Assuming this is a murder-suicide and not a mistake or malfunction somehow, it's very damning of the FAA's policy to revoke the pilot's licenses of anyone seeking treatment for mental health issues. This was in India and thus not FAA jurisdiction, but it still would be a case where an untreated mental health issue lead to hundreds of deaths. By making pilots choose between their careers & medical treatment (since they can't continue as pilots if they seek treatment) the FAA encourages hiding mental illness by pilots. The Pilot Mental Health Campaign[1] has been advocating for legislation to change, HR 2591 the "Mental Health in Aviation Act of 2025"[2] has just been approved by committee for a general vote. I certainly hope it passes, and that other nations with dangerous policies prohibiting pilots from seeking treatment change as well.
The murder suicide angle isn't particularly worthy of assumption yet. Have you ever put your phone in the fridge?
Pilots deactivate the fuel cutoff at the end of the final taxi to the gate. This makes flipping these switches a practiced maneuver, capable of being performed without conscious thought, regardless of whether they came with safety locks installed.
Brain farts are a real phenomenon, and an accidental fuel cutoff most closely resembles the transcript from within the cockpit.
The report is actually a little cagey about whether the locks were properly installed on these switches. Said locks are supposedly optional. Until I receive a more direct confirmation that the switches were installed with their full safety features, I will assume that it is more likely for the plane to have had improperly installed switches than not, given that the shutoff was the reason for the crash, and if they turn out to have been installed, I will assume that simple pilot error is responsible until a motive for murder is found. The pilots lives are under quite a lot of scrutiny, and I do not believe that a motive for murder is likely to be found.
> The report is actually a little cagey about whether the locks were properly installed on these switches. Said locks are supposedly optional.
The locks/gates on the switches are definitely NOT optional. There was an SAIB about some switches that may have been installed improperly. It didn't result in an AD, which likely means the extent was limited or potentially even nil.
The switches were moved to cutoff with a one second delay between the first and second switch. That's pretty suggestive of deliberate movement. I've flown a Max9 simulator, which has the same switches. Moving one of them by accident would be impossible, let alone two of them.
I agree with not jumping to conclusions about the pilots and possible motives or circumstances, but I will bet a lot of money that the switches were just fine.
The CVR will likely have audio of the switch movement to confirm as well.
The switch must be lifted and turned. The optional posts block you from inadvertently knocking the switch (that you must pull up and turn).
I second that it’s not an accidental motion, you must actively manipulate the switch. But just like your turn signal in your car, it is muscle memory when you use it. I just wonder what action the pilot mistook the fuel cutoff for. Looking around the cockpit shows just how unique those switches are and not something you mistake with another common activity.
did the report say a one second delay or that the two switches were turned off at consecutive seconds? The latter is what I remembered, but I'll check again.
> did the report say a one second delay or that the two switches were turned off at consecutive seconds?
The report states, on page 14:
The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec.
"with a time gap of 01 sec" seems fairly clear. The final report will have more granularity, but I don't think that's very ambiguous.
Not at all. First of all writing it as "01" begs the question if there is a typo (is that really supposed to mean 1 or 0.1?) but even without that only specifying the interval to a second precision makes is much more likely that the difference is between samples of the switch state that are recorded at that rate.
If you were correct, the only situation it would happen in is when the pilot flying asks for X to happen, and the pilot monitoring instead does Y. Pilots don’t just randomly reach over and screw with the controls. Everything is called out, and as far as I know there were no callouts here (e.g. “gear up”).
This is a bit like someone parking their car, pulling the handbrake, turning off the car and putting their keys in their pocket, then arguing that it’s a practiced maneuver because it happens at the end of every car ride.
Turning the fuel off seems roughly equivalent to turning the ignition off when you've parked your car. It's really something rather unlikely to do as a brain fart during takeoff.
But we can already conclude that something unlikely did in fact happen, otherwise there were more fatal 787 crashes. I don't think "it's unlikely" is a good argument for dismissing potential causes here.
They do make an effort to make it hard to do safety critical stuff by accident though in cars, small planes and jets. Like in a car it's easy to mix indicators and windscreen wipers which are on various stalks but turning off the engine and locking the steering is very different action, on traditional cars turning the key and taking it out. Similarly here the fuel cut offs are obvious levers that have to be pulled out before they can be moved.
You have to lift and turn these knobs. Hard pressed to think of other knobs like this one. Especially that there are none like it anywhere near those cutoff switches. It seems intentionally designed this way
> These switches are locked into place with a spring loaded detent switch. It's impossible to accidentally switch these off.
The report specifically mentions SAIB No. NM-18-33 which would be a very odd thing to do if the investigators didn't at least consider this to be a possibility.
> You say muscle memory. No muscle memory is involved in fuel cut off for both engines seconds after take off.
It doesn't matter when the action is normally done - muscle memory means that the complex action of flipping a guarded switch doesn't really need a bigger brain fart than any other input because once the action is initiated you're acting on autopilot.
you make some good points but i thought your example was funny. No, i have never left my phone in the fridge. And i’m in my 30s, so not that young.
I HAVE sometimes “lost” my phone in my own backpack though (lol).
Here’s my take as a non-pilot. Takeoff is a sequence of checklists and procedures that are repeated. Often. If it’s muscle memory, a brain fart seems very unlikely… that’s why i’m skeptical of your theory.
A better analogy would be “have you ever forgotten to put on shoes before leaving your house?” And no, i have not, even during emergencies or when i’m very tired (like when i had to rush my wife to the ER). Why? because that’s something i do daily, and is part of my checklist when departing my house.
Or “have you ever forgotten how to get to work?” that also is extremely unlikely, because one typically follows the same exact steps and route daily. And i don’t randomly turn off my engine while driving, even if i’m multitasking or im forced to take a slightly different route due to a detour.
To be clear, i’m not saying it’s physically impossible. I just find it inconceivable.
> Brain farts are a real phenomenon, and an accidental fuel cutoff most closely resembles the transcript from within the cockpit.
What transcript? We only got a few potentially re-phrased bits of what was said. That the preliminary report is very careful about not implicating either pilot is not evidence of anything except that the investigative team is not yet 100% sure on the matter.
The evidence points to inadvertent fuel cutoff switch movement rather than pilot error, or intentional pilot action. Most likely cause being locking mechanism failure combined with takeoff acceleration forces.
Investigation and preliminary report is not showing critical evidence that would help clarify. Like the full transcript of pilot conversations that is clearly already available, and if these switches had any maintenance in the last year.
The fact that both pilots denied moving the switches, combined with the extremely short timeline, makes mechanical/electronic failure the most probable cause.
Note the Critical Sequence:
08:08:39 UTC: Aircraft lifts off (air/ground sensors transition)
08:08:42 UTC: Maximum airspeed of 180 knots reached
08:08:42 UTC: IMMEDIATELY after max speed, both fuel cutoff
switches transition from RUN to CUTOFF (1 second apart)
08:08:47 UTC: Both engines below minimum idle, RAT deploys
08:08:52 UTC: Engine 1 switch returns to RUN
08:08:56 UTC: Engine 2 switch returns to RUN
So only 3 seconds between liftoff and fuel cutoff. Extremely short window for deliberate pilot action...
That doesn't make sense. If a pilot wanted to deliberately cut off the engine there's no reason they couldn't do at that time. The time difference between the switches being one second shows it was more likely to be deliberate, not less. An accidental hit would result in both happening at the same time, not with a time delay.
The two switches changed in sequence, but within the same second and at max speed. Dont think a human can have such a timing. If you look at the timing it looks more and more like electronical or software triggers.
Another possibility is a foreign object like a personal item sliding back during acceleration.
I looked at both pilots background, and unless a story of medical depression on the part of the captain emerges, I dont see the pilot suicide as plausible.
Well I'd Never sputter
Good Ma'am or Sir, ARE you implying something like a "MAIN BATTERY EXHAUST"¹ retrofitted to a flagship product because management was impatient and wanted the lighter, better, faster, stronger lithium-ion-battery for their rushed 787-sized baby?
First of all, thank you for calling attention to this. You’re absolutely right, despite what others are saying here. That’s why there’s a movement for reforms.
Secondly, yes, it was likely a deliberate action to cut off the fuel switches, as you say.
You are absolutely right that there’s an epidemic in the airline industry that forces pilots to stay quiet rather than risk their careers if they’re dealing with mental health issues.
In a sibling comment: “shouldn’t they be given alternate career paths?” No. Perpetuating the myth that people with mental health issues are somehow broken beyond repair is mistaken. Current policy lead directly to that one fellow to lock the cockpit door and slam the plane into a hillside. If Air India 171 has any chance of being a mental health issue today, it should be highlighted and explored. You’re exactly right to be doing that, and thank you.
Anyone who disagrees with this should watch https://youtu.be/988j2-4CdgM?si=G39BwNy1zJEeUi2k. It’s a video from a well-respected pilot. The whole point of the video is that aviation forces people to conceal their problems instead of seek treatment, and that this has to change.
> Current policy lead directly to that one fellow to lock the cockpit door and slam the plane into a hillside
While obviously the incidents are terrible, do you really think he would self-report, voluntarily endure 6+ months of therapy and come back like new, if only the current policy didn't lead him to do what he did?
Totally armchair, but I think people like the German dude and allegedly (but who knows) the Malaysian Zaharie are far gone. The only thing that can help is mandatory health checks, and even then who knows if it's possible to screen for everything.
Sorry, that conclusion is just silly. I know people in the airline industry (some pilots and a number of flight attendants) and the problem is not that they're forced to conceal mental issues.
The problem is that many people in aviation imagine that they need to conceal their problems. And they point to videos like this one as proof of that, ignoring that the events of discussed in the video are actually proof of the opposite.
Emerson (the suicidal pilot in the video from Alaska Airlines Flight 2509) self-medicated himself using hallucinogenic substances and developed suicidal ideations, because he didn't seek treatment (like therapy) for his mental issues after the death of a friend. If he had sought treatment, he'd still be flying today because he wouldn't have tried to kill several dozen people, and he would have learned to cope with his depression.
Props to Xyla for speaking out. Her case is interesting because her depression was caused by hormonal birth control, and was temporary, but she’s still grounded.
> And they point to videos like this one as proof of that, ignoring that the events of discussed in the video are actually proof of the opposite.
I have no idea how this video’s chapter 6 can be titled "a call for change" and then you still deny that the video is saying there’s something desperately wrong with the aviation industry. All I can think of saying is that you’re mistaken. It’s proof of exactly what the video is saying needs to change.
We’ll have to agree to disagree. I feel bad for all the pilots who have to deal with this kind of attitude about mental health issues, as if suicidal ideation should somehow disqualify someone from working in their chosen profession. People in the military are allowed to feel suicidal. Your doctor is allowed to feel suicidal. The guy next to you on the road is allowed to feel suicidal. But pilots? Nope. It’s treated as this unspeakable awful thing, and you’re forcing people to get "treatment" where they report "yes, that totally worked" (a lie) or else suffer consequences. If you don’t see how backwards that is, no words of mine will persuade you otherwise.
Why argue so vehemently that treatment should be denied to people? That’s what you’re doing by saying there’s no problem and that nothing needs to change. I assure you, the pilot in the video likely knows far better than your friends. That’s why he made the video.
>since they can't continue as pilots if they seek treatment)
You have your facts wrong. Pilots can and do fly if they have mental health diagnoses, as long as they are well managed and there is no history of psychosis or suidical ideation. This is how it should be.
On the contrary, that video actually supports the OP's claim. A pilot with a well-managed mental condition would be allowed to fly. So, a pilot with depression over the loss of a parent would still be allowed to fly.
But a pilot with suicidal ideations, or taking hallucinogens, like Emerson from Alaska Airlines Flight 2509 (the flight discussed in the linked video), would not be allowed to fly. And that's exactly the way it should be...
The issue is that many pilots don't seek treatment for mental issues because they imagine that they'll be grounded if they do, even though FAA policy, and most airlines' policy, is to allow them to continue flying.
Suicidal ideation is a normal part of being human. Fantasizing about committing suicide by crashing a plane is jot. Neither of these are remotely comparable to hallucinogens.
Bingo. And to be clear, if someone is explicitly fantasizing about crashing their plane, then obviously that’s worth grounding them until the condition is fixed. The crucial part is (a) that they still make a living, thanks to insurance, and (b) that they admit it, both to themselves and to everyone else.
I pointed out in https://news.ycombinator.com/item?id=44546377 that this is mistaken and why. Dehumanizing someone because they have suicidal ideation is exactly the kind of attitude that puts people at higher risk.
You’re forcing people to pretend like they don’t have suicidal thoughts. That doesn’t work. Attitudes that it somehow does work are backwards.
It is explicitly dehumanizing them by saying they’re not allowed to be pilots despite having issues. Claiming that it’s not is again part of the problem.
You can’t imagine what it’s like to worry about losing your career because of something you’re forced to keep secret, and is entirely treatable. That’s the kind of barbarism that future generations will look back on us and shake their heads at.
I hope you never have to worry about being de-yourjob’d. In the meantime, let the people who are worried about it campaign for change.
I imagine women had to face similar discrimination when campaigning to be allowed to fly. There were likely a bunch of people saying that the current system was fine, and besides, they didn’t trust a woman to do the job. Just because we’ve moved from discrimination against sexes to those with mental health issues doesn’t mean the system is perfect.
Without necessarily taking a side (I don't know enough about the specifics of the FAA policy or the various incidents over the years) I'd like to suggest that you are rather missing the point of the person you are responding to.
Take your argument to the extreme. Suppose someone has a physical or mental issue that renders them unable to reliably judge a certain type of situation or undertake some action that must be made consistently and repeatedly for safe flight. Presumably such a person has no business in a cockpit, let alone on a plane with hundreds of passengers on board?
The above clearly demonstrates that there are certain minimum requirements for practical reasons and that not everyone in the population is necessarily expected to meet them. It isn't a value judgment but rather an observation about the reality of the world we inhabit.
So the person you are responding to here is suggesting that suicidal ideations might be incompatible with the safety expectations of piloting a passenger airliner. Meaningful disagreement would need to somehow address the practical concern as opposed to deflecting with an appeal to emotion.
A related example that might be worth considering would be someone who suffered from severe and debilitating panic attacks. Or someone deemed to be at particularly high risk of having a heart attack. Or any number of other potentially debilitating conditions that can have sudden and unpredictable onset.
Feeling suicidal isn’t a debilitating condition. People around you have suicidal ideation every day, and they manage their jobs well.
I’ll counter your argument with this: a bus driver is allowed to feel suicidal ideation, yet they safeguard the lives of everyone on board. Maiming everyone would be as easy as accelerating on the highway and swerving off the road. Yet we don’t worry about this, because it’s rare enough not to matter.
Meanwhile if you say "a suicidal bus driver has no business behind the steering wheel", congratulations, you’ve just forced all the suicidal bus drivers to hide their condition.
You’re not going to be able to detect this illness the way you can detect the ones you name. Your policy is going to force people to hide it. It’s a dumb policy. That’s not an appeal to emotion.
tl;dr We're talking about a $200 million piece of equipment. This isn't your typical job. Merely "getting by" is nowhere near sufficient.
That line of reasoning isn't an appeal to emotion but your earlier focus on dehumanization and discrimination most certainly was.
I think it's a reasonable point that such a policy exhibits a severe perverse incentive. So the question becomes, how many lives are lost due to the perverse incentive versus if the policy didn't exist? Someone with the right knowledge and resources can at least make an objective attempt at estimating that.
Regarding bus drivers I'll observe there is a stark difference in both scale and certainty of death. The degree to which safety risks are tolerated almost invariably scales with such metrics. Pilots operate in a domain where an unmitigated failure not resulting in the deaths of everyone on board is far closer to the exception than the norm.
There are also public perception and financial angles to consider. People are rather paranoid about hurtling through the air in metal tubes. The equipment is also rather capital intensive, with a 787 and a hyperscale data center falling vaguely in the same order of magnitude. As such many of the practices surrounding that activity go a bit overboard from an actuarial perspective at least in comparison to other common daily pastimes (but not in comparison to aforementioned data centers).
Which circles back around nicely to your leading statement. It is the act itself, the attempt to commit suicide, that I think is reasonable to view as a sudden and debilitating condition. Those with suicidal ideations are statistically more likely to suffer from that. I think it's extremely similar to the heart attack example, and policy certainly requires commercial pilots to have regular physicals. The primary difference (and potential point of contention) is that there's no straightforward way to hide a physical condition whereas you probably can hide a mental one and (unlike a physical one) doing so is likely to exacerbate it.
> I think it's a reasonable point that such a policy exhibits a severe perverse incentive. So the question becomes, how many lives are lost due to the perverse incentive versus if the policy didn't exist?
There is also the question if they are better ways to reduce the perverse incentives.
1. If the pilot hides his mental illness, a mentally ill person is flying the airplane.
2. If the pilot gets treatment for his mental illness, a mentally ill person is flying the plane.
P.S. When I was a teenager, I tried to join the Air Force to be a pilot like my dad. But since I wear glasses, there was no way. The AF was perfectly justified in not taking me, I understood that. I empathize with the rejected pilots, but that's the way it has to be. Life isn't fair. So I chose another career.
Where's option 3: a pilot gets treatment for his mental illness and is signed off as safe to fly a plane? For all that it's a fallible process, that seems better than options 1 & 2.
Does it? I've never heard of anyone being cured of mental illness, just drugs that relieve the symptoms. The body develops resistance to the drugs, the drugs usually come with bad side effects, and patients often go off their meds.
Pilots who develop a heart condition get their license revoked. Every pilot knows this. There's nothing fair about that, either.
Fun fact - my Air Force dad told me that when an airplane was overhauled, the chief mechanic went up on the check ride. That ensured the job was well done.
It seems trivial that it's better than option 1; in both cases a mentally ill person is flying the plane, and in one of them a health professional is involved in managing the condition.
For option 2 I'll confess to not being sufficiently familiar with the gamut of what can be considered a mental illness, such that I couldn't tell you whether a person under management for such is a safer pilot than someone undiagnosed, or the median pilot. I'd be mildly surprised if you were, but stranger things have happened.
As it stands, I expect these would be the same diagnostics that until ~2013 considered sexual preferences as mental health issues.
Mental health is indeed an inexact and poorly understood condition.
As pragmatic rule, if one is prescribed drugs for it, one is not fit for being a pilot.
I know several people who are prescribed drugs for mental conditions. I would not get on an airplane if they were the pilot. Nor would I get on one with a pilot with a heart condition. It doesn't mean they are bad people, it's just the way it is.
well in case 2, the pilot get treatment and a doctor will decide if she is fit to fly. That's not bulletproof but still better than case 1.
And to your other point, it's easier to give up on your dream job when young and start with a career that you are a fit for, than to be kicked out after a huge sunk cost and maybe even half way to retirement (illnesses might not be known until later in life). Just as disappointing, but not nearly as life destroying.
I was prescribed glasses when I was 5. Since then, they have preserved my eyes from damage from at least 3 incidents. I no longer mind them - I like the protection!
This is like saying that we've had a problem with people piloting with pneumonia, so anybody sniffling or taking sudafed won't be allowed to pilot (the FAA is fine with sudafed). One hopes that getting pilots early treatment for incipient mental health issues would help ensure that they don't wind up with more serious issues.
It looks like the FAA has within the last few years gotten chiller about some antidepressants, but that they still require an elaborate and complicated process to approve use of them.
Those don't have to be the only two options. You can also criminalize hiding your mental illness as a pilot while incentivizing self-reporting via sufficiently generous disability insurance.
tangent: I believe Air Force and Navy have loosen the vision requirement quite a bit. IIRC the new rule only measures the corrected vision, regardless how you corrected it, including wearing glasses.
My dad had 20/10 vision. He was always first to identify enemy aircraft. They didn't have onboard radar at the time.
Wearing glasses still has issues. I have astigmatism, and so if I turn my eyes but not my head, I receive a warped view of the world. This is why I was simply terrible at baseball, tennis, etc. My brain could not adapt to this. I have difficulties with depth perception as a result, too.
I was more or less born to be a nerd. It's pointless to fight my fate :-)
No, it is not damning evidence or strong evidence either way. It would be strong evidence only if treatment significantly reduces the probability of a pilot's committing suicide.
Does it bring the risk of suicide to general population baseline? And if not would you still want the affected people be responsible for hundreds of lives?
It doesn't look like it: it says that the risk of suicide attempt for those experiencing depression decreases 37% with psychotherapy. But the baseline 12 month suicide risk is ~14/100k, while those experiencing major depressive disorder are at ~120/100k. So ~5 fold elevated risk after psychotherapy.
Wouldn't it be better to provide such pilots alternate career paths? That way they can still make a living and the traveling public is not placed under unnecessary risk.
Captain Steve discusses mental health issues amongst pilots during his discussion of the AI events after this most recent news. He's a trained counselor who got into counseling pilots exactly because of mental health issues he's seen with colleagues and students https://youtu.be/MD64uYK926o?t=742 .
It is known that the switches cannot effectively be flipped by accident.
It is known that the switches were set to "cut-off" because they were then later restored to "run", so it was not an electrical fault (i.e. switches pointing to run but reporting cut-off).
Pilot dialogue and engine telemetry confirms the cause of power loss was fuel cut-off.
The question I can't help but think is how did the pilot realize it was the cut-off switches?
I'm sure there's a warning message for them somewhere but in the few seconds of time when you're losing thrust right after rotate, and you're bombarded by a lot of warnings and errors on the screen and in the speakers: how likely are you to notice the fuel cut-off switches have been flipped?
Those switches are something you never, ever think about during operation because you're trained to only operate them when starting up and parking (and yes, in an emergency where you need to shut down the engine quick).
How long would it take for an average pilot to realize it's not one of the dozens of memory items pointing to more likely scenarios causing loss of thrust, ones that they've been training to check in case of an imminent emergency? And why didn't the first pilot who was recorded to notice the fuel cut-off didn't immediately flip the switches to "run" position first instead of asking the other pilot about it?
Given what you're vaguely implying -- that the switches would be nowhere near the first thing a pilot would normally think of in the kind of situation -- what are the odds the pilot asking on record "did you flip the fuel cut-off switch?" is the one who actually flipped the switches and was simply trying to fool the would-be investigation (even knowing they all are about to perish)?
> what are the odds the pilot asking on record "did you flip the fuel cut-off switch?" is the one who actually flipped the switches and was simply trying to fool the would-be investigation (even knowing they all are about to perish)?
This is such a diabolical mind-game that it never occurred to me. Like, they would all die, why would he want to incriminate someone else? But yet, people are weird and crazy. And maybe he didn't go down as a killer and decided to incriminate the other pilot? Anyway, it is totally possible to have happen. Sadly there are no cameras the cockpit, and a camera in the cockpit would really have help to find who did what.
Just a random example and I have no indication that that's what is going on here, but life insurance generally doesn't pay out for suicide so you'd need to make your death look like an accident or caused by someone else if you want to pull of a scam. Pointing this out to say it could be much more banal than some diabolical villain that gets off of killing hundreds of people.
I'd say the odds are 50%. The odds of the opposite scenario - where the pilot who said "did you flip the fuel cutoff" wasn't the one who did it are also 50%.
Based on the cutoffs for both engines being flipped 1 second apart, the above exchange being caught on the CVR, and then within 10 seconds the (presumably the other) pilot switching them back to Run, it's pretty clear that this was a deliberate act.
There is likely much more on the CVR than what has been released in the preliminary report - which seems to have been carefully sanitized so it doesn't implicate either pilot. I expect the investigators have a much better idea but not one that they are 100% confident in making public yet.
I've been reading commentary on aviation forums like PPRuNe and the consensus amongst pilots and others in the field seems to be that "electrical glitch" is a near impossibility. Also, the report states "and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec". They wouldn't have said the switches transitioned from one position to another if they weren't certain, they would have said something like a voltage change consistent with cutoff occurred. Several people have pointed out that these are large mechanical switches that make a distinctive noise when moved and the CVR is sensitive enough that it would have picked it up. Also, it's important to note that no safety bulletins were issued to Boeing as they would have in the case of some electronics issue.
Now, when I say deliberate act, I don't necessarily mean "pilot suicide" though that is certainly a strong possibility.
I’m more familiar with the 737 (as a hobby, not as a pilot), but for that aircraft the “loss of thrust on both engines” checklist has the start levers as the second item on the list.
Note that in the checklist I am looking at the goal is to restart the engines rather than diagnose the failure and that involves these levers. I suspect you’d notice pretty quickly if they were not in the expected location.
Thanks, this is good information. So it then fits the overall picture that they would've actually bumped into these switches in the rush of emergency eventhough they're never expecting the switches to actually be off.
Just from a systems perspective if the actions to restart the engines can be parallelized then they should be; maybe only one engine will start. You don't want the 50% (for 2-engine aircraft) chance that you spend time on the one that won't start before trying the other.
I would assume that the engines cur of due to fault in the shared control system.
And to restore power the pilots toggled the switches to off and then back on to get them running again.
Hopefully the timestamps tell if the engines lost power before switches were turned off? Or is there some time window that was not recorded due to the lost power to systems?
This is one of the first scenarios that came to mind for me as well.
i.e. hypothetically, no one flipped the switches to cutoff initially, but a glitch in a computer component caused the same effect, including some indication (a status light?) that the switches were in cutoff state. One of the pilots saw the indication, and asked the other. The other (truthfully) said they hadn't. Ten seconds of confusion later, one of them flipped the switches off and back on to reset the state to what it should have been.
That assumes that the switches are part of a fly-by-wire system, of course. I am not an aircraft engineer, so maybe that's not a safe assumption. But if they're fly-by-wire, seems like there might not be a way to know for sure without cockpit video, because the logging system might only log an event when the switches cause the state to change from what the computer thinks the current state is, not necessarily when the switches change to the state the computer thinks they're already in.
