Leeham News and Analysis
There's more to real news than a news release.
Air India Flight 171 Preliminary Crash Report Is Unclear Regarding Pilot Actions
By Bjorn Fehrm
July 11, 2025, © Leeham News: India’s Aircraft Accident Investigation Bureau has issued the preliminary report of the crash of Flight 171.
The report indicates that the aircraft and flight crew were fit for flight and that the pilots were experienced, with the Captain having a total of 15,638 flight hours, including 8,596 on type, and the First Officer having 3,403 flight hours, with 1,128 on type.
The report documents the technical registration of the engine’s Fuel Cutoff switches, which transition from RUN to CUTOFF, remain at CUTOFF for 10 seconds, and then return to RUN. By then, the engine cores have slowed down below flight idle, with the engines delivering almost no thrust.
Inadequate reporting on pilot conversations and actions
The report is detailed enough on the physical events in the aircraft to understand what is happening, but it is inadequate regarding the pilots’ discussions and actions. Here is why, with excerpts from the report (which you can find here):
- After a normal rotation at 153kts with flaps in the normal 5 degress position the report states: The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off. In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
- As per the EAFR (the intact forward data and voice flight recorder) data both engines N2 values passed below minimum idle speed, and the RAT hydraulic pump began supplying hydraulic power at about 08:08:47 UTC. As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC. The APU Inlet Door began opening at about 08:08:54 UTC, consistent with the APU Auto Start logic. Thereafter at 08:08:56 UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN. When fuel control switches are moved from CUTOFF to RUN while the aircraft is inflight, each engines full authority dual engine control (FADEC) automatically manages a relight and thrust recovery sequence of ignition and fuel introduction.
- The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
- At about 08:09:05 UTC, one of the pilots transmitted “MAYDAY MAYDAY MAYDAY”. The ATCO enquired about the call sign. ATCO did not get any response but observed the aircraft crashing outside the airport boundary and activated the emergency response. The EAFR recording stopped at 08:09:11 UTC.
The above are the important bits from the preliminary report.
Here are my comments on the information in the report and what is not in the report that should have been there:
- Everything is normal in the takeoff until it’s time to command and execute “GEAR UP” at about 08:08:42 UTC. Then the Fuel Cutoff switches are moved from RUN to CUTOFF. This is with a high probability done by a person as the switches are lift-guarded and these will not accidentally BOTH jump over the guard to CUTOFF. There is no discussion in the report that this could have occurred internally in the fuel system. In fact, one pilot says to the other, “ Why did you cutoff?” meaning he has either seen the action or the position of the switches.
- The information “In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.” This is suddenly a vague and inadequate standard of information in the report. Why is the asking or responding pilot not identified (Captain as Pilot Monitoring, PM, or First Officer, Pilot Flying, PF)?
- Why is the further conversation or actions of the pilots not described after this dialogue? Putting the switches in CUTOFF is a grave action that puts the aircraft and all people at risk. It’s improbable it’s a mistake, as there is no hand movement in this area during takeoff.
- Why does it take 10 seconds to move engine No. 1’s switch to RUN and 14 seconds for No. 2 engine?? I would have had both in RUN within 5 seconds or less! To me, this indicates a problematic pilot interaction after the switches went to CUTOFF, for which we receive NO information.
There is a passing reference in the early part of the report about a recommendation to check the locking mechanism of the Fuel Cutoff switches, as these on a 737 had deteriorated. I place little value on this part, as the switches in the 787 have not had a single issue. These cannot be moved without lifting the switch from its guarded position.
I interpret the inadequate reporting on pilot conversations and the remark on checks recommended for the switch guard mechanism as the investigation attempting to muddy the clarity of the facts and mire an ugly truth in doubt.
Wild A** guess – not an accident re switches. ( Not a pilot )
Not so wild a guess, methinks
Is it possible to mistake the fuel cut-off switches for the gear up lever?
But then, why do the same thing twice?
No. The Gear Handle is located on the Dashboard in front of the pilots. The fuel cutoff switches are positioned as far away as possible at the back of the throttle quadrant. No way.
@Bjorn
Are there any circumstances where engines are shut down WITHOUT first setting throttle / thrust levers to IDLE ?
In a FBW aircraft wouldn’t it be possible to ignore fuel cut off (or at least light up a caution warning that has to be actioned) if the throttle was not at IDLE ?
I understand that you’d still need to have some way to completely cut off the fuel if there was an issue with the throttle / thrust levers and I understand airframers won’t want to change / re-certify anything, but a pilot moving the throttle / thrust lever is going to be more easily noticed than just flipping a few switches while the other pilot is concentrating on other issues (to be clear intentional or accidental).
I far prefer the throttle / thrust lever – fuel cutoff design of the Citations, lever will move as far back as idle, but to cut off the fuel, you have to pull up the lock on the side of the lever to get over the detent to pull the lever back to cut off fuel (throttle lever is the cut off).
Nope! Completely different lever in a different area away from the fuel switches.
“Everything is normal in the takeoff until it’s time to command and execute “GEAR UP” at about 08:08:42 UTC. Then the Fuel Cutoff switches are moved from RUN to CUTOFF. ”
The report also notes, with a photograph, that the landing gear lever was found still in the DOWN position.
The report does not tell us whether the CVY transcript records a “gear up” call immediately before the fuel cutoff switches were moved to CUTOFF. This will be something to watch for in the final report.
The gear lever and the fuel cutoff switches are in different places and require completely different actions. That said, both involve actions for which pilots do have muscle memory.
Humans – even pilots – do a lot of things by instinct rather than deliberation, particularly where the action uses muscle memory. Occasionally we find, perhaps when distracted, that we have done something daft. Fortunately such brain blips rarely have fatal consequences.
I wonder if this might have been an exception: taking at face value the exchange quoted in the report, both pilots were surprised to find that the switches had been moved to CUTOFF…
IMO not possible. You have muscle memory for actions you do in the cockpit during the sequence of flight. You don’t touch the fuel switches during flight, so no muscle memory. You do move them to the cutoff after the engine has idled for some time after gate arrival. No chance of inadvertent movement, none.
My full agreement with Bjorn. Obviously we were totally different pilot types but some things are solid.
Keep in mind this is not just a switch movement.
These are toggle locked by a mechanical stop and spring pressure to keep them in that position.
Moving one is not an action done in flight ever. Yes its an action of a dual engine failure done in the simulator (maybe).
” Moving one is not an action done in flight ever. ”
But in case of an engine fire in flight- probably… 🙂
If both switches are ever switched off in a “real fight” (at high enough altitude) seems to be a valid question.
This has been making the rounds:
Dual Eng Fail/ Stall
Condition: Engine speed for both engines is below idle.
1 FUEL CONTROL switches both CUTOFF, then RUN
2 RAM AIR TURBINE switch Push and hold for 1 second
Causes
Threats
Mitigation
– (high altitude) Fuel leak, fuel starvation, volcanic ash
– (low altitude) Birdstrike on both engines
– Startle factor, confusion arising from multiple sub systems failures
– Very high workload
– Prompt recognition of the situation & initiation of the correct memory item
It seems that “toggling off and on” the fuel switch is a proscribed procedure. If both engines are below idle in the air, it is a bad day, but there seems to be a procedure. If you are low to the ground it seems to be a desperate move. Mover who is a 787 pilot suggested that if they / he had a little more time (how much 15 – 25 seconds??) it might have worked.
I believe that needs to be amended a bit.
While normally below idle on the Shutdown, some of the concept involves a runaway engine that needs to be shutdown. No idle in that case.
As a low to ground aspect, its not an option as it takes a full power engine to zero thrust. I would guess you need 3000 feet to pull it off.
Duel engine issues requiring drastic action are pretty much unheard of. So while its a aspect, two at the same time is serious odds like .0000000000001 to the 100th.
Spool up time for a 787 engine is probably 30-40 seconds. That is from partial power when you put the throttles full forward (TOGO button).
Raw ignitions from a dead stop? 45 seconds.
Was there a relief pilot on board for this longish flight, sitting in the jump seat and close to those switches and therefore out of sight of the PF and PM?
None reported yet but the flight did not require a relief pilot.
Does not mean no jump seater.
As a former Senior Purser with Cathay Pacific, I completely agree with your point about muscle memory — it’s something we rely on extensively in aviation and in our daily lives, often without even realising it.
I’ve been wondering the same: could one of the pilots have inadvertently placed a hand on the fuel cut-off switches due to familiarity or reflex? Back when I was flying, we still had a flight engineer in the cockpit, which added another layer of oversight. I do wonder why that third person isn’t considered essential anymore, especially given the increasing complexity of systems.
What I find most perplexing is: why isn’t there an audible alarm when such a critical switch is activated? Even cars alert us for far less serious actions — you’d expect that an aircraft, with so much at stake, would have a clear warning when fuel is cut off mid-flight.
The muscle memory thing has gotten way over the fence. Its being used out of context.
Muscle memory is triggered by a pre trained action triggered by a defined situation. Like a Batter swinging at a ball. That same batter at first base does not switch when he has a ball thrown to him. They train for all that stuff thousands of times.
The only muscle memory a pilot has or uses is on the stick or yoke for miner course adjustments.
Everything else is Peters famous PIOSE. Problem, Identify an Action, you in fact are trained to slow down and confirm.
As for the Alarm, there is. What form those alarms are and what triggers it FIRST, I do not know.
For sure the N1 and N2 engine alarms on both sides go off. The fuel system display if not up will pop up with switch and valve indicators in RED. Maybe an audible.
For never seen or trained situation, someone reacted very quickly in assimilating a Red Board and understanding or focusing on the cause of the Shutdown Switches put to OFF.
The problem with alarms is you have to sort them. In this case one of the pilots did rapidly and got it spot on right. It was in a phase of flight once done you were not going to recover from.
There is an EICAS message and a master caution. There’s not a master alarm because fuel can only be turned off by the pilots.
Makes some sense but then you can also program it as an alarm if WOW, airspeed, altitude etc is above certain limits.
Realistically the engines stopping is so quick as to be almost immediate as well.
I suspect the systems diagrams shift to or open a window on fuel system status
I continue to be impressed with the speed or recognition and response by one pilot for what was a profoundly abnormal condition.
The reality is that the pilot (most likely) who shut them off could turn them on and then shutoff again, or do other things.
Once behavior goes into abnormal, there is no logic.
While I am not fond of the term startle factor, my thought is if you were the pilot who had not touched the switches, you would be stunned.
All sort of scenarios come to mind but the pilot who did not move the switches would have been shocked.
Assume the pilot not involved in switch movement was looking at the instruments (both should have been).
Your first indicator would be an alarm and the N1 starting to wind down. You have to assimilate that for an action that should not be taking place.
Then realize it was deliberate and trying to deal with switch position back on and the pilot who had moved them.
Basically you are dealing with denial by the Switch Mover, ramping up to what to do and as Bjorn noted, what the Switch Mover was doing.
As we saw with Boeing assuming time to react was immediate and that is not true for line pilots. Maybe some, probably a lot delayed and some never recover.
Basically you are involved with someone trying to kill you and fly an aircraft.
The time I got into a spin (not intentional) I panicked and I am not panic prone.
Probably two or three full turns before I got into the calm spot, assessed and reacted (mostly correctly – kudo to Cessna all I had to do was mostly right). If I had been lower I would have been dead. In fact some luck as I did not like how the aircraft was handling that day in stalls and had gotten another 1000 feet to work with.
One thing I did, I told my brother when he started flying he needed spin training and I think every pilot should see a spin and recovery as part of their training (in small aircraft approved for spins)
Fighter pilots live in a world of emergencies and I think Sully was an example of that.
Most of us don’t live on those kind of edges.
While an obvious action to turn back to run, some pilots might well never have gotten that far past the being stunned.
Pilot error is the answer . Same as always ( 95% of the time).
The motivations arent too important but deliberate is very very rare
@Duke:
Its not error if done deliberately.
Obviously someone doing that has some kind of abnormal issue, but yes, you want to try to understand it if there are signs of that people can be aware of and prevent it.
Equally obvious the Psychedelic Episode on the A175 was well hidden.
As was pointed out, if you are having problems you can’t come forward or your career is over. Not what you want.
I personally think that the cause is the maintenance or ground crew, the pilots are experienced enough that they don’t do stupid shit like this and they are always aware, but I acknowledge that pilot error exists, The airliner company will do anything to protect the reputation of the industry, in my theory,the India Crash Investigation might have been working with the Air India, possibly bribed so they blame the pilot error because the pilots are dead, because if it were the airplane and ground crew, it will be more damaging to their reputation because they violated safety standards and a lawsuit will come in and the industry is cooked, its sickening that their pathetic business matters more than people lives
“In fact, one pilot says to the other, ‘Why did you cutoff?’ meaning he has either seen the action or the position of the switches.”
Maybe not. Maybe a pilot intentionally shut them off and asked the question to place blame on the other?
The non switch operating pilot is not going to be looking at the Switches. His focus is on the instruments be it PF or PM.
As the action is totally abnormal, you will see the alarms going off be it a non normal switch position and the fuel valves OFF or the N1 loss. Probably the valve position first.
You are also trained to confirm though at that phase of flight its impossible aspect.
Confirm, look at the Switches, move switches and a Bjorn has noted, what is the pilot who moved the switches doing?. Just sitting there or actively fighting you?
And its possible that the Pilot that turned those Switches off turned them back on.
When a human breakdown occurs there is no logic to it nor predicting what is next.
Maybe we finally get cockpit video recordings of cockpit into the CVR. That will help understand altitude overshoots and unstable approaches as well
Agreed and its so far past time as to be criminal on the part of those who oppose it.
There are only two ways the PF could have narrowed down the loss of thrust, with 30 options to choose from, to the fuel switches being moved to CutOff in just a few seconds: (1) he saw the PNF do it, in which case his voice would be three octaves higher, and he would have said “What the #$@%# are you doing?!?” (2) he was one who did it, and he wanted to place blame on the PNF, as FlyTime suggests.
I think the latter scenario is the most likely. Otherwise, his voice would’ve been three octaves higher.
you wouldn’t know, would you?
There is no audio around and the reference in the report is not a word for word transcript of text spoken.
OR
Whoever said it could have seen from the ECAM that the fuel valves were shut when he looked to see why there was no thrust, quick verification of the cut off switches and …
We’re going to have to wait for the final report & hope that more of the questions are better addressed.
The 4 seconds are the problem.If the pilots were fighting over the switches,how did one of them eventually succeed?There must be a clue in recording as to their demeanour, cooperative/uncooperative.If it was some kind of mechanical fault,wouldn’t one of the pilots have said something like “Oh!its come on again”?
First of all it is deliberate whether or not the PM of PF did it.
I don’t have a problem with the delay, I can easily see it even longer.
The Switch mover could just be sitting there denying it.
That is probably going to get clarified.
The immediate aspect is its not a 787 issue that needs action and the rest we may or may not understand when they dig into what was happening as well as back groundf leading up to it.
Why would you wait 4 seconds between turning each engine back on?
As noted, you have to see it, understand it which is unfathomable and then do something.
For the average pilot I don’t see that as anything but normal.
Boeing expecting your average pilot to have test pilot reactions would not be.
In this case I do not believer there was anything that would make any difference.
Low, stalling, thrust take time to come in even if no further interference.
wait for effect?
Not sure what you mean but as this does not happen nor trained for, the PF has nothing to go by.
He has to see the shutdown, realize its not just one switch but two switches that have moved, look down to confirm it (its how we are trained) at which point somewhere in that train, why did you do it? I am going with the PF asking the PM, it could be wrong.
Then one of the two turned the Switches back on, no matter how fast it was never going to be in time.
There is definitely a significant number of glaring omissions in this report which suggest that there is something more happening here!
Too bad they didn’t provide some graphics of N2 & N1 as a function of time. I guess we will wait.
It is mentioned that the fuel on the ground was tested but very limited amount of fuel samples could be retrieved from the APU filter and Refuel/Jettison valve of left wing. The testing of these samples will be done at a suitable facility capable of carrying out the test with the limited available quantity. Of course this is after the crash site has been contaminated by a fire truck that drove over the wing and who knows how much water was being sprayed around.
The reason that I bring the N1 & N2 RPMs up as a function of time is that there is a very slight probability that the switches were toggled for a technical reason of low thrust. The sequence and timing do not suggest that it was for a technical reason but not having that information does leave a question open.
In someways this report answers some questions and generates a number of new ones. Considering that the it was reported that the NTSB was getting upset about issues, maybe there is more to the story.
@F-82:
The report says Switches off, N1 coming down, then N1 starting to recover on one but no thrust on the other.
Its clear what happened and probably who (not answered but I suspect its there) but not why and maybe never that.
It needs to be kept in mind that ACARs would have transmitted or been transmitting so you will have confirming data and the absence of alarms is data as well.
You say probably “who” but to me the report made which switch was turned off first purposely vague (to possibly not suggest the WHO).
Personally it is hard to suggest the who.
Yes it was, they have a human factor problem and want to get the background with as little corruption in it as possible. That is my take.
Its not an omission its deliberate.
Right now who did it tells us nothing actionable. They will want to try to see if there is any indicators they did not see or realize were there.
It may or may not happen, but the effort seems to be in that direction.
Bjorn, I’m wondering if you think perhaps that part of the conversation was withheld, because it’s possibly a criminal matter?
Tend to be suspicious along those lines. I presume the investigation will be looking at the cockpit personnel’s psychological profiles now. That and their finances. Starting to see some similarities to pilots having some troubles.
I know in the US, if there is criminality involved, those aspects will be withheld by NTSB, so as not to compromise the simultaneous criminal investigation.
@Rob:
I think we take it at face value that they do not want the background checks any more polluted with who than they can help.
If they ID who they think or know, that person is going to be considered guilty and responses can shift when that happens.
Again it may never be known and no one has any info but you don’t want to make it any worse.
Air India seems to have had scheduling issues with Pilots recently?
=====
https://www.indiatoday.in/india/story/days-after-crash-aviation-body-orders-air-india-to-remove-3-officials-for-serious-lapses-2744144-2025-06-21
=====
In this accident, both pilots seem to have enough sleep and were well rested?
Captain / First Officer
Date of Class I Medical Exam 05 Sept 2024 04 Feb 2025
Total Flying Experience 15638:22 Hrs 3403:12 Hrs.
Total Flying Experience on Type 8596:43 Hrs 1128:14 Hrs
Total Flying Experience as PIC on Type 8260:43 Hrs 0 Hrs
Total Flying Experience during last 180 days 262:58 Hrs 233:07 Hrs
Total Flying Experience during last 30 days 56:58 Hrs 66:24 Hrs
Total Flying Experience during last 07 days 07:12 Hrs 06:10 Hrs
Total Flying Experience during last 24 hours 00:00 Hrs 00:00 Hrs
Did they do any flying in another type aircraft recently with a vastly different control setup?
I wonder if they flew through a few time zones in the last few flights? International pilots, on the wrong time zone schedule, can become zombies, if they aren’t able to manage sleep cycles properly.
No, out of Mumbai, rested
According to the records, in the last 7 days, Capt and FO has 7 and 6 hrs flying, respectively. Not terribly taxing….
I am assuming that the reports about the engine cut off switches being moved is based on information from the flight data recorders, as well as the pilots conversation.
However, how does that information get passed to the flight data recorder? Is the position of the switches independently measured in some way or is it derived from the electrical signal which is changed by the switches and if it is based on an electrical signal is that the same signal that the flight controls can also switch?
In other words, is it possible that there is any ambiguity about what was the cause of the signal that is meant to record the position of the switches?
I suspect its an aspect of the power or no power (and I have yet to see if those valves are fail safe or not, ie. no power and they go open)
I do not believe the system has any input into the Switches or the downstream actions.
Saying that with a caveat, the position is going to report into the FDR and ingitor will go on and maybe power to FASDEC.
That said, I don’t think the system has any action in this though there may be timer or an interlock that stops the ignition once N1 is sufficient.
