintenance records
revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023.
However, the reason for the replacement was not linked to the fuel control switch. There has
been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB.”
Some inference but not stated above.
Maybe someone around here can judge. I was a bit irritated when I read the Preliminary
Report, that the recordings of the CVR weren’t printed as quotes (like they’ve been recorded) but as „reported speech“. Is this „common practice“?
It leaves some room for interpretation. And indeed there are two versions being reported in the media: „Why did he cutoff?“ vs „Why did you cut off?“ This seems to be quite a difference to me (possibly) and it’s pretty unnecessary.
Any thoughts to maybe help clarify this?
First, the conversation may have been in Hindi, so we are getting the English translation, which may vary a bit with the translator.
Second, if there is a potentially separate criminal investigation, then AAIB might not release evidence that would compromise that investigation, such as direct quotes.
AAIB has played this entire incident very close to the chest, so there’s a lot we still don’t know. But they do seem to be complying with ICAO rules for accident investigations.
ICAO only requires an ADREP format for the preliminary report, and they don’t require it to be made public. But their guidance for high-profile incidents, is to publish the report, expand it to a written format, and conduct a briefing. They’ve done two of these things thus far. The briefing may follow next week, we’ll have to see.
It’s not the NTSB standard, but it is more than compliant.
100% Concur.
Those of us interested in what happened vs driving an agenda
It got the basic important information out in that it was not a Boeing or GE issue that needed to be addressed (argue all you want about throttle idle and then shutdown etc)
Its not perfect and I don’t think it was intended to be per Robs take.
The range of deliberate actions per what was going on is wide. Two deliberate OFF and then two deliberate ON points in a direction but only points, it does not say.
We may never know. Even with Video all you can say is who did what.
For now it was done and deliberate is the critical information. Deliberate does not mean any logical control a pilot would normally have.
I don’t know whether ur referring to my post with „driving an agenda“. For my part I sure don’t.
I just wanted to know whether it’s „normally“ done like this (not printing the CVR recordings as they were recorded but „describing“ them using ur own words) and thus (be it on purpose or not) leaving additional room for speculation where it’s for sure not necessary.
As far as I know the only source for this is the preliminary report and it can be interpreted in different ways.
I found some additional information on the Boeing switch service bulletin.
The switch has a rotating cap feature that can be used to convert it from a standard toggle without lock, to a toggle with lock. If the application is for locking behavior only (as the fuel cutoff switches are), there is a key inserted to prevent rotation of the cap. It then can only be in the locking mode.
Apparently for some lots of switches installed in the 737 prior to 2018, this key was missing. The switch was still installed with the lock active, but the cap could be rotated to defeat the lock.
The service bulletin was to inspect the switch for the key, and if missing either install the key or replace the switch. Boeing supplied the replacements on request.
Although the lots were only used in the 737, Boeing recommended all aircraft that use the switch be inspected, because maintenance sometimes swaps parts. But the bulletin was not mandatory.
This means in theory, AAIB should be able to inspect the fuel cutoff switches for the key, or twist the cap to see if it will unlock.
Rob:
Thank you, I can understand how it works.
I have a mind zark as to why you would make it that complex and provision to make it different. It would open things up to mistakes.
Maybe something they will address but does not seem to have any factor in AI 171.
I believe it’s a standard feature of the switch. You can order it as key locked, key unlocked, or unkeyed convertible, by different part numbers, for your application.
I have seen the convertible switches in other control applications. The procedure was you could move the switch freely between on/off, but in certain circumstances you were to twist the cap and lock the switch in position.
I get that but for a critial application, no.
Each switch should be no different than another and none should be common to anything else in a cockpit.
It saves a miner amount of money but just to security sake, no.
Frankly that is chilling.