Someone bumping the switches accidentally seems worthy of investigation as well, given the potential for an "Oops! No locking feature! Our bad!" scenario on the part of Boeing that's mentioned in the BBC article.
Why would you assume that? The engines were providing thrust to achieve normal take off. If they did that to restore engine power why would the voice recorder have one asking the other why he cut off the engines?
Maybe the pilot who cut-off the fuel was the one who asked “why did you cut-off?”. Knowing full-well the conversation is recorded in order to fool investigators, lay blame and confuse his colleague.
How can it be known that the switches were moved physically and not some electrical signal occured on its own (fault) equivalent of switches operated, without actual physical moement of the switch? Some electronic fault in the line of the signal. I do not expect having an independent sensor for this switch monitoring actual physical movements of the switch in parallel of the intended fuel controlling signals occurring, so the faulty signal reaching valves may have been registered and assumed that actual physical movement of the switch caused it?
We know that they restarted a few seconds later a few seconds apart from each other, and shut off a second part from each other.
It's extremely unlikely for a pilot to decide to react by shutting both switches off, then turning them on within seconds (this is not a failure mode they'd have expected, deciding to shut the engine off a couple hundred feet in the air would be... a fairly reckless decision).
That leaves both switches spontaneously turning off, then back on, a couple seconds after takeoff, which is a failure mode that's never been seen before once let alone twice. Also the pilots didn't make a statement about an incongruity between the report from the plane's systems about the switch being off vs the physical position, which they very likely would have in such a situation.
I find these comments very illustrative when taken together- they nicely show how different explanations sound spot on until you read the next one. Inexplicable is one of the great words in the English language
it makes sense to me that the pilot who said "I did not do it" actually did do it without realizing it, was supposed to be putting the landing gear up when he committed a muscle memory mistake. it happened around the time the landing gear should be up, and this explanation matches what was said in the cockpit, and the fact that the landing gear wasn't retracted. I think this idea was even floated initially by the youtube pilot/analysts I watch but dismissed as unlikely.
The landing gear lever is rather prominently featured in the 787 in a panel central to the cockpit layout so that either pilot can easily reach it. For decades and across many manufacturers, the landing gear lever has traditionally featured a knob that deliberately resembles an airplane wheel. It's very hard to mistake it for anything else. It's actuated by simply moving it up or down.
The fuel control switches are behind the throttle stalks above the handles to release the engine fire suppression agents. These switches are markedly smaller and have guards on each side protecting them from accidental manipulation. You need to reach behind and twirl your fingers around a bit to reach them. Actuating these switches requires pulling the knob up sufficiently to clear a stop lock before then rotating down. There are two switches that were activated in sequence and in short order.
The pilot monitoring is responsible for raising the gear in response to the pilot flyings' instruction.
I would find it very difficult to believe this was a muscle memory mistake. At the very least, I would want to more evidence supporting such a proposition.
This idea strikes me as even more unlikely than someone shifting their moving vehicle into reverse while intending to activate the window wipers.
Or even crazier, a manual shift on the steering column. Nothing weirder than pushing down the clutch and then changing the gear with your hand on a knob off to the side of the steering wheel.
I think the aircraft being familiar makes it worse: if you're used to going through a certain motion to do a thing, it may be one of things your brain can do without really thinking about it much, which is where the danger comes in.
I've engaged my wipers when meaning to shift gears before, in my truck which has a steering column shifter. After driving the truck for years. I have ADHD and I very often let my brain go on autopilot for things I do every day, and sometimes it just does the wrong thing. It doesn't matter how complicated or "intentional" the task has to be: my brain will memorize it to the point that it can execute it on its own without me consciously thinking about it.
I think it's totally plausible it was a muscle memory thing, if the at-fault pilot's brain works anything like mine.
(Side note: I actually took some flying lessons, including going through all of ground school, and realized that my brain is just not cut out for flying. I am the type of person to "cowboy" things if I feel like they're not worth doing, and flying is an activity where the tiniest missed checklist item can result in death, so I realized I have a statistically high likelihood of crashing due to some boneheaded mistake, and stopped taking lessons.)
There is no temporal nor spatial adjacency to the switches. The switches are equivalent to the ignition on your car, you operate it in the beginning and end of your trip, and there is nothing during the trip that will involve manipulating this switch.
There’s been at least 2 times I’ve turned my ignition switch while driving. (Luckily it was into the “on” position instead of off.)
Everyone in this thread thinking “these actions are temporally and physically distinct and therefore impossible for anyone to confuse” isn’t really thinking about the problem the right way. It’s not that I’m actually confusing two actions. It’s that I’m accidentally allowing my brain to perform one action when I meant to let it perform another action. “Allowing” is an important word here, because it illustrates that my brain is capable of doing this on its own without me thinking about it, and often will do it on its own, if I let it.
I firmly believe this is not the case. Putting more obstacles between me and the thing I’m trying to do, just trains my brain at rote performance of the task. It’s still “autopilot” as far as my brain is concerned.
This could be anything: starting a car, taking off a medicine cap, typing my password, clicking around cookie warnings. If I have to do it repeatedly, my brain will be able to perform it subconsciously, and I will do it without realizing it.
For fuel cutoff switches, it doesn’t matter that there two of them in a row. If you cut off both of them every single time, and you fly every day, your brain is gonna automate that task.
But the 787 doesn’t have an easily confused layout like that. The landing gear lever and fuel cut off switches are not two stalks on the yoke. Aircraft cockpits are deliberately designed in such a way that important things have differently shaped actuators that feel different from each other. Precisely so that you are not accidentally flipping the wrong switch by accident.
Actually the birth of Human Factors was related to this...
Alphonse Chapanis, a psychologist working at the Army Air Force Aero Medical Lab in 1942, investigated the issue and discovered a design flaw. He observed that the controls for the flaps and the landing gear in the B-17 cockpit were nearly identical and located close to each other.
This is exactly how the investigations are NOT conducted. You don't find the evidence that confirms your theory and call it a day when the pieces sorta fit together. You look solely at the evidence and listen to what they tell you leaving aside what you think could have happened.
One of the nice things about finally having the preliminary report is I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk at work because the preliminary report solidly disproved all of them so far. If anyone even had and stuck with an idea matching this report it wouldn't have stood out in the conversations anyways.
The collection of comments on this post remind me it'll just be a brand new set of random guesses until the final report is released. Or worse - the final report reaches no further conclusions and it just has to fade out of interest naturally over time.
It's human nature to want to guess at possible explanations for things that are unusual and unexpected.
If hearing those guesses annoys you, nobody is forcing you to read through comments on a thread of people making them! (I hope - sorry if you are being forced after all.)
> If hearing those guesses annoys you, nobody is forcing you to read through comments on a thread of people making them!
It’d be nice if we could only read insightful comments, and unread the wacko comments, but we can’t. This discussion has actually provided a lot of useful comments from people who seem to know what they’re talking about, but also a lot of really wild speculation.
Idle speculation is far from the only thing you won't find me supporting just because it's human nature. Thankfully, HN comment threads tend to include a lot more than just that kind of discussion, which is why I read them. Indeed there are lots of great details I didn't glean or fully understand in the report covered in the comments.
That doesn't mean I will always agree with the comments (or that everyone will always agree with mine) and that's okay. It'd be a very limited value discussion if we could only ever comment when we agree. It seems exceedingly unlikely any of this has something to do with users being forced to be here though.
I... don't believe that's the case? Though happy to be proven wrong. Unless perhaps you mean a moderator of a different forum, though that wouldn't really be relevant to their reading a thread of HN comments on a subject that annoys them.
Not me! I'm not even sure I'd be the right type or the right energy level to do it if the opportunity even came up. Hats off to the team here for the dedication.
Double engine failure was confirmed, not disproven. RAT deployment was confirmed, not disproved. Pilot error, confirmed, not disproven. Preliminary and final aviation reports are mostly guesses.
I don't think it's fair to say that pilot error is confirmed yet. It seems like a reasonable hypothesis, but what if the electronics glitched out and acted as though the cutoff switches had been flipped (the first time), even if they hadn't? All of the currently-disclosed facts still line up with that scenario IMO.
Even as a matter of safety/investigation hygiene, "pilot error" should be the conclusion of last resort, arrived at after months of poring over data, and because nothing else seems viable.
If we decided to pin all aviation incidents on pilot errors, we wouldn't even have invented checklists (what do you mean you forgot, try harder the next time).
"Natural" pilot errors lead to lessons that can be incorporated into design/best practices. That does not seem to be the case given current understanding: no flaw in any switch design seems apparent, and it does not sound like something you could do by accident.
So "pilot error" is not the "cracking the case"-grade conclusion it is being made out to be, it is an act of investigative resignation. In the days following the crash, allegations of mixing up flaps and landing gear were floated, and they all turned out to be wrong. This is not even accounting for the fact that the pilots are not around to plead their case, and basic human dignity requires us to defend their case until evidence clearly points a certain way
This is the difference between the official investigation and casual online comments for which it's OK to consider it pilot error once there is sufficient indication for that.
> I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk
This was a really disappointing incident for aviation YouTube - I unsubscribed from at least three different channels because of their clickbait videos and speculation.
> There is no possible way to confuse these two actions.
This is obviously an overstatement. Any two regularly performed actions can be confused. Sometimes (when tired or distracted) I've walked into my bathroom intending to shave, but mistakenly brushed my teeth and left. My toothbrush and razor are not similar in function or placement.
That's just your brain associating the bathroom with the act of brushing your teeth, and therefore doing it automatically upon the trigger of entering the bathroom. It bears no resemblance to the accidental activation of a completely different button.
The other poster's correction: "it’s like brushing your teeth with razor" is apt. Touching the fuel cutoff switches is not part of any procedure remotely relevant to the takeoff, so there's no trigger present that would prompt the automatic behavior.
Good analogy. Things I do every day in front of the mirror, but I occasionally attempt to squeeze some soap on my toothbrush. Or I have to brush my teeth and I find my beard foamed up. Or I walk out of the shower after only rinsing myself with water.
Not a bathroom one, but the number of times I've tried to pay for public transport with my work/office fob is mental. Generally happens on days where I'm feeling sharper than average but also consumed with problem solving
If someone confused their steering wheel for the brake you'd probably be surprised - there are indeed errors that are essentially impossible for a competent person to make by mistake. No idea about the plane controls, though.
Even in modern "fly by wire" cars the steering wheel and brake pedal have an immediate effect. They are essentially directly connect to their respective control mechanisms. As far as I understand both of the plane controls on question just trigger sequences that are carried out automatically. So it's more like firing off the wrong backup script than scratching the wrong armpit.
The only two production cars on sale where the steering wheel is mechanically decoupled from the wheels are the cybertruck and a variant of the Lexus RX.
Essentially impossible is not the same as impossible. We already know that an improbably sequence of events took place because a plane crashed which is highly unusual.
Technically an overstatement but not by much. Correctly restated, its highly unlikely these actions were confusing pilots. It's as if you mistook flushing your toilet twice when instead you wanted to turn on the lights in your bathroom.
I don't agree with the "twice". A frequently performed manipulation like the fuel cutoff (usually performed after landing) collapses down to a single intention that is carried out by muscle memory, not two consciously selected actions.
Not really, though. They're both (retracting the gear, and cutting off fuel) just toggle switches, as far as your brain's conscious mechanisms go. Doing them both on every flight dulls the part of your brain that cares about how they feel different to perform.
(I'm not strongly arguing against the murder scenario, just against the idea that it's impossible for it to be the confusion scenario.)
I meant philosophical toggle switches, not physical ones. The gear can go between down and up. The fuel can go between run and cutoff. Given enough practice, the brain takes care of the physical actions that manipulate those philosophical toggles without conscious thought about performing them.
Genuinely curious - could heavy marijuana use cause confusion between landing gear and fuel cutoff? Or some other drugs? (Wondering if they screen pilots for alcohol before they board an aircraft.)
The other day I was eating dinner while chatting with my partner. I finished eating and needed to pee and throw away the fast food container. I walked straight to the bathroom, raised the toilet lid and threw the fast food container right into the toilet.
As I get older, I do some similar stuff, way more than past, even it is just once per month. And I guess way more when sugar is high than not. Don't know your age or medical profile and I am not a doctor, just keep an eye.
Because there's no difference in actions needed to do so. A similar mistake is throwing away a useful item while holding onto a piece of trash. The action is the same, it's just the item in question that's different.
This is not what happened here at all. The actions needed to activate the fuel cutoff switches are not similar to any other action a pilot would want to make during takeoff.
How about actual switch covers (and switches that are not located right in the same area as stuff you are using routinely) instead of a glorified detent? Though I suspect this would also succumb to muscle memory
What about up on the overhead panel where the other engine start controls are?
Or (at the cost of complexity) you could interlock with the throttle lever so that you can't flip the cutoff if the lever isn't at idle
Also the fire suppression system is a different activation (covered pull handles I think)
> How about actual switch covers (and switches that are not located right in the same area as stuff you are using routinely) instead of a glorified detent? Though I suspect this would also succumb to muscle memory
The switches are already pretty distinct - but that only reduces failures, it can never eliminate them entirely.
> Or (at the cost of complexity) you could interlock with the throttle lever so that you can't flip the cutoff if the lever isn't at idle
More complexity also means more failure modes. You don't want it to be impossible to shut down the engines due to a broken throttle sensor.
And a gun that doesn't let you point it at your face. And a knife that doesn't let you cut yourself. And a car that doesn't let you accelerate into a static object. And...
Hey my car won’t let me accelerate into a static object. It’s so good it will even slam on the brakes when driving 5mph in a parking garage because it thinks parked cars are oncoming traffic.
"Sent into terrain in seconds by flipping a switch" is both too inaccurate and feels too cursory to take as impetus for serious design criticism, especially when the extensive preliminary report explicitly does not recommend any design changes with the current information.
Hilarious how Hacker News routinely bashes software managers who don’t understand a problem space and give vague and impossible goals. But somehow “just don’t let an aircraft fly itself into the ground” is a reasonable statement.
If we are going to pretend that Hacker News is a single person who should have consistent opinions on different topics then we might as well pretend that we are in a room together.
Those are caused by operating the same lever in a slightly different manner. Not comparable to two completely differently designed levers placed far apart.
Same goes for accidental acceleration instead of braking. Two of the same kind of lever right next to each other.
Accidental acceleration while intending to turn on the wipers would be a fitting example, I don't think that happens though.
Think of the action as a stored function. Maybe they’ve always recalled the function as part of a certain list. It can be a case where the lists get confused rather than the modality of input (lever etc)
Landing gear controls are nothing like the fuel shutoffs. And they are in completely different locations. Landing gear controls are in front of the throttle, fuel shutoffs are aft of the throttles.
Is that "nothing like" though? You are saying they are in different places, ok, but are they similar in other ways? Are both controls the same shape? size? colour? texture?
Respectfully, it's not up to other people to disprove your toy theory. The question you're asking here can very easily be answered with a quick Google search.
The short answer is that they are _very_ different controls, that looks and operate in a completely different way, located in a different place, and it's completely unrealistic to think a pilot could have mistaken one for the other.
Different controls with different t shapes, operated in different ways, of different number, different size, and very different positions. One is down almost on the floor, and well rearward, the other is at stomach height and well forward.
The fuel cutoffs also require pulling the control out and over a guard.
Is there a video feed of the cockpit inside the black box?
If not there should be one as even my simple home wifi camera can record hours of hd video on the small sd card. And If there is, wouldn't that help to instantly identify such things?
No neither black box stores video. One stores audio on flash memory and the other stores flight details, sensors etc.
I don’t think video is a bad idea. I assume there is a reason why it wasn’t done. Data wise black boxes actually store very little data (maybe a 100mbs), I don’t know if that is due to how old they are, or the requirements of withstanding extremes.
This isn’t true. This was a 787. It does not use a separate recorder for voice and data (CVR, FDR).
(Most media outlets also got this wrong and were slow to make corrections. )
Rather, it uses a EAFR (Enhanced airborne flight recorder) which basically combines the functions. They’re also more advanced than older systems and can record for longer. The 787 has two of them - the forward one has its own power supply too.
There should be video as well, but I’m not sure what was recovered. Not necessarily part of the flight data recording, but there are other video systems.
That's really interesting. From reading air crash reports there's a lot of times I've seen."Nothing is known about the last 30 seconds because the damage broke the connection to the flight recorders in the tail"
In the US, the NTSB has been recommending it for over 20 years. The pilot unions have been blocking it, due to privacy and other things.
I'm not in aviation. But my between-the-lines straightforward reading is that unions see it as something with downsides (legal liability) but not much upside. It could be that there are a million tiny regulations that are known by everyone to be nonsensical, perhaps contradictory or just not in line with reality and it's basically impossible to be impeccably perfect if HD high fps video observation is done on them 24/7. Think about your own job and your boss's job or your home renovation work etc.
Theoretically they could say, ok, but the footage can only be used in case the plane crashes or something serious happens. Can't use it to detect minor deviations in the tiniest details. But we know that once the camera is there, there will be a push to scrutinize it all the time for everything. Next time there will be AI monitoring systems that check for alertness. Next time it will be checking for "psychological issues". Next time they will record and store it all and then when something happens, they will in hindsight point out some moment and sue the airline for not detecting that psychological cue and ban the pilot. It's a mess. If there's no footage, there's no such mess.
The truth is, you can't bring down the danger from human factors to absolute zero. It's exceedingly rare to have sabotage. In every human interaction, this can happen. The answer cannot be 24/7 full-blown totalitarian surveillance state on everyone. You'd have to prove that the danger from pilot is bigger than from any other occupation group. Should we also put bodycam on all medical doctors and record all surgeries and all interactions? It would help with malpractice cases. How about all teachers in school? To prevent child abuse. Etc. Etc.
Regulation is always in balance and in context of evidence possibilities and jurisprudence "reasonableness". If the interpretation is always to the letter and there is perfect surveillance, you need to adjust the rules to be actually realistic. If observation is hard and courts use common sense, rules can be more strict and stupid because "it looks good on paper".
You also have to think about potential abuses of footage. It would be an avenue for aircraft manufacturers, airlines, FAA, etc to push more blame on the pilots, because their side becomes more provable but the manufacturing side is not as much. You could then mandate camera video evidence for every maintenance task like with door plugs.
I wonder how the introduction of police body cam footage changed regulations of how police has to act. Along the lines of "hm, stuff on this footage is technically illegal but is clearly necessary, let's update the rules".
If you work in a job where the lives of hundreds could be ended in seconds due to an error or intentional action then there is no excuse to not have critical control surfaces recorded at all times. Non-commercial/private flights/flight instructors and trainees have cameras, trains have camera, stores have cameras, casinos have cameras, buses have cameras, workers who work for ride hailing services have cameras as do millions of other people who just drive.
Hopefully other countries will start deploying recording systems or start forcing manufacturers of planes to have these integrated into cockpits.
> The answer cannot be 24/7 full-blown totalitarian surveillance state on everyone.
Surveillance is actually pretty common in many high-risk environments. And piloting is very much not just any other job but an exceedingly rare situation where the lives of hundreds of people are in the hands of only two people without anyone else being able to do anything to influence the outcome.
That pilot unions don't want surveillance is to be expected (the union is there to act in the pilots interest) but ultimately it isn't just up to them.
> Should we also put bodycam on all medical doctors and record all surgeries and all interactions?
Yes. We are finally starting to do so for police. These are all situations where an individual or very small team has direct control over the life of others who can't defend themselves.
In fact, you could add some AI to it, even, as an embedded system with a decent GPU can be bought for under $2000. It could help prevent issues from happening in the first place. Of course airgapped from the actual control system. But an AI can be very helpful in detecting and diagnosing problems.
If you shut off the engines a couple of dozen meters above ground shouldn’t every alarm be blaring or there should be some sort of additional lever you have to pull way out of the way to enable shutting off the engine that close to the ground.
If you read through the boeing procedures, if an engine fails just after take off you delay cutting throttle or hitting the cutoff until you have positive climb and pass a certain altitude. Specifically because a mistake here would be so incredibly catastrophic. The following number of steps and verbal cross checks for then shutting down the engine are quite daunting. Not something applicable here, but still interesting to learn about
That’s absolutely applicable here.
It means that an engine cutoff shouldn’t be allowed at all during certain parts of flight. It’s not crazy to think that a design fix would be to prevent those engagements during certain parts of takeoff (a certain window). It’s fly by wire anyway so it could presumably be done programmatically.
MCAS was basically made to prevent user input that would send the plane into a dangerous angle. The computer overrode the inputs. So there’s precedent for something like it.
I just remember that it happened commonly enough to US pilots. American pilots always recovered quickly enough that it didn't make the news before the fatal crashes.
which has detailed information, but I don't trust the NYT. The article also erroneously reports that the MCAS trim rate is twice the speed of manual trim. The trim rate for both is 0.27 degrees per second.
MCAS autonomously adjusts trim downward. The trim switches override MCAS, but when released, MCAS can resume trimming down again. The trim adjustments don't "override" the pilot's elevator inputs (MCAS has no direct control over the elevators), but they can make the controls so heavy that it's impossible to pull up.
If MCAS is running the trim, the thumb switches override it.
MCAS affects the stabilizer, the thumb switches affect the stabilizer, the cutoff switch affects the stabilizer.
The elevators are controlled by the control column and the autopilot.
> The trim switches override MCAS, but when released, MCAS can resume trimming down again.
That is correct. That is why the procedure is to return the trim to normal with the thumb switches, then turn off the trim system. That's it. That's all there is to it.
> but they can make the controls so heavy that it's impossible to pull up.
Almost right - the trim has more authority than the elevators. The trim's ability to travel far is to provide great ability to get out of trouble. I don't really know what factors the aerodynamics guys used to calculate the max travel required. I do know there is a travel limiter on it (as I worked on that, too!) which reduces the max travel at higher speeds, because otherwise it can rip the tail section off, which is a big no-no.
There are sooo many constraints on the design of an airplane I sometimes wonder how anyone manages to make one that works at all. The Wright Bros calculated that their machine would fly, and it did, barely. Their contemporaries did seat of the pants design, which is why they failed.
Thank you. I've had commercial pilots email me telling me I was correct and to keep on the good fight :-)
The Wrights did a lot more than that to be successful. Their innovations were:
1. using a wind tunnel to correctly get lift and drag coefficients for various wing sections (as you wrote)
2. first aviation engine (high power/weight ratio) (as you wrote)
3. first propeller theory, enabling 90% efficiency (other aviation propellers were 50% efficient)
4. first 3-axis control system
5. identified and solved adverse yaw problem
6. first research and development program, where problems were identified in advance, and a machine was developed to solve each problem, then the solutions were put together to make the 1903 Wright Flyer
7. kept meticulous notes on all their work and preserved the evidence of their success, such as photographs and notebooks. Exacting replicas have been built, and their flight characteristics match the Wright's results
Would it matter in this case since you would crash either ways. I’m talking about protection in a very specific situation where you make it harder to shut off both engines when you’re very close to the ground.
All I’m saying is in those situations it should involve another toggle or pedal that needs to be pushed to cut off the engines so it’s outside the realm of muscle memory.
I don't think the theory is that the muscle memory sequences resemble each other.
Instead, it's that because muscle memory allows you to do things without thinking about it, you can get mixed up about which action you meant to perform and go through the whole process without realizing it.
They're pilots, they do hundreds of stops each year. In case of domestic pilots, even thousands. And with years of experience, switching off fuel control switches is basically muscle memory at this time now.
That's a ridiculous analogy. The pilots aren't sitting in front of a uniform set of keys that they need to press in a specific order with a specific timing.
The mistake equivalent to what the pilot supposedly did would be if the pianist accidentally stuck a finger up his nose instead of playing the notes or something.
Quite, but the point is that even after doing something correctly a thousand times, someone can make a mistake that seems unbelievable.
The cutoff switches are operated every flight so the muscle memory is there, ready to be triggered at the wrong time.
All we know is that something went wrong in the pilot's head in at least a single moment that caused him to perform a ground action during takeoff.
Depressive murder-suicide is one possible explanation. Altered mental state is another: insomnia, illness, drugs/medications could all explain an extreme brain fart. Perhaps he just had food poisoning? It's India after all.
I keep reading "muscle memory" but the theory that one pilot shut down the engines instead of performing another action has nothing to do with muscle memory.
Muscle memory allows you to perform both actions effectively but doesn't make you confuse them. Especially when the corresponding sequence of callouts and actions is practiced and repeated over and over.
All of us have muscle memory for activating the left blinker in our car and pulling the handbrake, but has anyone pulled the handbrake when they wanted to signal left?
i have several passwords i type all the time. sometimes i get them confused and type the wrong one to the wrong prompt. i type them by muscle memory, but i also think about them while typing and i think thoughts like "time to reach up and to the left on the keyboard for this password". I couldn't tell you the letter i'm trying to type, i just know to do that.
not all my passwords are up and to the left, some are down and to the right, but when i type the wrong one into the wrong place, i type it accurately, i'm just not supposed to be typing it.
"time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
> "time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
If that were true, pilots would perform arbitrary motions all the time. Same with car drivers.
Typing something on a keyboard, especially when it's always in the same context, is always essentially the same physical action. The context of a password prompt is the same, the letters on the keyboard feel the same and are right next to each other.
Not comparable to pressing two very different buttons placed far apart, in a context when you'd never ever reach for them.
One time I almost drove to work instead of the shopping mall, because driving to work was basically subconscious. But my car doesn’t have safety features designed to stop me doing that. And I never did it twice in a row.
that makes it less likely, not impossible, we're trying to match against the data we have. I think distracted muscle memory is more likely than suicide and sounding innocent while lying about it
Not possible. Two fuel cutoffs. Two engines. Two intentional acts in rapid succession. Plane would have survived one cutoff. It is what it appears. Captain crashed the plane.