However, regardless you are talking both engines and software is not allowed to give a command (or a single computer) to both engines even for Thrust settings.
they keep those areas isolated from each other. It came up with the MAX crashes that two different groups write the software so a single error is not in both computers (granted that is a two computer system)
Even if possible the possibility of a dual action is close to if not zero.
You might want to research the TCMA (Thrust Control Malfunction Accommodation), for systems that can shut down the aircraft engines. (they should ONLY shut down when on the ground, but, on the 787) But, on the 787, the mechanical WOW sensors have been augmented…
======================
According to
=====
https://mentourpilot.com/does-the-787-have-a-problem-with-5g-interference/
=====
“Aircraft typically rely on weight-on-wheels (WOW) sensors, to let their systems know that they are on the ground.
But in the case of the 787, it appears that the radio altimeter has a key role in the process, making 5G interference a concern.”
=====
A previous duel engine automated shutdown, on the 787, not commanded by pilots.
https://simpleflying.com/ana-dual-engine-failure-on-landing/
=====
For the 787, the WoW function is not reliant on a single sensor, it depends on the rotation of the trucks and compression of the struts, as well as the stow sensor. The radar altimeter is a safeguard that prevents activation during extension and retraction, but it doesn’t indicate WoW.
The ANA dual rollback was caused by an uneven landing, during which the thrust reverser was also deployed early, before the aircraft was fully on the ground. This generated enough transient state transition events to convince the flight computers there was asymmetric thrust, so they rolled back the throttles once the aircraft reduced below the minimum ground maneuvering speed (below which the rudder lacks authority to prevent yaw).
The attorney Mary Schaivo has been peddling a conspiracy theory to recruit clients, that AI-171 experienced a similar computer commanded rollback on takeoff. But her theory was without factual basis or merit.
The 787 has two fuel shutoff valves. There is a high-pressure engine-side valve that is under dual control of the FADEC and the fire/cutoff switches in the cockpit.
Then there is the aircraft-side low-pressure valve mounted in the pylon. That one is only under the control of the cockpit fire/cutoff switches.
The flight recorders capture data from the FADEC, and so records if it commands the high-pressure valve to close. There are also separate captures from the cockpit fire control and cutoff switches. Additionally there are captures from the valves themselves, to determine state & position.
Thus I don’t think there is any potential for ambiguity. The cutoff switches close both valves, so the effect on N1 is immediate.
I’m not sure if this TCMA is used on the 787, but, it has a schematic showing some fuel cutoff relays along with the throttle. The FAA mandated this on because of some accident on the ground where the cockpit throttle was at idle and the engines were still going strong. The FAA wanted a system to stop the engines, if 1) the plane was on the ground and 2) throttle setting was idle and 3) the engines were going strong. I think the accident that prompted this resulted in a fire on the ground. I wonder if this is too much overkill myself.
===
https://patentimages.storage.googleapis.com/11/c0/6b/6dcf993795046a/US6704630.pdf
===
That incident resulted from a complete severing of the control wiring within the pylon, in which case the engine holds its current throttle setting, as a safety of flight issue.
The engine is fully redundant, providing its own power and having the ability to draft its own fuel from the tanks. So while the crew was able to land and stop, they could not shut off the engine. It also proved resistant to all the water the firefighters could pump into it.
I believe they finally used foam, which also damaged the engine, but there was really no other choice
There are probably many ways a troubled pilot can sabotage a flight. But to just reach over and shut off the gas for no logical reason in this age of computers and AI is terrible. I would seriously think this is a design flaw. It bodes well for the argument that maybe humans are not necessarily needed in the cockpit anymore.
There are design standards for certification that require risk analysis of probable failure modes. The risk that a pilot would shut off the engines on takeoff is essentially zero, and this incident does not appreciably change those odds. And to inhibit that function would also inhibit some situations where it might be necessary.
Ultimately the crew is responsible for their actions in flight. There is no avoiding that accountability. And if I have to choose between the risk of pilot intentional error, and automation like a Robotaxi, the odds are overwhelmingly and massively in favor of the pilot.
If you ever have done programming machines, even for simple systems, the failure modes are almost endless.
You have to make decisions. A pilot can pull the thrust lever or levers back as well.
It has nothing to do with AI or automation, it has everything to do with pilots being sane.
We have 6 I can think of the top of my head that was pilot induced crash.
If there is a fire you need to be able to cut off an engine and same goes for blades off (there are now shear bolts that will break fan loose).
The Germanwings pilot just pushed it over and into the ground as did the China 737-800.
How do you determine if a pilot is sane when he gets into the aircraft?
have him/her sign a waver 🙂
( I do wonder though if one could use
something like the “I am Human” checkbox.
with AI there should be a way to detect madness )
Sorry but my gut is just not buying this whole scenario
These experienced pilots had seconds
To react
My opinion is some serious malfunction in electrical power etc n all that followed was a response
To the underlying unknown culprit
@MS:
You have multiple facts saying it occurred the way it was laid out.
Voice
Switch Position Input
Engine Reaction DATA
Other: There are also a large number of things like Gen Power inputs, loss of hydraulic pressure etc that back all that up.
Probably the most massive electrical failure was on a test 787 going into San Antonio (Texas US). It took down the entire electrical system.
The engines as intended continued to run as they are independent. RAT deployed and they got minimum instruments and controls back .
Nothing in the data on AI 171 shows anything remotely like that happening.
TCMA ahs a separate circuit that overrides the Fuel Switches. So only 2
options here: TCMA went to work. This should have happened on ground. Unknown why. (But I guess the ANA shutdown on landing was a surprise). Or one of the pilots moved both switches to cutoff within 1 second !
I also think that the Auto Relight function could be responsible for the restart attempt. (Once the TCMA fault cleared). As I understand the relight will not happen until N1 and EGT has been reduced under a certain value. This could explain the 4 seconds between the “restart” attempts.
TCMA cannot explain the engines running normally until the cutoff switches were thrown.
Also the 4 seconds are between the switches being restored to the run position. The FADEC manages relight, the pilots would restore the switches ASAP.
In this case the first relight attempt by the FADEC was successful on the #1 engine, but although ignition ocurred in the #2 engine, it did not successfully relight on the several attempts by the FADEC.
Successful here is defined by arresting the deceleration of the engine spools and reversing it to acceleration.
Rob, Could the TCMA be triggered after takeoff, if the air/ground mode was taking it’s readings from the LRRA (gear down, or in transit mode, with trucks forward as some have mentioned)? And the Radar altimeter still thinking it was on the ground, either by 5G interference or this issue
=====
https://www.aviacionline.com/faa-issues-airworthiness-directive-for-boeing-787-dreamliners-due-to-autothrottle-and-radio-altimeter-issues
=====
the thottles were found in the aft (idle) position per the preliminary report, the engines were at full takeoff .. so what was the TCMA reading for ground/air mode? and could it at that low altitude have a false LRRA radar altimeter readings? The physical WOW senssors ‘should’ be reading air mode .. but, it seems like quite a complex decision tree for the air/ground mode ..
I think that is extremely unlikely, as it also would need to sense asymmetric thrust. In the ANA incident, it did that by sensing thrust reverser deployment.
And also if TCMA had triggered it would generate EICAS messages and events in the FDR. I’m sure AAIB would have reported that.
TCMA is not described very well in A/C manuals. Please read the Boeing patent and you will see that TCMA also controls Overthrust in all flight modes above idle thrust. It will only shut down an engine if on ground, and seses overthrust or to slow acceleration but will try to control thrust in other phases. Also I do not think there is any separate indication of the Cut Off switches position. Only the signal out, and that signal would be changed if for any not yet understood reason TCMA made the shutdown. I still believe that a technical malfunction caused this crash. We will see what the investigation comes up with. But the only 2 options are that either the switches was moved to cutoff manually or TCMA function cut off the fuel.
Just as a side note. I think I heard that the Embrier aircraft (please anyone that knows better chime in), require the throttles to be at idle, for the fuel cutoff switches to be active. If you flip the fuel cutoff switches in flight with the throttles at power, the switches are ignored (must be a micro switch tied to the idle throttle position etc?) This seems like a good idea. On the ground, for normal shut down sequence you’re at idle. If you need to shut down an engine in the air, you can put the engine at idle. But, if you’re in take off mode, and accidently hit the fuel cutoff switches, the engines won’t die. The only bug, I see is if the micro switch on the idle throttle breaks, and then you’d have to go to plan B to shut down the engine at the gate? Maybe another override switch on a far away panel?
Good question…
What signal is actually observed by the FDR ?
Obviously this is NOT the switch position but some sort of signal. Is it possible this signal to be jammed by something making the same effect that an action on the switch ? After all, in electrical cockpit, signals are all generated/processed.
Indeed — very valid questions.
Essentially, the FDR is giving us derived information.
Claes’ comment about video recording in the cockpit is pertinent in this context — preferably at least 8K, andd from multiple angles.
Indeed — very valid questions.
Essentially, the FDR is giving us derived information: it’s recording an electrical signal — not a mechanical switch position.
Also, regarding the cockpit conversation: is the querying pilot reacting to a direct observation, an indirect observation, or an assumption?
Claes’ comment about video recording in the cockpit is pertinent in this context — preferably at least 8K, and from multiple angles.
Issue is explained above. Ambiguity in the flight recorder data is not possible.
Of course it’s possible.
Any time an electrical device seeks to record the state of a mechanical device, there’s the possibility of error.
This is because electrical signalling can be influenced by extraneous factors that have nothing to do with the mechanical device being monitored.
Examples: crosstalk, EM interference, arc-over.
Getting into esoteric arguments sloths over the issue.
Failing to accept that they have done cross checks that confirm the data.
In theory one switch position movement could be wrong. Not two, not two and back on again. Backed up by the data on N1 and N2 from the engines.
Backed up by data on timing. Backed up by data on valves positions and FASDEC status.
Delving into technical conspiracy theories is nothing more than a false path.
Good point! Are the sensors that detect whether the fuel switches are in the “on” or “off” position located right within the switches themselves, or elsewhere? For example, at the other end of the circuit (at the fuel solenoids/valves that control the fuel feed)? Just curious.
1] If those sensors are located within the switches, yes, definitely one of the pilots physically moved the switches.
2] If sensors are located downstream from the switches, for example in the avionics bay below the cockpit, or at the fuel supply points, then other possibilities (sabotage) can come into play. For example, a PLC (programmable logic controller) can be introduced into the circuit to go through the timed fuel cutoff /restart steps sequentially, and both pilots would be caught unawares, and be helpless to do anything about it. A PLC with an embedded angle sensor and/or accelerometer can be programmed to stay dormant until becomes activated, for example, at the 5th takeoff, etc. The plane would crash, but the blame would be on the pilots because the FDR would have recorded the sensor output, not any physical movement of the switches.
The switches have 4 sets of contacts. At least 2 sets are recorded in the FDR. Another set is recorded in the FADEC EECM.
It’s improbable that if all the contacts are recorded with a state change at the same time, that the switch was not thrown.
Plane-Folk ,
Well , it was obviously a mechanical or human brain malfunction . Unfortunately it appears to be the latter ! 😕
Horrible tragedy but yes.
is this the 2025/06/12 timeline as of 2025/07/11?
08:07:33 UTC Air India Flight 171 Boeing 787 cleared for takeoff
08:07:37 UTC on runway, starting takeoff roll
08:08:35 UTC at takeoff Speed
08:08:39 UTC Liftoff & in the air
08:08:42 UTC at 180 Kts (would have been time for GEAR UP)
08:08:43 UTC estimated Engine 1 Left Cutoff
08:08:44 UTC estimated Engine 2 Right Cutoff
cockpit voice recorder one pilot asks the other
“Why did you cut off?” other pilot says “I didn’t”
08:08:47 UTC RAT hydraulic pump begins
08:08:52 UTC Engine 1 Switch to RUN
08:08:54 UTC, APU Inlet Door opens Auto Start logic?
08:08:56 UTC Engine 2 Switch to RUN
08:09:05 UTC mayday
08:09:11 UTC crash
a metal stop-lock mechanism must be intentionally lifted to change
their position & the report did not specify how the switches moved
2018 FAA bulletin SAIB NM-18-33 warned do not
“disengage” fuel control switch lock mechanism
The switches moved because someone lifted them up and moved them to Shutdown.
Not stated is who. While not likely there could have been a 3rd person in the cockpit.
The bulletin is an advisory and I have no idea why they would put something like that out without an action (switches were built wrong or installed wrong). Probably that would be found quickly.
”2018 FAA bulletin SAIB NM-18-33 warned do not
“disengage” fuel control switch lock mechanisn”
How do you do that?
IMU it is a sprung liftring on the toggle.
Pull, change position, release.
(issue I could envision is the liftring does not return into its retainer position. … )
for the interested, the Honeywell DS as used on 787:
https://eu.mouser.com/datasheet/2/187/honeywell_hwscs06627_1-1735572.pdf
Maybe its time to install a disable feature in those switches, when certain flight parameters are met? Can only be enabled when something occurs (engine fire, flameout etc).
And that opens up a whole arena of not being able to do what is needed when.
Do you disable the throttles? Yoke or stick?
Airbus has envelope protections, but the computers can be turned off.
As noted, I have done machinery programs. For something simple, there are a large number of branches of what other systems do or do not do. None of them are life safety, most are not equipment safety.
You can also have a computer just fly the aircraft, and good luck with the programing.
They might be able to set up some contingency to prevent what happened.
But I tend to think, if this happened on an Airbus A350, most of this discussion would be moot, and we would accept that this was Pilot Error.
Good point.
As I understand it the A350 has a single shutoff for both engines.
Hmmm.
Later down there is a discussion but I think Engine Shutdown/RUN switches belong someplace else, not that it had any aspect in this crash.
The report seems to purposely leave it a bit vague with regard to which switch is first in the sequence!
“ the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec.”
It makes one wonder why this was made purposely unclear as exact time stamps could have been used. The only rationale would be to not suggest who did it.
It is unfortunate as one engine successfully relit and one didn’t! Clearly in this case a few seconds counted.
I read it as 1 shutdown first and 2 a second latter. We will know at some point for sure.
I don’t think it made any difference as they needed 60,000 lbs of thrust from one or both engines and they were probably 40 seconds from that on ignite.
Gear is still down, flaps are still down, high drag and stalling.
Thanks for this Bjorn. Had I read the report before your article I would have comme to the exact same conclusion. I think we may be facing a similar scenario here than the one I have imagined from the start for Malaysia Airlines Flight 370.
Yep, that would be one. China 737-800 3 (?) years ago. Germanwings. One in Indonesia as I recall. Egyptair 767.
Honestly, this preliminary report leaves too many unanswered questions.
The sequence of events is clear — normal takeoff, then both fuel cutoff switches are moved to CUTOFF one second apart. But there’s barely anything about what the pilots were actually doing or thinking.
Those switches are lift-guarded. You can’t just hit them accidentally — and certainly not both at once. So that raises serious questions. The CVR records one pilot asking, “Why did you cutoff?” and the other replying, “I didn’t.” But we’re not told who said what — captain or FO — or what happened afterward. That’s a big gap.
Also, why did it take 10 seconds for engine 1 and 14 seconds for engine 2 to be put back to RUN? That seems way too long in an emergency. Any experienced crew would react instantly.
Finally, the mention of “better switch guards” feels like a distraction. These are already protected — that’s not where the problem lies.
I hope the final report is more transparent, especially regarding cockpit actions and CRM. Right now, it feels like something’s being softened or omitted.
@pascal:
I am assuming you are asking to understand. A lot of this is already stated.
Going from the top, the preliminary report is not a deep detailed report. In fact there is a lot more information in this one than there is in a lot of them that often just state facts we know (souls on board, souls on ground, how many of each died, date etc).
They actually did a fantastic job of reporting what was needed at this time. The Engine Control Switches were moved and it was deliberate.
That is critical for all involved, its not a 787 issue. Its now into the area of a Human issue.
Obviously they want a free access to both pilots past without a mark that says X pilot was the one that moved the switches.
Often we simply do not know, but if it is knowable the aviation community needs to know what to look for if its possible to detect.
As for the time lag, been there, done that, got T shirts. Someone in the cockpit just did the unbelievable. You have no training, you have no response, nothing in the simulator to go on.
You have to see the alarms, understand what they are telling you, then get over the hurdle those alarms are impossible, then do something about the alarms.
Note that is Engine 1 and then 2 shutdown and its Engine 1 and then 2 put back to the Run position.
One last point, even once the Switches were moved back to Run, there was never a chance that they could recover. Spool up time is easily 10 seconds and probably 30 from a full Shutdown state.
Pilots are trained in aircraft failures, they are not trained in dealing with a pilot for whatever reasons doing insane actions in the cockpit.
An item of note is the Gear Handle position.
It was found in the down position.
However, the throttles were found in the Idle position and the FDR reported they were in the flight positions, ie takeoff thrust full.
If the throttles could be knocked back in the crash the landing gear lever could have been as well as I do not believe that his a pull lock on it (maybe should)
A lot not stated but the obvious fact of deliberate action on the engine Shutdown Switches is the key, not an aircraft or an engine issue.
Of further note and no explanation is that Engine 1 was shutdown first, it also was the one that was moved to Run position first.
Speculation would be its the normal sequence as done by the Captain.
The locking mechs on the switches could have worn out and due to the thrust and 30 deg attitute of the aircraft during climb the switches could have gone into the down (off) position – a remote possibility
Fleet mechanics have weighed in on this, in other forums. They have never seen one of these switches malfunction without being physically broken (which has sometimes happened). However for this aircraft there were no reports of any problems with the switches. Nor has there ever been a report of an uncommanded change of state. There are many thousands of these switches in daily service.
The failure mentioned above, would also require BOTH switches to be worn and in-operative.
That’s not very likely…
Bingo. And 30 degrees is an exaggeration. Somewhere around 12 deg pitch up, it looks steeper and feels steeper but is not.
One Swithc is remotely possible, two, no. Two withing a second of each other, no.
Also note that the switches then stayed up after being put up through a crash that wracked the throttles back to idle position (which is why all data is used not a single bit as that is totally misleading)
“FAA flagged fuel control switch issue on Boeing jets in 2018”
“According to the report, Federal Aviation Administration (FAA) Special Airworthiness Information Bulletin (SAIB) No. NM-18-33, issued in December 2018, flagged potential disengagement of the fuel control switch locking feature in Boeing aircraft, including the B787-8 fitted with similar part numbers.
“This Special Airworthiness Information Bulletin (SAIB) is to advise registered owners and operators of The Boeing Company Model 717-200 airplanes; Model 737-700, -700C, -800, and -900ER series airplanes; Model 737-8 and -9 airplanes; Model 747-400, -400D, -400F, -8, and -8F series airplanes; Model 757-200, -200CB, -200PF, and -300 series airplanes; Model 767-200, -300, -300F, -400ER, and -2C series airplanes; Model 787-8, -9, and -10 airplanes; Model MD-11 and MD-11F airplanes; and Model MD-90-30 airplanes of the potential for disengagement of the fuel control switch locking feature,” the report said.”
“”If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown,” it added.”
https://timesofindia.indiatimes.com/india/advisory-not-mandatory-did-faa-flag-fuel-control-switch-issue-on-boeing-jets-in-2018-what-ai-171-probe-report-says/articleshow/122399618.cms
” time gap of 01 sec”
How does one have to read this?
usually you’d write “1 sec” if one second apart.
So is this presentation meant to indicate zero to one second?
( what is the (time) granularity for recording the fuel switch state? )
Can the switches be set to one position
without assured lock of the liftring on the toggle?
Are the fuel switches spring loaded towards “off”?
The switches are not spring loaded to either position. They have a normal snap action toggle that doesn’t favor either side. The spring is only in lifting the handle over the center detent.
If the spring is disengaged or the handle is stuck in the up position, so that it clears the detent, then it functions as an ordinary toggle switch with no lock.