If the fuel cut off switches were moved through the use of manual force, then the normal assumption would be that any action was completed by one of the two pilots. However, we do not know how many other pilots or crew members, if any, were occupying the jump seats. If these seats were occupied then by who and for what reason ? The very fact that the switches were recorded as being moved, in rapid sequence 1 -2, to the cut off position, with a one second delay between the two actions, would strongly indicate to me that these were activated manually and by someone who is used to shutting down the engines in rapid succession. It is typical of a swift shut down action by a pilot at the end of a long day….almost automatic. The probability that both switches failed, independently, or moved in sequence, through their own accord, one second apart is too remote to even contemplate. As an aside, I have often thought that putting these switches so close to the throttle quadrant, in an area of the center console where hands and forearms routinely reach over and cross over the top (to either cross tune radios, select flaps, raise spoilers etc) was not well thought out and that, similar to the design by Embraer, they should be placed under a spring loaded flip up guard or moved out of the way completely. Despite their spring loaded mechanical lock design, it seems utterly nonsensical to me that, just a few centimetres to the left, are the stab-trim switches which are mechanically guarded. Since the introduction of electrical switches, and the removal of cable actuated valves, the physical size of a lever or switch in the flight deck has progressively become smaller and smaller….but their resulting action is just as effective but infinitely more system widespread. I sincerely hope that the FDR and CVR readouts are published in full so that the industry can learn and minimise the possibility of a similar future event, however it was caused.
There is no evidence of anyone in the jump seat from the preliminary report. There would be evidence if that in the CVR . The report says two crew in the cockpit.
As far as the switch positioning, the ergonomics are that you group all the like controls in the same physical space. That is more or less the standard in design. All Boeing aircraft use that layout.
They are not in a position where the crew arms are crossing over them, they are behind the seat backs. As Juan Brown demonstrated in his video, the only scenario was if the captain allowed his hand to fall backwards off the throttle. But that could not move a locked switch, so it would have to be unlocked. And in that case, it’s not explained how he could not know he had moved them
The stabilizer cutout switches are guarded on the 787 because they aren’t supposed to be used by the pilots unless instructed by EICAS message. The 787 has multiple redundant safety systems to control the stabilizer automatically, including uncommanded motion and position disagree. If those systems fail, then the pilots are instructed to use the cutouts. That matters because there are dual actuators, so pilots need to know which one to disable.
@Rob:
As noted below, I share Oliver S take. This is discussion not criticism.
Miner note, they are not behind the seats, they are parallel or even a bit ahead or hand positions as the throttles need easy access forward of the pilot.
The STAB controls are not engine related. They are still there. Hard call as its also a quick need if it arrives and that is a good location in that regard though more awkwarder for the FO.
While its Boeing take it does not mean the best practices. Boeing had the FLCH Trap on the 777. Mode change should not cancel out a base protection.
Just need to be factual in the discussion. The crew arms absolutely do not cross over those switches in a manner that invites accidental activation. And there was no one in the jump seat.
People here can choose to be non-factual, but then others also can choose to point it out.
You were here for the 737 MAX discussions, you saw how narratives get rolling once misinformation is introduced. It’s best to nip that in the bud.
I agree though with some its pointless.
Fully spot on the Shutdown/Run switches are in a pretty unique location in regards to hand motion.
I just don’t like where and in proximity to anything as the throte4ls and flaps are used all the time.
Using common switches that can be changed adds to it.
I don’t think it needs to be changed but in the future aircraft I would look at a different location and totally unique switches that have no optional features.
@Rob: I noted that the throttle quadrant had been replaced twice.
Does that also contain the Shutdown/Run Switches?
No I am not giving any credence to the Switches being a problem, just curious on two replacements of the quadrant, some kind of issue that was not getting sorted would be my take.
One area I disliked about my first flying was the use of fuses. If you lost a system, you had to decide if it needed reset (flaps in one case) and rob a fuse from another circuit.
The next generation of Cessna used CB. I thought it should have been CB as soon as the tech was viable.
That is the kind of thinking I did and looked for.
Yes, the quadrant would include the switches, so they would have been replaced. Unless maintenance did something funky.
@Oliver S:
Fully concur. Only adder is 3rd person which has some possibility but if there was, I would think that would be noted to allow action by AI and other Airlines. Stranger things have happened though.
The Stab guards are more what I worked with if a switch needed to be guarded. And full on the busy area and proximity of those switches in that location. Not a setup I like to see certainly not with the consequences those switches create when moved.
In response to the preliminary report, FAA & Boeing have notified civilian aviation authorities & airlines that the 787 fuel cutoff switches do not pose a safety of flight risk.
https://www.reuters.com/business/aerospace-defense/amid-air-india-probe-us-faa-boeing-notify-fuel-switch-locks-are-safe-document-2025-07-13/
I am not accepting this had anything to do with the crash.