Each of the fuel switches on the 787 is equipped with a locking mechanism that is supposed to prevent accidental movement, experts said. To turn the fuel supply on, the switch must be pulled outward and then moved to a “RUN” position, where it is released and settles back into a locked position. To turn the fuel supply off, the switch must be pulled outward again, moved to the “CUTOFF” position and then released again.
Or they could be inadvertently flipped if the "locking" version was not installed:
(see the avherald link):
>>India's media report that the investigation is NOT focussing on a human action causing the fuel switches to appear in the CUTOFF position, but on a system failure. Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India.
> Recommendations
The FAA recommends that all owners and operators of the affected airplanes incorporate the
following actions at the earliest opportunity:
1) Inspect the locking feature of the fuel control switch to ensure its engagement. While the
airplane is on the ground, check whether the fuel control switch can be moved between the
two positions without lifting up the switch. If the switch can be moved without lifting it up,
the locking feature has been disengaged and the switch should be replaced at the earliest
opportunity.
2) For Boeing Model 737-700, -700C, -800, and -900ER series airplanes and Boeing Model 737-
8 and -9 airplanes delivered with a fuel control switch having P/N 766AT613-3D: Replace the
fuel control switch with a switch having P/N 766AT614-3D, which includes an improved
locking feature.
> The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
I know it's probably not worth the hazmat tradeoff for such a rare event, but the F-16 has an EPU powered by hydrazine that can spool up in about a second.
The F-16 EPU is to keep the flight controls powered so the plane doesn't immediately become uncontrollable following engine failure. The EPU doesn't provide thrust of any kind.
The 787 and nearly every other commercial aircraft with powered flight controls [1] (fly-by-wire or traditional) has emergency power available via RAT and/or APU, and any fly-by-wire aircraft has batteries to keep the flight control computers running through engine failure to power supply being restored by the RAT and/or APU. Due to its unusually high use of electrical systems, the 787 has particularly large lithium batteries for these cases. There is no need for an additional EPU because the emergency systems already work fine (and did their jobs as expected in this case). You just can't recover from loss of nearly all engine thrust at that phase of takeoff. [2]
1. The notable exceptions to having a RAT for emergency flight controls are the 737 and 747 variants prior to the 747-8. In the 747 case, the four engines would provide sufficient hydraulic power while windmilling in flight and thus no additional RAT would be necessary. The 737 has complete mechanical reversion for critical flight controls, and so can be flown without power of any kind. There is sufficient battery power to keep backup instruments running for beyond the maximum glide time from altitude - at which point the aircraft will have "landed" one way or another.
2. There is only one exception of a certified passenger aircraft with a system for separate emergency thrust. Mexicana briefly operated a special version of the early 727 which would be fitted with rocket assist boosters for use on particularly hot days to ensure that single-engine-out climb performance met certification criteria. Mexicana operated out of particularly "hot and high" airports like Mexico City, which significantly degrade aircraft performance. On the worst summer days, the performance degradation would have been severe enough that the maximum allowable passenger/baggage/fuel load would have been uneconomical without the margin provided by the emergency rockets. I'm not aware of them ever being used on a "real" flight emergency outside of the testing process, and I think any similar design today would face a much higher bar to reach certification.
That is a somewhat complicated answer. The simplistic answer is that certification criteria require all turbine aircraft (turboprop or jet) to meet minimum climb performance following an engine failure at the worst part of takeoff. Multiengine piston aircraft (almost all of which are grandfathered in under prior rules anyways) are not required to do so. As a proportion of commercial passenger aircraft, multiengine piston aircraft are fortunately fairly rare in terms of passenger-miles flown, but they are still fairly common in certain markets.
However, that answer is hiding a lot of complexity. In a multiengine turboprop, single-engine climb performance is dependent on fathering the propeller of the dead engine(s); if you don't (or can't), you will probably crash.
In all aircraft, different takeoff conditions (ambient temperature, pressure, runway length) will result in different performance (maximum takeoff weight, runway length and takeoff thrust required). In some extreme conditions (e.g. "hot and high" airports like Mexico City or Denver) this can result in a reduction of maximum takeoff weight to ensure that engine-out climb performance is maintained. Generally aircraft used in these airports are designed and/or acquired with these conditions in mind, and thus the aircraft are still profitable to operate with the reduced MTOW.
The Cirrus system is deployed by rockets, allowing it to function at a very low altitude. They say that you should deploy it no matter what altitude you are at, and it will add at least some friction. The system has a very impressive track record.
However, at this altitude, with an airplane this heavy, you might have to put the rockets on the plane to decelerate enough to save lives.
Wouldn't be able to save a fully-loaded 787 in low & slow conditions because the area of canopies needed to deploy would be several acres. And they'd add several tonnes.
I just want to call out that, whatever the facts of this case, pilot heroism is way more common than pilot murder. This is off the top of my head, so don't quote me on the precise details, I'm probably misremembering some things. But a few of my favorite examples:
- British Airways 5390: An incorrect repair causes the windshield of a plane to be blown out mid flight. A pilot is nearly sucked out. The head flight attendant holds onto his legs to keep him in the plane. The copilot and flight attendant think he is dead, but they keep the situation under control and land the plane.
- United 232: An engine explodes in the tail of an MD-10. Due to rotten luck and weaknesses in the design, it takes out all three of the redundant hydraulic systems, rendering the control surfaces inoperable.
There's a pilot onboard as a passenger who, it just so happens, has read about similar incidents in other aircraft and trained for this scenario on his own initiative. He joins the other pilots in the cockpit and they figure out how to use the engines to establish rudimentary control.
They crash just short of the runway. 112 people die, but 184 people survive.
- Pinnacle 3701: Two pilots mess around with an empty plane. They take it up to it's operational ceiling. While they're goofing off, they don't realize they're losing momentum. They try to correct too late and cannot land safely.
In their last moments they decide to sacrifice any chance they have to survive by not deploying their landing gear. They choose to glide for the maximum distance to avoid hitting houses, rather than maximizing how much impact is absorbed. They do hit a house but no one else is killed.
> British Airways 5390: An incorrect repair causes the windshield of a plane to be blown out mid flight. A pilot is nearly sucked out.
This one is a good illustration of how better design can help prevent accidents or make them less severe.
The error the maintenance people made was that when they replaced the window and the 90 screws that hold it on 84 of the screws they used were were 0.66 mm smaller in diameter than they should have been.
The window on that model plane was fitted from the outside, so the job of the screws was to hold it there against the force of the pressure difference at altitude. The smaller screws were too weak to do that.
If instead the designers of the plane had used plug type windows which are fitted from the inside then the pressure difference at altitude works to hold the window in place. Even with no screws it would be fine at altitude. Instead the job of the screws would be to keep gravity from making the window fall in when the plane is not high enough for the pressure difference to keep it in place.
My vague memory of the Air Emergency episode on this (AKA Air Crash Investigation, Air Disasters, Mayday, and maybe others depending on what country and channel you are watching it on) is that after this accident many aircraft companies switched to mostly using plug windows on new designs.
Aviation is full of those design choices. Similar to how a multi-engine propeller plane will use oil pressure to keep the props in the flying angle, which means that when oil pressure is lost (catastrophic engine failure) it will feather giving the other engine the best chances of keeping the plane flying with the least amount of drag. While on a single-engine plane it's installed exactly opposite, in case of oil pressure loss the prop goes to fine pitch giving you the best hope of creating some trust in case the engine may still be working.
Most of these things were figured out over 100 years of carefully analysing accidents and near accidents to continuously improve safety.
Dynamic pressure of wind is 1/2 p v^2 where p is the air density and v is the velocity.
At sea level p = 1.225 kg/m^3. It goes down as altitude goes up. At sea level the dynamic pressure at 800 km/hr would be about 4.4 PSI.
At 20000 ft the air density is about half that of sea level, so around 2.2 PSI wind pressure. It would be around 1.4 PSI at 35k ft.
At cruising altitude planes are typically about 8 PSI above the outside pressure.
It would be maybe an interesting project for someone more ambitious then me to get a speed vs altitude profile of a typical airline flight and an altitude vs cabin pressure profile and figure at what part of a typical flight the screws on a plug window are resisting the most force.
- Pilot calculated incorrect fuel due to metric/imperial unit mixup, and ran out of fuel midair.
- Said pilot performed an impossible glider-sideslip maneuver to rapidly bleed airspeed just-in-time for an emergency landing at an abandoned airfield, having to completely rely on eyeballing the approach.
It was a series of events and failures rather than simply “pilot calculated incorrect”. And it was a bit more nuanced than metric/imperial conversion.
Via wiki (but accident section is more detailed):
“ The accident was caused by a series of issues, starting with a failed fuel-quantity indicator sensor (FQIS). These had high failure rates in the 767, and the only available replacement was also nonfunctional. The problem was logged, but later, the maintenance crew misunderstood the problem and turned off the backup FQIS. This required the volume of fuel to be manually measured using a dripstick. The navigational computer required the fuel to be entered in kilograms; however, an incorrect conversion from volume to mass was applied, which led the pilots and ground crew to agree that it was carrying enough fuel for the remaining trip. ”
Yes. On a plane which is designed to be a good glider. I highly doubt a 767 is designed to be a glider.
It's definitely not impossible (after all, it was done successfully!), but certainly a very difficult (and undocumented) one on such a plane.
I don’t think there’s much connection between a plane’s ability to do a sideslip and how well it glides. A sideslip is just what naturally happens if you apply opposite aileron and rudder inputs. I think the issue is just that it’s a rather acrobatic maneuver to perform in a large passenger jet.
Yes an airliner is not designed for it and could easily get into a deadly spin when doing it. Especially engines out because you have two huge surfaces blocking airflow. A glider can do it pretty naturally because of its extremely low stall speed.
Since a sideslip increses air resistance by essentially flying sideways, if I didn't know that it has been done, I'd say it might even break apart a (long, thin) plane that wasn't designed for it. And it still might, but at much higher speeds than close to landing.
It's not unheard of for airliners to use a sideslip when landing in a crosswind, so I don't think structural strength is likely to be an issue at landing speeds.
Also with additional control difficulty due to reduced hydraulic pressure.
> On the Boeing 767, the control surfaces are so large that the pilots cannot move them with muscle power alone. Instead, hydraulic systems are used to multiply the forces applied by the pilots. Since the engines supply power for the hydraulic systems, in the case of a complete power outage, the aircraft was designed with a ram air turbine that swings out from a compartment located beneath the bottom of the 767,[10] and drives a hydraulic pump to supply power to hydraulic systems.
> As the aircraft slowed on approach to landing, the reduced power generated by the ram air turbine rendered the aircraft increasingly difficult to control.[16]
> The forward slip disrupted airflow past the ram air turbine, which decreased the hydraulic power available; the pilots were surprised to find the aircraft slow to respond when straightening after the forward slip.
I would say it is much much harder. The wing configuration of an aircraft dictates the minimum glide speed. The more angled (for a better word) the wing, the higher the speed it needs to be at to be able to glide and not stall.
Anyone who does on-call should look into aviation disasters. Crew resource management, the aviate-navigate-communicate loop, it's all very applicable. ('WalterBright is an excellent source of commentary on applying lessons from the airline industry to software.)
But I did burn out on Mentour Pilot after a while, I just had my fill of tragedy.
A long time ago I had a colleague turn me on to Sidney Dekker’s “Drift Into Failure”, which in many ways covers system design taking into account the “human” element. You could think of it as the “realists” approach to system safety.
At the time we operated some industry specific, but national scale, critical systems and were discussing the balance of the crucial business importance of agility and rapid release cycles (in our industry) against system fragility and reliability.
Turns out (and I take no credit for the underlying architecture of this specific system, though I’ve been a strong advocate for this model of operating) if you design systems around humans who can rapidly identify and diagnose what has failed, and what the up stream and down stream impacts are, and you make these failures predictable in their scope and nature, and the recovery method simple, with a solid technical operations group you can limit the mean-time-to-resolution of incidents to <60s without having to invest significant development effort into software that provides automated system recovery.
The issue with both methods (human or technical recovery) is that both are dependent on maintaining an organizational culture that fosters a deep understanding of how the system fails, and what the various predictable upstream and downstream impacts are. The more you permit the culture to decay the more you increase the likelihood that an outage will go from benign and “normal” to absolutely catastrophic and potentially company ending.
In my experience companies who operate under this model eventually sacrifice the flexibility of rapid deployment for an environment where no failure is acceptable, largely because of an lack of appreciation for how much of the system’s design is dependent on an expectation of the fostering of the “appropriate” human element.
(Which leads to further discussion about absolutely critical systems like aviation or nuclear where you absolutely cannot accept catastrophic failure because it results in loss of life)
Extremely long story short, I completely agree. Aviation (more accurately aerospace) disasters, nuclear disasters, medical failures (typically emergency care or surgical), power generation, and the military (especially aircraft carrier flight decks) are all phenomenal areas to look for examples of how systems can be designed to account for where people may fail in the critical path.
Something I love about Mentour pilot is that he’s started doing videos on incidents where there was a near miss but no tragedy. Just as much to learn but without the ghoulish rubbernecking aspect.
In the particular case of his channel's subject matter, I actually kind of like the dramatic cliffhanger effect that (un)intentionally heightens the narrative's tension, since his video is telling a story. Compare to doing that for informational videos where there's no need for manufactured drama.
I am not that person and can't talk about his finances, nor can you.
If it's content I otherwise can enjoy for free, I don't mind sitting through a short sponsor spot every now and then, or just skipping through it if I'm in a hurry, which is still better than TV ads in that regard.
If I saw something like that on a time sensitive video (e.g. proper CPR example) or something very short then I'd rightfully be upset, but this is not the case.
If you're focused on whether or not the pilot cares (or is even alive), you've lost the plot. The point is to keep passengers alive regardless of the pilot.
There's no real point to considering what happens if the pilot wants to murder people on board. Of course they will succeed....
The thing is, people always want something to be done. And politicians want to do something. No matter what kind of action it is, someone knifed a kid on the street, we must ban knives of a certain length. A pilot downs a plane while the other leaves the cockpit - we must mandate two pilots always present. Someone hides explosives in his shoe - we must X-ray all shoes of all passengers forever. Etc.
The human brain can't take the idea that yeah an exceedingly rare thing happened and we're not going to do anything, because rare things do happen sometimes. And the medicine can be worse than the disease. We just accept that yeah, despite best efforts, some pilots will be hostile for whatever mental reasons. Not saying that is what happened in this case, but just saying that IF that happened.
We need more tradeoff thinking, instead of do something! thinking.
That was a bad decision. They had major problems during the winter of 2021 too. It's all well to talk about tradeoffs but clearly Texas has under prepared for major weather events and it's getting people killed (not to single them out - they're certainly not the only ones). It's not a coincidence that there were 2 catastrophes in 4 years.
Acknowledging tradeoffs doesn't mean there aren't real problems or that something doesn't need to be done, it's only meaningful when comparing different proposed solutions. What is your alternative to the early warning system with better tradeoffs?
> What is your alternative to the early warning system with better tradeoffs?
I know little about this, I'm simply responding to the people who constantly demand that people do something, anything, and insist that all possible actions be taken without consideration to their cost.
The real world is full of tradeoffs, and it's easy in hindsight to say "That was a bad decision", it's not that easy ahead of time.
The 2021 incident is why we know it was a bad decision. They had 4 years of warning. Extreme weather is going to continue becoming more common. Texas is going to continue to face extreme weather. If they don't prepare, people are going to die. It's not really acceptable to say that it's not economical to do something about that, or unnecessary based on outdated flooding models. When there's an urgent problem - yeah, you do have to do something about it. Tradeoffs are useful to decide what we do, not whether.
I think you do your argument a disservice by using that particular example. If you're going to imply some lives were simply uneconomical to save, and when challenged say that you aren't familiar enough with the matter to discuss what else could've been done, it just comes off callous. I'm not left with the impression you don't think the alarm system was necessary because you understand the tradeoffs.
The problem isn't that Texans are valuing their lives too much and insisting on too many safeguards. The problem is that the safeguards are insufficient.
I was deferring to the judgement of the local people.
I was not making my own decision on the tradeoffs.
Also, your implication that the tradeoff is lives is unfair, I don't think that's the tradeoff, rather I think they were expecting that other types of alerts would be sufficient.
You're deploying a recent disaster, that killed scores of people, as evidence that people want something done when it isn't appropriate - and you aren't even willing to take a stance on whether what was done was appropriate? That's pretty weak tea. It really undermines your argument. If you aren't willing to take a stand on that, use a different example. Otherwise you aren't saying anything.
You're calling on people to have more nuanced discussions that include tradeoffs, but you retreat immediately from the implication that we're discussing people's lives. That's trying to have your cake and eat it too. Tradeoffs are about balancing different budgets, and it's not just a monetary budget, one of those is a budget of people's lives.
You're not quite understanding me, and I can see it's because I was not very careful in how I wrote, and that's on me.
But I'm going to let this drop because I would basically have to start over to explain myself, and I don't think there's any useful purpose in doing so.
> On Jul 12th 2025 (UTC) India's media report that the investigation is NOT focussing on a human action causing the fuel switches to appear in the CUTOFF position, but on a system failure. Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India. The stated MN4 computer with faulty soldering, that might weaken and lose contact due to the thermal stress after a number of cycles, interprets data and commands fuel metering valves - with the lost contact attaching the MN4 processor to the EEC intermittent electrical contact, loss of signal processing and engine control faults can occur. The SB writes under conditions for the SB: "An LOTC (Loss Of Thrust Control) event has occurred due to an EEC MN4 microprocessor solder ball failure." According to discussions in the industry it may be possible with the number of cycles VT-ANB had already completed, the solder balls were weakened sufficiently to detach the MN4 from the EEC momentarily due to loads during the takeoff rotation leading to the loss of control of thrust and shut down of the engines.
Still quite early in the investigation, and so many things to consider. I don't know why online communities have been so quick to gravitate towards the murder/suicide theory. I thought aviation enthusiasts of all people would want to keep an open mind until every other possibility is ruled out, however minuscule it might seem.
> I don't know why online communities have been so quick to gravitate towards the murder/suicide theory.
Because the hardware failure theories seem preposterously far-fetched and require an unnecessary multiplication of deities.
Your ghost in the machine needs to be “just so” so that it can cause both switches to be read in “cutoff” nearly simultaneously. Then, 10 seconds later one of the switches needs to be read in “run”, then 4 seconds after that the second one needs to read “run”. You also need to explain why there have been zero single engine failures of this type before this double failure.
The ghost also needs to explain why one pilot asked the other “why did you cutoff?” instead of something like “what happened to the engines?” (which is the more natural response, unless you already know the switches are in cutoff).
There's also maintenance lapses, faulty repairs, defective parts, and as far as software goes I can think of n number reasons how a ghost can manifest itself inside program logic. This is a new gen plane that relies more on software than any other before, and has in fact seen a couple of incidents with loss of thrust, both related to software. I think it's more prudent to be asking hard questions around these than to outright dismiss it as an open and shut case. Besides, the murder/suicide angle is the least interesting outcome. Because there's nothing you can do after that, other than to just move on.
There's also the timing. Maybe there's something specific about takeoff that makes it more likely for the failure to occur. However, assuming there's not, then the odds of this occuring at takeoff (the worst possible time) instead of any other time are extremely low. Takeoff accounts for a tiny percent of the plane's operation.
As explained in the text, take off loads aka g force from the plane rotating. That's the feeling that you get when the plane takes off and it pushes you into your seat.
I personally don't buy it. Why then did the switches just work after being toggled. Why did the switches go to shutoff one after the other. Why did the pilot question why the other pilot set it to shutoff?
Then there's the catastrophic nature of the timing, 10 seconds earlier and they would have skidded off the runway. 10 seconds later, the engines would've relit and regained enough thrust. If there's one thing pilots are experts in, it's what to do to get yourself killed in your airframe of choice. This was calculated down to the second.
Something else that's going on, there's a bot network alive and well on twitter blaiming boeing and all things under the sun except pilot mass murder. Yet occams razor, a mentally ill pilot shut off the fuel at the right time to doom the aircraft seems tragically possible.
My concern would be that the investigation in this case is more likely to be biased towards a system failure. Disgracing a major flag carrier is something very few regulars have the independence and courage to get away with.
The way i read what avherald highlighted is that a part that the manufacturer said should be replaced wasn't and failed as the manufacturer said it will. So it would point to the airline maintenance right now.
What the bbc says is truncated and omits the info about the failing part, so people can point towards murder suicide because they don't have all the info.
Which is why you should always read avherald first...
The avherald is reporting second hand reports of the Indian media. The EEC MN4 microcontroller is located on a control board on each engine. A dual failure seems improbable.
The fuel cutoff switches are of a similar design to the 737 and most other Boeing aircraft. A failure in that design seems less likely than the most charitable explanation, that the copilot inadvertently went into the wrong mode of muscle memory.
The interim report does mention the SIAB NM-18-33. If you read that document it specifically says that the fuel cut-offs were installed with the locking feature deactivated on some 737 aircraft. It's a pretty big leap to that causing this incident. Someone or some thing would still need to have touched the switches to move them.
10 years ago the dynamics could perhaps be as you sketched between regulators and the carrier but today it is more complex.
Air India was government owned company till 2020s when it was sold back to the TATA group from whom it was originally nationalized from in the 1960s.
Stakeholders like regulators, employees individually could have different PoV or interests in the change .
Regulatory leadership could just as easily want to prove why this de nationalization was bad if so inclined as they could be for not wanting embarrass the flag carrier.
So it would be hard to categorically say that regulator has vested interest in protecting the flag carrier
The one thing automatic system failure theory can't explain is whether there is a reverse connect from the machine back to the switches where if the machine decides to cut off fuel, would the physical switches toggle to cut-off or stay in run position while the fuel is actually cut off, this would require an actuator setup to flip the switches from inside the system which there is no documentation of if that is even support let alone reported?
Respectfully, media reports on what the investigation is focusing on should be taken with a grain of salt unless said media is known to be reputable and have credible sources.
If they had a credible indication of a technical failure that causes engines to randomly shut down, they would have already grounded 787 fleets, which hasn't happened.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally, they need to be unlocked first by pulling them out.
> In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
And both pilots deny doing it.
It's difficult to conclude anything other than murder-suicide.
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.
Nope. First of all, the FO was the “pilot flying” and thusly controls the throttle. The fuel shutoffs are on the left side, well clear of the range of motion throttle operation for the right seat.
If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.
Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.
Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.
And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)
The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.
You are wrong. The fuel shutoff switches are directly beneath the throttle levers, and they move down to cutoff, which is exactly the direction a hand beneath the throttle would move to accidentally switch them to cutoff.
Secondly, while the FO was flying the airplane and thus would have control of the throttles during rollout, the captain would certainly have his hand beneath the throttles in an observer position during at least part of the takeoff. And during takeoff, procedure would have the captain take over control of the throttle levers until rotation while the FO handled the yoke with both hands.
blancolirio[0] has two excellent video examples of 787 takeoffs within the cockpit showing FO-pilot takeoffs and both officers' actions during takeoff.
Page 10 of the Air India preliminary report[1] shows a picture of the fuel cutoff switches -- clearly labeled "FUEL CONTROL" with "RUN" in the up position and "CUTOFF" in the down position -- directly beneath the throttle levers.
This. There are no flip-covers on the switches in any of the photos I've seen. Additionally, it looks like the side guards are only on the left and right sides of the pair of cutoff switches, not in-between the two switches. So if one bumped one switch, seems like it would be very easy to bump them both.
There's a metal nib on the switch and switch housing preventing it from being bumped. There's also a spring holding it down so it can't bounce up. The distance and required force makes switching them at the same time impossible, thus the 1 second difference. This was absolutely an intentional act.
One can easily switch them with two fingers at the same time.
I tried (with similar switches.): Works. If the locking mechanism fails, even unintentionally.
Getting loose, wristworn jewlery snatched and then pull: Works.
My question to Boeing is:
Why did you cover the neighbouring (stabilizer cut-off, IIRC) switches with red springloaded flip-covers, but not the fuel cut-off switches?
please. pilot puts everyone to sleep but himself, turns everything off, then does a flyby of his hometown and then puts himself to sleep? the only one more obvious is the german one.
It feels quite uncomfortable to me. I remember using this exact example of why the changes after the German wings crash wouldn't prevent a murder suicide in the future.
The issue with the 737 MAX became evident within months of the plane's launch. By contrast, the Dreamliner has accumulated over a decade of flying history across over 1000 aircraft with precisely zero fatal accidents.
The fact that the pilots denied that they had shut the switch (one asking the other why they had done so and the other denying it), and that they restarted the engines should be taken into account. Ok, murder suicide is definitely on the table but I would want to see some other reasons for believing that this is so.
Sorry to nitpick, but for a good Bayesian, absence if evidence is evidence of absence. If you want the aphorism to be technically correct, you should say "absence of proof is not proof of absence".
A note on the terminology: "evidence" is a piece of data that suggests a conclusion, while not being conclusive by itself. Whereas "proof" is a piece of data that is conclusive by itself.
For a long time my wife refused to accept that Tree Kangaroos existed and insisted that I'd made them up. When the internet came along she looked them up and treated me strangely for a while.
What things that you have never seen do you not believe in?
(not the OP) Giant isopods. They're not real. I know there are pictures of what are supposed to be giant isopods but they are not real animals, instead they're clearly fake models of made-up animals.
A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.
The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.
He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.
Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.
My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.
I'm not disagreeing with you I think this was manually done
But here's the thing a "near zero chance" when we are talking about an actual event changes the math
Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident
Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure
So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded
We could also suggest that aliens in the cockpit did it — about the same probability. Two switches, on independent circuits, both failing within one second of each other in the exact same way?
Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
What is "01 second" as quoted above? If it's 1 second, you could possibly conclude that it was intentional. If it's 0.1 second you might think it was an accident and the lock was disengaged.
There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.
Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.
You don’t inadvertently turn off both switches. The linked SAIB was in 2018 and addresses faulty installations, not a failure after use. And preflight over thousands of flights would have detected if the switches had a failed locking mechanism. And for both to fail at once? Practically impossible. Also the recommended inspection — that was almost 7 years ago. If a major airline didn’t comply with the SAIB, that’s on them, not Boeing. There hasn’t been a single reported instance of fuel switches being accidentally switched off on any Boeing airliner — in 320 million flight hours over the past 10 years.
The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.
They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
More like 30 seconds. Just throttling an already running engine up from idle (which is quite a bit above zero throttle in most respects) takes seconds.
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
Here is the full SAIB on the Boeing fuel control switches. This report lists the part 4TL837-3D as the switch used on 787s, and is the part mentioned in the preliminary report on the accident.
The SAIB does single out the part 766AT613-3D, but that's for suggesting a replacement for it as 766AT614-3D.
Per the Honeywell catalog for 4TL837-3D, if is a Snap Action toggle switch. The base model doesn't have a locking mechanism, which is available as an option
still, it at least shows that there's been issues with the locking mechanism in the past. inadvertently bumping something that was assumed to be locked is a simpler theory; i find it hard to believe that a murder suicider would take this route, when the china nosedive option is easier, faster, and has a higher chance of success.
The preliminary report says the switches were triggered a second apart, so it would have to have been faulty switches and two inadvertent bumps. That seems unlikely to me.
Within a second apart. If I read the report right. The time resolution of the recorder?
And yes, it does sound like it was probably intentional. I would still like to see an engineering review of the switch system. Are they normally open or normally closed, In the end the switch instructs the FADEC to cut the fuel, but where does the wiring go in the meantime? what software is in the path? would the repair done before the flight be in that area?(pilot defect report for message STABS POS XCDR), and perhaps compromised the wires?
The wings hosts the engine and a good portion of the fuel is quite a bit back from the nose in a big plane like 787. The engines lost power and hit just 180 knots just 4 seconds after the plan lifted off. The plane could have just easily broken up differently where the nose crashed in a different spot than where the fire would likely start.
At such a slow speed and altitude they could even have well crashed inside the airport perimeter and got a quicker/ better emergency response from the fire units at the airport.
Attempting this during takeoff or landing when the pilot monitoring is fully engaged and closely observing would be most difficult to execute .
It's interesting to try to imagine a device that would prevent that, without causing more issues.
My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?
It’s a pointless exercise though - if one of the pilots wants to crash the plane, there’s almost nothing that can possibly be done. Only if someone can physically restrain them and remove them from the controls.
There’s always going to be many ways they could crash the plane, such a feature wouldn’t help. The pilots are the only people you can’t avoid fully trusting on the plane.
It's only pointless if we assume crashing was the intended result of the pilot. If the switches failed, or the pilot activated the switches by mistake, it's worth considering options for handling the inputs.
There's a balance of accidents to be found, I think. There are likely cases where fuel does need to be cut off to both engines, and preventing that would lead to accidents that might have been recoverable. This case shows that cutting off fuel to both engines during takeoff is likely unrecoverable. There have been cases where fuel is cutoff to the wrong engine, leading to accidents. Status quo might be the right answer, too.
So basically we need software that can 100% autonomously fly a plane. Software that is extremely reliable and trustworthy, basically. Software with multiple fallback options. Multiple AI agents verifying every action this software takes. Plus, ground-based teams monitoring the agents and the autonomous flight software.
> Again, it’s probably pointless but it’s an interesting thought exercise.
Coming up with ad-hoc solutions is easy, especially the less you know about a complex system and its constraints. I'd say it's not an interesting exercise unless you consider why a solution might not exist already, and what its trade-offs and failure modes are. Otherwise, all you're doing is throwing pudding against a wall, which can of course be fun.
That’s the whole fun part - come up with an “obvious” solution and the try to figure out the problems or risks it would cause.
For example, an obvious solution is that the switch can't be changed from "RUN" to "CUTOFF" when the throttle isn't at idle - this could be done with a mechanical detent because they're right next to each other. Simple!
But now you've introduced additional failure modes - throttle sticks wide open and the engine is vibrating and needs to be shut down - so maybe you make it that the shutdown switch can work for ONE engine at any throttle position, but if TWO get turned off, both throttles have to be off, but that introduces ...
Or you simply interlock the engine cutoff with the thrust lever position, any position other than idle prevents shutdown. This all goes through the flight computers already.
If there’s a fire or similar problem the fire handles will cut off fuel without the normal shutdown procedure, but the normal switches only need to be used at idle thrust.
I wonder if Airbus has this logic, since their philosophy is to override the pilot commands if they’d endanger the aircraft (which has its own issues of course) where’s Boeing will alert the pilots and still perform the action. I don’t have access to that information.
According to AI, Airbus places these switches on the overhead panel, so that alone would make it harder to inadvertently move them. Apparently, Airbus "protections do not extend to mechanical or FADEC‑controlled systems like the engine‑fuel shutoff valves. If you deliberately pull and flip the ENG MASTER lever to OFF, the FADEC will immediately close the LP and HP fuel valves and the engine will flame out. If you then return the lever to RUN (and you meet relight conditions), it will automatically relight."
As another commenter said the Airbus engine start/stop controls are located behind the thrust levers, and according to the A350 operations manual which I got my hands on there are two conditions required for the FADEC to command engine shut down: Run switch to off, thrust lever to idle.
So if that's correct on an Airbus aircraft you can't just switch off the engines when they're commanded to produce thrust. This also seems to be backed up by the difference in the guards for those controls in the Airbus cockpits.
Yes, the S.A.I.B. was about the switch, which is used in many airplanes,
and _should_ be checked and replaced. But they didn't. Because it wasn't mandatory. So my guess is those 50-70€ per switch were too expensive for the airline?
They reported that they replaced the whole middle console twice, so I cannot accept the 'it's pricey' or 'it's non-mandantory' as an excuse.
Hackers gona hack, so I'd like to get my hands on those switches, or better the whole fuel control panel. The pictures don't let me see or feel if a loose front panel could lift those shiny glowy locking knobs up by, say, 2.3mm and therefore unlock those switches, for example.
Only picture I could find online about this malfunctioning switch:
which looks like a really nasty 'mechanical inadequacy': half of the locking mechanism is the shiny glowy knobs. And they could _turn_. WTHolyF!? What where they smoking when designing or reviewing this?
In this fine post here, if you can read chinese or click the translation button on your browser:
(CAVE: I'm not inside boeing's tech support system so I cannot verify this from the original maintainance manual, since they seem to be practically guarded as trade secrets...)
I tried to order some of those switches (766AT613-3D and 766AT614-3D) and hope they get delivered ... this year. Anyone here got their hands on those switches to test their feel when handling or their resiliency?
(My hypothesis is:
Hand on throttle, Hand pushes throttle full forward to start, Hand rests on throttle while accellerating, then pilot does the routine rotate and plane takes of and all is fine and Hand lets go of throttle, Hand falls on both switches directy behind the throttle: Click-click-WTF?-BOOM.)
Of Course almost anyone involved in the airplane industry would prefer this to be a clear-cut case of 'pilot error' or 'Terrorism/Insanity' - but that doesn't exnorate the manufacturer or owner of building and flying an airplane where the engines can be shut off while taking off, IMHO.
As an aside, I especially like the disclaimers on the last page of Honeywells catalogue (this one: https://www.farnell.com/datasheets/2604543.pdf)
- don't use it for anything safety-of-live related.
- if it breaks because we delivered junk, we'll replace the switch - nothing else.
(I'm paraphrasing. Some laywers migth find a way to get out of this. I hope Boeing doesn't.)
There Is a connection: The same type and make of switches, which already where officially found to be prone to subtle malfunction and ought to be checked and replaced. Read the SAIB.
Look at the switches. https://www.xuefeiji.org/public/uploads/weixin_mpimgs/e3/e36...
Your argument of being "totally different" flight decks or fordy ignition switches aside (ignoring that one is allowed to to drive both mentioned cars using the same license, but not two different generations of airplanes, ignoring that the biological concept of generation implies kinship), this affair reminds me of https://en.m.wikipedia.org/wiki/General_Motors_ignition_swit...
And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:
"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on
December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking
feature. This SAIB was issued based on reports from operators of Model 737 airplanes that
the fuel control switches were installed with the locking feature disengaged. The airworthiness
concern was not considered an unsafe condition that would warrant airworthiness directive
(AD) by the FAA. The fuel control switch design , including the locking feature, is similar on
various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8
aircraft VT-ANB. As per the information from Air India, the suggested inspections were not
carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records
revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023.
However, the reason for the replacement was not linked to the fuel control switch. There has
been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."
So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.
> It's difficult to conclude anything other than murder-suicide.
You're leaping into the minds of others and drawing conclusions of their intent. One of them moved the levers. It could've been an unplanned reaction, a terrible mistake, or it could've been intentional. We may never know the intention even with a comprehensive and complete investigation. To claim otherwise is arrogance.
The car equivalent is being on a highway and "mistakenly" pulling the hand brakes, except that there are 2 hand brakes and you need to first unlock both of them.
That's very hard to do by panic and mistake, if not impossible by design.
Nope, I strongly disagree with that comparison. One doesn't need to pull up a big stick in hand using elbow and shoulder to flip this fuel switch _down_. Would a car's hand brake stop your engine if it's thumb-push-button lock failed silently and you happen to let something fall on it, like a hand? no. But this little fuel switch would.
On pprune there is a professional pilot that says they had multiple instances of inadverent switching off fuel switches. They do it every startup, shutdown and training captains (the captain on this flight was pilot not flying, he had >10k hours) do it all the time in the sim to trigger engine out scenario during training
You moved the goalposts from "do something catastrophic by doing something completely unrelated to what you were trying to do" to "press the wrong pedal or button in a car or elsewhere"
We're talking about taking an action in a different place in the cockpit controls that has safeties built in to prevent accidental use... like pulling a handbrake by accident while the car is moving when you meant to put your wipers on
Bad analogy because pilots are trained and rehearse and practice memory items until they are instinctual.
> impossible by design.
Deflecting that the human is the weakest part of the system. One or other may have panicked and made a mistake, made a mistake unintentionally, went crazy and doomed the flight, or intentionally doomed the flight for some socioeconomic reasons. These are speculative possibilities that we don't know yet, and may never know; we only know what has definitely happened from the evidence per the investigation. It's standing way out over one's feet to declare from an armchair that it was "definitely" X or Y before the investigation is complete.
It was done. Yes. There is no way to determine from the evidence why it was done, how much conscious or not thought was put into it, or the thought process behind it.
> One of them moved the levers. It could've been an unplanned reaction, a terrible mistake, or it could've been intentional.
Fuel levers are designed to only be moved deliberately; they cannot be mistaken for something else by a professional pilot. It's literally their job to know where these buttons are, what they do, and when to (not) push them.
It's not arrogance to assume the most likely conclusion is true, despite how uncomfortable that outcome may be.
Pilot are trained until actions are instinctual and certain memory items are almost unconscious. But pilots are still people and people are fallible and make mistakes, and sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.
> It's not arrogance to assume the most likely conclusion is true
You don't know this. This is beyond the capability to know and is therefore pure speculation. That is the definition of arrogance.
> sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.
By this logic it would be impossible to ever find anyone guilty of murder (or any other nefarious action) with intent unless they explicitly state that it was in fact their intent.
Obviously this is not how justice works anywhere, because at some point you have to assume that the overwhelmingly most likely reason for doing an action was the true reason.
If someone pulls out a gun, cock it, aim it at someone and pull the trigger, killing the other person, should we hold off any judgement because they might have done it purely mechanically while in their head thinking about the lasagna they are going to cook tonight and not realizing what they were doing ?
The fuel cut off switches have a unique design, texture and sequence of action that need to be taken to actuate them, they don’t behave like any other switch.
Pilot are also absolutely not trained to engage with those particular switches until it’s instinctual.
Courts do not seek to establish the truth. They aim for a reasonable balance between false positives (innocents convicted of crimes they didn't commit) and false negatives (criminals allowed to go free). In practice, the false positive rate is probably around 5%, and innocents go to prison all the time.
Air accident investigations mostly deal with one-in-a-billion freak occurrences. Commercial aviation so safe and reliable that major accidents rarely happen without a truly extraordinary cause.
That's not what Occam's razor means. It means that after you have exhausted all options to rule out competing hypotheses, you choose the simplest one that remains, for the time being.
Consider some explanations that are consistent with the evidence presented so far. And remember that the purpose of the investigation is to come up with actionable conclusions.
1. One of the pilots randomly flipped and crashed the plane for no reason. In this case, nothing can be done. It could have happened to anyone at any time, and we were extraordinarily unlucky that the person in question was in position to inflict massive casualties.
2. Something was not right with one of the pilots, the airline failed to notice it, and the pilot decided to commit a murder-suicide. If this was the case, signs of the situation were probably present, and changes in operating procedures may help to avoid similar future accidents.
3. One of the pilots accidentally switched the engines off. The controls are designed to prevent that, but it's possible that improper training taught the pilot to override the safeties instinctively. In this case, changes to training and/or cockpit design could prevent similar accidents in the future.
Because further investigation may shed light on hypotheses 2 and 3, it's premature to make conclusions.
Extremely unlikely, since we can hear the other pilot ask why he turned the fuel switches. If it was an electrical glitch, he wouldn’t be able to see that they are in the cutoff position.
All we know is the pilot flying is only asking whether the pilot monitoring if he cut off
- We don't know if he meant the switch specifically at all. He could also have meant engines or thrust in general. There are many other visual signals and UX indicators to know if engines are spinning down. Thrust levels, to RPM to falling speed, change in angle of attack, rate of climb, even engine noise, vibrations you expect at full thrust etc.
- We also don't know if the switch was physically in cut off position in the first place or even if was the pilot noticed that specific visual signal and meant that when he spoke.
If it was a software issue, it is possible the switch was properly positioned, and software issue cut engine was cutoff, the display screens and other lights would show that.
In such a scenario, the pilot(s) would have likely checked with each other first if they did something as in the audio and manually tried restarting the engine as they seem to have done.
I am not saying it is a bug or any specific fault scenario, Just that it too early, we don't yet have enough information to say what is likely at all.
I think there are a couple of factors that disprove these theories:
- The specific mention of "cut off" in the CVR is very telling. If both pilots were genuinely surprised, you'd expect they'd say something like "engine failure" or "loss of thrust" first. Noone thinks the engines have been shut down as a knee-jerk reaction to a sudden loss of thrust.
- If investigators had the slightest indication there's a software or hardware bug out there that randomly causes dual engine failures, an emergency airworthiness directive would have been issued by now. This hasn't happened.
> an emergency airworthiness directive would have been issued by now. This hasn't happened.
737 Max incidents proved it isn’t always the case.
This is also not the NTSB or FAA doing direct investigation . Without certainty no one is issuing a directive, at this stage it is simply too early and only a possibility
I wouldn’t read so much intent during high stress part of takeoff from two non native speakers
> 737 Max incidents proved it isn’t always the case.
> This is also not the NTSB or FAA doing direct investigation . Without certainty no one is issuing a directive, at this stage it is simply too early and only a possibility
You are mistaken. The first MAX crash resulted in emergency directives being issued barely a week after the crash. That investigation was conducted by the Indonesian authorities, not US ones.
Emergency directives aren't issued when there's complete certainty, quite the opposite. Hence the "emergency" bit.
> I wouldn’t read so much intent during high stress part of takeoff from two non native speakers
I agree there's some fuzziness since the exact transcription wasn't provided. But "why did you cut out the engines" is by no means a normal question when facing sudden thrust loss.
Yeah and the other pilot flipped the switches back on and one of the engines started spooling up but it was too late.
Murder-suicide looks like the likely conclusion, given that flipping the cutoff switches requires a very deliberate action. That said, it's not entirely impossible that due to stress or fatigue the pilot had some kind of mental lapse and post-flight muscle memory (of shutting off the engines) kicked in when the aircraft lifted off.
The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.
However, the only relevant evidence that exists suggests they had enough rest. You don't build verdicts on suppositions, you build them on proven facts.
This does not guarantee you will reach the truth, but it's miles better than admitting every baseless hypothesis that comes up.
Aren't you the one building on suppositions? We know that they don't have flight hours. We cannot conclude what condition they were in aside from that.
to jump from "they could be tired or hungover" to "yeah or aliens" is very dishonest. Especially for a very fresh matter where we know very little, all our assumptions are just that, and nothing we writes has any bearing on anything.
0.1% of airline pilots fly intoxicated, and probably many more fly hangover which is an undetectable condition.
There is speculation that in the Air France flight 447 that crashed into the ocean en route to Paris, one or the pilots only had 1h of rest because of partying the night before. Of course it’s all speculative, and however unlikely it is, eventually it’s bound to happen that we get pilots with poor mental clarity in charge of large Boeings with hundreds of lives on board. Unfortunately it only takes one lapse of judgement to compromise the flight profile of a large airliner, even if corrected after a few seconds.
At some point I think we need to accept more control from automation. The model where ultimate authority reverts to a single input is a cop out. That could be pilot input, sensor input or even direction from ATC. They will all provide false data on occasions. When that data contradicts 99% of the other data then the safest option is to ignore it. And that doesn't just mean with compromised humans but with normal human weakness. Fully understanding the aircraft, its state, its systems and the minds of its crew is impossible.
In this case I wonder if the fuel cut off switches could be replaced by buttons for particular situations. Have an engine fire button or a shut down whilst on the ground button. Let the pilot provide input on state and let the automation decide what to do with that. Obviously this is not a solution to suicidal or murderous behaviour. But it could be a solution to all the low probability edge cases.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC.
Damn. That's pretty quick to diagnose and take action.
Boeing's probably gonna have a big sigh of relief over this one.
> Boeing's probably gonna have a big sigh of relief over this one.
The 787 is 15 years old, and this particular plane was 10 years old. It always seemed unlikely to be a major, new issue. My money was actually on maintenance.
While unlikely, there have been issues before that took decades to surface (e.g. Aloha Airlines where a 737 manufactured more than a decade earlier became a cabriolet due to Boeing underestimating sea water corrosion and short flight cycles), or the 737 rudder issues where the planes were also 10+ years old.
I once worked with a software engineer who would do things and then bald face lie about it. This reminds me of that person.
Me: “The build is breaking right after you checked in. Why did you do that?”
Him:”I did not do so.”
Me: “The commit shows it as you. And when I rolled back everything builds.”
Him:”It must have been someone else.”
I’ve worked with some chronic liars. They would deny reality no matter how much evidence you had.
The weirdest thing was how often it worked for them. In each case their lying eventually caught up with them, but in some cases they’d get away with lying for years.
It’s amazing how often someone would have clear evidence against what they were saying, but the people in positions of authority just wanted to de-escalate the situation and move on. They could turn anything into an ambiguous he-said she-said situation, possibly make a scene, and then make everyone so tired of the drama that they just wanted to move on.
i worked in many companies but I always remember one , where during a public chat in the middle of an open office the programmer next to me (who was always conniving but I just ignored it ), said incorrectly something akin to " yes I know all about that source control its... based on locking " , the whole point was that although locking technically occurs, the SC would allow different coders to work on it at the same time. The non technical manager said correctly, "no the whole point is that the codebase isnt locked", to which the programmer replied " yeah thats what I mean".
In that moment I realised he was just bare faced lying right infront of everyone, about a technical subject, only HE should be the expert in, and to this day I am perplexed why his contract kept being renewed.
Eventually I was let go ( he possibly suggested I be let go ) for an incident that was unrelated to me.
This is all fine, but i learnt 5 years on he was still being paid a top 1% salary at the same company.
I promise the point isnt that I am jealous, its that this guy, who was a sub par coder and liar, somehow managed to keep his job whilst everyone else lost theirs and earnt untold amount in England ( where salaries are always low).
My goodness - I just remembered he was found by police driving a vehicle seemingly under the influence on a motorway, work found out after the police called them, and somehow he turned up the next day at work , lied about it, and STILL kept his job.
I am only mentioning this guy , because he was NOT a nepotist hire, he was just some guy who would lie and somehow people were ok with it. I still think of him often and wish I could have learnt more from his abilities just out of interest.
> So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally
FAA issued a Special Airworthiness Information Bulletin SAIB NM-18-33 in 2018 warning that on several Boeing models including the 787 the locking mechanism of the fuel switches could be inoperative.
Does the Flight Data Recorder consider the physical position of the fuel switches or does it get the information from some fly-by-wire part that could be buggy?
The conversation would suggest that the switches were in CUTOFF position, but there is also a display that summarizes the engine status.
There is no conversation that mentions flipping the switch to RUN again.
EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
I've had discussions on HN with people who insisted that having a video camera always pointed out the control tower at the runway was some sort of impossibility. Despite every 7-11 having such a system.
This would leave accident investigators with a lot of work to do to try to figure out how a collision happened.
Airlines are decades behind on tech. You can get satellite internet almost anywhere on the planet and GPS can give you ten-foot accurate positioning, but we've still _lost_ planes because we haven't mandated a system that sends the realtime position of the plane over the satellite internet. The days of limited storage are still going strong in the industry.
There are reasons they don’t. This is a deceptively difficult problem
Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
And by stations, I mean aircraft. There are a TON. Current constellations probably wouldn’t even be able to handle half the current aircraft transmitting all at once. Bandwidth, in the physical sense, becomes a limiting factor
Coverage (different constellations have different coverage, which means planes would not have transmit guarantees depending on flight path). So you’d have huge gaps anyways
There have been alternative solutions posed, some of which are advancing forward. For example, GPS aware ELTs that only transmit below certain altitudes. But even that has flaws
Anyways I think we’ll see it in the next decade or two, but don’t hold your breath
There's somewhere around 15 thousand relevant planes in the air at any time.
If you sent two updates a minute over Iridium, using their 25 byte message plan, you'd be looking at a megabyte per minute for the entire planet. That's such a tiny fraction of what that single constellation can do.
Most airplanes regularly crossing oceans already do have satcom.
The cost of hardware and additional fuel consumption due to drag aren’t nothing, but the data used itself is essentially a rounding error. (Iridium for example has tiny antennas, and SBD data costs about a dollar per kilobyte, and position data is tiny.)
Of course, that’s all little help when a pilot acts adversarial; on MH370, the breakers for both satcom and transponder were likely pulled, for example.
Yep. Inmarsat has this data for most of the world widebody fleet, and had it for MH370... except when transmission stopped. It's not publicly shared information, because that's what the ADS-B transponder they're all equipped with is for...
Not necessarily. Required certifications, SLAs etc. for safety critical systems are vastly different from those only handling passenger entertainment/connectivity. For example, Iridium has been around for almost 30 years now (launched in 1998), but it only became certified for safety of life applications at sea in 2019, and for aviation around 2010.
Many planes still use completely separate systems for non-critical communication (often Ku or Ka band based geostationary satelliets) and for ATC or operational communication (usually L-band based Inmarsat or Iridium) as a result.
> Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
That’s nonsense. Even when I’m flying right over the north pole my airline will give me unlimited in-flight internet for $20. Maybe antartica has worse reception, but cost isn’t the issue.
So? The comparison still makes no sense. Those switches cannot be accidentally flipped, and they are in a place where the pilots' hands have no action to take at all during that period. That is very different from mixing up two similar weapons in a similar location.
The pilots have no business with their hands in the area of those switches in that phase of the flight (9:30+ in the video). They don't even have to touch the throttle, and even if they did, that's a long way from where you touch the throttle down to the base where those switches are. Which you can't just flip either.
How is that even remotely similar to that cop's situation?
Yes, unbelievable things can happen. There are crashes where the pilot got discombobulated and a crash resulted.
For another example, there are at least two crashes I recall (and I am sure there are many more) where the pilot pulled back to recover from a stall despite being trained endlessly to push forward to recover. (And they killed everyone on board.) Pilots get confused by what an alarm means, and do the wrong thing. Pilots assume the autopilot is on but they had accidentally turned it off. Sometimes people get crazy urges to do the wrong thing (there's a word for that: cacoethes).
These things are rare, but when there are millions of flights, rare things happen.
Suicide is quite a stretch without any supporting evidence from the pilots' backgrounds. I would take mental fog, cognitive overload, wrong muscle memory, even a defective fuel cutoff system over suicide.
Agreed. The sequence of events also supports this.
I believe one of the pilots made a terrible muscle memory mistake and cutoff the fuel instead of raising the landing gear. This would explain why the landing gear was never raised, why the pilot who was accused of cutting off the fuel denied it (in his mind he had only retracted the landing gear) and why the engines were turned back on after presumably realizing the mistake.
Not that humans are known to behave rationally when trying to commit suicide, but it’s interesting that the switches were re-engaged successfully without protest or a fight. It’s just an interesting detail to wonder about.
The reasoning I’ve heard is: it didn’t matter anymore, the damage was already done and there was no way any attempts at recovering from it would have been successful.
and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec
Or more precisely, the signals which come from them were found to behave as such.
Without any audible record of turning the switches off, I wouldn't blame the pilots without first checking the wiring and switches themselves for faults. This reminds me of the glitches caused by tin whiskers.
But from the audio recording it seems like one pilot is noticing them bering in the CUTOFF position, and asking why (and moving it back). If the switch was actually in RUN, but some other issue caused the signal to be sendt, the pilot would see it beeing in the RUN position, not CUTTOF.
This is very clearly EAFR data, so the logical/electrical switch state. Nothing about the mechanical state of the switches has been mentioned, except a picture that shows their final state to be in the RUN position (which makes sense given the relight procedure was ongoing).