The switches stayed in the up/run position on impact, which would imply they were locked. The AAIB should be able to confirm their operation.
I’ve used this type of switch in designs.
( demand for positive action for on and off
contrast with the red plastic tab cover for switches
which is positive action for on but not for off)
Never seen one with a “block locking” feature.
But you can block the locking shroud with lint.
No, you use those switches each and every start and stop.
Anything mechanical can break. If it does its a Red Tag and aircraft is going no where until fixed.
And that is just one, not two.
“The Boeing 787 uses spring-loaded locking mechanisms on its fuel control switches to prevent accidental movement. The switches installed on VT-ANB (Part No. 4TL837-3D) were referenced in FAA SAIB NM-18-33 (2018), which warned that these switches might be installed with the locking feature disengaged, making them susceptible to unintended movement due to vibration, contact, or quadrant flex.”
https://www.outlookindia.com/national/air-india-ai171-a-preliminary-report-that-raises-more-questions-than-it-answers
Irrelevant, its not an AD.
This aircraft is 12 years old? Sheese
Thats the ‘locking feature’ not the switches themselves.
Would you describe could be a maintenance feature ”these switches might be installed with the locking feature disengaged’
Someone still has to flick the switch
Does that align with the following:
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52* UTC. The APU Inlet Door began opening at about 08:08:54 UTC, consistent with the APU Auto Start logic. Thereafter at 08:08:56* UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN.
Approx four seconds between ‘transition’ of fuel cutoff switch of the Engine 1 and Engine 2.
Do we know if the cockpit conversation was in English or in Hindi?
It would be unfortunate to have to rely on translations.
“I did not do so” sounds stiff and formal under the circumstances…it’s not what a native English speaker would say…
English as spoken in India differs from usage as in GB or the US.
( differences in expression, Hmm, slightly “oldschool” ? would that fit ?)
There’s no point in wondering what would fit as the actual conversation wasn’t given in the first place. The only thing the report does is to describe that one crew member asked about it and the other denied. We don’t know the language nor the exact wording.
Spot on and we don’t have to.
They got the basic fact of what happened.
They are not looking for a tech issue and going off on those tangents is just putting stuff on a screen. It add a negative to any understanding.
It does not matter. What matters is the Switches were moved, it was deliberate and its now in the human factors arena, not a 787 or Engine arena.
It never mentioned that was the literal transcription, the report says “The other pilot responded that he did not do so.”. It’s merely a description. People are now filling in that the reply was something like “I didn’t” but nobody actually knows.
Is there a path forward, in today’s highly computerized environment, where a feature is installed that would require the agreement of both pilots, to shut off the fuel to the engines?
There are many flight protection devices installed today (more so in Airbus aircraft) that will not allow the pilots to do certain things.
Can those switches be disabled, after the aircraft has reached ~50 knots, which would require both pilots agreeing (maybe a switch too far apart for one pilot alone to initiate) BUT…would be enabled during certain circumstances.
1) Aircraft detects a fire in an engine, or another engine
anomaly, single pilot authority restored
2) If a pilot leaves the flight deck (bathroom break), thrust, fuel and yoke control remain as is and ‘locked’ until he returns
3) An override of the system, restoring full one-pilot control – in the case of an incapacitated pilot, requires the permission of a 3rd crew member. Maybe a pin pad, inside the cockpit door?
If memory serves, this is the 3rd time (Egyptair, Germanwings) that this (allegedly) has happened.
I know that there would be huge pushback from pilots, but is it time for video cameras in the cockpit, as well?
With the ability of satellites today, how about continually uploading FDR and CVR data to a data hub, so that finding the black boxes is no longer an impediment to an investigation?
One issue with safeguards is that they increase complexity.
complexity (more hardware/software involved )
increases failure probability.
Agreed.
Perhaps it it time to move those switches away from the throttle quadrants, put on an overhead panel and have a safety cover installed on top of them, as an added safety feature?
Lets put them in the Biffie in the back of the Aircraft behind a locked safe.
@ Frank P
Excellent comment.
Far too easy to (inadvertently) do something with very far-reaching consequences.
Actually as mentioned above, there are design standards for certification that are based on risk assessment. This is not an actionable risk. The odds beforehand were essentially zero, and the odds afterwards remain essentially zero. So it’s highly unlikely this will be considered a design issue.
You cannot subtract accountability from the crew function, nor would you want to do that. It’s not a solution.
Certification standards change all the time — because we’re frequently confronted by effects that were previously discounted.
Shifting balances of probabilities.
There is no shift in probability, that is the point.
Probabilities shift all the time, as new data becomes available.
It’s intrinsic to the whole concept of probability, which is calculated based on the relative sizes of solution spaces.
Rob is correct.
People are arguing all sort of aspect.
‘
You want to see conundrum, look up Airbus and the Sao Paolo crash all around thrust reversers and spoilers and what can activate when.
Airbus does the same thing with cutoff switches.
What is being presented is removing all controls from the cockpit. You can’t trust the pilots and the only way to ensure anything is to remove the controls.
Will they reconsider the possibility of recording cockpit footage after this case? I know there’s a lot of resistance to this idea, especially from pilots’ unions, but it might be necessary. (Note: Please excuse my “Google” English)
You came across just fine.
I have long advocated for video. Protect it the same as CVR. Yes I was a pilot (still am, not current)
It was the definitive thing that sorted out that Shuttle Cock space plane crash. They recorded the deployment of the control, video confirmed he did it early.
Keep in mind for all the jumpers here, that action was part of the sequence, it was done early but it was going to be done. No one knows why he did it against all training but he did.
Thanks!
I also believe there are no longer any reasons to justify not installing cameras in the cockpit. Some opponents often claim that installing cameras would “disrespect” pilots’ privacy. However, in many professions, workers are filmed throughout their workday.
Agreed. CVR is protected unless an incident. Then the need to know overides privacy.
I was subject to spot breathalyzer and drug tests.
Many of the areas I worked had cameras.
If this were a suicide, it seems to be a strange way to do it. The suicide sets himself up for a slow view of the ground coming up followed by what could be a survivable crash but ending in burning to death. At that altitude, don’t both pilots have better ways to cause their death such as pushing down on the yoke? But a third person in the cab might see the fuel switches and see it as the way to go since they can’t get to the controls as easily.
Indeed.
Very odd set of affairs.
“cut off fuel”
decisive no recourse action.
“push on Yoke.”
other crew member will fight against that action.
or the suicider can just stop the action.
there is a wiring diagram around on a.net.
looks like quite a bit of intermediary linkage
from switch toggle to effected action.
(would be interesting to know at what point in the effector chain the recorder tap is located )
Looks like pilots’ associations in India are not happy with the pilot blaming currently going on:
“Reacting to the report, a pilots’ association issued a sharp statement criticising the direction of the investigation. “We are surprised at the secrecy surrounding these investigations. Suitably qualified personnel have not been included in this crucial probe,” the statement read.
“It added that the mention of a technical bulletin on possible fuel switch gate malfunctions points to a mechanical issue being overlooked. “The investigation seems to presume pilot error, and we strongly object to this line of thought,” the association said, further questioning why the report was circulated to the media without a signatory.”
It appears that instead of putting the gear up, after achieving a positive climb rate, one of the pilots inadvertently turned the fuel cutoff switches off. The CVR should show something along the lines of flying pilot “positive rate / gear up” and then a response of “gear up” by the other pilot.
Three seconds after the aircraft transitioned from ground mode to air mode the fuel cutoff was noted by the black box data recorder. So, the TCMA (Thrust Control Malfunction Accommodation) doesn’t sound like it’s in the picture, with the 3 second lag. This will be verified when the full
readout of the black box data recorder is released, as the TCMA signal should be printed out as one of the parameters. I assume that some human factors people will be brought on board the investigation, to try and determine why a pilot went from muscle memory circuit
of ‘gear up’ to his ‘turn off engine’ muscle memory circuit. Did the flying pilot say something other than “positive rate / gear up”? Was there a distraction of some type on takeoff that brought the pilots mind out of normal takeoff sequencing? I certainly hope it was an inadvertant memory lapse and not an intentional action of the pilot. Either way, the human factors experts will have to do their best to figure it out. Unless this becomes a trend, I’d rather not see any reengineering of the aircraft. Only one other time, that I’ve heard of has a pilot cut off fuel accidently to an aircraft in the air.
“… one of the pilots inadvertently turned the fuel cutoff switches off…”
Or the switches moved of their own accord (e.g. due to vibration), per the 2018 FAA warning (see above).
As unlikely as that might seem, it’s still a possibility until such time as it has been specifically eliminated.
Pilots’ associations in India are stressing this point, and expressing disapproval of the default pilot blaming currently occurring.
A large “bump” causing both swtiches at once to be thrown? No other evidence of a ‘bump’.
There would be more instances of fuel cutoff’s in bumpy weather recorded. This was at the time of ‘gear up’. So, one of the pilots should be reaching for the gear lever. Until the full inforation on the flight data recorder is published, I think the accidental muscle memory argument seems the most believable. Somehow, the hand went for the fuel cutoff sequence in memory, rather than the gear up sequence. Something distracted him, or he was thinking about something else and his automatic memory sequence flipped from gear up to shut down plane. If this was the case, trying to reconstruct what was going through his mind at that second will be more than a little difficult. I think some ‘go-pro’ camera’s in the cockpit would be a great idea, as long as they are strictly used only for accident and safety purposes.
(1) “Vibration” is not the same as “bump”.
(2) The landing gear lever is nowhere near the fuel cutoff switches.
(3) Regarding muscle memory: there’s zero reason to do anything with the fuel switches in the course of a normal flight. They are used in an engine fire and/or when the plane has pulled up to to the de-boarding position.
Engine vibrations as well
There has never been a recorded instance of the switches moving of their own accord. That is a massive projection from the statement of the service bulletin, which only indicates it could be a possibility.
This is an example of the possibility vs probability fallacy. All that is equally possible, is also equally probable. Which is false.
If FAA or EASA thought this was a probable event, it would have been an AD rather than an SB. Instead they issued the SB as a precaution. It was not mandatory, which is why Air India never carried it out.
“There has never been a recorded instance of the switches moving of their own accord”
There’s a first time for everything.
The Tacoma Narrows bridge had never collapsed — until it collapsed.
All possibilities need to be considered — particularly when the subject of a previous FAA warning.
That might be uncomfortable for Boeing, but it’s good for the public.
This is a fundamental misunderstanding of statistics.
There ar tens of thousands if these switches being used multiple times per day, around the world, in billions of events. if there was any likelihood at all that the switches could move on their own, it would have surfaced long ago. It’s improbable in the extreme.
And if there was in fact a probability, FAA and EASA would be all over it. Yet there is no response to this incident, and no claim that the switches moved, or even could move.
Perfect understanding of statistics.
Just because something hasn’t happened before doesn’t mean that it can’t happen.
As the sample size increases, so does the chance of particular phenomena manifesting themselves.
Getting struck by lightning tomorrow — less likely.
Getting struck by lightning in the next 10 years — much more likely.
Nope. As horrible as the MAX crashes were, factor it into 737 flights and they statistically are not relevant.
It was a glaring data point in MAX flights but it is rapidly being dropped down.
Abalone is present spurious arguments.
Tacoma narrows was cocked and loaded and baked in to fail. All it needed was the wind trigger which then occurred.
These fuel shutoff switches are used in thousands of Boeing aircraft.
So now its, not only one failed but two failed when one has never failed.
Bizzare
Huge disrespect to the Indian Authorities,
@RD:
You really ran into technical conspiracy theory on that one.
There is no muscle memory associated with that action on takeoff and in fact any Shutoff Switch work is deep inside other procedures.
Spiraling into a HMI wildness does nothing. Using buzz words like Human Factors does nothing.
The only human factors in involved are one of two human beings who did actions that we may well never know why or understand because if you did, you would be deemed (rightfully) insane at that moment (though you could also be lucid the next and put the Switches back to Run. )
There is not logic because there is no logic.
Similar to no matter you go, there you are. Word salad et al.
Good point! I think this muscle memory hypothesis is important to consider. I found this because I have had the same thought. Until this report, the gear down was used as a clue to a problem before positive rate. Now we know positive rate was achieved. We don’t know if it was called. So what’s the new explanation for the gear down? Perhaps a pilot was suicidal. Or maybe he just made a mistake. I know it sounds crazy. But it must be considered. If we find out PF called gear up a second before cutoff, that strengthens the muscle memory hypothesis.
Maybe it’s time to put the safety of passengers ahead of pilot privacy. I have a nagging feeling we will never know exactly what happened, and that as well as every crash investigation could have been enhanced if we had video in the cockpit.
Agreed 100%.
Unacceptable that we have another all-lives-lost crash so quickly after the Jeju one, without a *clear* account of what happened.
Dito for MH370 and China Eastern 5735.
Even with legitimate accidents, we have to infer so many things from context where a video could easily show what happened.
Actions that don’t make a sound, attention to instruments that will not register of FDR.
The only reason not to put them in the cockpit is because you are afraid of what you might see.
Agreed again, 100%.
Audio-only is absolutely primitive in this day and age. We have video surveillance all around us — time to have it in the cockpit also.
@Casey:
Fully on board and maybe this will lend to the case and get it done finally.
I did read that AI had it in the cockpit and active but that could well be wrong. So far its not been repeated.
To the repetitive statements above that ambiguity in the flight recorder data is possible, it’s not.
In this case, the recorder has the data from multiple (4) sets of contacts inside of each fuel cutoff switch, the state of the valve actuators, and the position of the valves.
The data design is to allow the isolation of actions and errors. Further transients and glitches leave traces in the data, and would not be isolated to just one circuit.
Again this is the possibility vs probability fallacy. All things are possible but not all things are probable. And the designers take into consideration things that are probable.
Any electrical signal being transmitted from point to point is subject to potential corruption.
Whole books and courses are based upon this fundamental concept.
Trying to dismiss it as “impossible” shows poor engineering acumen.
Improbable is an entirely different matter. But, in a crash investigation, probability is subordinate to possibility.
Again this is the possibility vs probability fallacy. Just because you can imagine it as a possibility, does not make it in any way probable within the actual system.
If flight recorder data were not redundant and reliable, they would be useless.
However if you don’t acknowledge the fallacy, and you don’t understand it’s embedded in the premise of your statements, then you will see any possibility as also being probable. Which seems to be your perspective, but in this case, it is not.
Again: whole textbooks written on the subject of signal corruption.
Just because the phenomenon is inconvenient to a particular narrative does not merit its dismissal.
If you don’t understand the basic premise here, there is nothing more I can say to persuade you.
If you want to stand in opposition to the regulators and the facts on this, that’s your privilege.
@Rob:
Clearly he does not think of it as learning but presenting an agenda.
Its a shame but there it is.
I should add understanding as well.
If it was signal corruption , what moved the mechanical switches- as the pilots commented on that.
It seems that this random ‘noise’ corrupted the two separate fuel cut-off signals to different engines on different wings some seconds apart.
This is a different corruption on crash of China Easter FL 5735
‘On 19 May 2025, in response to an open government information request, the CAAC said that it decided not to release an annual interim investigation report to the public because releasing the report might “endanger national security and societal stability’
@Duke:
You are attempting to interject logic into Abalone. I predict you will fail.
The stone carving has been done, its now etched in.
Those circuit may not even be on a data bus. As a safety measure they could be hard wired.
Granted that is how I would do it and I am also attempting to interject logic here.
FASDEC will be on a data bus, separate ones and of course that can roll back power if the logic interlocks are ignored.
Keeping on going, another bizzare assumption is hash does something when in fact processor system are configured to ignore anything other than commands. But there I go again.
According to textbooks in String Theory we can step between universes.
Having worked with problem data lines, it can stop data moving, it does not invent commands.
And if you want to jump into single point of failure:
“Airbus just has one master switch for the engine. ”
I don’t know if that is true but in this case, old tech works as a cross check on movement of two not one devices.
Also note that Lock (or detnet0) issue has not been reported on any aircraft for one let alone two since the AB.
This is a quote and I have no knowledge if its true or not.
“Martin also criticised the omission of cockpit camera footage in the report. “The Boeing 787 is equipped with cameras that record pilot actions. Why hasn’t this footage been mentioned?”
just info
AI 171 Crash: Ex-Air India Pilot Speaks Out! Decodes What Might Have Gone Wrong With London-Bound Jet: OPED
https://www.eurasiantimes.com/ai-171-crash-ex-air-india-pilot-decodes-why-airbus/
As much wrong withing that while some is right.
Despite the angles we saw, it was a normal takeoff with normal rotation and initial flight.
Gear is not up as the Switches were turned off before that.
We do not know for sure about the gear as that is not a latched handle and it could have been flipped down the way the throttle were knocked to Idle position in the crash.
Engine control switch position is a serious clue as they latch and they are in the position FDR reports. Not a given but if the throttle got knocked back a loose switch would likely have as well.
Its obvious the Shutdown Switch movement was deliberate even if the pilot who did it was mentally incapacitated (all the range of human aspects including a stroke)
As its unfahomalb its equally possible he turned them back on as well. I won’t read anything into that aspect other than is a horrible human tragedy on so many levels.
WOW is not a mechanical lock. It has a number of aspects and Rob has noted and that included when and how thrust revers and spoilers can be deployed.
More than one incident has resulted in time delays in what happens when.
To flip it around to an opposite action when none of it has to do with the Shutdown switches.
You shutdown the engines and you just have had all the requirements of RAT deploying.
That is absurd.
The only allowance I see is if the RAT pre deployed, but that can be done via pilot action as well. I won’t rule it out as I do not have the event timing.
He is spewing nonessential in the Airbus assertion pilots have control, they do not. In fact Boeing has full override and Airbus pilots cannot.
Accident rates for both types of approach as virtually the same.
Airbus logic has failed before and Boeing has failed as well with their own logic but both fail.
Clearly thats written just before the prelim accident report came out – so makes it worthless
I went back and saw that. You have to wonder why he would have even written it.
Is it possible to tell from the recorded sounds in the cockpit if the gear lever was or was not moved, or if the fuel cutoff switches were moved?
I doubt it.
What you can tell is the Data recording of what position they were in.
Assuming CVR is good, you can hear if the PF called for gear up. Sans video it won’t tell you it was moved up. It could have been Shutdown Switches were moved instead.
What is clear is the Shutdown/Run switches (both) were moved to OFF.
You build the evidence and you don’t jump on something like the throttles in idle with all data says they were not as well as the parameters for what was going on and when with the engines that confirms that.
You don’t have to look too hard to find articles indicating that Indian national pride is a factor here.
A German pilot can go berko and it’s quickly accepted,the Indian press seems to have an inferiority complex and takes offence that the “western” media can even hint that the crew might have caused this disaster.God only knows what happened to the Chinese 737.
However, I am confident that the Indian investigators will eventually disclose the probable cause amongst all of the implausible options
@Grubbie:
When racist views have been a major part of your recent history, yes you are going to be sensitive to that. Its not something I have had to face or deal with but many of our citizens have (and yes I have had those conversations with them and it can be an is chilling).
What we can be is understand the reaction and accept it is not correct.
I am impressed with the Indian AHJ getting this out which quells the 787 issue.
Yea ll the spinners take the data set to weird corners and fail to realize or don’t care this is a preliminary report and its done its job. Sorted it to the direction of cause.
I am sure all Boeing pilots with those switches are now going to be extra vigilant on the switches and any issues with them regardless of them not being the underlying cause.
It may prevent an inadvertent engine shutdown.