But it is an odd bulletin, why even put it out if there is no action needed?
If the lock is part of the design, then it not working is an issue though it may not be deemed a risk issue.
Frankly if a problem negates the design, then it is an issue.
I suspect as a pilot I would check that function (aka the vertical lock) with a gentle movement to off to ensure it was not failed.
The aircraft checks may have that as a check item as well.
The bulletin without explanations leaves things rife for conjecture. Some will grab onto that and it does not help if its not in context and why its not an issue (or deemed not an issue).
Aircraft are that odd aspect that everything works out of the factory and the first pax flight, you can have all sorts of things not working aka the MEL. Either its needs to work or it does not and reverting to backup even if redundant is a bad practice.
I will note that EASA has caused FAA to revisit cert process, documentation etc.
All in line with better safety and not some of the FAA past practice of just signing off (787 Battery) on Boeing word.
Certainly its worth a look. Two switches identical other than a function locked or now could get into the system and you have an issue.
It probably would be found but probably is not a sure thing.
Going forward its something I think should be changed.
All switches check, cease produion of dual possible switch and make it a single funtion specific switch for that use.
Its an easy change to add a layer of safety
My guess is that crew would report a switch that didn’t lock. And also that a turn of the cap is required for them not to lock. And that apparently there were no actual instances in flight.
My feeling is that this service bulletin, like the one from GE on EEC microprocessor soldering, will end up being a distraction, and not relevant to the accident or the investigation.
@Rob:
I think you are right about a notify.
It takes nothing let alone a snippet to get some off on a tangent. So this is grist for that mill, but the FAA could have snuffed it with some detail. People are not
accepting, take our word for it. Too many times we have been hosed by that.
What you and I assume is understood non tech types do not. In this case they will be a very complete examination of the Switches. Not because they suspect them, but as part of through.
I was impressed when the NTSB got down to a Contact issue on the Dali disaster (6 dead). Having worked with those types of switches, it was yep, I see it. Talk about an obscure trigger for failure. They obviously had good forensics on that.
My take though was on a higher level that any vessel that can damage a bridge should have tugs attached going under the Bridges (NY has that in place on at least6 some bridges).
That engine failure could have happene4d to anyone and it was a matter of time.
Clearly they could have run a split bus and the emere4cny system up and running.
Lack of will to do the correct thing to protect bridges (and in turn people on them).
Yea it all cost a bit more like we are not paying anyway. But if all are required to do it then its a level field and place4s like Baltimore can’t go cheap trying to appeal to shippers.
Split bus and backup system on line would give a lot more scope and coverage and in the case of the Dali, a bit of steerage could have changed patch enough to miss the bridge or glance off the support.
While its not fully effective, with full power on you can also fire up the bow thruster and anything added can avoid that fatal aspect.
It always was my philosophy that we can do better now matter how good we are, do or respond.
The Top Gun format was what I came to identify with. Full scrub, no ego, what went wrong more than what went right (if anything)
Ergo, I can question the Switches and a possible issue and also understand they were not a factor.
So I don’t like the location and I do not think they should be able to be converte4d from one function type to another.
I think its worth noting the kind of denial that goes into this regardless of the facts. The following tries to lay out a case for “other”
https://thefederal.com/category/business/flight-insight/pilot-error-boeing-ahmedabad-air-india-crash-fuel-cut-196721
The flaw in their illogical is that this has nothing to do with human factors and reactions. You don’t know how long the Switch mover was poised to do so, you only know a Switch was moved per the timeline (Left). A second latter, Right.
I doubt the Switch registers a gate lift. And as this is NOT a reaction, its a pre planned movement, it can be done fast.
The other pilots reaction is fully in line with startle, shock, assess and reaction.
And I can remember as a kid the I did not do it thing. Sometimes you got away with it, worth a try. If my folks had proof, out it came, oh, yea.
I have seen people do something and deny it.
There are people claiming 1 second apart is not possible, and others claiming that it is. And videos demonstrating both. I guess the investigation will resolve it.
To me, the clincher is the engines were normal until the switches were thrown, and there was no evidence in the FDR that the switches weren’t thrown (the contacts moved together).