From what I understand, the relight procedure involves cycling these back to CUTOFF and then to RUN anyway. So it is not clear if they were mechanically moved from RUN to CUTOFF preceding the loss of thrust, or cycled during relight.
You can't yet - what we have is this sentence from the report: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
The other pilot responded that he did not do so."
It's not a direct quote or transcript, it's reported speech.
I agree, there's a significant distinction between "the switches were (physically) flipped" and "the circuit was opened/closed".
In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.
The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.
My understanding from what we've been reading is that these are physical switches that cannot be moved using remote triggers. Wildly speculating, there _may_ be a possibility that the _effect_ of the switch may be triggered remotely, if it's a signal being read by a control unit or computer of some sort that then actuates the specific electromechanical components. But it would seem impossible to move a physical switch to do it.
As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.
If that was the case, it does seem a bit odd that there was a one second gap. But yeah, still worth investigating, if that’s even possible given the extensive damage.
> And both pilots deny doing it.
> It's difficult to conclude anything other than murder-suicide.
You’re trying to prove a negative here.
I am not familiar with the 787 operations, but there are a few issues that need to be sorted out first:
- altitude when pilots start the after takeoff checklist
- if there are any other switches that are operated in tandem in the general vicinity of where the engine cutoff switches are
- if the cutoff switches had the locking mechanisms present, and if not, if they could be moved inadvertently by the pilot flying hand
Discarding other possibilities in an investigation can have adverse consequences.
Did you ever always push the right buttons every time?
The switches have lockout mechanisms that prevent accidental triggering. I'm not a pilot, but these guys are, and they find it exceedingly unlikely that anyone would switch both off by accident:
You have to time it spy movie right to ensure dying.
This is what I am debating.
There are too many variables you need to account for.
For example, I want an expert opinion about the tone in the cockpit when the other pilot said “No, I did not touch it” or what was said. Is it calm? Surprised? Cold?
> Did you ever always push the right buttons every time?
A whole world full of 787’s is pushing the right buttons every single day. If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.
I wonder if the switches are still in tact after the crash? Can they verify that the switches are mechanically sound? If so, seems highly likely it was intentional.
I'd suspect the wiring leading from the switches to the engine controllers first, especially since it looked like both circuits cut out nearly at the same time.
This is speculation again since I don't really know, but my understanding of aviation engineering is that there would be two separate controllers for each engine connected to these two switches. At no point would they be connected to the _same_ control unit. The really short time (~1s) between the two being cutoff is the difficult thing to explain here.
Are the wires leading up to those switches on the console also kept separate, or are they just bundled together as part of the same harness (presumably before it splits to go to the engines)? I think that's also important in understanding the possible failure modes.
> It's difficult to conclude anything other than murder-suicide.
The balance of probability might tend to support that hypothesis. However I'm wondering if it was just something involuntary. My ex for instance who learned to drive on a stick shift would randomly stall the engine after a few weeks driving an automatic.
You have to pull the switches out (against a spring) to be able to move them over a notch and flip them. Not really something you can just mistake for another switch or bump into by accident.
I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.
Is it possible to rest the switch on the notch? Does the switch make contact if the switch is in the RUN position but the switch is not completely down?
That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?
Just trying to think of some semi-plausible non-active causes.
?? One pilot to other: why cut-off. Other: Did not do it
08:08:52 Engine 1 run
08:08:52 Engine 2 run
1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.
Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The big question is whether the switches were moved or something made it seem as if the switches were moved.
Well in the murder-suicide scenario it makes sense for the culprit to turn them off as quickly as possible. The longer time to turn them on could plausibly be a struggle or simply needing to fly the plane while reaching for each switch individually.
> Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The workload is pretty high during the takeoff phase. The engines react right away when fuel flow is stopped. The engine displays can have some lag before data is updated.
Relighting an engine at low speed is not feasible - most need 230-250kts IAS before attempting the operation.
Maybe you could do it if the APU was still running and could provide compressed air, but it takes about 20-30 seconds to start up amd then probably 5-10 more to spool up to full thrust. I am speculating here a bit, but the pilot did not have enough time to save the plane even if he did everyting right and as fast as humanly possible.
All this aside is overshadowed by the limited amount of time the pilot flying (I would assume the captain in this case since there was only one ATPL pilot in the cockpit) had to troubleshoot the issue of a dual engine failure - as this is what would have felt to him - during takeoff.
My bad. I assumed it was the captain since the report says the FO only has a CPL license. And I was a bit surprised he could fly on a comercial airplane with only that kind of license and not an ATPL one.
Did you mean to say you can activate the switches with one hand simultaneously? That is probably what the above commenter assumed you meant. Since lifting and twisting two switches simultaneously with one hand seems challenging.
snypher: You can do them with one hand. [Ed. This is ambiguous and could be read as "one hand, simultaneously". In fact, doing it with one hand non-simultaneously would be a weird claim to make of a simple knob. See also ajb's comment below.]
zihotki: Really? They are not close together and have a spring mechanism. [Ed. Seems to believe snypher is claiming simultaneous operation.]
Context is both these switches being turned off with a 1 second gap. Doing it with one hand simultaneously would possibly explain it, otherwise it doesn’t seem relevant.
What I gathered from comments here is it's not a simple flick of the switch and it actually takes some effort to turn them off. Can you really do it twice within the span of 1 second?
You pull it out and flip it. It’s not easy to do inadvertently. But it’s also not convoluted—you want to be able to quickly cutoff if there is an engine fire.
I wonder if they could theoretically rest on top of the notch, not fully locked into either position and flip accidentally. No idea how the switches behave when not all the way up or down, but the notch looks pretty long and flat so it could be possible.
It could be defective switch springs, fatigue-induced muscle memory error, or something else. The pilot who did it saying he did not may not have realized what he did. It's pretty common under high workload when you flip the wrong switch or move a control the wrong way to think that you did what you intended to do, not what you actually did.
That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.
They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.
Still... that has its own set of risks and failure modes to consider.
If its both engines you're fucked anyway if its shortly after takeoff.
But I'm an advocate of KISS. At a certain point you have to trust the pilot is not going to something extremely stupid/suicidal. Making overly complex systems to try to protect pilots from themselves leads to even worse issues, such as the faulty software in the Boeing 737-MAX.
Was thinking this same thing. A minute feels like a long time to us (using a Garmin as the example said) but a decent number of airplane accidents only take a couple minutes end to end between everything being fine and the crash. Building an insulation layer between the machine and the experts who are supposed to be flying it only makes it less safe by reducing control.
First, the fire handles would override any delay and cut fuel (and other things) immediately.
Second: the window of time where you don't have enough altitude (aka time) to restart is relatively small. So this could easily be a temporary protection.
It is difficult to find exact data on this but restart to significant thrust seems to be in the 30-60s range. If you run the numbers on climb rate and glide time the possible danger zone is relatively small, a few minutes after takeoff at most.
Is this an extremely rare event? Yes. But most other accident causes are also rare, regardless of whether they are pilot error or mechanical.
For example: you might think no pilot would deploy the thrust reversers in flight but system protection errors and/or mechanical failures have conspired to allow it and a bunch of people paid in blood to learn that reverser deployment in flight at altitude was actually unrecoverable - contrary to conventional wisdom at the time. It turned out everyone was flying around with a "kill everyone now" mechanism. In some cases with a much lower margin of safety than previously believed due to the aforementioned "conventional wisdom" that if it happened it wouldn't be a big deal.
Know what else isn't normally a big deal (relatively speaking)? Accidental shutdown of both engines. Because a single engine shutdown is easily recovered and the aircraft can fly on one engine. And dual engine shutdown is easily recovered with a restart if you have enough altitude. But it turns out there's a small window after takeoff where it is fatal.
Somewhat relatedly shutting down the wrong engine in an engine failure scenario is so common they explicitly train crews to slow down and not immediately shut down an engine after failure because rushing just leads to dual engine loss.
Proposed algorithm: If the flight computer thinks the engine looks "normal", then blare an alarm for x seconds before cutting the fuel.
I wonder if there have been cases where a pilot had to cut fuel before the computer could detect anything abnormal? I do realize that defining "abnormal" is the hardest part of this algorithm.
The incident with Sully landing in the Hudson is an interesting one related to this. They had a dual birdstrike and both engines were totally obliterated and had no thrust at all, but it came up later in the hearing that the computer data showed that one engine still had thrust due to a faulty sensor, so that type of sensor input can't really be trusted in a true emergency/edge case, especially if a sensor malfunctions while an engine is on fire or something.
As a software engineer myself I think it's interesting that we feel software is the true solution when we wouldn't accept that solution ourselves. For example typically in a company you do code reviews and have a release gating process but also there's some exception process for quickly committing code or making adjustments when theres an outage or something. Could you imagine if the system said "hey we aren't detecting an outage, you sure about that? why don't you go take a walk and get a coffee, if you still think there's an outage in 15 minutes from now we will let you make that critical change".
If the computer could tell perfectly whether the engine “looks normal” or not, there wouldn’t be any need for a switch. If it can’t, the switch most likely needs to work without delay in at least some situations.
In safety-critical engineering, you generally either automate things fully (i.e. to exceed human capabilities in all situations, not just most), or you keep them manual. Half-measures of automation kill people.
But humans can't tell perfectly either and would be responding to much of the same data that automation would be.
I wonder if they could have buttons that are about the situation rather than the technical action. Have a fire response button. Or a shut down on the ground button.
But it does seem like half measure automation could be a contributing factor in a lot of crashes. Reverting to a pilot in a stressful situation is a risk, as is placing too much faith in individual sensors. And in a sense this problem applies to planes internally or to the whole air traffic system. It is a mess of expiring data being consumed and produced by a mix of humans and machines. Maybe the missing part is good statistical modelling of that. If systems can make better predictions they can be more cautious in response.
If the warning period is short enough is it possible it's always beneficial or is 2-3 seconds of additional fuel during a undetected fire more dangerous?
Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.
There is a relatively short window where dual engine shutdown is unrecoverable. Once you have a bit of altitude (and these jets climb at 2000-3000fpm) you have time for a restart and as thrust comes back sink rate will decrease even on one engine.
My proposal is during this window if dual engine shutdown is commanded don't do it. Treat it like it is happening - show the EICAS message, give the alert, but don't actually do the shutdown until the window has passed. This gives the pilots 10 seconds of startle factor then a bit of time to flip the switch back on.
Single engine shutdown would still behave as today so sure if one engine eats a fan blade shut it down. Not that it matters, the engine computer is going to cut fuel in that case anyway.
Insert a delay only for shutting down the remaining engine and only for X seconds after transition to air mode. A delay that the fire handle overrides.
Just a tiny bit of insurance. There aren't any emergency scenarios at low altitude where engine shutdown works but pulling the fire handle does not. You are coming right back to land at the airport no matter what.
Shutting off both engines would display "ENG SHUTDOWN" in yellow text (caution) on the EICAS. If only one engine was shut down, it would say "ENG SHUTDOWN L" or "ENG SHUTDOWN R".
Any of these would trigger an unmistakable audible "BLEEP BLEEP BLEEP" to draw your attention to the screen so that you could see what the caution was. These messages are right next to the engine N1 indications anyway, so it would be immediately obvious that one or more of the engines was spooling down.
I'm doing it all the time while rebasing commits or force pushing to my branch. Sometimes I would just click the wrong buttons and end up having to stay late to clean the mess. It's a great thing I'm not a pilot. I would be dead by now.
This is a place that puts "Hacker" in the name despite the stigma in the mainstream. Given the intended meaning of the term, I would naturally expect this to be a place where people can speculate and reason from first principles, on the information available to them, in search of some kind of insight, without being shamed for it.
You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.
For me it's mainly about intent/unearned confidence.
If someone is speculating about how such a problem might be solved while not trying to conceal their lack of direct experience, I'm fine with it, but not everyone is.
If someone is accusing the designers of being idiots, with the fix "obvious" because reasons, well, yeah, that's unhelpful.
For the record I don't think the designers of the switch or Boeing are idiots. The switches have guard notches and the throttle quad has metal guard edges to help prevent accidental activation.
As far as we know this is the first accidental dual engine cutoff at low altitude; with just a bit more altitude (not sure of how much exactly) the engine that had restarted and was ramping would have started producing enough thrust to arrest their descent. That makes the margin of "unrecoverable" a lot smaller than you might initially think.
Bottom line is it is worth considering implementing some protection here:
1. It can be done in software without a lot of complexity
2. The transition to "air mode" is relatively reliable.
3. The failure scenario is the system doesn't provide the protection but because the failure we protect against is very rare that is acceptable
4. It typically fails "safe": allowing shutdown without delay and worst case is a delay in shutdown.
5. The fire handle overrides delay; if things are going so wrong the delay matters the engine isn't coming back and pulling the fire handle is likely already part of your checklist.
The benefit being elimination of the small window after takeoff where accidental dual engine shutdown is unrecoverable.
Obviously before implementing something like this the proper engineering and failure analysis has to be done.
I don't think most think they know better but it's frankly fun to speculate and this is a casual space rather than the serious bodies tasked with actually chewing over this problem in earnest.
First I am a pilot. Not commercial or jet rated but I like to think I have a tiny bit more insight than average.
The point of what GI275 does is as a backup instrument you are much more likely to need it when the electrical system fails or is turned off due to fire. Yet if it just remains on until shutdown pilots would frequently forget to turn it off on the ground, resulting in its battery being worn out. Because it is considered critical it delays its own shutdown. Long enough for you to notice in flight but not so long it wears out the battery (which might result in only a few minutes of power in a real emergency).
My entire point was that engine restarts take some time. If both engines eat a blade or catch fire you are screwed anyway so whether or not the fuel cutoff switch does anything at 1500ft is irrelevant. But that is so rare I don't think we have any events on record. So it might be worth inserting a delay - enough to account for standard climb rates to achieve enough altitude to make restart likely or at least possible. The delay would only be for the second engine shutdown and only for time T after going into air mode. And if the system gets it wrong, thinking the other engine is shutdown when it is not pulling the fire handle would override any delay - and pulling the fire handle is part of any engine failure or departed aircraft procedure I know of. In other words you wouldn't even need to change the QRH or emergency checklists in most cases.
I noted that engineering for aviation is complex and everything has failure modes to consider. Privately I went through several iterations of this idea and discarded them for problems with failure modes and complexity. What I proposed is boiled down to the minimal thing that would have saved this flight.
The other thing I'll say is there is a reason the computer will auto-extend some flaps/slats at slow speed even if you put the handle to zero. And there's a reason auto-throttle provides protection. And with the exception of the 737 the computer auto-starts the APU on dual engine failure. And any attempt to deploy thrust reversers in the air is ignored. And stick pushers exist for good reason.
We put in all kinds of measures to override human decisions to prevent mistakes and errors.
It literally is. Accidental/malicious activation can be catastrophic, therefore it must be guarded against. First principles.
The shutoff timer screen given as an example is a valid way of accomplishing it. Not directly applicable to aircraft, but that's not the point.
> "ugh can't you just do what garmin did"
That's your dishonest interpretation of a post that offers reasonable, relevant suggestions. Don't tell me I need to start quoting that post to prove so. It's right there.
(Different user here) Hacker News' "culture" is one of VC tech bros trying to identify monopolies to exploit, presumably so they can be buried with all their money when they die. There's less critical thinking here than you'd find in comments sections for major newspapers.
Yeah, people shouldn't bat ideas around and read replies from other people about why those ideas wouldn't work. Somebody might learn something, and that would be bad.
Reminds me of 2017 Las Vegas shooting. The perpetrator looked and acted completely normal till the day of shooting and all his issues like anxiety or losing money was nothing far from ordinary. And what seems all of a sudden did a well planned shooting and didn't bother to leave a note or tell his story.
There's 0 reason to conclude murder-suicide, there's an infinitude of things that could have the same result, and both pilots denied it to eachother: how is that presented as proof?
I hope I don't need to explain why the fact no one knew in advance the Las Vegas shooter was going to shoot has ~0 similarities with the situation as we know it, and banal similarities with every murder.
Could you explain more? There's too many negatives in that last sentence for my decaffeinated early morning brain. I'm titillated by the idea there's a way to justify making up things so I really want to parse it.
A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.
But why does the pilot then comment that they are in the CUTTOF position and move it to RUN? A mechanical failure would have to also move the physical switch in the cockpit for the audio recording to make sence.
You have the exact CVR audio? The report says "one of the pilots is heard asking the other why did he cutoff" which I interpreted to mean one of them noticed the engines shutting down, and asked the other if he did that.
Then he would have asked the other pilot why the engines are shutting down. It seems a lot more probable that he glanced at the switches before asking such an explicit question.
From the preliminary report, quote: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."
I'm trying to understand your complaint here... you think you need to hear their voices with your own ears to believe it?
We know that the switches physically moved from the run to the cutoff position because one of the pilots noted that they were in the wrong position. We know that they were moved back to the run position because they found in that position. I don't understand how a short could explain that - it really seems like someone would have had to physically move the switches.
What we have is reported speech: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."
So we don't know the exact words used. Did he say for example, "Why did you move the switches to cutoff" or did he ask "Why did you cut off the engines"? If there are indeed two shorts (astronomically low as those probabilities are), the other pilot would say "I didn't", look around confused and then (possibly?) flip both of them down and back up? Which could explain the 4s delay in pulling them back up.
Speculation, but since we do not have actual transcripts or recordings, all I'm doing is answering speculation with more speculation.
Do we know that the pilot noticed they were in the wrong physical position, or did some other status indicate the engie fuel had been cut?
I would be surprised if there was only one channel for this information
In the last mentour pilot livestream, they showed the simulator and both engines, and there's a little graphic near the cutoffs showing engine state and performance. Also, in _this_ livestream as soon as the report was released, Ben mentions in response to a question that if you cut off the engine, a lot of electrical systems are going to face power cuts, so there will be alarms blaring all over the cockpit. So, yes. There are many channels of information here.
It amazes me that some people can ever make it out the door if they spend all their lives contemplating a series of increasingly unlikely possibilities.
It's not that rare, and there are institutional factors (such as seeking treatment for psychosis being career-ending for a pilot) that incentivize serious pilot mental health crises being untreated.
This is highly reminiscent to me of this case. [0] The co-pilot accidentally hit the wrong switch and then quietly corrected his mistake later, without resetting the previous switch (which led to feathering).
>It's difficult to conclude anything other than murder-suicide.
This kind of attitude gets innocent people behind bars for life. Disgusting.
It's difficult to conclude anything until the investigation is finished and I hope the ones who are carrying it out are as levelheaded, neutral and professional as possible.
Cutting the engines within seconds of leaving the ground doesn't fit suicide very well. I'd expect something more like flying into the side of a mountain or heading really far out into the Indian ocean until you vanish from radar and cause a big mystery.
For instance, you might deliberately kill yourself by driving your car really fast into something solid, but you probably wouldn't try to do that while backing out of the garage.
I think it is opposite.
Flying into a mountain & etc would require one pilot to somehow incapacitate another pilot.
Cutting fuel off, if done on takeoff, is not recoverable (engines can’t relight and spin up quickly enough).
It's interesting to see how people manage incomplete information.
You could have made the same assumptions after the first MCAS crash, much like boeing assumed pilot error. It's easy, comforting and sometimes kills people because it makes you stop looking.
I know this thread runs the gamut of armchair experts, pretend experts, and actual experts and there's no telling who is which but I really want to know why the downvotes and why this is not a good idea.
The idea is to notify for crucial settings, replace vocal confirmation (probably) already in the SOP anyway, reducing mistakes in bad faith or otherwise.
Don't some planes already have an automated announcement for seatbelts on?
Only reason I can think of why it's not there yet is the cost (whether $$$ or design opportunity) of cramming that in the already-cramped cockpit.
My first instinct is that the suggestion is overfitted due to hinsight bias. This particular accident happened to involve these particular switches so let's add a warning to these switches. Duh!
Some problems that immediately come to mind:
- For which settings is there going to be a voice confirmation? Is their confirmation more important than all the other audio warnings?
- During emergency situations, when pilot workload is high, will these only add to that workload, making the emergency even worse?
- Will the pilots get so used to hearing these every day that their brains will simply tune them out as background noise?
Really though, if a pilot wishes to doom an aircraft, there's 1000 different ways they could do so. The solution to this problem likely lies in the pilot mental health management department, rather than the fuel cut off switch audio warning one.
Pretty obviously a bad joke and a bad idea IMO. I did not personally downvote, but I think it deserves its current score.
Look at the timeline of the events. The switches were shut off, noticed to be shut off, and restored to the proper position within 10 seconds with the current system. Insufficient notification that the switches have been turned off was clearly not a problem in need of a solution. It would be slower and more challenging to understand an automated verbal announcement than the surely extremely obvious sudden lack of thrust and all engine dials rapidly dropping to zero.
So it wouldn't contribute at all to solving this particular case, would only be a slightly annoying distraction in the more normal case of normal aircraft shut-down after completing its flights, and would be a potentially hazardous distraction in the intended emergency case of engine is on fire and fuel must be cut off immediately, where there's probably a bunch of other extremely important and urgent things to pay attention to and do other than a silly automated warning telling you what you just did.
It's a joke about the design of safety systems involving actual human lives (movies being more safe). I get an audible warning on my laptop if i hit a key for too long for God's sake. These companies are a joke.
Do you know if the mechanical position of the switch guarantees its electronic state without any possibility for hardware malfunction? If no, then you are claiming a person made one of the most grave acts of inhumanity ever.
This sounds to me like an electronics issue - an intermittent, inadvertent state transition likely due to some PCB component malfunction
The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated. Malice looke very likely to me. An investigation into the pilots life may turn something up, I guess.
It’s worth noting that Premeditation or “intention” doesn’t have to factor into this.
Studies of survivors of impulse suicides (jumping off of bridges etc) indicate that many of them report having no previous suicidal ideation, no intention or plan to commit suicide, and in many cases no reported depression or difficulties that might encourage suicide.
Dark impulses exist and they don’t always get caught in time by the supervisory conscious process. Most people have experienced this in its more innocuous forms, the call of the void and whatnot, but many have also been witness to thoughtless destructive acts that defy reason and leave the perpetrator confused and in denial.
> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated
How so? It is just as likely to be an intermitted electronic malfunction.
And then 10s later the switches magically fixed themselves? The likely not electronically connected switches since that would compromise engine redundancy?
It is, and one would expect that a single switch failure would be far more probable, so how often have we had switch failure single engine cutoff in the 787?
The four Indian pilots on her show are clearly not convinced that the pilots are to blame.
As they mention, it's important to know what else was spoken in the cockpit. Quite possible that there's more, and that might have implicated the pilots. However, if that's not the case, this is a very poorly worded report.
This is BBC, they have a history of being uncharitable when it comes to reporting on their erstwhile colonies. Jumping to a conclusion about pilot's fault when the recorded dialogues show both had no idea who cut it off (leaving ground for a possibility of some malfunction) is irresponsible, especially when the report could have been worded better without needing to reach a definitive conclusion.
Both pilots have a long history of flying, a lot of experience, so while there is a chance one of them did it unknowingly, it's a small one in my opinion. Because it's not just a small switch, but a multi step procedure. The reporting on such a sensitive issue has been shocking to say the very least,
Where in the BBC coverage are the pilots blamed? Sounds like you might have a bit of a chip on your shoulder, and indeed it sounds like you are the one who is biased towards a particular conclusion (namely that the Indian pilots bear no blame).
i see the confusion. Initially the title of the video on BBC youtube channel was:
> BREAKING Air India crash: Pilot cut off fuel to engines - no fault with plane | BBC
and then they changed it to:
> Fuel switches cut off before Air India crash, preliminary report says | BBC News
You can decide. I had noticed it then. It was also noticed by many others as the story started getting traction and there are many x accounts (and probably elsehwere too) which would corroborate the same.
I'm completely ignorant about this matter, but why is it even possible to cut off fuel while taking off? Shouldn't there be a control that completely disables this? Is there actually a situation where cutting off both engines could be necessary and wouldn't lead to a catastrophe?
The general principle of aircraft control is that the pilot has the final say on how it is operated, not the designer, because you never know when you will need to take extraordinary measures. And the pilot generally prefers to return to the ground safely.
This is true for boing, but not true dor Airbus design philosophy. Airbus tends to limit the pilot control inout pushing the plane out of safe operation conditions. I'm not sure of it's possible/not possible to cut the engine fuel supply during take-off in any Airbus though.
I'm assuming fuel being cut off is salvageable if not in the middle of a densely populated city, especially if above a plain or water. So it could be the favorable option in case of an engine fire.
Also, such complexity would introduce additional points of failure - as a sister comment mentions, a faulty altimeter (or whatever sensor) could prevent you from cutting off fuel when you need to.
> if not in the middle of a densely populated city, especially if above a plain or water
What is on the ground below does not matter at that point - how far above that ground you are is what is important. More altitude is more time.
This flight was less than 200 meters up in the air. Sully's flight that you probably remember, that made a successful emergency landing on the river, was about 860 meters high, giving them much more time - about 3.5 minutes of glide time, vs. 32 seconds in the air, total, for the Air India flight.
Okay, maybe there is little hope of making an ideal landing. But the likelihood of it being a fatal accident is significantly reduced without the building in the equation, no?
Pretty sure nearly all runbooks have you first move the thrust lever to idle before cutting off fuel. That suggests you shouldn't be able to cut fuel independently of the throttle.
Sometimes? If you have enough altitude to trade for speed then after the cutoff you could glide to a hypothetical miraculously-placed runway right in front of you, vs. having fire quickly consume the entire plane if you don't cutoff..
You can physically cut off fuel without pulling the thrust lever to idle, because the two are separate controls.