Some Indian aviation safety experts are even pointing to the pilot sabotage hypothesis as the possible ugly truth based on the fuel switches position https://www.ndtv.com/india-news/air-india-plane-crash-report-aviation-expert-flags-pilot-suicide-angle-amid-air-india-crash-probe-8864239 However, a basic profile outline of Captain Sumeet Sabharwal brings out that he was in his mid-50s, was not married and was living with his 88 year old father. Post crash news reports on him further reveal that he was almost on the verge of taking a break from flying to care for his ailing father. Even his neighbours confirmed that he was often seen walking with his father in his residential society lawn.
https://www.hindustantimes.com/trending/pilot-sumeet-sabharwals-last-promise-to-ailing-father-before-air-india-crash-wanted-to-quit-flying-and-come-home-101749812628348.html
This fact about him is a clear contradiction to the pilot sabotage hypothesis as why would a person so deeply attached to a parent contemplate and undertake a suicidal act. The flying officer Clive Kunder too had a very regular psychographic profile hailing from a financial well to do family with parents settled in Australia. Further, he was about to get married in August this year. https://indianexpress.com/article/business/air-india-171-pilots-captain-sumeet-sabharwal-first-office-clive-kunder-mumbai-10122662/
Lastly, the pilots actually veered the aircraft away from a highly populated residential block, after they issued the mayday call, to minimize loss of lives. Why would someone on a hypothetical suicidal mission, owing to presumed psychological issues, do a sane act like that. It’s again a contradiction. Maybe someone beyond the pilots, but from Air India internally, could have tampered with the fuel switches setting before the pilots boarded the 787. However, the pilots would have seen that as part of pre-flight checks for sure…
A seriously depressed person is very hard to read from the outside. Their brain chemistry becomes very heavily weighted toward the negative. If you don’t believe anyone cares or will help you, then you don’t talk about your problems or internal feelings with other people.
That’s why talk therapy is effective, other people can identify the negative weighting that you cannot perceive yourself, and present a more hopeful and optimistic viewpoint.
Most of us engage in talk therapy all the time with our friends and family. Humans are social because it’s an evolutionary strength that counterbalances our ability to imagine negative outcomes. It’s not so negative if other people are surrounding you to help.
However if a person becomes isolated, then that mechanism is missing and the negativity can spiral. Especially if the perception is that the people closest to them either won’t or can’t help. It doesn’t matter if that is even true or not.
That person is at risk for harming themselves or others. Almost all the school shooters fall into that category. What seems irrational to us, is rational to them within the distorted mindset they have developed. But it may be completely invisible from the outside.
Aerobuff presents the classical phrases and it does not cover this situation let alone any other one.
Flip the script around, a man is looking at a huge change in his life into one of the saddest depressing situations in dealing with an aged parent.
How each of us internalizes the life situations should never be attributed onto anyone else, you can only speak for yourself and only if introspective. Equally no one knows until they are faced with any given situation, predict all you want, human beings are not predictable.
We also get the noble pilots steered the aircraft away. If anything it deviates left a bit and hit more buildings when there was some park of some sort to the right.
They had no control and there was no intentional right or left deviations stated. If it moved off trajectory as determined by Engine 1 shutdown first. It might have come back a shade right as Number 1 engine is starting to respond to re-light. That is purely speculative.
FDRs will have all control movements and other than an estimate of how nose up it was, no trajectory data. No controls data was released. We don’t know but we will know eventually.
Its possible one of the pilots tried but its more probable of no control nor altitude to do anything with regardless.
To clarify, I was just making general observations based on school training for active shooters. I wasn’t speaking about any specific circumstances for this case.
That training was partly on evasion, but more importantly on the psychological profile, and the fact that you can’t necessarily spot an impending action. People are generally surprised when it happens.
However there are methods of prevention. The staff was encouraged to look for isolation behaviors, kids that were excluded and not participating in class or school activities. The emphasis was on inclusion, giving them welcoming social opportunities so they don’t view others in the school as targets or as irrelevant lives. That can make a difference in arresting a negative spiral.
Regarding TransWorld’s comment on the Captain’s psychological profile, it does not factor in the vast cultural differences between the Collectivist cultures of the East and the Individualistic cultures of the West. In the Eastern cultures, it is not considered a burden to take care of an ailing parent and is rather considered as a responsibility as familial bonds are relatively much stronger than in the West (no disrespect here) providing a much stronger social & psychological support. Since the crash happened in India, we have to apply the Eastern cultural lenses to analyze the context and put the narrative into perspective. Seemingly, there’s more at play here despite the fuel switches evidence being stacked against and pointing towards the pilots.
Fair enough and I concur in regards to different cultures. I expressed it in terms of my culture and am in no way or should assess theirs.
Human beings do things and no culture is exempt.
Culture wise I heard the same argument in regards to Egyptian 767 but the Egypt Government who refused the findings. Did not happen, against Arab culture etc. You could interpret the CVR two ways which is another reason for Video.
That said, the FDR showed FO with full down input and the Captain with full up.
It was clear what happened, and again you always use corroborating data in the flight path of the aircraft reflected exactly what the FDR said the input were doing.
I do not have the answer but if the Throttle control quadrant includes the Engine control switches (shutdown/run) its been replaced twice.
“The scrutiny of maintenance records
revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023.
However, the reason for the replacement was not linked to the fuel control switch. There has
been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB.”
Some inference but not stated above.
Maybe someone around here can judge. I was a bit irritated when I read the Preliminary
Report, that the recordings of the CVR weren’t printed as quotes (like they’ve been recorded) but as „reported speech“. Is this „common practice“?
It leaves some room for interpretation. And indeed there are two versions being reported in the media: „Why did he cutoff?“ vs „Why did you cut off?“ This seems to be quite a difference to me (possibly) and it’s pretty unnecessary.
Any thoughts to maybe help clarify this?
First, the conversation may have been in Hindi, so we are getting the English translation, which may vary a bit with the translator.
Second, if there is a potentially separate criminal investigation, then AAIB might not release evidence that would compromise that investigation, such as direct quotes.
AAIB has played this entire incident very close to the chest, so there’s a lot we still don’t know. But they do seem to be complying with ICAO rules for accident investigations.
ICAO only requires an ADREP format for the preliminary report, and they don’t require it to be made public. But their guidance for high-profile incidents, is to publish the report, expand it to a written format, and conduct a briefing. They’ve done two of these things thus far. The briefing may follow next week, we’ll have to see.
It’s not the NTSB standard, but it is more than compliant.
100% Concur.
Those of us interested in what happened vs driving an agenda
It got the basic important information out in that it was not a Boeing or GE issue that needed to be addressed (argue all you want about throttle idle and then shutdown etc)
Its not perfect and I don’t think it was intended to be per Robs take.
The range of deliberate actions per what was going on is wide. Two deliberate OFF and then two deliberate ON points in a direction but only points, it does not say.
We may never know. Even with Video all you can say is who did what.
For now it was done and deliberate is the critical information. Deliberate does not mean any logical control a pilot would normally have.
I don’t know whether ur referring to my post with „driving an agenda“. For my part I sure don’t.
I just wanted to know whether it’s „normally“ done like this (not printing the CVR recordings as they were recorded but „describing“ them using ur own words) and thus (be it on purpose or not) leaving additional room for speculation where it’s for sure not necessary.
As far as I know the only source for this is the preliminary report and it can be interpreted in different ways.
I found some additional information on the Boeing switch service bulletin.
The switch has a rotating cap feature that can be used to convert it from a standard toggle without lock, to a toggle with lock. If the application is for locking behavior only (as the fuel cutoff switches are), there is a key inserted to prevent rotation of the cap. It then can only be in the locking mode.
Apparently for some lots of switches installed in the 737 prior to 2018, this key was missing. The switch was still installed with the lock active, but the cap could be rotated to defeat the lock.
The service bulletin was to inspect the switch for the key, and if missing either install the key or replace the switch. Boeing supplied the replacements on request.
Although the lots were only used in the 737, Boeing recommended all aircraft that use the switch be inspected, because maintenance sometimes swaps parts. But the bulletin was not mandatory.
This means in theory, AAIB should be able to inspect the fuel cutoff switches for the key, or twist the cap to see if it will unlock.
Rob:
Thank you, I can understand how it works.
I have a mind zark as to why you would make it that complex and provision to make it different. It would open things up to mistakes.
Maybe something they will address but does not seem to have any factor in AI 171.
I believe it’s a standard feature of the switch. You can order it as key locked, key unlocked, or unkeyed convertible, by different part numbers, for your application.
I have seen the convertible switches in other control applications. The procedure was you could move the switch freely between on/off, but in certain circumstances you were to twist the cap and lock the switch in position.
I get that but for a critial application, no.
Each switch should be no different than another and none should be common to anything else in a cockpit.
It saves a miner amount of money but just to security sake, no.
Frankly that is chilling.
If the fuel cut off switches were moved through the use of manual force, then the normal assumption would be that any action was completed by one of the two pilots. However, we do not know how many other pilots or crew members, if any, were occupying the jump seats. If these seats were occupied then by who and for what reason ? The very fact that the switches were recorded as being moved, in rapid sequence 1 -2, to the cut off position, with a one second delay between the two actions, would strongly indicate to me that these were activated manually and by someone who is used to shutting down the engines in rapid succession. It is typical of a swift shut down action by a pilot at the end of a long day….almost automatic. The probability that both switches failed, independently, or moved in sequence, through their own accord, one second apart is too remote to even contemplate. As an aside, I have often thought that putting these switches so close to the throttle quadrant, in an area of the center console where hands and forearms routinely reach over and cross over the top (to either cross tune radios, select flaps, raise spoilers etc) was not well thought out and that, similar to the design by Embraer, they should be placed under a spring loaded flip up guard or moved out of the way completely. Despite their spring loaded mechanical lock design, it seems utterly nonsensical to me that, just a few centimetres to the left, are the stab-trim switches which are mechanically guarded. Since the introduction of electrical switches, and the removal of cable actuated valves, the physical size of a lever or switch in the flight deck has progressively become smaller and smaller….but their resulting action is just as effective but infinitely more system widespread. I sincerely hope that the FDR and CVR readouts are published in full so that the industry can learn and minimise the possibility of a similar future event, however it was caused.
There is no evidence of anyone in the jump seat from the preliminary report. There would be evidence if that in the CVR . The report says two crew in the cockpit.
As far as the switch positioning, the ergonomics are that you group all the like controls in the same physical space. That is more or less the standard in design. All Boeing aircraft use that layout.
They are not in a position where the crew arms are crossing over them, they are behind the seat backs. As Juan Brown demonstrated in his video, the only scenario was if the captain allowed his hand to fall backwards off the throttle. But that could not move a locked switch, so it would have to be unlocked. And in that case, it’s not explained how he could not know he had moved them
The stabilizer cutout switches are guarded on the 787 because they aren’t supposed to be used by the pilots unless instructed by EICAS message. The 787 has multiple redundant safety systems to control the stabilizer automatically, including uncommanded motion and position disagree. If those systems fail, then the pilots are instructed to use the cutouts. That matters because there are dual actuators, so pilots need to know which one to disable.
@Rob:
As noted below, I share Oliver S take. This is discussion not criticism.
Miner note, they are not behind the seats, they are parallel or even a bit ahead or hand positions as the throttles need easy access forward of the pilot.
The STAB controls are not engine related. They are still there. Hard call as its also a quick need if it arrives and that is a good location in that regard though more awkwarder for the FO.
While its Boeing take it does not mean the best practices. Boeing had the FLCH Trap on the 777. Mode change should not cancel out a base protection.
Just need to be factual in the discussion. The crew arms absolutely do not cross over those switches in a manner that invites accidental activation. And there was no one in the jump seat.
People here can choose to be non-factual, but then others also can choose to point it out.
You were here for the 737 MAX discussions, you saw how narratives get rolling once misinformation is introduced. It’s best to nip that in the bud.
I agree though with some its pointless.
Fully spot on the Shutdown/Run switches are in a pretty unique location in regards to hand motion.
I just don’t like where and in proximity to anything as the throte4ls and flaps are used all the time.
Using common switches that can be changed adds to it.
I don’t think it needs to be changed but in the future aircraft I would look at a different location and totally unique switches that have no optional features.
@Rob: I noted that the throttle quadrant had been replaced twice.
Does that also contain the Shutdown/Run Switches?
No I am not giving any credence to the Switches being a problem, just curious on two replacements of the quadrant, some kind of issue that was not getting sorted would be my take.
One area I disliked about my first flying was the use of fuses. If you lost a system, you had to decide if it needed reset (flaps in one case) and rob a fuse from another circuit.
The next generation of Cessna used CB. I thought it should have been CB as soon as the tech was viable.
That is the kind of thinking I did and looked for.
Yes, the quadrant would include the switches, so they would have been replaced. Unless maintenance did something funky.
@Oliver S:
Fully concur. Only adder is 3rd person which has some possibility but if there was, I would think that would be noted to allow action by AI and other Airlines. Stranger things have happened though.
The Stab guards are more what I worked with if a switch needed to be guarded. And full on the busy area and proximity of those switches in that location. Not a setup I like to see certainly not with the consequences those switches create when moved.
In response to the preliminary report, FAA & Boeing have notified civilian aviation authorities & airlines that the 787 fuel cutoff switches do not pose a safety of flight risk.
https://www.reuters.com/business/aerospace-defense/amid-air-india-probe-us-faa-boeing-notify-fuel-switch-locks-are-safe-document-2025-07-13/
I am not accepting this had anything to do with the crash.
But it is an odd bulletin, why even put it out if there is no action needed?
If the lock is part of the design, then it not working is an issue though it may not be deemed a risk issue.
Frankly if a problem negates the design, then it is an issue.
I suspect as a pilot I would check that function (aka the vertical lock) with a gentle movement to off to ensure it was not failed.
The aircraft checks may have that as a check item as well.
The bulletin without explanations leaves things rife for conjecture. Some will grab onto that and it does not help if its not in context and why its not an issue (or deemed not an issue).
Aircraft are that odd aspect that everything works out of the factory and the first pax flight, you can have all sorts of things not working aka the MEL. Either its needs to work or it does not and reverting to backup even if redundant is a bad practice.
I will note that EASA has caused FAA to revisit cert process, documentation etc.
All in line with better safety and not some of the FAA past practice of just signing off (787 Battery) on Boeing word.
Certainly its worth a look. Two switches identical other than a function locked or now could get into the system and you have an issue.
It probably would be found but probably is not a sure thing.
Going forward its something I think should be changed.
All switches check, cease produion of dual possible switch and make it a single funtion specific switch for that use.
Its an easy change to add a layer of safety
My guess is that crew would report a switch that didn’t lock. And also that a turn of the cap is required for them not to lock. And that apparently there were no actual instances in flight.
My feeling is that this service bulletin, like the one from GE on EEC microprocessor soldering, will end up being a distraction, and not relevant to the accident or the investigation.
@Rob:
I think you are right about a notify.
It takes nothing let alone a snippet to get some off on a tangent. So this is grist for that mill, but the FAA could have snuffed it with some detail. People are not
accepting, take our word for it. Too many times we have been hosed by that.
What you and I assume is understood non tech types do not. In this case they will be a very complete examination of the Switches. Not because they suspect them, but as part of through.
I was impressed when the NTSB got down to a Contact issue on the Dali disaster (6 dead). Having worked with those types of switches, it was yep, I see it. Talk about an obscure trigger for failure. They obviously had good forensics on that.
My take though was on a higher level that any vessel that can damage a bridge should have tugs attached going under the Bridges (NY has that in place on at least6 some bridges).
That engine failure could have happene4d to anyone and it was a matter of time.
Clearly they could have run a split bus and the emere4cny system up and running.
Lack of will to do the correct thing to protect bridges (and in turn people on them).
Yea it all cost a bit more like we are not paying anyway. But if all are required to do it then its a level field and place4s like Baltimore can’t go cheap trying to appeal to shippers.
Split bus and backup system on line would give a lot more scope and coverage and in the case of the Dali, a bit of steerage could have changed patch enough to miss the bridge or glance off the support.
While its not fully effective, with full power on you can also fire up the bow thruster and anything added can avoid that fatal aspect.
It always was my philosophy that we can do better now matter how good we are, do or respond.
The Top Gun format was what I came to identify with. Full scrub, no ego, what went wrong more than what went right (if anything)
Ergo, I can question the Switches and a possible issue and also understand they were not a factor.
So I don’t like the location and I do not think they should be able to be converte4d from one function type to another.
I think its worth noting the kind of denial that goes into this regardless of the facts. The following tries to lay out a case for “other”
https://thefederal.com/category/business/flight-insight/pilot-error-boeing-ahmedabad-air-india-crash-fuel-cut-196721
The flaw in their illogical is that this has nothing to do with human factors and reactions. You don’t know how long the Switch mover was poised to do so, you only know a Switch was moved per the timeline (Left). A second latter, Right.
I doubt the Switch registers a gate lift. And as this is NOT a reaction, its a pre planned movement, it can be done fast.
The other pilots reaction is fully in line with startle, shock, assess and reaction.
And I can remember as a kid the I did not do it thing. Sometimes you got away with it, worth a try. If my folks had proof, out it came, oh, yea.
I have seen people do something and deny it.
There are people claiming 1 second apart is not possible, and others claiming that it is. And videos demonstrating both. I guess the investigation will resolve it.
To me, the clincher is the engines were normal until the switches were thrown, and there was no evidence in the FDR that the switches weren’t thrown (the contacts moved together).
I had a case of driving dumptruck and an issue with a failed seat belta I reported.
Latter the spread foreman pulled me over for something, I popped my seat belt and and out of the cab. He accused me of not using the seat belt as no one could open it that fast.
I had rolled a Bronco some years before, I had my seat belt on as did my brother, both of us were good because we did.
I never drove then or now without the seat belt. He was convinced I was lying. Shrug. Maybe not everyone could do it, I certainly could. Well practiced motion.
I believe the facts.
There is another possibility, however remote (and no, I am not a conspiracy theorist):
Most of the comments above indicate that we believe that the pilots did in fact, move the switches – from run, to cut-off, then back to run.
We take the pilots statement (one of them, anyways) as purposefully misleading. We assume that one of them, did in fact, move the switches.
What if we take the pilots statements at face value? The switches were never moved? They stayed in the run position, throughout?
Firstly:
Could the pilot who asked the cutoff question, received the information that fuel was cut, in another manner, aside from looking at the switches?
Secondly:
Is there an electrical manner, in which those switches stay as they are and through some freak fault, switch the engines on and off, as happened during the flight?
I agree with most, that the CVR conversation probably clears all this up. But absent that and given what we have been told…it is possible. However improbable…
The engine cutoff switches generate an EICAS message. So they could and likely would have known without looking at the switches.
There is no electrical fault that could simulate the switches being thrown, given the 4 sets of contacts of which multiple are monitored by the FDR.
Since there two fuel valves for each engine (engine-side and aircraft-side), only the cutoff and fire switches have the ability to close both valves. I’m sure AAIB would have mentioned if there had been an anomalous closing sequence.
The language AAIB used was the switches “transitioned” from RUN to CUTOFF, so I don’t think there is any doubt they moved. But AAIB did not draw a conclusion as to how they moved.
https://i.ibb.co/4ngwYHmT/B787-Fuel-Control-Switch-Schematic.jpg
B787-Fuel-Control-Switch-Schematic
someone made this available ( via a.net )
second level of the action chain is bistable relays with push/pull coils. ( now where is the recorder tap ? at the fuel control switch level or further down behind the second level actors? )
“transitioned”
The top level switch “commands” action on the secondary level.
( all IMU, IMHO )
In English, please. For us dumb, non-engineering types….
But from that schematic, the switch itself is directly monitored by the FDR. So I don’t think there is any doubt that the switch itself moved.
No.
the way it looks it is directly monitored by “core system”
you don’t let a flight recorder log data items by having them passed through another system first. ( Well, that would be good design practice )
we don’t know where the tap for that signal is located.
Note that the “common core” is the aircraft network. The FDR is recording off the network, that’s standard practice.
Accuracy is assured by following the action sequence. Switch closes, at least two sets of contacts are monitored, actuators change state, valve positions change. If all of that is consistent, then the data are correct.
Also in this case, two separate and independent switches and systems, same behavior in each, 1 second apart. That can only be from the switches being moved.
You would need 4 identical failures across two systems. I’m sure AAIB would have confirmed all of that, and probably replicated to be sure the signal sequence, timings and patterns agree.