There is another possibility, however remote (and no, I am not a conspiracy theorist):
Most of the comments above indicate that we believe that the pilots did in fact, move the switches – from run, to cut-off, then back to run.
We take the pilots statement (one of them, anyways) as purposefully misleading. We assume that one of them, did in fact, move the switches.
What if we take the pilots statements at face value? The switches were never moved? They stayed in the run position, throughout?
Firstly:
Could the pilot who asked the cutoff question, received the information that fuel was cut, in another manner, aside from looking at the switches?
Secondly:
Is there an electrical manner, in which those switches stay as they are and through some freak fault, switch the engines on and off, as happened during the flight?
I agree with most, that the CVR conversation probably clears all this up. But absent that and given what we have been told…it is possible. However improbable…
The engine cutoff switches generate an EICAS message. So they could and likely would have known without looking at the switches.
There is no electrical fault that could simulate the switches being thrown, given the 4 sets of contacts of which multiple are monitored by the FDR.
Since there two fuel valves for each engine (engine-side and aircraft-side), only the cutoff and fire switches have the ability to close both valves. I’m sure AAIB would have mentioned if there had been an anomalous closing sequence.
The language AAIB used was the switches “transitioned” from RUN to CUTOFF, so I don’t think there is any doubt they moved. But AAIB did not draw a conclusion as to how they moved.
https://i.ibb.co/4ngwYHmT/B787-Fuel-Control-Switch-Schematic.jpg
B787-Fuel-Control-Switch-Schematic
someone made this available ( via a.net )
second level of the action chain is bistable relays with push/pull coils. ( now where is the recorder tap ? at the fuel control switch level or further down behind the second level actors? )
“transitioned”
The top level switch “commands” action on the secondary level.
( all IMU, IMHO )
In English, please. For us dumb, non-engineering types….
But from that schematic, the switch itself is directly monitored by the FDR. So I don’t think there is any doubt that the switch itself moved.
No.
the way it looks it is directly monitored by “core system”
you don’t let a flight recorder log data items by having them passed through another system first. ( Well, that would be good design practice )
we don’t know where the tap for that signal is located.
Note that the “common core” is the aircraft network. The FDR is recording off the network, that’s standard practice.
Accuracy is assured by following the action sequence. Switch closes, at least two sets of contacts are monitored, actuators change state, valve positions change. If all of that is consistent, then the data are correct.
Also in this case, two separate and independent switches and systems, same behavior in each, 1 second apart. That can only be from the switches being moved.
You would need 4 identical failures across two systems. I’m sure AAIB would have confirmed all of that, and probably replicated to be sure the signal sequence, timings and patterns agree.
Plus they have the recovered switches to also test.
I don’t think there is any doubt here that the switches moved.
I agree – it is a longshot, and the investigation will most likely reveal that someone threw the switches, then denied it.
However, to say with 100% certainty (with the investigation barely a month in and the aircraft still in pieces, all over the place) that some kind an anomaly (electrical, computer?) didn’t occur – and that the only path to those engines shutting down is either 1) Those switches or 2) Fire switches, might be premature. However unlikely.
But with the amount of wiring in aircraft, today – with such a heavy reliance on computerization and electrical demand…
For example:
“On August 14, 2013, the media reported a fire extinguisher fault affecting three ANA airplanes, which caused the fire extinguishers to discharge into the opposite engine from the one requested.[411] The fault was caused by a supplier assembly error.[412] ”
Now, if the fire extinguisher was fired into the wrong engine, people could easily say, “It was the pilot – he pulled the wrong switch. Has to be. No other way.”
All I’m saying is, what if?
Crazier things have happened.
The thing is, though, the switches moved. That doesn’t rule out a contributing electrical fault of some kind. But the incipient action was the switches being thrown.
That’s the most insightful comment so far. A Boeing software engineer might be able to expand upon it.
I’m encouraged that we at least got an unbiased preliminary report. This report is not the result of the formal investigation but a basic recap of the data captured from the observable and the FDR/CVR’s that were both recovered intact. It assigns no blame and concludes nothing other than the objectively true facts surrounding the crash. There is no “narrative”, there is only the objective truth. Anything other than the truth undermines the entire commercial aviation enterprise, making us all less safe.