However, it’s against procedure to do so - even dangerous. Throttle should always be at idle before pulling the cutoff switch, because otherwise excessive pressure can be created in the fuel system.
Essentially this is just a best practice, but there is no interlock between throttle and fuel cut off.
Then I got intrigued by your comment in case the throttle encoder fails. Turns out there is double redundancy on the throttle encoder (if one computer fails, the next one takes over), and if both fail the airplane will run on the last known setting at which point the only possible action that can be taken is to cut off the fuel (or keep it running with the last known throttle level).
In this regard both Boeing and Airbus follow the same implementation and there is no difference whatsoever between them.
Perhaps something they I have learned is that cutting off fuel during max throttle position (take off) may have damaged the fuel system of the Air India airplane because of big pressure in the lines and that may have interfered with the restart of the engines when the fuel valve was opened again.
So many garbage takes here - this report wants to imply pilot error and without all the data/audio that remains a remote possibility but the truth is it is far more likely that this plane experienced a total electric failure following liftoff and the onboard computer entered some form a failsafe mode which set the fuel valves to a default closed state.
The pilots were likely immediately trying to relight the engines which is the correct reponse but sadly they didn't have the altitude to see the process through.
My guess is the truth here (i.e. Boeing equipment malfunction) or at least the framing of it is being used as a chip in trade deal negotiations which are active and ongoing.
Video would definitively show whether either pilot moved these switches or if some other mechanism caused the movement.
The aviation industry has consistently resisted cockpit video recording despite decades of available technology. The pilot unions argue privacy concerns, but cases like this demonstrate the value it would have. Current audio captured the pilots' denials, but without visual confirmation we may never be able to definitively determine who turned the engines off.
Its more about concerns about Airlines using video to micro-manage pilots.
I too would hate it if my manager was watching my every move while working so I can empathize.
Throttle control module (TCM) was replaced twice in the past 2019 and 2023 which is not very usual.
Now pure speculation, both pilots have long record of flying, you have to literally pull up and move each fuel control switches to cut off. Either one of the pilots did this intentionally or control unit was faulty. Considering past history and pilot experience, my bet is on faulty controls but we will never know.
>Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India.
You've linked to something regarding an ECU component. Nothing about fuel switches. "This Service Bulletin provides instructions to replace the EEC MN4 bridge ball
grid array (BGA) microprocessor"
Because that maintenance check is an optional one as stipulated by Boeing. I don't think most users of the 787 themselves carry out the check, so singling out Air India for this alone is just bad faith
No they don't, do they. That also corroborates the fact that they could be both switched to CUTOFF within a second, like the report states. That impossibility was raised by parallel threads here. In the video they are both switched on even faster than 1 sec apart, or, at least it feels like it.
What makes me more inclined to suicide is that this might have been the perfect time to do this so that even a small interruption in fuel would be catastrophic.
If this is the case, you have to then think about why this pilot would want suicide but also murder all aboard the plane. It's a bit irrational if they wanted to just suicide - you can easily just cut your own throat, hang yourself, or jump off a tall building.
This report is outlining the known facts of the flight at present. The main one being the movement of the fuel switches to the off position did occur a few seconds after take-off, almost certainly by one of the pilots. And this was the primary cause of the crash. However, blame has not been apportioned and the reason for why is not known.
Three things:-
1) Pilot clearly said I didn't do it.
2) Report talks about the second switch being turned off in a second.
3) Known advisory on switches getting flipped.
If you see these three together, it becomes easy to deduce that based on point 2, switch was not human induced as the actions required take more than a second.
Next the third point, advisory was for this exact scenario which played out, though rare but still it shouldn't have been just an advisory, but more than that.
The switches are right next to each other and have a very short throw[1]- it would definitely be possible to do them in under a second and it looks possible to throw them together.
IMO that looks like a spot that would be pretty difficult to hit accidentally even if the ward failed. You'd have to push them down and the throttles are in the way.
Doesn't mean the switch couldn't have failed in some other way- eg the switch got stuck on the ward but was still able to activate with a half-throw, and spring pressure pushed it back into off during a bump. But switches generally only activate when fully thrown, and failing suddenly at the exact same time is not really what you would expect.
> it becomes easy to deduce that based on point 2, switch was not human induced
This just isn’t correct at all. The evidence isn’t conclusive but if a human operated switch was flipped, and one of the humans present says to the other one hey why did you do that, then Ockham’s razor points to a human flipping the switch.
It’s not the only option, but it’s certainly the most likely.
Where do you get this from? You have to pull up the switch with two fingers and move it to the other position and put it back in. This doesn't seem to take more than a second if deliberate.
To me, it points to a Germanwings-style sabotage. And the "I didn't do it" seems to be a lie. Not very confident in it, just the likeliest to me. Though one can ask why not just push the nose down instead. Maybe he thought that's too easy for the other pilot to counteract. The fuel switches are more out-of-mind and more startling to change.
As has been pointed out elsewhere, even if one of the pilots did deliberately move the switches, it's not clear from the reporting so far if that's the same pilot who responded to the question. In other words, it's possible one pilot flipped the switches and then asked the other pilot why he cut off the fuel to misdirect and create more confusion.
Edit: Of course this is all speculation, we don't know if the switches were moved deliberately and if so which pilot did so and which pilot was which in the exchange. More investigation is clearly needed.
If there was any worry that 787 switch lockouts are not working properly, wouldn't they release an immediate bulletin for inspections on all aircraft? It seems like the lack of any bulletins implies the lack of any suspicion on hardware problems.
The advisory was for the lock being disengaged meaning you would still need to manually move it. it wasn't for being moved by factors such as vibrations also If it was from vibration how would a crash impact not move them back to cut off?
In this phase of flight the pilot’s hands should be nowhere near the thrust levers let alone the fuel cutoff switches. There is no way they could accidentally knock them with their hands.
On the contrary, it's quite normal that the PF's hands are on the throttle levers throughout the climb (until the switch to automation), which are directly in front of the cutoff switches.
Not sure where this is asserted? These aren't complicated mechanisms, it's just a pull lock, right? Pilots flip the switches twice on every flight at startup/shutdown, it's a routine action.
These airplanes reject a lot of the pilot inputs if they don’t align with the expectations. Any idea why the system even allows the cut engine fuel input at that time of flight? Sounds to me that it should be just ignored. Even if both engines were on fire while climbing that early, what could cutting fuel offer?
Fire, probably. But also, how complicated would you make the system if you needed to prevent certain switches from working during certain times of flight? At some point... we're all just in the hands of the people in the cockpit.
Sure, but you can open the door, pull the handbrake, or turn the wheel so hard you lose control of the vehicle. These are all similarly preventable, but maybe not worth the risk of being unable to open the door, brake or steer if the safety mechanism fails closed, or if your situation is outside the foresight of its designer.
Also, you don't need multiple certifications and 1500 hours of experience to drive a car.
On my Tesla Model Y there's a hand brake on the push button of the right lever. On the left hand lever there's another push button, the windshield wiper liquid. Guess what have I mistakenly, and scarely, done twice already when driving at highway speeds when my windshield was a little dusty?
New designs are prone to ill decision-making from engineers, drivers and pilots alike. Every pathway of let's do it differently is the beginning of a journey of fine-tuning loops until stability.
A friend did exactly that in a manual transmission, doing 100km/h.
She was mad and said she has to jam it hard ( going for 5th and missed), but it went into reverse. And the gearbox literally hit the road when she let out the clutch.
There may be a good reason to cut fuel to one engine shortly after takeoff.
You could have a system that prevents both switches being thrown, and only in the specific window after takeoff, but you’ve also now added two additional things that can fail.
They look nice, but they can be turned on the C17 (and probably other military airplanes).
Commercial airplanes have safeguards against in-flight thrust reverser deployment. That is why they only work in tandem with the ground sensing systems - like the airplane must firmly believe both main landing gears to be physically on the ground for both reversers to be operational.
Disable the fuel system cutoff controls during the takeoff climb phase of flight. Once the aircraft loses contact with the runway, these controls shouldn't function without tripping certain thresholds (speed & altitude), or following a two-man procedure that is physically impossible to execute solo. In any other flight regime, the controls function as originally designed.
The danger of a burning engine is irrelevant if you are heading into terrain.
Now you created a fuel system cutoff control inhibition system which may malfunction in its own ways, e.g., refuse to cut off fuels from a burning engine because it thinks the plane is too low due to faulty altimeter reading.
I don't think so. A moderately hard landing with an engine(s) smoldering because they were on fire but had their fuel cut off is probably survivable for most of the passengers. A moderately hard landing with the engine(s) a raging inferno pouring burning fuel all over the place because the fuel couldn't be cut off or took too long to do so is much less survivable.
Putting complex and fallible restrictions on safety-critical controls like fuel cutoff is usually a bad idea overall.
> The danger of a burning engine is irrelevant if you are heading into terrain.
Not quite. When you hit the ground you do not want any fuel leaks or hot surfaces as much as possible. That is why for example engines are shutdown when doing an emergency belly landing, to try abd prevent the airplane from bursting into flames.
Engine overheating even on idle thrust (if this happens after V1, you would idle it and continue the takeoff anyway; you are beyond the point at which you can safely abort).
Engine oil leak has drained the oil completely and the engine is about to fail catastrophically (unlikely on takeoff but you never know).
Engine is on fire (out of all of the things that can go wrong with an engine during takeoff, this is very likely).
Engine has blown up (ditto).
Engine is missing from the aircraft (not likely, but engines have fallen from planes on takeoff before).
Debris / Ash / etc is in the engine (not likely).
Severe fuel leak (not something I'd worry about during takeoff).
As long as you also eliminate the possibility of maintenance problems and defects in automation, and have perfect microscale weather forecasts, and still have overrides for the human safety pilot that can still... wait a minute.
The NYTimes states that there was an advisory on the switches but that the FAA had not deemed them unsafe. It also states that on this plane the switches were changed in 2023.
In the 787, each engine has an independent control oil circuit switch. This switch needs to be pulled out, moved, and then pressed to take effect; I feel that this is difficult to complete in about a second.
I recall something similar to this happened in the USA in 2023. An off-duty pilot in the cockpit tried to pull that fuel shut-off handle (edit: I'm informed it's a different fuel shut-off mechanism), but was overpowered by the other two:
> "Both pilots then saw Emerson grab on to the red fire handles, also known as the “T-handles,” which are used to extinguish engine fires and shut off all fuel to the engines, potentially turning the plane into a glider, the pilots told federal investigators."
> "“If the T-handle is fully deployed, a valve in the wing closes to shut off fuel to the engine. In this case, the quick reaction of our crew to reset the T-handles ensured engine power was not lost,” Alaska Airlines said in a statement."
> "One pilot struggled with Emerson for about 25 or 30 seconds before the off-duty pilot “quickly settled down,” according to the complaint."
That's not the same one, that's the big red FIRE ones on the overhead panel. They're not reversible and are under a plastic cover. As far as I know these ones are. They're also used to just switch them off at the end of a flight which can of course be reversed. But I guess in this case there wasn't enough time. They only had 30 seconds.
As we just reported, the report says that according to data from the flight recorder both the fuel control switches, which are normally used to switch the engines on or off when on the ground, were moved from the run to the cutoff position shortly after takeoff. This caused both engines to lose thrust.
The preliminary report suggests this is pilot error.
From my (limited) understanding you cannot really switch these off inadvertently as they require a couple of actions in order to be switched off. So it would mean one of the pilots switched these off (and they were a few seconds later switched on again but it was too late).
But there was audio, too, and one pilot asked the other "why did you switch these off" and the second one said "I didn't".
It's safe to state these fuel cutoff switches aren't to be touched in-flight unless the word 'fire' is said beforehand. Even then, you only perform fuel cutoff for the flaming engine. If the copilot was busy with takeoff, there is exactly one other person in the entire world that could have flipped both switches. We may never know which one flipped them back.
Yep. Fan blade off, shroud separation, HP disc separation, compressor stall, FOD ingestion/bird strike, EGT rise, oil system issues. Very unlikely events but still possible events that need a prepared response to and capabilities to manage the aircraft. The presumption is that the crew is trained, diligent, disciplined, and concerned with survival. Without that, aircraft would need to be unmanned and flown by AI lacking in ability to handle any unforeseen events creatively.
I don't want AI planes either, but the alternative of unmanned is ground-based drone operators who lack the survival interests of being on the planes. As such, I want non-AI flown planes with sane, stable, rested, practiced, experienced, sober pilots on the plane that isn't overly complicated and is reliable.
Why didn't they turn them back on then? Or does it take too long to spin up again even if they are still spooling down? This is one of the worst possible moments for this to happen of course. Low speed, low altitude, lots of drag...
They did, about 10 seconds later (which is both incredibly short and an eternity). But the engines almost immediately start losing thrust and it takes them much more time to restart. At the end of the flight, FDR records that one engine was gaining thrust, and the other was attempting to spin up, but it was too late and they didn't have enough glide time for both to gain enough thrust to climb.
Yeah 30 seconds is not much. This is really the worst phase of flight for this to happen. 30 seconds later and the plane would have had much more altitude and energy
The India AAIB website (https://aaib.gov.in/) is not responding ... For anyone who read the report, was there information about the age & experience of the pilots?
It’s interesting to see how many people are bending over backwards here to avoid coming to the obvious conclusion. If this was pilot suicide, it’s a terrible thing. If it was somehow an error (which seems very unlikely) or two defective controls (which seems even more unlikely), then it remains a tragedy. But I don’t need to do mental gymnastics to come up with implausible hypotheticals.
This comment stream on HN is not a jury. We don’t have to refrain from making judgments right now about what happened. There is nothing wrong with rational people reaching a preliminary conclusion based on available evidence.
Rational people should also remain open to revising their judgments/conclusions if new information becomes available.
And we shouldn’t demand any specific consequences for anyone absent a trial.
It’s nowhere near an obvious conclusion. A failure with the locking mechanism or muscle memory confusion are just as likely, and probably other theories I’m not thinking of. More investigation is clearly needed, which is why this is called a preliminary report.
Dual failure of the locking mechanism is extremely unlikely.
These are not switches that are regularly used so a muscle memory issue also seems very unlikely (but is still the most likely non-suicide scenario)
Is it really desirable though? Sure, it might eliminate human error, but it also probably eliminate pilots saving planes. I don't think an autopilot would have put US Airways Flight 1549 into the Hudson.
reached v1, then when airborn fuel cut off. Seems like there was a FAA report like in 2018 that recommended few airplane models (incl this one) to check the fuel valves correctly, seems like air india didn't do it. Turns out it was made by Honeywell
And this can't possibly be all the audio if the other pilot noticed the switch position, I would expect a lot more cussing and struggle.
So they didn't notice the switch position? The switch was in the right position but not really? Is this a rarely used switch that one might not look at (or know where to look) during regular use?
Dual engine failure on takeoff gives them about as much time to react as if the front passenger grabbed the steering wheel while on a windy mountain road and yanked them off a cliff.
It only takes a few seconds to completely screw everyone, but a bit longer for the consequences to occur.
The switch had to be operated deliberately, but still a UX fail on a modern aircraft if cutting off fuel to the engines does not result in an audible alert/alarm which both pilots can hear - especially at that altitude.
It would not make any difference. They were too low and did not have enough time to recover. They immediately switched back to on. Two captains is discussing it here (https://www.youtube.com/watch?v=SE0BetkXsLg).
The switches were re-engaged within 10 seconds so isn't it possible they quickly heard a warning alarm, realised the issue and fixed it? (Of course, not quick enough in this case)
Studying how humans make errors is a fascinating field. Simply banning someone who's made a "slip" error as hypothesized wouldn't actually reduce the likelihood of this error occurring in the future. These sorts of errors are stochastic and could happen to anyone at any time. Preventing them requires a lot of thought.
The report says the black box reports the fuel cutoff switches being activated. That doesn't necessarily mean that either of the two pilots activated them, it just means that the fly-by-wire system reacted to a fuel cutoff event.
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cutoff.
In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
> That doesn't necessarily mean that either of the two pilots activated them
It does:
1. Those switches have physical interlocks and cannot be manipulated by any computer system.
2. The flight data recorder is measuring the position of the switches; they aren't inferring the position from some system state. There's a "position of this switch" channel.
The switches were physically moved in the cockpit, that's basically ground truth. The question now is who and why.
What is the path of the wires from the switch onward? Do they go into a digital input of the flight computer, or do they directly feed the fuel control valves?
The 787 entered service with an improved fly-by-wire flight control system. Rather than mechanical processes, the systems convert flight deck crew inputs into electrical signals. Still, there were additional advancements with the type."
Can't find a definitive source right now, but everything is implying there are discrete lines - at least one for command signal to the FADECs, and a separate sense line to the DFDAU for packaging up and sending to the EAFR. That lines up with design philosophy on this stuff of sensing control input data as close to the source as you can get.
Thanks for looking. I worked for Boeing (satellites, not airplanes) for a good part of my career, and I was there when Dennis Muilenburg pushed through his cost saving measures. It was the same culture that created the problems with the 737-MAX. Experienced design engineers were replaced/outsourced and the culture of safety was sacrificed. One example here:
787 (Dreamliner) was pushing hard for weight reduction, and it would not surprise me at all if the switch output fed a digital computer input rather than routing directly to the fuel shutoff valves, but I don't have any direct knowledge of this.
Then why do we see the pilots notice the cutoff, move the switches back, and the engines respond as expected? The switched cannot move themselves. We’d expect to hear more commentary and confusion if the cutoff was active and the switches still in Run.
There would have likely been an indication on the glass cockpit displays that the fuel had been cut off, perhaps the pilot flying noticed this and asked the captain.
Yes, there is, but the reaction to that would be to look at the position the cutoff switches were in. We didn’t hear “wtf, they’re in Run” - the report says they just moved them from Cutoff to Run and the engines responded as expected.
I think you have to really reach to make this not pilot error. I know it’s appealing to call this a Boeing problem, but the evidence just from this prelim report is very compelling.
Until we hear the actual CVR audio, I don't think we can assume much. They are under a very high stress at that point in the flight, and while the "WTF?" might be going through their minds, all they could've resorted to is toggling the switches off and on again.
No, lacking other evidence (e.g. CVR recording) it doesn't mean they have been moved. The wiring in between the switches and the engine+FDR could've also developed an intermittent fault.
The fact that your car's engine stops doesn't mean you turned the ignition switch off. Anyone who has had to troubleshoot a car with intermitent electrical faults knows that.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Why wouldn’t this qualify as a murder-suicide, assuming your theory is correct?
I guess I let my emotions get in the way. But nobody seems to be saying that we’ve witnessed one of the worst acts of mass murder in history. Most of the notorious serial killers don’t come close to killing 300 people.
It feels qualitatively different than someone pointing a gun at someone else and then themselves, which is usually what pops to mind when you hear “murder-suicide”.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Even taking intent for granted, to deny suicide in a case like this would be to suppose that the person responsible expected to survive while everyone else died. What could possibly support that conclusion?
He appears to have meant something like “this isn’t just common murder-suicide: it is a particularly heinous version of murder-suicide that I wish there were a stronger word for” but phrased it confusingly.
As someone with no qualifications on this beyond occasionally playing some flight simulators, I can't think of a reason you would ever intentionally move the switches in flight (barring an emergency like a leak or fire or something) and unintentionally doing so seems extremely unlikely since generally "switches meant to be operated on the ground" are located well out of the way of "switches meant to be operated in flight". Though I believe Boeing does have them by the thrust levers, every type of fuel control switch I've seen has some sort of guard or mechanism that makes it effectively impossible to move the switch by simply bumping it.
So I can't imagine how it could have been done accidentally.
I am, and I’m willing to stake my reputation on it. If I’m wrong, I’ll hang up my hat and never cover live news again.
Pilots are drilled from day one that the fuel switches are sacred. After a few accidents where one engine failed and the pilot accidentally turned off the remaining functional engine, the training was overhauled so that it would be impossible for it to be an easy action done by mistake. One pilot is required to ask the other for confirmation before toggling the switch, I believe. It wouldn’t be something you’d do from muscle memory.
> If I’m wrong, I’ll hang up my hat and never cover live news again.
It easy to say that when you know there's likely no way to prove or disprove whether it as an accident or not. Unless a pilot left a note stating his future intentions, there's no way to determine their state of mind.
Someone took their hand, pulled one spring-loaded switch into the off position, and then did it the other switch moments later. Is there any way that could be accidental?
If there was no mechanical failure, the only remaining possibility is deliberate action. And if it was mechanical failure, we’d see an emergency air worthiness directive being issued, which we haven’t.
People do things bizarre, inexplicable things all the time. It's called a brain fart... the human brain is complicated, sometimes wires just get crossed.
Honestly I think the chances are good that you're right, but the way you're presenting it as absolutely certain strikes me as overconfident, borderline arrogant.
Also, what's with the whole "staking your reputation" thing? What reputation? Are you some kind of famous journalist? Is there some reason we should care about you "covering live news" ? Serious questions -- I personally have no idea who you are.
I also don't recognize this guy's name, but I do find it ironic that his profile is possibly the most well-linked to a other identities I've ever seen on HN: https://news.ycombinator.com/user?id=sillysaurusx
It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
The victims also deserve to be acknowledged. At this point the overwhelming body of evidence points to a deliberate act. Pilots are trained never to touch the fuel switches in flight, and (I believe) there is a verbal confirmation required before toggling. This captain had over 8,000 hours.
The reason I’m so confident is because I trust the system. It’s designed so that if either of the two pilots do anything, they verbally call it out, e.g. "gear up." A callout like that followed by fuel switch cutoff would indicate it was accidental. But as far as I know, there was no callout.
The pilot flying is also the one who asks for gear up and such. It’s the job do the pilot monitoring to perform those actions.
Suppose it was accidental. That would mean the pilot flying was fiddling with switches instead of flying; that’s against SOP. Or it would mean the pilot monitoring was performing uncommanded actions, which is also against SOP. It’s not something that happens on a whim. Both are contradictions, hence, no accident.
As for being overconfident or arrogant, what matters to me is accuracy, and passing along that accuracy. No one seemed to be willing to publicly call this a malicious action, so I did. If I’m wrong, you can be sure I’ll feel terrible for weeks, post an apology in the thread that shows I was wrong, and then bow out in disgrace, never to cover news again.
People here did the same thing when the common belief was that there was a non-zero chance of nuclear war. I was one of the few voices in that thread saying absolutely not, stop stressing yourself out for no reason.
I’m simply one voice of many. As always, it’s up to the reader to decide what to believe.
> It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
Then why not either wait until there's more information or temper your remarks by acknowledging there's still ambiguity? That would directly hedge against spreading misinformation, whereas staking your reputation on it and then shutting up if you're wrong only works after the misinformation has spread and doesn't seem very productive.
I think the right response to realizing you've spread misinformation (in the event that you turn out to be mistaken [I think it's 60-40 in favor of deliberate]) is to temper your statements and rededicate yourself to checking the facts, not removing yourself from the discussion altogether. And if you were keeping your mouth shut, wouldn't you continue to see discussions you could meaningfully contribute to, and after a while wouldn't you wonder whether anyone was really benefitting from your silence?
I was about to leave a big reply, but then I remembered that the guidelines ask that we only comment when feeling intellectual curiosity. That’s not what I’m feeling now, so I’ll go spend the evening with my daughter. I hope you have a nice evening as well.
> It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
I understand that you appear earnest. However, your history of multi-accounting on this site makes your promise to never post on a given topic again meaningless to me, because I have no expectation that you wouldn’t continue to post about it on other accounts that we don’t know about at this time, possibly because they haven’t even been created yet.
The report indicates the cut off switches were found, and were in the RUN position. However, the report does not indicate if the locking mechanism was functional; given the thermal damage, it might not be possible to determine.
I'm also interested in the earlier switch defects where the switches were installed with the locking mechanism disengaged on some 737s and inspection was advised for 787, but the incident aircraft was not inspected.
The airworthiness directive for that [1] indicates switches with locking disengaged should be replaced, but I wonder if it's possible to reingage the locking somehow, which could result in a situation where the locking wasn't engaged, the switches changed inadverdently and then when restored the run position the lock was engaged... that's a big reach, of course.
All that said, assuming the switch was working as designed, there's a semantic argument around deliberate and intentional. If the switch requires specific action, it's fair to call it deliberate action; but if the switcher thought they were activating a different switch, it's not murder.
Either way, there's no sense rushing to a conclusion of murder. Assuming one of the pilots activated the switch, they have already died and they are beyond the effects of human judgement; so we may as well wait for further information.
The switches require that you pull them out, move them to the end position and then push them back down, and it was two switches. It could have still took off on one engine. This is essentially the turn off plane switch. It would seem to almost impossible that it would be an accident.
Not possible it's an "I bumped it" type of accident, maybe.
It's quite possible it's a "performed the wrong muscle memory at the worst possible moment" type of accident. This is unlikely, but anyone who thinks such a mistake is impossible doesn't know anything about human factors.
Unlikely just means "low probability." There are thousands of flights per day, so it's only a matter of time.
You mention "brain fart". There is certainly a long history of pilots selecting the wrong lever, or wrong switch. So, it is possible the pilot who denied switching the fuel off thought he had switched something else.
My understanding is that after several incidents of pilots shutting off the wrong engine, the training was overhauled so that from day one they treat fuel switches as sacred. I heard that it’s required to ask for confirmation before toggling the switch, just to be absolutely certain. It’s not really something that can be done by muscle memory during flight, and especially not during takeoff.
If he was trying to do something else, he would have called it out. E.g. an audible “gear up.”
Also, it took 10 and 14 seconds to switch them back on. If it was an accidental switch, you would think it would have been quicker to switch them back.