Plus they have the recovered switches to also test.
I don’t think there is any doubt here that the switches moved.
If the FDR samples are nothing more than messages taken from the internal network ( as you stipulate ) significant trust in them is lost.
Once through computer logic anything can be the outcome.
i.e. this would fully mask software issues.
( computer had a funny moment or was involved in the nigh improbable bad outcome of a rare race condition of events
and posted “Fuel Cut Out” without cause ? )
Uwe, I’m sorry, but that’s just crazy.
Modern airliners use networking just like modern buildings do. There is no loss of trust in that method, because it’s designed with redundancies and safeguards to be able to determine the validity if the data. Just like any other network, only with greater assurance since it flies.
The EADR in the 787 (and in the A350) capture thousands of data sources in the aircraft. You could not run thousands of individual cables to the recorders.
Plus these units are certified by FAA and EASA who know that accident investigations rely on them. I have never heard your claim from anyone, anywhere.
Agreed.
I had a network with hundreds of controllers on it. We lost the data link a few times. We never had anomalous information pass through it.
The controllers themselves had checks on the sensors that they had to be in a specific range of possible. If not, that information slots was ???????????
While we did not do it, you can filter out a sudden jump out or norm using the other sensors.
The Aircraft networks are built and programmed to not get bad data let alone bogus commands.
You can keep trying to come up with weird illogicals or accept that it was done.
With the Throttles in TOGO mode, you also have the alarms coming in on the engine panel as soon as those values drop off be it N1, N2, bleed pressure, EGT as well as generators and hydraulics dropping off line.
No lack of alarms. Quick work to figure out what the sources was.
I agree – it is a longshot, and the investigation will most likely reveal that someone threw the switches, then denied it.
However, to say with 100% certainty (with the investigation barely a month in and the aircraft still in pieces, all over the place) that some kind an anomaly (electrical, computer?) didn’t occur – and that the only path to those engines shutting down is either 1) Those switches or 2) Fire switches, might be premature. However unlikely.
But with the amount of wiring in aircraft, today – with such a heavy reliance on computerization and electrical demand…
For example:
“On August 14, 2013, the media reported a fire extinguisher fault affecting three ANA airplanes, which caused the fire extinguishers to discharge into the opposite engine from the one requested.[411] The fault was caused by a supplier assembly error.[412] ”
Now, if the fire extinguisher was fired into the wrong engine, people could easily say, “It was the pilot – he pulled the wrong switch. Has to be. No other way.”
All I’m saying is, what if?
Crazier things have happened.
The thing is, though, the switches moved. That doesn’t rule out a contributing electrical fault of some kind. But the incipient action was the switches being thrown.
Its a matter of possible crazy things and impossible.
We are talking impossible down to .00000000000000000000000 to the 100th exponent.
It does the situation a horrible disservice to try to find impossible ops. We might as well have no FDR or investigations if we keep going to the conspiracy area.
Going there is nothing more than a technical conspiracy theory.
@Transworld
“It does the situation a horrible disservice to try to find impossible ops. We might as well have no FDR or investigations if we keep going to the conspiracy area.”
Fail. Massive projection, as well.
You ignore details included in an official report. Ignoring facts – THAT…is the textbook definition of conspiracy theory.
What facts, you ask?
“In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.”
That is in the report. Yet you ignore it, like it never appears. Essentially deciding that…well…you know best. Someone must be lying, according to you. Dismissed it because you don’t want to hear it.
Who would YOU want investigating a crash like this:
1) Someone who looks at every possible explanation, then runs down every lead, no matter how unlikely?
2) Someone who dismisses a potential explanation, calling it crazy and impossible? Even when some evidence is included, that makes it a potential outcome…
You don’t even see the blind spot, in your logic.
@Rob
Finally – someone else who has enough of an open mind to consider the possibility.
Let me ask you this:
“That doesn’t rule out a contributing electrical fault of some kind. But the incipient action was the switches being thrown.”
Could there be an electrical fault (remote as it may be) that could cause the valves to close?
I think we’re talking about (as John Court put it) something a Boeing software engineer would look at. Along perhaps with an electrical engineer. Maybe more than one.
Yah, it’s a longshot and not very likely, but to ignore it out-of-hand?
It’s the whole “The pilots are presumed to be guilty”…
(which yes, as Duke put it – 95% of the time, that is the case. I agree.)
Is this one of the 5% times?
I’m sure AAIB will work to rule out all possibilities in the fault tree.
As far as I know, only the cutoff and fire switches can close both engine-side and aircraft-side fuel valves. The automated systems only have control of the engine-side valve.
@FrankP:
You are trying to put my comments into a box.
Addressing the Conversations: Those are human beings involved and all human beings can do the unbelievable or make mistakes. As there is no corroboration evidence in the he said he said, I am discounting the CVR unless its linked to specific actions. There are lots of possibles from a real reaction to a shift of the blame and a denial.
The solid facts are that the Switches were turned off and then back on. I can have a suspicion of who turned them off, its possible the same person also turned them back on. They may be able to sus it out but Sans video, who did what may never be known.
The Switch movement has been corroborated by other hard data, engines shutting down, then engines going through re-start.
Equally denial is a human thing even when someone not only did it but was seen to do it. So no, I put no weight on that other than I would be looking for corroborating evidence if there is any.
They will know which channel the voices came over and who it was that said it. Unless someone has a hand moving another switch that is recorded at the same time as the Switches went off, I don’t see anything provable.
I do have faith in the Switches. The Caveat is if one or unlikely both were the wrong type switch, then you have to test how much force it would take to actually move them.
No ones hands should be down in that area at that phase of flight.
Its very likely to come out that the PF had a known position for his left hand, be it on the Yoke or the throttles (both are a standard and there does not seem to be an Airline dictate though that can also change airline to airline).
I was taught to have my hand on the throttle and I suspect if I had done that kind of flying that would be my MO.
Prior to that it is standard training for the Captain to have his right hand on the throttles to V1. then into his lap as no more rejection possible (at which point the FO can move his hand onto the throttles)
As there was NO comment on the Switches being suspect, I go with deliberate.
The details if they can sort them follow from there, including testing of the Switches for the final detail.
Despite the bulletin they did not put out an edict to check switches.
That is being done anyway under abundance of caution.
The one aspect we needed to know, the Switches were moved and its not a system issue be it Boeing or GE.
That does not stop the human part of the tragedy, but it does clear up the area that tragedy came from.
That’s the most insightful comment so far. A Boeing software engineer might be able to expand upon it.
Thank you.
I would tend to agree with some, who say that some 95% of the time, it’s due to the pilots.
But this:
“In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.”
Demands that we at least consider the possibility, that the pilots did not hit the fuel cut off switches.
I guess we’re in this time and age, where facts and science get ignored, when they don’t line up with the narrative.
It’s not a likely outcome…but we shouldn’t dismiss it outright.
I’m encouraged that we at least got an unbiased preliminary report. This report is not the result of the formal investigation but a basic recap of the data captured from the observable and the FDR/CVR’s that were both recovered intact. It assigns no blame and concludes nothing other than the objectively true facts surrounding the crash. There is no “narrative”, there is only the objective truth. Anything other than the truth undermines the entire commercial aviation enterprise, making us all less safe.
Off topic, as this is from a different accident, a refueling incident between a KC-46 and an F-22.
Damage to the tail indicates this was probably another breakaway incident with the receiving aircraft, that forced the boom up into the tanker. That is usually what wrecks the boom.
If so, this is the third such incident in the last 3 years. The other 2 were with an F-15 and an F-16.
https://www.facebook.com/AFamnncosnco/posts/inbox-mcconnell-tail-that-landed-at-sj-for-the-boom/1064789229116019/
I saw that. That boom is still stiffer than it should be as the USAF did not fix their spec on it .
USAF is terminating the A-10, have to wonder if they will fix it.
Yeah, that whole thing is crazy. All that expense for one aircraft that USAF doesn’t even want.
I’m hearing from Boeing that it will still help the F-16 though, which sometimes needs afterburner to stay on the boom. That won’t be necessary with the new hydraulics, which can adjust from 1400 to 600 pounds connection force. So maybe that’s why they are continuing.
I had not read anything about adjustable, makes sense, hate not seeing real tech info when they discuss things.
F-16 going into AB to stay on the boom sounds nuts. Has to be a horribly loaded up F-16. At one time it was a very clean bird.
USAF is all about crazy. I find it amazing they ever get anything done. Even sans the current admin, they changed their assessment every time a new guy came in, no continuity. No questions drones are changing this hugely.
Now its just willy nilly cuts like the E-7. The one statement by Hegseth was a horrible joke. E-7 is not survivable! Ok, long range missiles are getting to be an issue for tankers and AWACs type.
But if an E-7 with its altitude and speed is vulnerable, an E-2 is far more so.
Odd part is they are putting money into the F-22 finally, that is still the best Air to Air bird on the planet.
I know someone at Northrop that works with the E-2 program. He told me that the E-7 survivability issue has some merit, but is not the true driver.
He says that in meetings with DoD officials appointed by the Trump administration, they expressed concern about American systems that are largely focused on overseas deployment. They view that as unnecessary and possibly dangerous, if it entangles the US in a foreign war.
Based on this, Northrop made a big sales pitch for the E-2, which is much more suited to US defense and is difficult to deploy at long ranges, outside of a carrier. He said they snapped up the idea.
I have no way to evaluate that narrative, but I know Trump leans more towards isolationism, so it seems credible.
I personally think they still need the E-7. It will be some time before satellites reach replacement capability. But the E-2 is ok as a stopgap, better than nothing.
You could see this one coming, they had to do it.
https://www.reuters.com/business/aerospace-defense/south-korea-preparing-order-airlines-check-fuel-switches-boeing-jets-2025-07-14/
If you put something out there with no detail, not to mention, a part can slip through if it looks the same and gets labeled the same or even just put it.
The Florida shop failing to check their AOA they sent to Indonesia. Some bogus parts have gotten into the system.
I would not be surprised if NTSB come out with a directive not to have options on that switch.
A key piece of info here out of same article.
“But it also said maintenance records showed that the throttle control module, which includes the fuel switches, was replaced in 2019 and 2023 on the plane involved in the crash.”
Have to put in a caveat, unless cross check a wrong switch could have slipped in anyway (not likely let alone two but that is the sort of extra coverage aviation deserves or should have)
In all reality there is probably a check on switch function if not done by pilots by maint action but extra layers are good and in this case its a very easy check.
It should be a regular one unless they remove the option from the system and even then its not irrelevant.
It will be interesting to see if any reports of switches not function or wrong switches installed.
Again the switch still requires movement unless it is horribly worn out and any oddity would normally be written up.
The Swiss Cheese model is all about holes lining up so should is not the same as is.
India orders airlines to check fuel switches on Boeing jets
“The 2018 advisory urged – but did not mandate – operators of Boeing models to inspect the locking feature of the fuel cut-off switches to ensure they could not be moved by accident.
Air India had not carried out those inspections because they were not mandatory, the AAIB said in its preliminary investigation.”
article has good pic of fuel switch
https://www.msn.com/en-us/money/companies/india-orders-airlines-to-check-fuel-switches-on-boeing-jets/ar-AA1IAaEz?ocid=winp2fptaskbarhover&cvid=e8bd65346fe745f19210d25ed5afac69&ei=62
Repeat of what has been posted. Curious if you even read posted material?
I had seen the Switches early as the two Switches aka fuel cutoff was one of the few things that can cause both engines to shutdown.
Early question was if they required lifting up and they do.
Bad idea to mix up Switches of the same type that can be built differently.
I am all for a common Shutdown/Run Switch but it should not be used for any other purpose let alone any other action type.
This is very interesting from VAS aviation. He shows Boeing, Airbus (pretty much t he same) and the Cessna Citation Engine Shutdown/Run systems which is different from both. All of them work obviously.
https://www.youtube.com/watch?v=CoTsvyA-bRw
Great spot TW, thanks.
That video demonstrates exactly what I posted earlier today.
IMHO a much better implementation of a fuel cut off than the fuel switches most other airframers use.
The Airbus switches look like they need a bit more “lift” before they will clear the gate than the Boeing switches in that video (may just be the angle of view though), the Citation system just looks better thought out.
I presume that the Citation has a breaker of some similar means to cut the fuel to the engines if there is a physical issue with the thrust levers.
Thank you, normally VAS does ATC replay. Kind of a treat when he does an adder like that (its really bad as to why it came about, so many lives lost and impacted)
While I like more remoted shutdowns the Airbus and Boeing are safe. As noted, I have an issue with a Switch that can be multi mode. That in my view is just bad practice for all the reasons noted above.
I have not seen if the valves are fail safe (open).
I also ackno9wledge, there are so many branches to each decision on this stuff that you can get lost of the logic and in the end a decision has to be made.
I was impressed that despite the total elecrical loss going into San Antonio, the engines kept running. That is very good engine redundancy when all else goes south.
On the 787, the aircraft-side low pressure valve located in the pylon, is fail-open, so a power failure does not shut off the engines.
However the engine-side high pressure valve, is fail closed because of the redundancy built into the engine, which has its own fuel pump and dedicated alternator. Further each of the twin FADEC’s have a backup battery that powers the valve. It’s something like 30 or 60 minutes (don’t recall but it’s part of ETOPS).
Thus if the FADEC is lost, the engine is shutting down anyway, so best to close the fuel valve.
Makes sense.
You also show how there are layers within layers of safety and logic.
Its a reason MCAS 1.0 was so bizarre as they did not do even the basic cross link of AOA let alone the better programing.
It is not necessary that one pilot visually saw the other physically move the fuel switches. He could have reacted to the sound of engines decelerating. In fact, that would be an experienced pilot’s first cue.
Secondly, it is not necessary that pilots physically moved the switches to cutoff and back to on. The TOGA or TCAM software could have erroneously commanded cutoff and reverted it 10 seconds later. The flight data recorder knows nothing about the switches’ physical position. So the fuel could have been cut off AND reversed automatically without the physical switches ever moving. They were found in the RUN position after impact.
Possible automatic software operations must be simulated, including failures and contingencies, and studied. Only Boeing can do so as the source code is proprietary, and Boeing has no incentive to do so – unless Air India brings a civil suit , or the dead passengers’ families bring a class action suit, against Boeing. Stay tuned.
Concise description of what Rob would like to hide behind a rhetoric smokescreen.
Thank you.
Some six years ago, no one ever imagined that a piece of computer software, (that pilots didn’t even know was onboard their aircraft), that in certain circumstances (however unlikely, like an exact bird strike) could overrule pilot inputs and fly the plane into the ground.
Yet here we are.
No…it is not very likely. If I was placing a bet, I would go with “One of the pilots is lying and one of them flipped the cut off switch”, as my choice.
It’s the most likely reason.
But we’re gambling with human lives here, not some of my disposable income. This should be run down and not dismissed. Just to be sure.
Just to clarify, MCAS did not override pilot inputs, the pilots had full control of the stabilizer at all times.
The error was in using the elevator to fight the stabilizer, with was a training violation as pilots are specifically trained that the elevator cannot overcome the stabilizer.
Also the MCAS malfunction left clear traces in the FDR, so it was known within a few days that it had initiated the upset that led to accident. I think the same would be true here, if there was a software error that led to an inconsistent state or action, it would be evident in the EADR, which contains far more data than an FDR.
Of course AAIB will run all possibilities within the fault tree to ground, which is their proper function. But at least at present, a month after the accident, there is no smoking gun, as there was with MCAS.
@Rob
You say: “Also the MCAS malfunction left clear traces in the FDR, so it was known within a few days that it had initiated the upset that led to accident.” So, why wasn’t the fleet grounded after the first crash? Why did the second crash happen?
The FAA was not going to do it because of the links into Boeing and the Trump administration.
I thought as did most, that a warning out would be enough to work around the issue. It was not.
Ethiopian had both the warning and the process both pilots had read.
That gets into some pilots might have handled it but two more did not and its more than time to ground MAX which China did first.
Most are afraid to go first particularly if its been identified and while not fixed far from the first time a problem has had a work around until they did fix it.
Oddly in this case I would have grounded the 787 until the cause was identified. Indian Authorities I am guessing had enough info to not call for that. Other agencies probably had the same informality.
Now my view is biased as to what happened with the MAX but I believe I was inclined to ground it because of the lack of AOA cross link.
The software and deg of movement of the stab as it came out was stunning.
The FAA Inspector General investigated this and published a report.
They found that after the JT610 accident the FAA had run a standard statistical analysis, based on the historical failure rate of an AoA vane in the 737 fleet, which was about once per year. A vane failure was the incipient event in the JT610 accident, so FAA presumed that another failure could produce another accident.
Then they factored in the mitigations they had ordered.
1. Boeing was required to update MCAS across the fleet within 6 months.
2. The FAA had issued an AD to airlines requiring them to insert new language in the QRH and FCOM, which described the MCAS behavior and how to respond to it. The AD required mandatory airline paper or electronic difference training on the new language.
3. FAA issued a worldwide NOTAM to highlight the new language and reference the QRH and FCOM changes.
4. The JT610 accident investigation found that the previous flight LN043, had handled the vane failure and MCAS activation correctly.
(although not the FAA, Boeing had earlier issued a service bulletin to airlines with the same information).
With mitigations factored in, the FAA found the statistical risk was acceptable to continue operations. The IG report noted that EASA ran the same analysis and got the same result.
After the ET3O2 accident investigation, it was found that Ethiopian Airlines had pushed the AD to the crew iPads, but had not alerted them or conducted the required difference training. It’s not known whether the crew saw the NOTAM.
During the accident event, the crew found the new language in the QRH, and executed it. However in the confusion, they neglected to reduce throttle after takeoff, which resulted in the aircraft over-speeding by about 100 knots. Thus they were not able to carry out the procedure, due to aerodynamic loading.
These facts were omitted in the Ethiopian accident report, which is why both NTSB and BEA wrote rebuttals.
Also Ethiopia presented an elaborate theory that the 737 autothrottle had failed to reduce speed, and that the over-speed could not be attributed to the pilots. Both NTSB and BEA refuted that theory as false, along with a few other false claims in the report.
Rob further up stated that it was due (3rd world) Pilot Error.
( not following the manual and B’s expectations )
( IMU, IMHO: the vagaries of MCAS realization may have been known internally at Boeing. it was defective over all design steps, you wait for the “steaming pile of S* hitting the Fan”. believable naivete has its limits. )
To clarify once again, what I said was that there was an accident chain that involved both MCAS flaws and pilot error.
I also mentioned that polarization was a detriment and a distraction, because it seeks to establish only one side or the other.
I can’t let this comment go as it is. In the Etheopean Accident, the pilots did everything by the book, then when they couldn’t get control of the stablizer manually, through the trim wheel, because the high speed trim motor setting of MCAS had put the trim so far out of normal, and they were at a high speed, they turned the trim motor back on, to try and gain control again. On the 737 NG the 2 separate trim switches operate differently. One is to cutout the autopilot commads to the ONE trim motor. The other to cutout the manual electric commands to the ONE trim motor. When putting the changes for MCAS in, they rewired the two switches, so either one cut out everything. You can’t cut only MCAS commands out. You are always fighting with it. There is no OFF switch for MCAS. There is only turning OFF the ONLY trim motor. This really perplexes me. Why there is no way to maintain manual electric control of the ONE trim motor, without MCAS involvement? You might be able to add one notch of flaps, and hope you don’t have too much structural damage at high speeds. I tried looking at circuit brakers to pull, but, I think it would require more than one circuit breaker, and who has time at that point to turn around and find the right circuit breaker? I don’t want to rehash the 737-MAX, but, couldn’t resist clearing up some MCAS design
logic.
Thanks for this correctly clarifying comment, RD.
While this is true, it was found not to be a factor in the accident, for two reasons:
First, the crew could have backed out the MCAS input to the stabilizer at any time, with the trim switches. It’s not known why they didn’t.