I have a couple of those type of switches, though smaller, in my parts bin. They were from some piece of surplus equipment that got junked. Where I've seen them used is in a crowded control panel where they might just get bumped. The two red plastic levers to the left are another type of safety switch: The lever is spring loaded, and covers the handle of a toggle switch.
In my view it would be quite hard to move them by accident, and probably not possible to move at once.
It would be interesting to know if the plane has any other switches of the same type, that are routinely activated.
Sadly not. It’s a physical switch with no capability of a remote toggle. The flight data recorder clearly shows one was toggled off within a second of the other, which rules out almost every non-intentional scenario.
Is this a switch that has a dedicated connection to the corresponding cutoff valve? Or does it go through some common digital bus that passes commands? If so, how well is this bus protected?
Another commentator has pointed out that the flight data recorder records two signals - one for the switch itself, and one for the actual valve movement.
I take your point that we should always be suspicious of complicated, digital buses, and this is not the final report, so there’s still plenty of time to uncover weirdness. However, if the flight date reporter shows the switch being thrown, and then a few milliseconds later, shows the valve starting to close, and the same sequence happening shortly there after on the second switch and valve, I feel this would really limit the likelihood of any digital shenanigans.
It's an entirely different shape, different location, and different motion from any other switch they could be looking for. Suicide is a way more likely explanation.
It did glide briefly, the glide path took it directly into a school building.
Right after takeoff at low altitude is basically the worst place for this to happen. Speed and altitude are low so gliding is going to be a short distance and happen quickly.
If there had been a perfect empty long flat grass field in that location it may have been salvageable, but also right after takeoff the plane usually has a heavy fuel load which makes for a much riskier landing.
Edit: This article has a map showing the glide path:
They only ever got a few hundred feet off the ground.
Yes of course the plane glided once the engines stopped, producing thrust, just like all planes do. But just like all planes, and all gliders, gliding means trading altitude for velocity - giving up precious height every second in order to maintain flight. At that stage in the flight, they just didn’t have enough to give. If the same thing had happened at 30,000 feet, it would be a non-event. They would glide down a few thousand feet as the engines spool back up and once they return to full power, everything will be back to normal. Or if for some reason, the engines were permanently cooked, you’d have maybe 20 to 30 minutes of glide time so you’ve got a lot of time to look around and find a flat spot. But you just don’t have enough time for all that to happen When you’re a few hundred feet off the ground.
I’ll take this as an honest question. The simple answer: too much mass, no clear landing path, not enough speed or altitude to turn to find one and glide to it. In short, not enough time. Once the engines cut, that thing probably dropped like a brick.
Impossible. Low and slow conditions with insufficient energy to 180 return or crash land safely straight ahead in any form. The power loss happened at the most critical phase of flight. Plus, they were on the heavy side.
Yes I acknowledge this. But I also retain control to the very last moment. I don't have to bank on the driver of my vehicle not being suicidal. If I feel another driver is dangerous, I can just stop. This obviously doesnt prevent all accidents but I've never been in a serious one.
That being said ive flown plenty of times. My fear comes from lacking any control and just finding out mid-flight were going down through no fault of my own. I wouldn't want to know, but then again air France 447 is terrifying too.
You still have to rely on other drivers not being actually suicidal. Just to give one terrifying example scenario: you will pass hundreds, if not thousands of other drivers driving in the opposite direction in the course of a long journey. Any motorist driving in the opposing lane has the ability to engage other drivers in a head-on collision at any time by making a relatively trivial maneuver. Given human reaction times, and the very high closing velocity of such a collision, you ability to avoid this would seem to be non-existent. You certainly couldn't "just stop" to prevent it.
This is all true. It doesn't really apply to my personal driving situation where I can't recall the last time I personally was on a road with a speed limit above 40. I drive less than half the days a week. Thats part of maintaining control for me. I can't set plane schedules. I can drive when there's less drivers and on slow roads.
Also, there are numerous situations you're leaving out where just stopping(or just slowing down) does solve the safety issue. Far more than a suicidal driver choosing me as their target.
Most importantly it's extremely problematic that BBC is pushing the pilot error angle subtly! This is a preliminary report! No news organization should spread opinion pieces based on this.
Somehow it feels like Boeing paid BBC to shift the narrative.
We should all wait for the final report. Pilot error or Machine fault, either way it's a huge tragedy.
Where did you see that? You say subtle. What does that mean?
It's a fact that there are no recommendations to manufacturers or airlines yet. If they had found anything seriously suspicious they would already issue recommendations as soon as possible, not just in the final report, not even just at the prelim report, but as fast as possible. Grounding planes, forcing maintenance etc. That has not happened.
It's easy to fall in the other direction and jump on the Boeing hate bandwagon. It's become a trendy thing online.
The report contains significant evidence that one of the pilots switched off the engines.
It doesn’t rule out other options, and it doesn’t explain why they might have done that or if it was inadvertent but it’s still new information, and presenting new important information is what the news is for.
There's literally hundreds of such settings. When you get into the combinations there's such a multitude of scenarios that you certainly can't have dedicated code for everything.
I suppose you could have it attempt to run a full forward-looking flight simulation to predict but part of the reason for there being so many controls is to deal with situations where the plane isn't acting like it should be, situations which would invalidate the simulation.
Assuming this is a murder-suicide and not a mistake or malfunction somehow, it's very damning of the FAA's policy to revoke the pilot's licenses of anyone seeking treatment for mental health issues. This was in India and thus not FAA jurisdiction, but it still would be a case where an untreated mental health issue lead to hundreds of deaths. By making pilots choose between their careers & medical treatment (since they can't continue as pilots if they seek treatment) the FAA encourages hiding mental illness by pilots. The Pilot Mental Health Campaign[1] has been advocating for legislation to change, HR 2591 the "Mental Health in Aviation Act of 2025"[2] has just been approved by committee for a general vote. I certainly hope it passes, and that other nations with dangerous policies prohibiting pilots from seeking treatment change as well.
[1] https://www.pmhc.org/
[2] https://www.congress.gov/119/bills/hr2591/BILLS-119hr2591ih....
The murder suicide angle isn't particularly worthy of assumption yet. Have you ever put your phone in the fridge?
Pilots deactivate the fuel cutoff at the end of the final taxi to the gate. This makes flipping these switches a practiced maneuver, capable of being performed without conscious thought, regardless of whether they came with safety locks installed.
Brain farts are a real phenomenon, and an accidental fuel cutoff most closely resembles the transcript from within the cockpit.
The report is actually a little cagey about whether the locks were properly installed on these switches. Said locks are supposedly optional. Until I receive a more direct confirmation that the switches were installed with their full safety features, I will assume that it is more likely for the plane to have had improperly installed switches than not, given that the shutoff was the reason for the crash, and if they turn out to have been installed, I will assume that simple pilot error is responsible until a motive for murder is found. The pilots lives are under quite a lot of scrutiny, and I do not believe that a motive for murder is likely to be found.
> The report is actually a little cagey about whether the locks were properly installed on these switches. Said locks are supposedly optional.
The locks/gates on the switches are definitely NOT optional. There was an SAIB about some switches that may have been installed improperly. It didn't result in an AD, which likely means the extent was limited or potentially even nil.
The switches were moved to cutoff with a one second delay between the first and second switch. That's pretty suggestive of deliberate movement. I've flown a Max9 simulator, which has the same switches. Moving one of them by accident would be impossible, let alone two of them.
I agree with not jumping to conclusions about the pilots and possible motives or circumstances, but I will bet a lot of money that the switches were just fine.
The CVR will likely have audio of the switch movement to confirm as well.
The switch must be lifted and turned. The optional posts block you from inadvertently knocking the switch (that you must pull up and turn).
I second that it’s not an accidental motion, you must actively manipulate the switch. But just like your turn signal in your car, it is muscle memory when you use it. I just wonder what action the pilot mistook the fuel cutoff for. Looking around the cockpit shows just how unique those switches are and not something you mistake with another common activity.
Pretty sad day if this was an intentional action
> one second delay
did the report say a one second delay or that the two switches were turned off at consecutive seconds? The latter is what I remembered, but I'll check again.
The report can be found here: https://aaib.gov.in/What's%20New%20Assets/Preliminary%20Repo...
> did the report say a one second delay or that the two switches were turned off at consecutive seconds?
The report states, on page 14: The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec.
"with a time gap of 01 sec" seems fairly clear. The final report will have more granularity, but I don't think that's very ambiguous.
> seems fairly clear
Not at all. First of all writing it as "01" begs the question if there is a typo (is that really supposed to mean 1 or 0.1?) but even without that only specifying the interval to a second precision makes is much more likely that the difference is between samples of the switch state that are recorded at that rate.
You are right, I was remembering the description of turning the switches back on.
> Moving one of them by accident would be impossible
Improbable, not impossible.
If you were correct, the only situation it would happen in is when the pilot flying asks for X to happen, and the pilot monitoring instead does Y. Pilots don’t just randomly reach over and screw with the controls. Everything is called out, and as far as I know there were no callouts here (e.g. “gear up”).
This is a bit like someone parking their car, pulling the handbrake, turning off the car and putting their keys in their pocket, then arguing that it’s a practiced maneuver because it happens at the end of every car ride.
Look at a 787 cockpit. There are no other switches like that anywhere in the vicinity of those cutoff switches.
This is like pulling the handbrake on the highway when you’re trying to use your high beams
> Pilots don’t just randomly reach over and screw with the controls.
Plenty of crashes have resulted from Pilots not acting 100% by the book.
> and as far as I know there were no callouts here (e.g. “gear up”)
Unfortunately we don't have a full CVR transcript.
Turning the fuel off seems roughly equivalent to turning the ignition off when you've parked your car. It's really something rather unlikely to do as a brain fart during takeoff.
But we can already conclude that something unlikely did in fact happen, otherwise there were more fatal 787 crashes. I don't think "it's unlikely" is a good argument for dismissing potential causes here.
Most commercial aircraft have quite a few more buttons, knobs, levers, dials, etc than a car.
Commercial aircraft pilots are also much better trained than car drivers.
They do make an effort to make it hard to do safety critical stuff by accident though in cars, small planes and jets. Like in a car it's easy to mix indicators and windscreen wipers which are on various stalks but turning off the engine and locking the steering is very different action, on traditional cars turning the key and taking it out. Similarly here the fuel cut offs are obvious levers that have to be pulled out before they can be moved.
You have to lift and turn these knobs. Hard pressed to think of other knobs like this one. Especially that there are none like it anywhere near those cutoff switches. It seems intentionally designed this way
Putting your phone in the fridge seems like a pretty crazy thing to do, but we do it sometimes. Plane crashes are very rare.
I don't fly a lot of planes, but I do know what muscle memory is like, and sometimes it misfires. Misfires are rare, but then, so are plane crashes.
The emergency fuel cutoff should not be a practiced maneuver.
These switches are locked into place with a spring loaded detent switch. It's impossible to accidentally switch these off.
You say muscle memory. No muscle memory is involved in fuel cut off for both engines seconds after take off. There is no procedure remotely similar.
> These switches are locked into place with a spring loaded detent switch. It's impossible to accidentally switch these off.
The report specifically mentions SAIB No. NM-18-33 which would be a very odd thing to do if the investigators didn't at least consider this to be a possibility.
> You say muscle memory. No muscle memory is involved in fuel cut off for both engines seconds after take off.
It doesn't matter when the action is normally done - muscle memory means that the complex action of flipping a guarded switch doesn't really need a bigger brain fart than any other input because once the action is initiated you're acting on autopilot.
you make some good points but i thought your example was funny. No, i have never left my phone in the fridge. And i’m in my 30s, so not that young.
I HAVE sometimes “lost” my phone in my own backpack though (lol).
Here’s my take as a non-pilot. Takeoff is a sequence of checklists and procedures that are repeated. Often. If it’s muscle memory, a brain fart seems very unlikely… that’s why i’m skeptical of your theory.
A better analogy would be “have you ever forgotten to put on shoes before leaving your house?” And no, i have not, even during emergencies or when i’m very tired (like when i had to rush my wife to the ER). Why? because that’s something i do daily, and is part of my checklist when departing my house.
Or “have you ever forgotten how to get to work?” that also is extremely unlikely, because one typically follows the same exact steps and route daily. And i don’t randomly turn off my engine while driving, even if i’m multitasking or im forced to take a slightly different route due to a detour.
To be clear, i’m not saying it’s physically impossible. I just find it inconceivable.
> Brain farts are a real phenomenon, and an accidental fuel cutoff most closely resembles the transcript from within the cockpit.
What transcript? We only got a few potentially re-phrased bits of what was said. That the preliminary report is very careful about not implicating either pilot is not evidence of anything except that the investigative team is not yet 100% sure on the matter.
The evidence points to inadvertent fuel cutoff switch movement rather than pilot error, or intentional pilot action. Most likely cause being locking mechanism failure combined with takeoff acceleration forces.
Investigation and preliminary report is not showing critical evidence that would help clarify. Like the full transcript of pilot conversations that is clearly already available, and if these switches had any maintenance in the last year.
The fact that both pilots denied moving the switches, combined with the extremely short timeline, makes mechanical/electronic failure the most probable cause.
Note the Critical Sequence:
08:08:39 UTC: Aircraft lifts off (air/ground sensors transition)
08:08:42 UTC: Maximum airspeed of 180 knots reached
08:08:42 UTC: IMMEDIATELY after max speed, both fuel cutoff switches transition from RUN to CUTOFF (1 second apart)
08:08:47 UTC: Both engines below minimum idle, RAT deploys
08:08:52 UTC: Engine 1 switch returns to RUN
08:08:56 UTC: Engine 2 switch returns to RUN
So only 3 seconds between liftoff and fuel cutoff. Extremely short window for deliberate pilot action...
That doesn't make sense. If a pilot wanted to deliberately cut off the engine there's no reason they couldn't do at that time. The time difference between the switches being one second shows it was more likely to be deliberate, not less. An accidental hit would result in both happening at the same time, not with a time delay.
The two switches changed in sequence, but within the same second and at max speed. Dont think a human can have such a timing. If you look at the timing it looks more and more like electronical or software triggers.
Another possibility is a foreign object like a personal item sliding back during acceleration.
I looked at both pilots background, and unless a story of medical depression on the part of the captain emerges, I dont see the pilot suicide as plausible.
If it were possible for a trained pilot to "brain fart" cut fuel to a 787 as it is taking off that would be a huge design flaw.
Did I hear "Design Flaw"? On a Dreamliner??
Well I'd Never sputter Good Ma'am or Sir, ARE you implying something like a "MAIN BATTERY EXHAUST"¹ retrofitted to a flagship product because management was impatient and wanted the lighter, better, faster, stronger lithium-ion-battery for their rushed 787-sized baby?
¹) https://media.cnn.com/api/v1/images/stellar/prod/14011413401...
Brain farts are literally not a real phenomenon.
First of all, thank you for calling attention to this. You’re absolutely right, despite what others are saying here. That’s why there’s a movement for reforms.
Secondly, yes, it was likely a deliberate action to cut off the fuel switches, as you say.
You are absolutely right that there’s an epidemic in the airline industry that forces pilots to stay quiet rather than risk their careers if they’re dealing with mental health issues.
In a sibling comment: “shouldn’t they be given alternate career paths?” No. Perpetuating the myth that people with mental health issues are somehow broken beyond repair is mistaken. Current policy lead directly to that one fellow to lock the cockpit door and slam the plane into a hillside. If Air India 171 has any chance of being a mental health issue today, it should be highlighted and explored. You’re exactly right to be doing that, and thank you.
Anyone who disagrees with this should watch https://youtu.be/988j2-4CdgM?si=G39BwNy1zJEeUi2k. It’s a video from a well-respected pilot. The whole point of the video is that aviation forces people to conceal their problems instead of seek treatment, and that this has to change.
> Current policy lead directly to that one fellow to lock the cockpit door and slam the plane into a hillside
While obviously the incidents are terrible, do you really think he would self-report, voluntarily endure 6+ months of therapy and come back like new, if only the current policy didn't lead him to do what he did?
Totally armchair, but I think people like the German dude and allegedly (but who knows) the Malaysian Zaharie are far gone. The only thing that can help is mandatory health checks, and even then who knows if it's possible to screen for everything.
Sorry, that conclusion is just silly. I know people in the airline industry (some pilots and a number of flight attendants) and the problem is not that they're forced to conceal mental issues.
The problem is that many people in aviation imagine that they need to conceal their problems. And they point to videos like this one as proof of that, ignoring that the events of discussed in the video are actually proof of the opposite.
Emerson (the suicidal pilot in the video from Alaska Airlines Flight 2509) self-medicated himself using hallucinogenic substances and developed suicidal ideations, because he didn't seek treatment (like therapy) for his mental issues after the death of a friend. If he had sought treatment, he'd still be flying today because he wouldn't have tried to kill several dozen people, and he would have learned to cope with his depression.
What about Xyla Foxlin’s case: https://youtu.be/aj0H8oVS7qg?si=X7Nux24PPbNa24Y8
Props to Xyla for speaking out. Her case is interesting because her depression was caused by hormonal birth control, and was temporary, but she’s still grounded.
> And they point to videos like this one as proof of that, ignoring that the events of discussed in the video are actually proof of the opposite.
I have no idea how this video’s chapter 6 can be titled "a call for change" and then you still deny that the video is saying there’s something desperately wrong with the aviation industry. All I can think of saying is that you’re mistaken. It’s proof of exactly what the video is saying needs to change.
We’ll have to agree to disagree. I feel bad for all the pilots who have to deal with this kind of attitude about mental health issues, as if suicidal ideation should somehow disqualify someone from working in their chosen profession. People in the military are allowed to feel suicidal. Your doctor is allowed to feel suicidal. The guy next to you on the road is allowed to feel suicidal. But pilots? Nope. It’s treated as this unspeakable awful thing, and you’re forcing people to get "treatment" where they report "yes, that totally worked" (a lie) or else suffer consequences. If you don’t see how backwards that is, no words of mine will persuade you otherwise.
Why argue so vehemently that treatment should be denied to people? That’s what you’re doing by saying there’s no problem and that nothing needs to change. I assure you, the pilot in the video likely knows far better than your friends. That’s why he made the video.
>since they can't continue as pilots if they seek treatment)
You have your facts wrong. Pilots can and do fly if they have mental health diagnoses, as long as they are well managed and there is no history of psychosis or suidical ideation. This is how it should be.
https://www.faa.gov/ame_guide/app_process/exam_tech/item47/a...
On the contrary: https://youtu.be/988j2-4CdgM?si=G39BwNy1zJEeUi2k
The whole reason a pilot made that video is because there’s a huge problem in the airline industry right now.
Xyla Foxlin lost her PPL because her IUD was replaced, and how the new one (initially) released chemicals caused mood changes:
* https://www.youtube.com/watch?v=aj0H8oVS7qg
A must watch for anyone interested in pilots and mental health
Many of her videos were about her dream of being a pilot, and a few trolls on the internet reporting her grounded them
On the contrary, that video actually supports the OP's claim. A pilot with a well-managed mental condition would be allowed to fly. So, a pilot with depression over the loss of a parent would still be allowed to fly.
But a pilot with suicidal ideations, or taking hallucinogens, like Emerson from Alaska Airlines Flight 2509 (the flight discussed in the linked video), would not be allowed to fly. And that's exactly the way it should be...
The issue is that many pilots don't seek treatment for mental issues because they imagine that they'll be grounded if they do, even though FAA policy, and most airlines' policy, is to allow them to continue flying.
Suicidal ideation is a normal part of being human. Fantasizing about committing suicide by crashing a plane is jot. Neither of these are remotely comparable to hallucinogens.
Bingo. And to be clear, if someone is explicitly fantasizing about crashing their plane, then obviously that’s worth grounding them until the condition is fixed. The crucial part is (a) that they still make a living, thanks to insurance, and (b) that they admit it, both to themselves and to everyone else.
I pointed out in https://news.ycombinator.com/item?id=44546377 that this is mistaken and why. Dehumanizing someone because they have suicidal ideation is exactly the kind of attitude that puts people at higher risk.
You’re forcing people to pretend like they don’t have suicidal thoughts. That doesn’t work. Attitudes that it somehow does work are backwards.
It's not dehumanizing them. It's depiloting them. Not everyone should be a commercial airline pilot, no matter how much they may want to be one.
It is explicitly dehumanizing them by saying they’re not allowed to be pilots despite having issues. Claiming that it’s not is again part of the problem.
You can’t imagine what it’s like to worry about losing your career because of something you’re forced to keep secret, and is entirely treatable. That’s the kind of barbarism that future generations will look back on us and shake their heads at.
I hope you never have to worry about being de-yourjob’d. In the meantime, let the people who are worried about it campaign for change.
I imagine women had to face similar discrimination when campaigning to be allowed to fly. There were likely a bunch of people saying that the current system was fine, and besides, they didn’t trust a woman to do the job. Just because we’ve moved from discrimination against sexes to those with mental health issues doesn’t mean the system is perfect.
Without necessarily taking a side (I don't know enough about the specifics of the FAA policy or the various incidents over the years) I'd like to suggest that you are rather missing the point of the person you are responding to.
Take your argument to the extreme. Suppose someone has a physical or mental issue that renders them unable to reliably judge a certain type of situation or undertake some action that must be made consistently and repeatedly for safe flight. Presumably such a person has no business in a cockpit, let alone on a plane with hundreds of passengers on board?
The above clearly demonstrates that there are certain minimum requirements for practical reasons and that not everyone in the population is necessarily expected to meet them. It isn't a value judgment but rather an observation about the reality of the world we inhabit.
So the person you are responding to here is suggesting that suicidal ideations might be incompatible with the safety expectations of piloting a passenger airliner. Meaningful disagreement would need to somehow address the practical concern as opposed to deflecting with an appeal to emotion.
A related example that might be worth considering would be someone who suffered from severe and debilitating panic attacks. Or someone deemed to be at particularly high risk of having a heart attack. Or any number of other potentially debilitating conditions that can have sudden and unpredictable onset.
Feeling suicidal isn’t a debilitating condition. People around you have suicidal ideation every day, and they manage their jobs well.
I’ll counter your argument with this: a bus driver is allowed to feel suicidal ideation, yet they safeguard the lives of everyone on board. Maiming everyone would be as easy as accelerating on the highway and swerving off the road. Yet we don’t worry about this, because it’s rare enough not to matter.
Meanwhile if you say "a suicidal bus driver has no business behind the steering wheel", congratulations, you’ve just forced all the suicidal bus drivers to hide their condition.
You’re not going to be able to detect this illness the way you can detect the ones you name. Your policy is going to force people to hide it. It’s a dumb policy. That’s not an appeal to emotion.
tl;dr We're talking about a $200 million piece of equipment. This isn't your typical job. Merely "getting by" is nowhere near sufficient.
That line of reasoning isn't an appeal to emotion but your earlier focus on dehumanization and discrimination most certainly was.
I think it's a reasonable point that such a policy exhibits a severe perverse incentive. So the question becomes, how many lives are lost due to the perverse incentive versus if the policy didn't exist? Someone with the right knowledge and resources can at least make an objective attempt at estimating that.
Regarding bus drivers I'll observe there is a stark difference in both scale and certainty of death. The degree to which safety risks are tolerated almost invariably scales with such metrics. Pilots operate in a domain where an unmitigated failure not resulting in the deaths of everyone on board is far closer to the exception than the norm.
There are also public perception and financial angles to consider. People are rather paranoid about hurtling through the air in metal tubes. The equipment is also rather capital intensive, with a 787 and a hyperscale data center falling vaguely in the same order of magnitude. As such many of the practices surrounding that activity go a bit overboard from an actuarial perspective at least in comparison to other common daily pastimes (but not in comparison to aforementioned data centers).
Which circles back around nicely to your leading statement. It is the act itself, the attempt to commit suicide, that I think is reasonable to view as a sudden and debilitating condition. Those with suicidal ideations are statistically more likely to suffer from that. I think it's extremely similar to the heart attack example, and policy certainly requires commercial pilots to have regular physicals. The primary difference (and potential point of contention) is that there's no straightforward way to hide a physical condition whereas you probably can hide a mental one and (unlike a physical one) doing so is likely to exacerbate it.
> I think it's a reasonable point that such a policy exhibits a severe perverse incentive. So the question becomes, how many lives are lost due to the perverse incentive versus if the policy didn't exist?
There is also the question if they are better ways to reduce the perverse incentives.
Looking at the transcript, it seems to confirm the link I posted, that there is a path back to flying, and that the FAA approves antidepressants.
I don't see where the win is here:
1. If the pilot hides his mental illness, a mentally ill person is flying the airplane.
2. If the pilot gets treatment for his mental illness, a mentally ill person is flying the plane.
P.S. When I was a teenager, I tried to join the Air Force to be a pilot like my dad. But since I wear glasses, there was no way. The AF was perfectly justified in not taking me, I understood that. I empathize with the rejected pilots, but that's the way it has to be. Life isn't fair. So I chose another career.
Where's option 3: a pilot gets treatment for his mental illness and is signed off as safe to fly a plane? For all that it's a fallible process, that seems better than options 1 & 2.
Does it? I've never heard of anyone being cured of mental illness, just drugs that relieve the symptoms. The body develops resistance to the drugs, the drugs usually come with bad side effects, and patients often go off their meds.
Pilots who develop a heart condition get their license revoked. Every pilot knows this. There's nothing fair about that, either.
Fun fact - my Air Force dad told me that when an airplane was overhauled, the chief mechanic went up on the check ride. That ensured the job was well done.
It seems trivial that it's better than option 1; in both cases a mentally ill person is flying the plane, and in one of them a health professional is involved in managing the condition.
For option 2 I'll confess to not being sufficiently familiar with the gamut of what can be considered a mental illness, such that I couldn't tell you whether a person under management for such is a safer pilot than someone undiagnosed, or the median pilot. I'd be mildly surprised if you were, but stranger things have happened.