Second, they were already beyond the maximum speed of the aircraft when they attempted the trim wheel procedure, so it was not possible to manually move the stabilizer at that point. It was only possible with the trim switches, which they used only partially.
The BEA wrote in their rebuttal, that even without the MCAS problem, the unarrested over-speed likely would have resulted in an accident. Even if the aircraft had landed safely, it was stressed well beyond its limits, with control seriously degraded.
It should be noted that the throttles remained at take off thrust until impact.
“Even if the aircraft had landed safely, it was stressed well beyond its limits, with control seriously degraded.”
ROFL.
without the MCAS distraction they would not have had the overspeed issue.
throwing s* at dead people, none nicer.
Also note that the known “MCAS event they managed to walk away from” was solved by the supernumerary in the cockpit enabled by no other workload and apparently a bright kid )
No, Uwe, yet again you are making a misrepresentation, aligned with that also made by Ethiopia.
As the BEA explained in their rebuttal, the over-speed was a response to the AoA vane failure, which generated “Invalid Air Data” alerts, including airspeed.
Thus the crew did not follow procedures to establish airspeed, did not use their reference instruments, and ignored multiple warnings of over-speed.
None of that had any relation to MCAS. In fact BEA noted they were already on that path before the flaps were retracted, which was the activation event for MCAS.
Note that this is not my opinion, this is a finding of the investigation. It’s established fact.
@SH:
That has been covered. Engine shutdown is going to create a lot of alarms, what the order the MASTER alarm is, I won’t claim to know. But the PF would have seen it on the HUD and a glance at the main panel would show engines winding down, alarms galore as they were in TOGO.
He may have even triggered on the deceleration. Probably a combination of all of it.
Clearly he grasped what the underlying cause was, that was outstanding work in my opinion when it should never happen and no training for it.
@Ewe: Rob is not hiding behind rhetoric. There is factual and then there is a design aspect. I may not agree with where and how they went about it, but the AHJs made a decision based on their assessment.
We have seen the consequences of a locked cockpit door. No one gave any thought to other than hi jack actions. An induced crash may have happened before, we did not know it.
No hijacking attempts as far as I know since but a number of suicides. The middle ground would be for forward attendants to have an override code and accept that worst case someone tries to get it out of them.
Then the PF can maneuvers to upset things or the passengers and cabin crew and the pilot back there can take on the hijackers like the Pennsylvania 757. There are always going to be some pax like me that realize you got nothign to loose.
@Rob:
If MCAS in its lethal form had not been there, the pilots would not have been in that fix.
Yea, I understand there were clews etc, but for the average pilot, it was not acting per training and the PF was in information overload.
MCAS was a piece of garbage as implemented, plain and simple. Ethiopian pilot 0r pilots got caught in it as well and they had some advance information.
What they did not have was any time in dealing with MCAS ops in a simulator.
Line pilots are not test pilots. People like Sully are in a class and background of their own.
It helps to understood that one can hold both views at the same time, without contradiction.
The accident chain required the MCAS flaws, but it also required pilot error. Those are the facts most relevant to preventing a future occurrence. And that was the conclusion of NTSB and BEA. They did not fault or question the Ethiopian conclusions on MCAS. But they did point out the omission of the pilot contributions in their report.
One of the worst consequences of the 737 MAX accidents, in my view, was the polarization that occurred with people taking one side or the other. We saw that here and many other places. In the end that was only a distraction, it didn’t change any of the facts or the reality of what happened.
This is not true. The switches are directly monitored by the EADR.
The scenario that Uwe describes, would require identical failures across 4 sets of contacts and 2 independent systems. And AAIB would be able to identify those faults in the EADR data, as the switches having inconsistent positions among their contacts.
TOGA does not have the ability to close the fuel valves. And TCMA, as I explained to Richard, requires several conditions to be set, including bogie/truck rotational position, strut compression, radar altimeter, and asymmetric thrust. And it too would be observable in the EADR data, since it generates EICAS messages when activated.
Rob, you seem to know an awful lot about the inner workings of Boeing aircraft. Care to elaborate, so that we can properly weigh the source of the information?
It’s a combination of research by myself and others that contribute to aviation forums. Some are 787 pilots, some are engineers like myself, a few actually work for Boeing.
There are also people with access to the 787 service manuals. For example the schematic that was posted here was drawn up as a representation from the manual because it can’t be posted online.
Much of it is explained in incident reports, for example the ANA TCMA engine shutdown on landing incident described in detail the 787 weight on wheels (WoW) mechanisms and how they are different from previous Boeing aircraft, as well as the trigger conditions for activation.
If you do enough research, you can acquire a general understanding of how things work. There is a lot of published information on the 787. I wouldn’t claim to be an expert, but I’m comfortable enough to refute things that seem obviously untrue. I wouldn’t post things without some confidence in their credibility.
For the most part my background concurs with Rob though I do not have the depth of details he has or has access to.
I can disagree with some of the specifics because I think and have seen they are bad practices (a switch that can be converte4d to a different function is a bad idea and we see that playing out now with everyone doing inspections, you have to do it with the Bulletin out and the possibility of parts swaps so I will put that down as I was right)
Obviously we disagree on MCAS. Its not that he is totally wrong, but not knowing about it specifically and no tr5aining let alone the horrible triggers and major operation in deg per second, it was pure garbage.
When they re-wrote it, they did it right and the way it should have been in the first place. One of the worst setups I have read of in Aviation.
so your are the spout of a committee.
Who payrolls this thing?
Some people find it satisfying to go down rabbit holes to understand how things work. Engineers are particularly prone to this affliction because they literally have a vocation that is based on this concept. Sometimes it turns into an avocation of having to understand how it works.
When the MAX crashes occurred, an ex Boeing engineer who had a consulting business went extremely deep into how things worked. Did such a good job that he had to testify before Congress. Boeing made it sure that he was “muzzled” by numerous threats to him. One thing in particular was that the posted parts of technical Boeing documentation that Boeing considered confidential or copyrighted (or some such thing) would allow Boeing to pursue legal actions.
After the MAX episode, he has never posted anything of any substance.
There were many opinions on MCAS and Boeing and pilots, after the 737 MAX accidents.
But out of all that, there were also accident reports being reviewed by multiple investigative agencies, which determined the truth of what happened, and published it.
That is what engineers consider as the established factual record. I realize that laypersons are not bound by the same standard, they can select the narrative that best suits their beliefs, and insist that is really what happened.
But as I’ve said repeatedly here, none of that changes the facts, or the reality. Not for Boeing, not for FAA, not for NTSB, not for the airlines, not for any engineering entity that is bound by their profession to adhere to the facts.
@Rob:
I disagree on MCAS 1.0 so called opinion. Universally it was considered worse than garbage .
One pilot managed a MCAS 1.0 action (jump seat pilot as I recall)
6 did not (two on the jump seat flight, 4 total on the two crashes)
Nothing wrong with MCAS, its just a variation of speed trim (stick shaker) but the implantation could not have been worse.
You don’t write control programs for test pilots, you write them for the worst line pilot.
@TW, just a brief correction to your post.
In the LN043 flight that preceded the JT610 accident flight, the captain was confused by the repetitive MCAS behavior, but managed it with the trim switches. The jump seat pilot only reminded him of the procedure to disable the stabilizer and use the trim wheels. But that flight was never at risk for an accident.
In the JT610 accident flight, that same pattern repeated. The captain managed MCAS and stabilized the aircraft in a holding pattern at 5000 feet. It didn’t become at risk of an accident until he gave control to the first officer, who had not understood that the captain had been continuously correcting for MCAS.
In the ET302 accident flight, you are correct that neither pilot was able to manage MCAS.
@Rob:
I can accept that though the Jump Seat pilot clearly had his head in the situation and we do not know what might have happened if it kept on.
They might have managed it but its a major distraction unless you kill the stab motors.
Its one key I think a lot of people miss, its not MCAS 1.0 as bad as it was done exactly by itself, its the confutation it caused.
@TW Agreed, a design that confuses the crew is not a good design, and MCAS definitely confused the crew.
@Rob:
While the crew confusion was the lethal end of this, MCAS 1.0 failed in how it was implemented, horribly.
Failure to cross link the AOA sensors was the immediate gross aspect.
That was added to by their so called failure analysis that cherry picked AOA wear out vs damage from all other causes be it ramp or bird strikes.
What started out as a miner nudge became a full authority drive the Stab to its extremes at a high rate of movement.
That logic failure was as bad as the BOA 747 that retracted the flaps on a single input. Fortunately BOA was not fatal but one engine hickkup and it would have been. Boeing simply disabled the feature rather than correct it because it was not a flight safety issue, it was an operation thing.
There were many opinions on MCAS and Boeing and pilots, after the 737 MAX accidents.
But out of all that, there were also accident reports being reviewed by multiple investigative agencies, which determined the truth of what happened, and published it.
That is what engineers consider as the established factual record. I realize that laypersons are not bound by the same standard, they can select the narrative that best suits their beliefs, and insist that is really what happened.
But as I’ve said repeatedly here, none of that changes the facts, or the reality. Not for Boeing, not for FAA, not for NTSB, not fur the airlines, not for any engineering entity that is bound by their profession to adhere to the facts.
Additionally, AAIB as the investigator of record, has full powers of discovery at Boeing. If Boeing was unwilling to assist, as you allege, AAIB could enlist support from NTSB and FAA. NTSB like AAIB, has no enforcement powers, but FAA does, and they can invite DoJ into the investigation, as they did in the MAX accidents.
I’m not aware of any accident investigation where Boeing failed to cooperate or assist when requested. It would invite criminal charges, as we saw with the two Boeing technical pilots when their private text messages were exposed in discovery.
Agreed. Even if you go with its too public to hide, they are fully cooperating.
I admired Airbus on the AF447 crash. They kept at it until they had the data recovered and fully understood it.
I don’t like Airbus logic in some cases but it was clear what the failure path was an in that case, pilots not following their training.
Note where the energy is spent:
Airbus invested a lot into grocking the issue ( by recovery of the AF447 wreck .. )
Boeing seems to invest up front in distractions and other “destructive to finding truth” operations. cue Rob.
Actually the wreck was not recovered, parts of it were.
They also knew to a small area where it would be. They have scanned thousands of square miles of ocean with best info and still have not found MH 777 wreck)
People seem to think Boeing should do so, all the flight actions show there is nothing to be found aka aircraft system and its a human factors issue.
To be clear, the French government paid for the search and recovery of AF447, not Airbus.
@Rob:
I thought it was Airbus but I stand corrected, Air France and France jointly funded the 3rd phase that found it.
It is good to keep the facts correct
FR government financed ..
which is more than any actor in the US ever did?
Airbus did an extended flight testing campaign in Down Under to research the (changed) atmospheric conditions
( why increasingly in spec probes ice over )
Air France was the airline responsible for the accident. BEA was the investigative agency of record. So they were naturally involved in the recovery.
If you are implying the US has not contributed to the MH370 search, that is false. Only Australia has contributed more than the US, in terms of dollars and assets.
In the Air India accident, there isn’t much for the US to do but support the AAIB, if it was indeed an intentional act.
In reviewing Bjorn’s analysis, it’s evident that many of the unresolved issues pertain to the pilots’ actions and decision-making during the incident. The Flight Data Recorder (FDR) confirms that switches #1 and #2 were manually actuated, raising further questions about cockpit conduct.
This underscores the ongoing need for cockpit video monitoring. Currently, we utilize cameras in passenger cabins, galleys, and crew rest areas, yet the flight deck remains a blind spot during the most critical phases of operation.
Installing cockpit cameras that activate in response to EICAS warnings, vertical speed anomalies, or GPWS alerts is not a matter of surveillance, but of safety and post-incident clarity. This capability is long overdue. Resistance to this from certain pilot groups should be weighed against the broader imperative of flight safety and accountability.
In parallel, we must re-examine the role of existing safety technologies such as flight envelope protection and autoland systems. Should flight crews retain absolute authority to inadvertently stall an aircraft into the ocean, fly it into terrain, or cut fuel 100 meters above the runway? Or should the aircraft be empowered to intervene—at the last possible moment, if necessary—to prevent a catastrophe? These systems are not theoretical; they have been available and proven for years.
At a minimum, we must ensure that all pilot inputs are reliably logged and that cockpit video becomes a standard part of accident and incident investigation tools. These steps are not about assigning blame, they’re about ensuring we have the full picture when lives are on the line.
[Video reference autoland technology: https://youtu.be/JvzPpOknjME?si=BrrJumSpsmhUemSV%5D
The problem with this approach, is that there are literally hundreds of ways that pilots can crash an aircraft, if that is their intent. You cannot proof an aircraft against all potential pilot actions, unless there is no pilot.
As many observers have noted, the better solution is to address mental health issues within the pilot workforce. At present, an admission of mental illness is regarded as a weakness and would likely be deleterious to a pilot’s career. So there is an incentive to conceal problems and the fact that a pilot may be struggling.
Hopefully as time goes on and society becomes more open and accepting of depression and other mental health issues, there would be options to take the pilot out of the aircraft without stigma or negative consequences.
The other aspect of this, is that the emphasis of our data collection and investigative systems is on the failures, especially those that cost lives. But the reality is that there are thousands of saves by pilots for every error or accident. So the pilot data are weighted by failures, for example the statistic that most accidents involve pilot error. That’s true, but it doesn’t capture the full picture.
No question you can’t proof the aircraft.
The F-16 has a recovery system if the pilot is incapacitated. Its food for thought.
I concur 100% on Video. We have CVR, video is no more instructive and I lived under campers coverage due to the area I was working in. Don’t do anything you are not supposed to and its a non issue. CVR has gotten into public but reality is, pilots are in a unique position and the job justifies it.
Agreed on mental health. Peter H says there are now forms of insurance to cover loss of a pilot career though as long as mental stuff is managed they should be back in the cockpit. Problems are not the same as suicides.
Keep in mind, a pilot may get his airline job and realize its not for him. I knew a guy like that. He could not get ahead of a jet. And as a pilot you need to be ahead. I told him if it did not get better (FO) then he needed to quit. He did not long after and pursued another career.
AF447 was an example of unnecessary system program (degrade one level). You can program the system to ignore that in that flight mode and area. If extended then program the shift to 5 deg and 85% power and a master caution to the pilots Pitots have been lost and refer to non pitot ops.
The cockpit cctv monitoring capability, seemingly, is already there on the 787, as per a U.S. aviation safety expert https://www.financialexpress.com/business/airlines-aviation-air-india-probe-report-why-aviation-expert-rules-out-pilot-error-and-warns-of-boeing-error-3911733/ and he rightly has questioned the prelim report for mentioning that as that would be the crucial evidence whether the fuel switch issue happened autonomously due to a system error or due to a pilot error. Hope the final report takes that into account.
My only disagreement is that there is no question of Autonomous.
Switches were moved to OFF. The Who we don’t know and the AAIB does.
A micro stroke and swit6h actions would be deliberate but not a conscious pilot action.
But yes they know which pilot did it regardless of the underlying cause.
Not sure. The pilot who asked for confirmation will be identified, but there is no proof he didn’t flip the switches himself.
Policewoman Kim Potter accidentally killed somebody after mixing up a taser with a gun.
It’s not something that happens all the time, but it can happen so we shouldn’t rule out an “impossible”bit of muscle memory madness.
Policewoman Kim Potter panicked.
She should never have been in uniform.
You never take someones verbiage, auto excuse.
In the Preliminary Accident Report, it lists the Captain, age 56, as having his last Class 1 Medical exam in Sept 2024. In the USA, since he is over 40 years old, that would only be valid for 6 months.
But, in India, if I read the rule correctly, it’s good for 1 year, if part of a multi crew, but, only 6 months if operating in single pilot operations?
======
(5) (a) The period of validity of medical fitness assessment in respect of the licences specified against items (i) and (ii) of the table under sub-rule (1) shall be reduced to half after the holder of the licence has attained the age of forty years in case of single crew commercial air transport operations and sixty years in case of multi-crew commercial air transport operations.
=====
https://www.dgca.gov.in/digigov-portal/?dynamicPage=aircraftRulesContent2Req/1/4181/viewDynamicRuleContLvl2&mainaircraftRules1937/1/0/viewDynamicRulesReq
=====
US Rules .. for ATP Pilot in Command over 40 years old .. 6 months Valid
=====
https://www.law.cornell.edu/cfr/text/14/61.23
====
Huh?
Was there a point?
[Post deleted as violation of Reader Comment rules.]
Hmm, curiouser and curiouser. Clear as mud..
“Boeing flight diverted to check fuel switches amid Air India crash investigation”
“An India-bound Boeing aircraft was forced to return to Abu Dhabi for fuel control switch checks amid ongoing investigations into the Air India crash.
“Etihad Airways flight EY352, travelling from the UAE capital to Hyderabad, India, turned back to Abu Dhabi under an engineering work order mid-flight on Sunday (13 July), the Times of India reported.”
https://www.independent.co.uk/travel/news-and-advice/boeing-fuel-switches-flight-diverted-air-india-crash-b2789420.html
***
“Air India Crash Findings Prompt Inspections of Boeing Fuel Switches”
“Regulators in India and South Korea ordered inspections this week of fuel control switches on Boeing airplanes after a report on a deadly Air India crash showed that the plane’s fuel supply had been cut.
Singapore Airlines also said Tuesday that along with its low-cost subsidiary, Scoot, it had completed inspections of the switches on Boeing planes.”
https://www.miamiherald.com/news/nation-world/world/article310702740.html#storylink=cpy
***
“Airlines ordered to check Boeing fuel switches after Air India crash”
“Some airlines around the world, including Australia’s Qantas Airways and Japan’s ANA, told Reuters they had been checking relevant switches since 2018 in accordance with the FAA advisory.
“Others said they had been making additional or new checks since the release of the preliminary report into the Air India crash.”
“South Korea’s Transport Ministry said it ordered domestic airlines on Tuesday to inspect fuel control switches in accordance with the 2018 FAA advisory.”
“Flag carrier Korean Air Lines said on Tuesday it had proactively begun inspecting fuel control switches.
“Japan Airlines said it was conducting inspections in accordance with the 2018 advisory.”
https://www.dailysabah.com/business/transportation/airlines-ordered-to-check-boeing-fuel-switches-after-air-india-crash
***
Looks like various major airlines aren’t overly convinced by the pilot-blaming narrative 😅
Interesting that these Asian carriers are just ignoring the “reassurances” coming from Boeing and the FAA. Now where have we seen that before? 😉
No doubt Rob will chime in to “clarify” how misguided these actions are 🙈
What you see happening now, is whether the airline conducted the inspections as recommended by the service bulletin, after it was released.
Those who did, are not really concerned because they already know their fleet has operative switch locks.
Those who didn’t, are doing the inspections now because of the liability that would result if something happened with a defective switch. And also to assure themselves they have operative switch locks.
Essentially this accident has made the voluntary inspection mandatory, from the perspective of the airlines.
Which is a good thing, because a survey of the fleet will help to establish the probability of an inoperable lock on the accident flight.
The Indian media and pilot’s union are pushing hard on the switches having uncommanded movement. I watched some excerpts today and they are blaming DGCA and Air India for not having conducted the inspections.
They are pointing to the UK notice for the bulletin, which had an update to an email address in May, to claim that a “recent” notice was ignored. But it’s the same bulletin from 2018, with just the email address changed.
This also ensures none of the other Switches setup have gotte4n into the system as Engine Run/Cutoff switches.
They are going to have to do those checks routinely and obviously after any throttle quadrant change because you can have a wrong setup swtich get into the system as a Engine Shutdown/Run.
That is why it should never be allowed. Some switches should be unique and those are one of them.
A mistake or deliberate is always possible with something like that.
This may have been mentioned with a term or abbreviation I am not familiar with, but were GPS data signals directly transmitted from the 787’s engines to GE?
WHEN the Malaysian Air 777 disappeared over the Indian Ocean, Rolls Royce had been getting data transmissions from the plane. If this happened in the 787 case, that data could possibly shed light on the fuel flow interruption.
That’s a good question that wasn’t answered in the preliminary report.
What I’ve been told by people who work with ACARS, is that the FADEC and ECM collect engine data, that is then transmitted in packets or bursts. It can go either to VHF receivers at the airport, or to satellites if no receivers are in range.
Ordinarily the takeoff engine data transmission occurs after the initial climb. So it’s not clear that enough time or altitude would have elapsed in the accident flight for a transmission to be received.
question:
is this stored in volatile or nonvolatile memory inside the FADEC?
@SamW:
I brought that up some time ago. Its been noted that the Preliminary report is short on details though it answer the critical one for airlines, Boeing and GE.
It adds one in a Switch that can be keyed to two different functions. Not an aspect of this situation but something that will forever have to be checked as exterior sans acualy testing it, you can’t tell one from the other.
It depends on how their data stream is setup. And is it triggered by an event?
I believe they did have some or all of that data as well as the answer to most if not all the questions.
However, each aspect has to be checked out and that includes the Switches. Right ones, do the Toggle lock appear to be wor5king?
Note the throttle are in IDLE in the picture, data shows they were full on TOGO. So the wreck knocked them back. Its an indicator the Switches were normal as they did not also knock back though dynamics of the crash not a given.
Trump announces trade agreement with Indonesia, including 19% tariff
“Trump also said Indonesia committed to buying “$15 Billion Dollars in U.S. Energy, $4.5 Billion Dollars in American Agricultural Products, and 50 Boeing Jets, many of them 777’s”
Good news for Boeing, wonder what 777x slots they will be getting (e.g. after Trump leaves office?)
per wiki
Garuda Airlines only has 8 777 in the fleet and 25 787 on order (deliveries after 2029) Has 26 Airbus widebodies in the fleet with 9 on order (deliveries from 2026 to 2031)
For single aisle 45 737-800 in fleet and they cancel 50 737 Max in the past
or will they just reorder 50 737 max to replace the order they had cancelled
As I am not an engineer, a pilot, or software expert, I must confess to confusion over words and the idea of narrative that some use here. I find the published report brilliantly misleading through its use of indirect speech and repetition of the word “switch.” I’m not sure I truly understand what a “switch” is in a FBW system, or even what it is on the level of computer engineering. When I hear the word “switch” my 20th century, original Star Trek mind goes to relays that quite literally and physically open and close big fat circuits. I think of the controls of Scotty’s transporter — that only he could finesse. These were replaced by touch screens in The Next Generation. Very little physicality. It no longer depended on the reflexes and muscles of the crew membrer — the computer was in charge. One person above says: “The Flight Data Recorder (FDR) confirms that switches #1 and #2 were manually actuated, raising further questions about cockpit conduct.” I’m still not sure if the FDR can assess this or if it did. If it had, I would imagine that the report would have been less manipulative and ambiguous.
Then there is one person alleging that there are true engineering facts which are pitted against not so true narrative. This is not how science and nature work. There is always an intervening narrative that observes the natural world and then orders these facts into phenomena; into knowing. Otherwise it makes no sense. It’s obvious that there are many narratives here weighing on the facts. It is possible to warp, change, and obscure the facts with believable narratives. It’s amazing that Kubrick’s 2001 still resonates. Why is it so much easier to believe in a deranged pilot than a deranged computer? At one point one of the commenters here lists all the flights deliberately commandeered by a deranged pilot, who ultimately killed himself and everyone on board. But, in the past 20 years there have been millions of flights and fewer than 10 were taken over by suicidal pilots. The percentage is so small, I’m not sure it’s even significant. So, why is it so easy to muddy the engineering waters and apply that narrative here?
Engineering facts are engineering facts. The laws of nature are not open to narratives, and neither are the facts established by accident investigations.
When people start arguing that switches are not really switches, and the EADR is not really recording those switches, that’s an example of establishing a narrative that runs counter to the facts.
And since we know that narrative cannot actually alter those facts, it has only one purpose, to distract from those facts.
There’s no issue with credible alternative theories, but they have to come with supporting arguments and evidence.
The AAIB formulated their report from supporting evidence, therefore if you want to argue against it, you have to develop equivalent evidence. Same as any other accident report, or really any issue in science. You cannot just announce your theory and stand back in triumph. Then get upset when the evidence doesn’t support it.
@spot:
Some of us are engineers and or mechanical background. I was a designated engineer (mechanical system though lots of electronic control) with no letters, years of experience with Generoar4s, Electrical distribution in bldgs, fans, pumps, boilers etc.
Switch: In this case, it is a physical item you have to move. Think of it as at least what used to be starting a car. What the key went into was a multi contact switch even though it does not have the “form” you think of as a switch.
As its a physical device, a computer cannot lift it up (in this case an action above normal) and move it. No iffs and or butts in the case of this Switch.
Yes it can get strange, if the Switch contact(s) is an input to a computer aka an off/on mode, then software written wrong can do things you do not want to.
What I cannot tell you is what the output of that Switch does specifically.
I do not know if it has power on one set of contacts and then it directly powers a valve(s) and all that on the engine, that would be direct control and I would think that is how it should work.
There are multiple contacts on that switch. One of those sets of contacts when closed or open sends a signal to the data buss and is logged in the FDR as to what position it was in and crucially, what the time was .
In this case the Switch Left clearly moved at X time right after liftoff and 1 second latter Switch Right moved (to off) – then 9 seconds latter they moved again, this time to ON.
That is how it works and those are the core facts.
As the aircraft computers have nothing to do with those switches, they are 100% physical devices, what moved the switches is the question.
If they are working correctly, then a pilot moved those switches. Anything else is impossible. We do not know why and we may never know why (we may know who in time)
As far as deliberate crashes, statistically in the number of flights it is tiny.
But if you are on one of those flights its your life (and the other pax) lost. This is a case of you could not see the trend but you know it when you investigate a crash (or hope to and pretty much given in this day of electronic FDR).
@spot:
In one case we did have a deranged computer, it did not turn engines off.
A training flight with an A319 for (5 I believe) students all of who had to get in a take off and landing.
There was a computer faulted and the Captain reset it over and over again so the training could go on.
That then got into an unknown, you were not supposed to keep resetting it, switch yes but reset no.
Eventually something locked up in the program and all computers dropped off line and the aircraft was in Direct Control.
In that mode its flyable but landing is going to be bad as you don’t have good control.
They crash landed. A captain pulled t he computers breaker in Russia and did the same thing for unknown reasons (associated with a lightening strike but his actions were not part of any reset).
Note that the aircraft did not do so meting bizarre exactly, when all the computers were corrupted they shut off as intended.
While not true in depth technical details, form 3 pilots perspective, this is worth viewing. As I understand it, the Switches are part of the throttle quadrant and have been replaced twice, the last time in 2023. That does not stop the wrong action type switch ge4ting put into a Throttle quadrant. It does make if very likely that there were no Switch issues as its been two years of pilots working those switches.
https://www.youtube.com/watch?v=zV5B_A8JQvU
Mover makes clear what gets your attention is the alarm and displays popping up and I am going to assume Engines are up in a screen already as that is a critial aspect of the take off.
An example of some data on a Flight Data Recorder outputs of a 787 investigation. (this was from a 2012 accident)
The fuel cutoff switch signal is shown, along with the fuel valve signal and the TCMA signal.
=====
https://www.ntsb.gov/Pages/search.aspx#k=DCA12IA114%20flight%20data%20recorder%20(FDR)
=====
I’ve got a weird theory that might fit things, but, is rather a long shot. What if, some cleaning liquid or soda, coffee etc was spilled on the throttle quadrant? During takeoff, a few drips that have fallen below the throttle segment roll backwards during takeoff connecting the two cutoff switches (they must be insulated for this but…) that could cause a momentary short during takeoff of the fuel cutoff wires? The switches would look electrically like they had been thrown, but, physically weren’t. It’s a long shot, but, would explain the temporary fuel cutoff without the pilots physically turning the switch. (it would be really nice to have a camera in the cockpit)
Or some condensation on the wiring somewhere between the switch in the cockpit and the computer flight control box?
I”m sure the wiring is insulated but, the Throttle quadrant had been replaced twice before. To actually find this after the crash and fire would be nearly, if not totally, impossible. If there are no physical switch sounds on the CVR, then it opens up a large can of worms to look at.
The thing about the liquids theory is that it would leave signal traces as well.
It has happened twice on an A350, drinks were spilled and 15 minutes to an hour later, one of the engines shutdown.
In those cases, it was the engine-side fuel valve that closed, which is the one under automated control. The aircraft-side valves remained open. That was an obvious tell in the EADR.
It also makes sense in terms of shorting contacts. Logic circuits require very small currents to activate, which a liquid can conduct. Hence the automated valve closure. The manual valve is controlled by relays and requires much higher current and power levels, hence were not activated by the liquid short.
In this accident, both fuel valves closed, which indicates the switches moved.
I would add not indicates, confirms/shows the OFF and then ON positions of the Engine Switches as well as associated engine parameters confirming that action.
I missed something … “In this accident, both fuel valves closed, which indicates the switches moved”?? how is moving the physical switch monitored? Aren’t the FDR signals monitoring the electrical signal and not the physical switch movement? That’s why camera data would prove so useful, Right now, there needs to be an audiable ‘click’ in the CVR to ‘hear’ the physical switch movement? There should switch noises on the CVR, if there aren’t then you’re back to the drawing board? Obviously, we have to wait for the full printout of the trace data that will probably be in the final report. If the physical click noises are on the CVR, then the pilot saying he didn’t flip the switch becomes rather questionable. Either he was in micro-sleep mode, or out right fibbing. BTW, on the ‘micro-sleep’ concept .. (I find this rather hard to believe as this was in takeoff mode. Even a pilot without sleep should be rather awake on takeoff)
=====
https://www.airwaysmag.com/new-post/ai171-dual-fuel-switch-error-pilot-fatigue
=====
@Richard:
Rob is giving you benefit of doubt and I am someplace in between of it being argumentative and trying to understand. So, I don’t get it why you don’t get it but here goes.
Physical Switch Positions: There are at least two sets of contacts on that Switch.
One goes to the Valve and or FADEC circuit. I full admit keeping the picture of the circuit in my brain is not something I would do. I can accept the general working without the in depth detail because the in depth detail does not matter.
The other set of contacts will be associated with the FDR input. As its Digital (on or off) its a Binary Input into the system.
Its how switch positions are monitored in this case and its the direct monitor vs inferred.
You can have a Switch activate a relays with its own set of contacts. That would be a secondary sensing as you are not monitoring the switch directly.
You could have a Switch on the fuel valve that closes contacts at 90%.
There is no way to monitor a switch other than its position contacts or other means as noted.
I am not trying to solve this, I am just working to understand it.
I am accepting facts as the Indian Report stated them. They are confident of those facts to state them.
Investigators will be looking to poke holes in those facts, the fact they had zero follow up to me means that Switches have been checked that the detents were as they were supposed to be. Yes they may be heat damaged but the mechanical aspect will be there. They don’t state all the corroborating evidence, they are still looking at all of it.
The clear intent was to put to rest it being a Boeing or GE issue. They did that.
As to the human factor and Switch movement, they and we may never know all the details. We have to accept that, we are dealing with human beings and not machines.
The CVR is not intended to pick up Switch movements.
In takeoff thrust and whatever surface the Runway is imparting into the gear, air noise, that is not what the CVR does.
Given CVR or video I would rather have video. A person can say anything and it can be fully misleading. Video shows who did what. Far more valuable. CVR was all they had at one time, Video came along latter so FDR and CVR is what we have not because its what we need but because the Pilots Unions have used political leverage to stop further progress.
There are a lot of physical things that can impair a pilot, some more likely than others and we may never know which or what.
The Purpose of the FDR is to show what devices were in what position and if that changed just as the report stated on the Switches. That includes where the throttles were, what N1 and N2 were as well as EGT along with a huge number of other Binary or Analog information on devices.
To clarify, there are 4 sets of contacts on the switch. Two of them are monitored directly by a digital input board, which translates activity to packets on the aircraft network, which are received by the EADR.
The other two contacts are monitored indirectly, by sensing the systems they control.
Thus as stated earlier, in order to appear as a switch transition that didn’t actually occur, the fault would have to involve 4 direct measurements across two independent switches, with the correct timing. And also 4 other indirectly controlled systems responding to the alleged switch movement, again with the correct timing.
The odds of such a fault occurring are essentially zero.
If the CVR picks up the switches being thrown, I agree that would be further proof.
This is the switch in question, is it not? Either a 2,4 or 8 pole switch with the locking up pull option? One for each engine? Are you saying one of the poles go to the FDR and the other to the actual cutoff valve circuit?
=====
https://octopart.com/datasheet/4tl837-3d-honeywell-25749542
=====
It’s a four pole switch. Two of the poles are monitored by the EADR. Here is a video created by a 787 tech. He also answers your question about the Embraer shutdown strategy. It’s really for engine wear considerations rather than safety.
https://youtu.be/-ur234kwnhk?si=EaYESbzPTjaY5LsZ
Wow. They did find the throttle quadrant and it has a picture of the one found. Read the report. Look at the pictures. I am stunned you have not.
Why do you need to come up with a theory regardless?
Coffee into the works? What coffee or drink? Regardless of reaching when it has no place, this is takeoff. Do you think pilots would be putting cups on the throttle quadrant and where? Let alone why would they have any drink at that point in flight?
For those not familiar, you are not going to short out a physical switch with fluid. Or theory condensation (like man its hot, close to 100 deg hot). Those contacts are locked onto each other. I suspect you could dunk them in fluid and they would continue to conduct.
Yes Airbus had a problem with spilled moisture into the electronics, not the a physical Switch.
And to add further absurdity, you are postulating the identical thing happening to both Switches as logic says, anything out past the Switches has to be identical on both circuits.
One again I will state it. You could dunk the switch in fluid and it would not shift contacts. Insulation has nothing to do with it other than you force this theory into the Switch themselves.
The simple fact is the Switches were moved. OFF and then Back On. That is the one iron clad fact from the investigation (as far as the crash goes)
At that point, someone had to have moved them.
The fuel valves on the engines are powered open but they are also powered off (motor on the valve itself).
And yes, I have worked with motors exactly like that, you not only have to open contacts from the Drive the valve open, you have to remove that contact and then power up separate contacts to drive the valve closed.
Remove all power and it just stays in the last commanded position. Everything FDR wise is fully in line with both turned off and both turned back on. One is wild, two is beyond any calculated odds (99.9999999999999999999999999 to the 100th certainty)
And last commanded position for both valves is Run. Which is exactly where they found them.
Factually the engine data agrees the engines were turned off and then back on. Space between off is 1 second between 1 and 2 engines for the off, a 10 second space and then back ON with a 4 second time delay between 1 ON and 2 On.
Further postulation failing on there is a location for drink containers, pilots are also trained on the spill issue.
The so called theory fails on so many fronts.
I think what Richard meant, was could they find evidence of a liquid short in the recovered throttle quadrant, after it had been through a fire. I suspect he’s right that they couldn’t.
Since it has happened twice before it’s not unreasonable to suggest the theory. There are major differences between the A350 and 787 center consoles that make it less likely on the 787.
Richard said it was a long shot, so I think he understands the issues. I give him credit for doing research, providing evidence, and developing a plausible rationale. Even if the theory didn’t work out.
I’ll also say that his analysis of the stab cutout switches on the 737 MAX, was correct. We only disagreed on the contribution that made to the accidents.
@Rob:
Maybe on RD, but I don’t believe so. He drops in items totally out of context pretty often.
Why come up with implausible when the investigation stated facts? That gets into what I refer as Techno Conspiracy.
The Indian, French, US authorities are not stupid. It would be on their check list. I give the authorities credit for ruling it out.
Do I think the Switches were broken? No, did they check them out to the best they can, yes.
Frankly bogus (wrong Switch) parts getting into the system is far more likely than other aspects and that also will have been looked at.
You are sanguine about identical but different action switches in the system.
I am not. Its been done deliberately and I have seen it repeatedly.
Passing on items that are intermittent is all too common. Mfg checks them out, fine, back into the system.
Do I think its likely Wrong Switches would have not been discovered? No.
But the FAA released a bulletin with no facts as to why it was out but not mandatory and then repeats it, trust us, we are the Government.
Darned right I would test every switch in the system and make mandatory a Switch gentle check on each flight as well as a mandatory full on check any time one is replaced.,
I do not believe it applies to this one, but it could to another and one pilot has stated, he had one of those Switches in an Airbus that while it toggled, it was not locked.
That was interesting as he was PF in the FO seat, Captain said it was his decision, he elected to fly but guarded the switch. They discussed it and then downed the aircraft after landing. The Airline did not have a policy on that.
For them it was a flight of safety issue.
I just meant that Richard’s method is good, he does a lot more work to evaluate things than some others here.
It helps to differentiate errors of method from errors of knowledge. If Richard reaches the wrong conclusions sometimes, it’s from errors of knowledge which can be corrected.
Errors of method are much worse because they will almost certainly be repeatable, and can’t really be corrected unless the person acknowledges their method is wrong.
It’s a similar difference to that between a mistake and a deceit. The former has no intention to mislead, while the latter does.
That I am going to have to ponder.
I am accepting the Indian report as factual and they have looked at anything around Switch ops that made positions misleading.
Both are methods in my view.
Knowledge, hmmm. I spent a career unraveling mechanical and electrical /electronic occurrences getting at and fixing if possible the root cause though sometimes it was replace the part and its going to happen again but its a mfg issue we can’t fix.
My MO was to gather information (data if you will) and at some point it often got into a conceptual aspect of what could be causing that.
If you trace it to a board, you probably don’t have the test points or the wave forms anymore to check components.
One of my cohorts solved an issue as he and I had been burning in boards to ensure we had good working ones. He saw a resister fry and noted a newer board had a larger resister.
simpler board and in that case just matched the resister size on the newer ones and problem gone. The mfg never acknowledged they had changed the resister or put out a bulletin though once focused it, obvious.
On another one I got suspicious of a sub board mounted to the main board. I swapped out it on a failed board from one of our good spare boards and it fixed the issue. I had some hints on the wiring diagram but had to confirm the suspician.
Why not replace the whole board? 42 connections and a number of them hot that involved an entire system you could not shutdown (24 volts stuff).
We had a mechanical actuator that regularly failed. I got into some wild theories as to the cause and attacked each one with a fix and it never worked.
In the end we cut out the old system that had those on it and attached a new duct with an actuator that did not fail (the old one was totally specific, the new ones were generic actuators)
My first step was not to come up with theories, the obvious aspect was a rubber boot that failed and replace it.
Theories came next when the same boot failed inside of 6 months.
Cost to replace each one was initially $2500 a unit. 75 of those. Ergo, they wanted theories! Once I had done everything I could think of, then we looked at replacement.
I had an epiphany (rare) and came up with a way to avoid the cost and we got each one done for something like $300.
Point being I did not go to theories first unless something pointed out a need to do so and I don’t think in this case there is any need.
The facts explain what actions caused it, why is a human aspect we probably will never know.
The thing about the liquids theory is that it would leave signal traces as well.
It has happened twice on an A350, drinks were spilled and 15 minutes to an hour later, one of the engines shutdown.
In those cases, it was the engine-side fuel valve that closed, which is the one under automated control. The aircraft-side valves remained open. That was an obvious tell in the EADR.
It also makes sense in terms of shorting contacts. Logic circuits require very small currents to activate, which a liquid can conduct. Hence the automated valve closure. The manual valve is controlled by relays and require much higher current and power levels, hence were not activated by the liquid short.
In this accident, both fuel valves closed, which indicates the switches moved.
I had missed this and thank Rob for bringing it up, it is well written so my hat off to RD.
I think the two Stab cutout Switches go back to the Classic when it had two trim motors. I have not seen an explanation of why or how they worked. I do not believe the NG had those.
Fully a guess but removing them would have required a new panel and manual writes up and it was easier to leave them both there and cross wire them.
I don’t believe you would stop auto pilot to a trim motor with a Switch. Those switches I believe are purely power (or relay) cutout switches.
I certainly could be wrong.
As for MCAS logic and cutout, they wanted to cover Runaway Stab and MCAS in an existing Switch so they did not have to re-write manual or incur training.
There is a trim counter to the MCAS in that if you trim electrically, MCAS is overridden.
One of the tragedies is they did not keep on trimming until stable then turn the stab off.
I think the Indonesia Captain was so overloaded he did not realize he could put a notch of flaps down and stop it.
With the high speed the Ethiopian pilots had I don’t know the results of flap but they did not associate MCAS with flaps either.
Training on MCAS and the actions to do would have stopped it (or should) but MCAS 1.0 was a crime as designed and written.
“I can’t let this comment go as it is. In the Etheopean Accident, the pilots did everything by the book, then when they couldn’t get control of the stablizer manually, through the trim wheel, because the high speed trim motor setting of MCAS had put the trim so far out of normal, and they were at a high speed, they turned the trim motor back on, to try and gain control again. On the 737 NG the 2 separate trim switches operate differently. One is to cutout the autopilot commads to the ONE trim motor. The other to cutout the manual electric commands to the ONE trim motor. When putting the changes for MCAS in, they rewired the two switches, so either one cut out everything. You can’t cut only MCAS commands out. You are always fighting with it. There is no OFF switch for MCAS. There is only turning OFF the ONLY trim motor. This really perplexes me. Why there is no way to maintain manual electric control of the ONE trim motor, without MCAS involvement? You might be able to add one notch of flaps, and hope you don’t have too much structural damage at high speeds. I tried looking at circuit brakers to pull, but, I think it would require more than one circuit breaker, and who has time at that point to turn around and find the right circuit breaker? I don’t want to rehash the 737-MAX, but, couldn’t resist clearing up some MCAS design
logic.
You are correct about the evolution of the trim cutout switches. Originally there were two actuators, right and left. That is still true on the 787, which also has the two switches.
On the 737, when they went to a single actuator, the switches were reconfigured as Richard described. One cut power to the actuator, the other disconnected the speed trim system.
On the MAX, I asked people at Boeing why they changed that configuration to just duplicate the switches. They answered that to reduce complexity, they looked at the history of that configuration, and how often crews had used the speed trim cutoff switch. They found it had virtually never been used. So the thinking was, why include it if it can be made simpler for the crew.
Of course the problem with this, is that the speed trim system virtually never failed. Whereas MCAS introduced a failure mode that would occur with AoA vane failure. So they simultaneously removed the safeguard while introducing the error that would make use of it. Which they didn’t foresee at the time.
@Rob:
Thank you for getting that straight.
I had now known about the one doing Speed Trim system shutoff.
Do you know why two actuators originally and then one?
Other question would be was one actuator what the aircraft worked through speed trim wise and you disconnected that actuator ?
The other I at this point assume is both pilot trim and auto pilot trim?
This sounds like the cockpit door setup we have now that intended to solve one problem and has induced more crashes than it would have solved (opinion but I think valid as the layers to stop it short of a full on cockpit door lockout work)
The reduction in actuators was based on reliability and usage data. Boeing was able to show the FAA that there weren’t enough failure incidents to justify the second actuator, and the trim wheels were always available. So that configuration was safe, as has been borne out by the NG fleet safety data.
I am going to rephrase the Stab cutout Switches in MCAS.
Initially they had no intent of having to cutout the Trim motor simply because they were hiding what MCAS could do. It was not in the pilots manuals and it was not in any training.
Frnakly I think there was a left hand and right hand not knowing the whole story (one hand) and declensions may have been made or were based on what they thought they knew in how the Stab switches should work)
Then when Indonesian crash occur ed and they saw the data it was, ok, this is how to deal with it.
It was some ugly logic in that they were right, if you counter trimmed to neutral and then turned it off you were fine.
But you had to get there and no actually training it was not something in the Sim.
It also should be repeated, the speed lock up on the manual trim had been eliminated so any stab training they were able to spin the wheel just fine.
How that got taken out is something they never investigated, it is not supposed to be possible to change something like that without approval (which would not have been granted)
But MCAS was truly a horror in its full conception.
I did support a Sim operation and I saw the extent they went to including an issue with extra nous noise that had to be corrected as it messed with the fidelity of the Sim.
Their fix was wrong and caused us and them endless grief until we could years latter get them to run the sound test without their fix and admit we had corrected the noise at the source.
There is an error in the above.
I had a comment about MCAS being a horror and its out of context.
WSJ is reporting that sources who listened to the AI171 CVR, claim it was the captain (PM) who turned off the fuel, and the first officer (PF) who asked him why he did. The captain denied it and reportedly remained calm while the FO called mayday.
https://www.wsj.com/world/asia/air-india-crash-senior-pilot-eab72db5?st=QEtZ5v&reflink=desktopwebshare_permalink
That how its settled in my mind for now though subject to official information that confirms or says differently.
With a human failure involved, there is no making any logic of things though one pilot would have maintained what he was and the other not.
Have to be (or should be) cautious with what deliberate means.
An action can be deliberate (aka the E175) and be abnormal behavior for whatever underlying cause. Strong suspicion we will never know as in most of these cases. E175 we can, but that was a fully cooperate individual when he was recovered. Fortunately he did not fight them getting him out of the cockpit.
Hey Bjorn, you´re even being quoted on an article about the accident in the biggest Brazilian news channel: https://g1.globo.com/mundo/noticia/2025/07/16/as-duras-criticas-ao-relatorio-preliminar-sobre-queda-de-aviao-da-air-india.ghtml
I also saw him quoted in another publication in which he indicated it was a human factors issue.
I give him my appreciation on the MAX crashes as I was torn between pilots the issue vs MCAS. I continue to feel he explained it well why it was MCAS with pilots (not a direct quote) a contributor factor but overloaded and outside any training.
AAIB has released a statement in response to the WSJ article, claiming there are no conclusions based on the CVR.
An interesting tidbit is that Jennifer Homendy, the NTSB chair, has asked to listen to the recording.
http://timesofindia.indiatimes.com/business/india-business/ai-171-crash-aaib-slams-irresponsible-conclusions-after-us-media-claims-says-captain-turned-off-fuel-switches/articleshow/122647752.cms
This is an interesting example that shows that we should not to easily conclude that this was pilot error based upon the present findings:
https://www.linkedin.com/feed/update/urn:li:activity:7351246362623033344/
Thanks for this comment, and most enlightening link.
-V.
The thing is, this could not have been a software error because the switches moved, or “transitioned” as stated in the report. There is really no getting around that fact. We don’t yet know why they moved, or the circumstances. But they did move, as the incipient event.
Yep
Help me out again please how we know this for sure? The switches were found in the ‘on’ position as I understand.
The switches are recorded in the EADR, as transitioning from Run to Cutoff, one second apart. They remained in Cutoff for 10 and 14 seconds respectively, before transitioning back to Run. You are correct that they were found in the Run position after the accident
Thnx Rob, it was a rhetorical question however. I strongly believe in the value of Occam’s Razor, so no argument about probability of the odd explanation. Nevertheless, we only have electronic data to ‘prove’ the transitioning of the switches, no physical trace left. That’s why I shared the link.
There are two sets of contacts in each switch monitored directly by the EADR. And the other two sets of contacts control systems that are themselves monitored by the EADR.
So as I explained to Uwe and Richard, you’d need a coordinated failure in time to simulate the switch being thrown. And you’d need to replicate that error across two engines and two switches.
That would be improbable in the extreme. Occam’s Razor would suggest the switches were thrown by one of the crew.
I would really like to hear the click-click-snap, click-click-snap of the Two switches being moved. They most likely are on the CVR, but, before I trust that they were moved, I’d like to verify by seeing the jumps on the audio waveform. Seeing that, I think you then have to put the Captain’s actions / motives / medical condictions / recent history etc under a microscope. On something of this magnitude you have to be as correct as one can be. Saying that, could he hold the switch spring up, and just for a moment move the switch to cutoff, returning the switch to the normal as soon as the fuel was interrupted long enough to kill the engines? How many seconds would he have to hold the switch in place? I’m making the huge assumption that the pilot would be intentionally trying to shut the engines down without the other pilot noticing the fuel cutoff. It would obviously show on the FDR trace. Thinking way outside the box again…. how large a magnet would you have to have to ‘close the fuel switch’ connection? I can’t imagine a magnet being used to hold a flight plan or paperwork to the throttle quadrant, but, just thinking outside the box. It would be only about 1.5 inches from the outside of the case to the connections. But, what about a cell phone magnetic holder? I assume that would be mentioned somewhere on the CVR? If on rotation the magnet moved down the throttle quadrant to the fuel cutoff switch location?
I totally doubt a switch moving can be heard on there CVR. Its not intended for that, Its a Voice recorder not a switch movement recorder.
I suppose we could postulate a space based magnetic satellite as well.
Me? I am accepting that the FDR recorded what happened.
No idea why you would think off/on quickly, that is not what the report said.
And yes you would have a fuel system alert pop up along with a computer message and the engine group which is up for takeoff for sure (and probably the rest of times) will show engines spooling down.
There is no lack of indicators. While its assumption, at least one of those said Engine Shutdown. You would look to confirm that and see the Switches in their reported positions.
Other incidents on not just 787 have never said things were not accurately reported on the FDR.
Software can do odd things, there have been odd things reported. But those odd things were no a logged switch movement that did exactly what it was supposed to do.
ANA is a prime example of that. It logged the event accurately.
The issue is how fast is your scan rate and what is the timer involved? You do not want a mili second or a flickering input to trigger being allowed to use thrust reversers and spoilers.
Airbus had one crash at least where the sequence was conflicted and had been changed due to another incident.
Jeju air is an example of a pilot being able to activate thrust revers and or spoilers but as no WOW, he could not.
Flip is you don’t want a thrust reverser deploying in mid air, Lauda Air 767 (over India I believe).
Writing software for that stuff is insanely complicated.
None of which applies to AI 171. Everything that occurred is corroborated by the systems doing what the Switch position said to.
In the case you suggest, where the switch is momentarily moved to cutoff and back to run, the FADEC will initiate the relight sequence. Since there wouldn’t be time for N1 to spool down, it would likely be quickly relit.
The only exception would be if the engine is too hot to restart, then the FADEC might let it cool for a few seconds before relight. That can happen at high altitude where the air is thin. It’s less likely at low levels.
You would need a humongous magnet to move the switch, and it would be attracted to everything made of steel in the cockpit. You’d struggle even to hold it or move it. So unlikely in the extreme that being any kind of accidental thing.
I’m not talking about moving the switch physcally by a magnet, but, just ‘moveing the electrons’ to close the electrical contacts of the switch. (i.e. placing a magnet very close to the contacts will connect the electrical path) .. but, how close is close? I assume you’d need to be very near the switch, and/or wires for this to be a factor, but, I haven’t done any testing. I’m not talking about a ‘reed’ switch, where the contacts move from the magnet, but, the just the electrical connection being made by the magnet. I know EMI from a large motor can cause sensitive meters etc to go haywire. But, how many gauss does it take to make an electrical only, not physical connection for the switch to connect? I doubt the throttle casing has any magnetic shielding, but, I don’t know.
Going from Bottom to top, while there is not shielding the way you postulate it, there is a metal plate and the system is built to robust standards as far as EMI goes. Not EMP level but well above any known EMI. So yes it is shielded in reality if not a Faraday cage over the throttle.
A magnet cannot cause a physical set of contacts to conduct. There is a huge chasm between random radio noise (aka an electric motor) and conduction. Taking a bit getting knocked askew in a computer vs an electrical connection conducting , not happening.
We are getting deep into electrical theory. It takes a solid link for electrons to flow. Be it wire or switch contact/contactors.
The flow theorists don’t even know which of the models is correct. Electrons flowing or bumping and created a flow.
The postulation of a magnet created any flow let alone a switch level flow, ungh. We might as well start discussing string theory.
You are not talking about knocking one electron out of orbit, you are talking about millions.
While I got fairly deep into current theory, I don’t have the math to disprove it. So get a magnet and a switch and try it, that is how the early guys like Watt did it.
There is no way to form a conducting connection across an air gap with a magnetic field, unless you are dealing with a plasma. A plasma by definition has the electrons stripped away from their atoms and existing in a free state. They can be manipulated by a magnetic field while in that state.
However there are no plasmas on the flight deck or in the cockpit, so that theory is moot.
Is it possible that the switch-thrower inadvertently moved ONE of the switches — perhaps it wasn’t fully in the locked position or the locking mech had failed/worn. He felt or heard the action of the accidental movement and then looked down and saw the two switches in opposite position. Knowing that was not normal, and intending to undo the error by putting the switches in the same position, the same pilot grabbed the other switch mistakenly and turned it to the off position, instead of resetting the other switch that was mistakenly flipped. This theory reduces the mechanical failure to one switch with a worn/failed detent and the mental/cognitive error to one mistake — moving the wrong switch. All of this could have occurred within the 1 second stated in the report.
While anything is possible, the odds are like .000000000000000000000 to the 100th.
I continue to go with the Authorities have the switches in their position and can tear down and assess condition prior.
When you replace a throttle quadrant, the Switches are replaced. While I do not believe they would be worn out and NOT noticed, they were replaced in 2023. So no, not one would have worn out in that time, maybe if they were original and that is a huge maybe and were not written up.
Reuters has confirmed that NTSB has been fully briefed on EADR data and that Jennifer Homendy requested and heard the CVR recording.
“The U.S. National Transportation Safety Board has been assisting with the Air India investigation and its Chair Jennifer Homendy has been fully briefed on all aspects, a board spokesperson said. That includes the cockpit voice recording and details from the flight data recorder that the NTSB team assisted the AAIB in reading out, the spokesperson added.”
Reuters also confirmed the detail reported in the WSJ article about the verbal exchange between captain and first officer, citing “US sources”.
https://www.reuters.com/business/aerospace-defense/air-india-cockpit-recording-suggests-captain-cut-fuel-engines-before-crash-2025-07-16/
If it was the Air Current, I would call it a fact.
They are not perfect, they had an article on Boeing not at rate 38 with the MAX when they were or so close as to be there.
In reality, establishment of who did what is not going to change things. No one was locked out of cockpit, seems no third party in cockpit etc. I do think the cockpit lockout needs to change. A delay at the door is more than enough in my opinion.
We know it was not a Boeing or GE issue and was a human factors and no one has come up with anything that changes that end.
I have seen the one attorney claim MH370 pilots had nothing to do with that one either. She did not have any credibility with me but it was into negative area after that. You can make a strong case who in MH370 as it was a technically deep action and only one person knew that stuff (as well as the routes found on his Sim).
I am not saying computers don’t do some odd things, but a physical movement of a Cutout/Run switch is for sure not one of them.
The Flight Safety Detectives released a follow up based on the flood of illogic that occured after the preliminary report was issued.
https://flightsafetydetectives.com/air-india-investigation-facts-and-logic-must-prevail-episode-281/
An area I think is questionable is the APU.
Per the one guy, you can’t get engine start without it.
But the engines were in a restart mode and Left was responding (right was but lagging). So either the batteries can spin them the fact they are spinning already is enough for a restart.
The APU never ran, it was in a startup sequence but that is 40 seconds?
Yeah, no APU in this case. The relight was based on the engines still spinning.
You can see the difference between the first and second engine. 4 extra seconds of spinning down was enough to make it more difficult to relight.
I would really like to have this issue clarified. I would find it difficult to believe that the relatively small battery could be used to restart two large engines simultaneously (even if the necessary power electronics were available, which I suspect are not). My operational thought is that engine 1’s N2 RPM was still high enough (but lower than flight idle) to allow the reintroduction of fuel (and be relit) and not overheat the combustor. So if I understand the general starting sequence of a gas turbine, the electric motor brings the high pressure spool up to an RPM that provides enough cooling air to allow the introduction of a small amount of fuel (that is lit). Together with the still engaged electric motor the high pressure spool will increase RPM up to some point that the core has sufficient cooling air to not overheat and generate sufficient power produced by the combustion to continue to increase RPM up to ground (/ flight, [which are two different RPMs]) idle. Generally at some point the starter motor must physically be disengaged due to possible heating and over RPM issues (depending upon what is being used), but with the 787, the variable frequency starters / generators are always physically connected to the high pressure spool and can take the full N2 RPM. At some RPM they transition from starter motor to generator mode.
My thinking is that N1 will roll back rapidly but N2 will not roll back as rapidly and that the residual N2 RPM left after fuel cutoff was still high enough that the reintroduction of fuel would still produce enough power to spool up engine one but was too low for engine 2.
I have been hoping for a good technical explanation if the N2 RPM scenario is possible vs using the battery as it is extremely unlikely that the APU could provide the power at that point in the APU auto-start sequence.
Of course a more complete release of the data recorder would immediately clarify a lot. Unfortunately I have not seen a knowledgeable source that addresses these issues. The person who has a lot of gas turbine videos sorta talked about this in generalities but he has no experience with the GE engines on the 787 and basically can not add to the relevant discussion.
Not my area though I am generally familiar with Jet engines, never worked on any.
Rob makes sense, residua energy, igniters start firing and feel fuel per the situation which is what the FASDEC does.
I am just technically curious, it has nothing to do with the crash as such.
Again not an expert but for 50% total thrust6 to get generated out of one engine or a combination of both was 30-60 seconds away?
The aircraft stood no chance of recovery.
The automatics were doing as intended but not recoverable is a dual engine loss of thrust at that altitude. The automatics could not overcome a lost situation.
787 sports a dynastart arrangement.
Generator and Starter are one device.
( I suppose as a starter motor it is driven by a VFD )
Power should be available via the RAT?
Main engine start on Battery seems to be not liked.
I “think” that the 787 variable frequency starter / generator can be compared to a dynastart configuration only in sprint. The VFSG is fully brushless and a rather impressive piece of engineering. The technical paper that I found that talks about modeling the 787 electrical system only explains the generator mode and not how it is driven as a starter motor. From my experience with “DC” brushless motors they are actually very much an AC type of motor. Reading between the lines from the paper would strongly suggest that to use the VFSG as a starting motor would require a some high power driver electronics, motor position sensors and some circuitry for rotor coil excitation (unless there is enough residual rotor magnetization to get things going). The generator mode of operation is quite clever, so I presume that to operate it as a motor is also nontrivial.
Neither the battery nor the RAT can start the 787 engine. Only the other engine or the APU can power the starter generator.
In this case there was no real question of either being available. The engines had to restart by inertia and windmilling.
I will not say I knew batts could not start the engines, but it make sense.
Some background is that the 787 has something like 1.45 megawatts of generators to power the almost all electric systems.
Total of 6 Generators , APU has 450 KVA so I believe the APU gens are the same size as the engine Gens. Not sure if it take the two Gens on the APU for a start of not.
I have worked with small gens that did that. Onan and latter Cumins who bought them out was the one I knew about, might have been others. Small stuff, 2-3 KW maybe.
You don’t need inverters though I don’t know they use them on that portion of the system. AC comes out in Gen form and that is stepped down and most if not all inverted as its a variable source I believe (again this is from memory, its an incredible system and not sure it was worth it as the A350 works as good from what I can tell and while the 787 is efficient, its not like its 50% better, something in the 15 to 20% area I believe.
[Post deleted.]
@Davenport: Knock of the mRNA bullshit. This is not a conspiracy or a health care website.
Hamilton
A latest, alternate take and excellent analysis on the cause of 787 crash by a former Air India B777 and Navy pilot who has raised the right questions on the prelim report while also pointing towards FADEC as the likely culprit rather than pilots and the FCS, as being purported. Worth a read…
https://www.indiatoday.in/opinion/story/story-of-the-crash-of-flight-ai-171-and-a-very-flighty-investigative-report-air-india-ahmedabad-2764682-2025-08-01