As it stands, I expect these would be the same diagnostics that until ~2013 considered sexual preferences as mental health issues.
Mental health is indeed an inexact and poorly understood condition.
As pragmatic rule, if one is prescribed drugs for it, one is not fit for being a pilot.
I know several people who are prescribed drugs for mental conditions. I would not get on an airplane if they were the pilot. Nor would I get on one with a pilot with a heart condition. It doesn't mean they are bad people, it's just the way it is.
well in case 2, the pilot get treatment and a doctor will decide if she is fit to fly. That's not bulletproof but still better than case 1.
And to your other point, it's easier to give up on your dream job when young and start with a career that you are a fit for, than to be kicked out after a huge sunk cost and maybe even half way to retirement (illnesses might not be known until later in life). Just as disappointing, but not nearly as life destroying.
But I salute you, fellow four-eyes!
> But I salute you, fellow four-eyes!
I was prescribed glasses when I was 5. Since then, they have preserved my eyes from damage from at least 3 incidents. I no longer mind them - I like the protection!
This is like saying that we've had a problem with people piloting with pneumonia, so anybody sniffling or taking sudafed won't be allowed to pilot (the FAA is fine with sudafed). One hopes that getting pilots early treatment for incipient mental health issues would help ensure that they don't wind up with more serious issues.
It looks like the FAA has within the last few years gotten chiller about some antidepressants, but that they still require an elaborate and complicated process to approve use of them.
I'd much rather have a mentally ill person with treatment flying the plane than without!
You don't get to choose "no mental illness" because of the bad incentives of hiding them!
Those don't have to be the only two options. You can also criminalize hiding your mental illness as a pilot while incentivizing self-reporting via sufficiently generous disability insurance.
If you criminalize hiding your mental illness, you can be sure that people will hide it! Even if the alternative has some money attached.
tangent: I believe Air Force and Navy have loosen the vision requirement quite a bit. IIRC the new rule only measures the corrected vision, regardless how you corrected it, including wearing glasses.
My dad had 20/10 vision. He was always first to identify enemy aircraft. They didn't have onboard radar at the time.
Wearing glasses still has issues. I have astigmatism, and so if I turn my eyes but not my head, I receive a warped view of the world. This is why I was simply terrible at baseball, tennis, etc. My brain could not adapt to this. I have difficulties with depth perception as a result, too.
I was more or less born to be a nerd. It's pointless to fight my fate :-)
No, it is not damning evidence or strong evidence either way. It would be strong evidence only if treatment significantly reduces the probability of a pilot's committing suicide.
> if treatment significantly reduces the probability of a pilot's committing suicide
Psychotherapy significantly reduces the risk of suicide. https://pmc.ncbi.nlm.nih.gov/articles/PMC6389707/
Does it bring the risk of suicide to general population baseline? And if not would you still want the affected people be responsible for hundreds of lives?
It doesn't look like it: it says that the risk of suicide attempt for those experiencing depression decreases 37% with psychotherapy. But the baseline 12 month suicide risk is ~14/100k, while those experiencing major depressive disorder are at ~120/100k. So ~5 fold elevated risk after psychotherapy.
Wouldn't it be better to provide such pilots alternate career paths? That way they can still make a living and the traveling public is not placed under unnecessary risk.
A “dead airspace”, perhaps?
For anyone who didn’t already know, this concern is a key plot point in the second season of HBO’s “comedy” series The Rehearsal.
Personally, found it simultaneously one of the greatest and most insane seasons of television ever. YMMV.
Captain Steve discusses mental health issues amongst pilots during his discussion of the AI events after this most recent news. He's a trained counselor who got into counseling pilots exactly because of mental health issues he's seen with colleagues and students https://youtu.be/MD64uYK926o?t=742 .
Psychopathy isn’t the category you’re thinking of I’m sure.
It is known that the switches cannot effectively be flipped by accident.
It is known that the switches were set to "cut-off" because they were then later restored to "run", so it was not an electrical fault (i.e. switches pointing to run but reporting cut-off).
Pilot dialogue and engine telemetry confirms the cause of power loss was fuel cut-off.
The question I can't help but think is how did the pilot realize it was the cut-off switches?
I'm sure there's a warning message for them somewhere but in the few seconds of time when you're losing thrust right after rotate, and you're bombarded by a lot of warnings and errors on the screen and in the speakers: how likely are you to notice the fuel cut-off switches have been flipped?
Those switches are something you never, ever think about during operation because you're trained to only operate them when starting up and parking (and yes, in an emergency where you need to shut down the engine quick).
How long would it take for an average pilot to realize it's not one of the dozens of memory items pointing to more likely scenarios causing loss of thrust, ones that they've been training to check in case of an imminent emergency? And why didn't the first pilot who was recorded to notice the fuel cut-off didn't immediately flip the switches to "run" position first instead of asking the other pilot about it?
Given what you're vaguely implying -- that the switches would be nowhere near the first thing a pilot would normally think of in the kind of situation -- what are the odds the pilot asking on record "did you flip the fuel cut-off switch?" is the one who actually flipped the switches and was simply trying to fool the would-be investigation (even knowing they all are about to perish)?
> what are the odds the pilot asking on record "did you flip the fuel cut-off switch?" is the one who actually flipped the switches and was simply trying to fool the would-be investigation (even knowing they all are about to perish)?
This is such a diabolical mind-game that it never occurred to me. Like, they would all die, why would he want to incriminate someone else? But yet, people are weird and crazy. And maybe he didn't go down as a killer and decided to incriminate the other pilot? Anyway, it is totally possible to have happen. Sadly there are no cameras the cockpit, and a camera in the cockpit would really have help to find who did what.
Just a random example and I have no indication that that's what is going on here, but life insurance generally doesn't pay out for suicide so you'd need to make your death look like an accident or caused by someone else if you want to pull of a scam. Pointing this out to say it could be much more banal than some diabolical villain that gets off of killing hundreds of people.
I'd say the odds are 50%. The odds of the opposite scenario - where the pilot who said "did you flip the fuel cutoff" wasn't the one who did it are also 50%.
Based on the cutoffs for both engines being flipped 1 second apart, the above exchange being caught on the CVR, and then within 10 seconds the (presumably the other) pilot switching them back to Run, it's pretty clear that this was a deliberate act.
There is likely much more on the CVR than what has been released in the preliminary report - which seems to have been carefully sanitized so it doesn't implicate either pilot. I expect the investigators have a much better idea but not one that they are 100% confident in making public yet.
Reading https://news.ycombinator.com/item?id=44543536 I think we should not jump to conclusions yet.
I've been reading commentary on aviation forums like PPRuNe and the consensus amongst pilots and others in the field seems to be that "electrical glitch" is a near impossibility. Also, the report states "and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec". They wouldn't have said the switches transitioned from one position to another if they weren't certain, they would have said something like a voltage change consistent with cutoff occurred. Several people have pointed out that these are large mechanical switches that make a distinctive noise when moved and the CVR is sensitive enough that it would have picked it up. Also, it's important to note that no safety bulletins were issued to Boeing as they would have in the case of some electronics issue.
Now, when I say deliberate act, I don't necessarily mean "pilot suicide" though that is certainly a strong possibility.
Thanks.
I’m more familiar with the 737 (as a hobby, not as a pilot), but for that aircraft the “loss of thrust on both engines” checklist has the start levers as the second item on the list.
Note that in the checklist I am looking at the goal is to restart the engines rather than diagnose the failure and that involves these levers. I suspect you’d notice pretty quickly if they were not in the expected location.
Thanks, this is good information. So it then fits the overall picture that they would've actually bumped into these switches in the rush of emergency eventhough they're never expecting the switches to actually be off.
Do you know if it says anything about restarting them simultaneously or not?
I would think trying to restart engines one at a time would be preferred, over both of them at the same time - or maybe thats not how it works..?
Just from a systems perspective if the actions to restart the engines can be parallelized then they should be; maybe only one engine will start. You don't want the 50% (for 2-engine aircraft) chance that you spend time on the one that won't start before trying the other.
I would assume that the engines cur of due to fault in the shared control system. And to restore power the pilots toggled the switches to off and then back on to get them running again.
Hopefully the timestamps tell if the engines lost power before switches were turned off? Or is there some time window that was not recorded due to the lost power to systems?
This is one of the first scenarios that came to mind for me as well.
i.e. hypothetically, no one flipped the switches to cutoff initially, but a glitch in a computer component caused the same effect, including some indication (a status light?) that the switches were in cutoff state. One of the pilots saw the indication, and asked the other. The other (truthfully) said they hadn't. Ten seconds of confusion later, one of them flipped the switches off and back on to reset the state to what it should have been.
That assumes that the switches are part of a fly-by-wire system, of course. I am not an aircraft engineer, so maybe that's not a safe assumption. But if they're fly-by-wire, seems like there might not be a way to know for sure without cockpit video, because the logging system might only log an event when the switches cause the state to change from what the computer thinks the current state is, not necessarily when the switches change to the state the computer thinks they're already in.
Someone bumping the switches accidentally seems worthy of investigation as well, given the potential for an "Oops! No locking feature! Our bad!" scenario on the part of Boeing that's mentioned in the BBC article.
Also, when asked the pilot said they didn’t switch the fuel control off.
That seems like an important clue, bc it points at a possible glitch that could affect other aircraft.
Why would you assume that? The engines were providing thrust to achieve normal take off. If they did that to restore engine power why would the voice recorder have one asking the other why he cut off the engines?
Maybe the pilot who cut-off the fuel was the one who asked “why did you cut-off?”. Knowing full-well the conversation is recorded in order to fool investigators, lay blame and confuse his colleague.
How can it be known that the switches were moved physically and not some electrical signal occured on its own (fault) equivalent of switches operated, without actual physical moement of the switch? Some electronic fault in the line of the signal. I do not expect having an independent sensor for this switch monitoring actual physical movements of the switch in parallel of the intended fuel controlling signals occurring, so the faulty signal reaching valves may have been registered and assumed that actual physical movement of the switch caused it?
We know that they restarted a few seconds later a few seconds apart from each other, and shut off a second part from each other.
It's extremely unlikely for a pilot to decide to react by shutting both switches off, then turning them on within seconds (this is not a failure mode they'd have expected, deciding to shut the engine off a couple hundred feet in the air would be... a fairly reckless decision).
That leaves both switches spontaneously turning off, then back on, a couple seconds after takeoff, which is a failure mode that's never been seen before once let alone twice. Also the pilots didn't make a statement about an incongruity between the report from the plane's systems about the switch being off vs the physical position, which they very likely would have in such a situation.
I think it's reasonable to rule that theory out.
> how did the pilot realize it was the cut-off switches?
The answer to this question is explained by a pilot in here https://youtu.be/00ooqCuRoU8?t=731
The pilots can hear engines spool down.
I find these comments very illustrative when taken together- they nicely show how different explanations sound spot on until you read the next one. Inexplicable is one of the great words in the English language
it makes sense to me that the pilot who said "I did not do it" actually did do it without realizing it, was supposed to be putting the landing gear up when he committed a muscle memory mistake. it happened around the time the landing gear should be up, and this explanation matches what was said in the cockpit, and the fact that the landing gear wasn't retracted. I think this idea was even floated initially by the youtube pilot/analysts I watch but dismissed as unlikely.
The landing gear lever is rather prominently featured in the 787 in a panel central to the cockpit layout so that either pilot can easily reach it. For decades and across many manufacturers, the landing gear lever has traditionally featured a knob that deliberately resembles an airplane wheel. It's very hard to mistake it for anything else. It's actuated by simply moving it up or down.
The fuel control switches are behind the throttle stalks above the handles to release the engine fire suppression agents. These switches are markedly smaller and have guards on each side protecting them from accidental manipulation. You need to reach behind and twirl your fingers around a bit to reach them. Actuating these switches requires pulling the knob up sufficiently to clear a stop lock before then rotating down. There are two switches that were activated in sequence and in short order.
The pilot monitoring is responsible for raising the gear in response to the pilot flyings' instruction.
I would find it very difficult to believe this was a muscle memory mistake. At the very least, I would want to more evidence supporting such a proposition.
This idea strikes me as even more unlikely than someone shifting their moving vehicle into reverse while intending to activate the window wipers.
> This idea strikes me as even more unlikely than someone shifting their moving vehicle into reverse while intending to activate the window wipers.
I suspect you've never driven an older vehicle with the shifter on the steering column.
Or a Tesla. I've done this exact thing, although the car just beeped at me and refused to go into reverse, of course.
> I suspect you've never driven an older vehicle with the shifter on the steering column.
Or a new Mercedes ;)
But if he did, would have done hours of retraining in a simulator?
Or even crazier, a manual shift on the steering column. Nothing weirder than pushing down the clutch and then changing the gear with your hand on a knob off to the side of the steering wheel.
Like in a Citroën 2CV?
The pilot wasn’t flying an unfamiliar aircraft.
I think the aircraft being familiar makes it worse: if you're used to going through a certain motion to do a thing, it may be one of things your brain can do without really thinking about it much, which is where the danger comes in.
I've engaged my wipers when meaning to shift gears before, in my truck which has a steering column shifter. After driving the truck for years. I have ADHD and I very often let my brain go on autopilot for things I do every day, and sometimes it just does the wrong thing. It doesn't matter how complicated or "intentional" the task has to be: my brain will memorize it to the point that it can execute it on its own without me consciously thinking about it.
I think it's totally plausible it was a muscle memory thing, if the at-fault pilot's brain works anything like mine.
(Side note: I actually took some flying lessons, including going through all of ground school, and realized that my brain is just not cut out for flying. I am the type of person to "cowboy" things if I feel like they're not worth doing, and flying is an activity where the tiniest missed checklist item can result in death, so I realized I have a statistically high likelihood of crashing due to some boneheaded mistake, and stopped taking lessons.)
There is no temporal nor spatial adjacency to the switches. The switches are equivalent to the ignition on your car, you operate it in the beginning and end of your trip, and there is nothing during the trip that will involve manipulating this switch.
There’s been at least 2 times I’ve turned my ignition switch while driving. (Luckily it was into the “on” position instead of off.)
Everyone in this thread thinking “these actions are temporally and physically distinct and therefore impossible for anyone to confuse” isn’t really thinking about the problem the right way. It’s not that I’m actually confusing two actions. It’s that I’m accidentally allowing my brain to perform one action when I meant to let it perform another action. “Allowing” is an important word here, because it illustrates that my brain is capable of doing this on its own without me thinking about it, and often will do it on its own, if I let it.
If your wipers had the equivalent of a child safety cap it would be hard to do it accidentally, especially twice in a row.
I firmly believe this is not the case. Putting more obstacles between me and the thing I’m trying to do, just trains my brain at rote performance of the task. It’s still “autopilot” as far as my brain is concerned.
This could be anything: starting a car, taking off a medicine cap, typing my password, clicking around cookie warnings. If I have to do it repeatedly, my brain will be able to perform it subconsciously, and I will do it without realizing it.
For fuel cutoff switches, it doesn’t matter that there two of them in a row. If you cut off both of them every single time, and you fly every day, your brain is gonna automate that task.
But the 787 doesn’t have an easily confused layout like that. The landing gear lever and fuel cut off switches are not two stalks on the yoke. Aircraft cockpits are deliberately designed in such a way that important things have differently shaped actuators that feel different from each other. Precisely so that you are not accidentally flipping the wrong switch by accident.
Actually the birth of Human Factors was related to this... Alphonse Chapanis, a psychologist working at the Army Air Force Aero Medical Lab in 1942, investigated the issue and discovered a design flaw. He observed that the controls for the flaps and the landing gear in the B-17 cockpit were nearly identical and located close to each other.
> It's very hard to mistake it for anything else. It's actuated by simply moving it up or down.
On some aircraft types you also have to pull it towards you before moving it to avoid hitting it by mistake.
But I agree it's very unlikely to be a muscle memory mistake.
This photo: https://theaircurrent.com/wp-content/uploads/2025/07/ai-171-...
from this article: https://theaircurrent.com/aviation-safety/ai171-investigatio...
shows you the switches on a 787. They are protected and hard to futz around with by mistake.
> it makes sense to me that..
This is exactly how the investigations are NOT conducted. You don't find the evidence that confirms your theory and call it a day when the pieces sorta fit together. You look solely at the evidence and listen to what they tell you leaving aside what you think could have happened.
Gp was posting a comment on an online discussion forum, not conducting an official investigation. Hope that clears things up.
One of the nice things about finally having the preliminary report is I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk at work because the preliminary report solidly disproved all of them so far. If anyone even had and stuck with an idea matching this report it wouldn't have stood out in the conversations anyways.
The collection of comments on this post remind me it'll just be a brand new set of random guesses until the final report is released. Or worse - the final report reaches no further conclusions and it just has to fade out of interest naturally over time.
It's human nature to want to guess at possible explanations for things that are unusual and unexpected.
If hearing those guesses annoys you, nobody is forcing you to read through comments on a thread of people making them! (I hope - sorry if you are being forced after all.)
> If hearing those guesses annoys you, nobody is forcing you to read through comments on a thread of people making them!
It’d be nice if we could only read insightful comments, and unread the wacko comments, but we can’t. This discussion has actually provided a lot of useful comments from people who seem to know what they’re talking about, but also a lot of really wild speculation.
Idle speculation is far from the only thing you won't find me supporting just because it's human nature. Thankfully, HN comment threads tend to include a lot more than just that kind of discussion, which is why I read them. Indeed there are lots of great details I didn't glean or fully understand in the report covered in the comments.
That doesn't mean I will always agree with the comments (or that everyone will always agree with mine) and that's okay. It'd be a very limited value discussion if we could only ever comment when we agree. It seems exceedingly unlikely any of this has something to do with users being forced to be here though.
Having just found myself in a similar situation to the one you were complaining about, I'd like to withdraw and apologise for my previous comment :D
They are a forum moderator and therefore it is part of their job, it is nice that you apologised.
I... don't believe that's the case? Though happy to be proven wrong. Unless perhaps you mean a moderator of a different forum, though that wouldn't really be relevant to their reading a thread of HN comments on a subject that annoys them.
You could be right and I’m getting confused with someone else. We will need to wait for them to confirm.
Not me! I'm not even sure I'd be the right type or the right energy level to do it if the opportunity even came up. Hats off to the team here for the dedication.
Double engine failure was confirmed, not disproven. RAT deployment was confirmed, not disproved. Pilot error, confirmed, not disproven. Preliminary and final aviation reports are mostly guesses.
I don't think it's fair to say that pilot error is confirmed yet. It seems like a reasonable hypothesis, but what if the electronics glitched out and acted as though the cutoff switches had been flipped (the first time), even if they hadn't? All of the currently-disclosed facts still line up with that scenario IMO.
Even as a matter of safety/investigation hygiene, "pilot error" should be the conclusion of last resort, arrived at after months of poring over data, and because nothing else seems viable.
If we decided to pin all aviation incidents on pilot errors, we wouldn't even have invented checklists (what do you mean you forgot, try harder the next time).
"Natural" pilot errors lead to lessons that can be incorporated into design/best practices. That does not seem to be the case given current understanding: no flaw in any switch design seems apparent, and it does not sound like something you could do by accident.
So "pilot error" is not the "cracking the case"-grade conclusion it is being made out to be, it is an act of investigative resignation. In the days following the crash, allegations of mixing up flaps and landing gear were floated, and they all turned out to be wrong. This is not even accounting for the fact that the pilots are not around to plead their case, and basic human dignity requires us to defend their case until evidence clearly points a certain way
This is the difference between the official investigation and casual online comments for which it's OK to consider it pilot error once there is sufficient indication for that.
> I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk
This was a really disappointing incident for aviation YouTube - I unsubscribed from at least three different channels because of their clickbait videos and speculation.
There is no possible way to confuse these two actions. There's a reason a wheel is attached to the gear lever.
> There is no possible way to confuse these two actions.
This is obviously an overstatement. Any two regularly performed actions can be confused. Sometimes (when tired or distracted) I've walked into my bathroom intending to shave, but mistakenly brushed my teeth and left. My toothbrush and razor are not similar in function or placement.
That's just your brain associating the bathroom with the act of brushing your teeth, and therefore doing it automatically upon the trigger of entering the bathroom. It bears no resemblance to the accidental activation of a completely different button.
The other poster's correction: "it’s like brushing your teeth with razor" is apt. Touching the fuel cutoff switches is not part of any procedure remotely relevant to the takeoff, so there's no trigger present that would prompt the automatic behavior.
Now I'm trying to remember if I've ever picked up my razor and accidentally begun tooth brushing motions with it. Probably!
More relevantly, you seem to me to be unduly confident about what this pilot's associative triggers might and might not be.
Good analogy. Things I do every day in front of the mirror, but I occasionally attempt to squeeze some soap on my toothbrush. Or I have to brush my teeth and I find my beard foamed up. Or I walk out of the shower after only rinsing myself with water.
I've definitely put shaving cream on my toothbrush before.
Not a bathroom one, but the number of times I've tried to pay for public transport with my work/office fob is mental. Generally happens on days where I'm feeling sharper than average but also consumed with problem solving
I agree. Has anyone here unplugged their mouse instead of pressing caps lock by mistake?
Do you unplug your mouse so frequently that it has become muscle memory?
It depends on how that person internalized and learned the behaviour. We store things differently.
If someone confused their steering wheel for the brake you'd probably be surprised - there are indeed errors that are essentially impossible for a competent person to make by mistake. No idea about the plane controls, though.
Even in modern "fly by wire" cars the steering wheel and brake pedal have an immediate effect. They are essentially directly connect to their respective control mechanisms. As far as I understand both of the plane controls on question just trigger sequences that are carried out automatically. So it's more like firing off the wrong backup script than scratching the wrong armpit.
The only two production cars on sale where the steering wheel is mechanically decoupled from the wheels are the cybertruck and a variant of the Lexus RX.
Essentially impossible is not the same as impossible. We already know that an improbably sequence of events took place because a plane crashed which is highly unusual.
Technically an overstatement but not by much. Correctly restated, its highly unlikely these actions were confusing pilots. It's as if you mistook flushing your toilet twice when instead you wanted to turn on the lights in your bathroom.
I don't agree with the "twice". A frequently performed manipulation like the fuel cutoff (usually performed after landing) collapses down to a single intention that is carried out by muscle memory, not two consciously selected actions.
Your opinion is valid but definitely doesn't align with any evidence.
What a shallow, copy-paste response.
His statement was about a certain, obviously real tendency in general, existence of which is reasonable to assume there is enough research about.
He objected not to the unlikelihood of an accidental manipulation, but to the potential flaw in your comparison (which was at best a valid opinion).
Can you elaborate on why you think I copied and pasted my response? There is no evidence of it existing anywhere other than my cerebrum:
https://www.google.com/search?q=%22Your+opinion+is+valid+but...
I think you're misarticulating my argument.
Well if we are going by "unlikely" equals "didn't happen" then we can conclude that the plane didn't crash.
If I were to apply OPs assertion to your actions it’s like brushing your teeth with razor. I guess that’s what they meant.
Not really, though. They're both (retracting the gear, and cutting off fuel) just toggle switches, as far as your brain's conscious mechanisms go. Doing them both on every flight dulls the part of your brain that cares about how they feel different to perform.
(I'm not strongly arguing against the murder scenario, just against the idea that it's impossible for it to be the confusion scenario.)
Neither is a toggle switch and the gear lever is incredibly conspicuous:
https://www.aerosimsolutions.com.au/custom-products/olympus-...
This would be like opening your car door when you meant to activate the turn signal.
I meant philosophical toggle switches, not physical ones. The gear can go between down and up. The fuel can go between run and cutoff. Given enough practice, the brain takes care of the physical actions that manipulate those philosophical toggles without conscious thought about performing them.
Even humans have fixed action patterns. Much behavior is barely under conscious control.
this bathroom thing and various similar scenarios happens to me when im on weed.
Genuinely curious - could heavy marijuana use cause confusion between landing gear and fuel cutoff? Or some other drugs? (Wondering if they screen pilots for alcohol before they board an aircraft.)
They don't screen every time but there are spot checks. A pilot with heavy use will certainly get caught
The prelim report states these pilots were indeed breathalyzed before takeoff.
[dead]
The other day I was eating dinner while chatting with my partner. I finished eating and needed to pee and throw away the fast food container. I walked straight to the bathroom, raised the toilet lid and threw the fast food container right into the toilet.
Weird mistakes can happen.
My partner got a good laugh out of it
Yep, I’ve taken clean dishes from the dishwasher and put them “away” in the refrigerator.
As I get older, I do some similar stuff, way more than past, even it is just once per month. And I guess way more when sugar is high than not. Don't know your age or medical profile and I am not a doctor, just keep an eye.
Sometimes people put cleaning liquid in the fridge.
Given a long enough span of time, every possible fuck up eventually will happen.
Because there's no difference in actions needed to do so. A similar mistake is throwing away a useful item while holding onto a piece of trash. The action is the same, it's just the item in question that's different.
This is not what happened here at all. The actions needed to activate the fuel cutoff switches are not similar to any other action a pilot would want to make during takeoff.
The form of the action isn’t necessarily what’s stored. They may have memorized something as “fourth action” or some other mnemonic mechanism
Probably time to design a plane that can't be sent into terrain in seconds by flipping a switch.
Now try to design a plane that also lets you rapidly shutoff fuel to both engines in case of fire.
How about actual switch covers (and switches that are not located right in the same area as stuff you are using routinely) instead of a glorified detent? Though I suspect this would also succumb to muscle memory
What about up on the overhead panel where the other engine start controls are?
Or (at the cost of complexity) you could interlock with the throttle lever so that you can't flip the cutoff if the lever isn't at idle
Also the fire suppression system is a different activation (covered pull handles I think)
> How about actual switch covers (and switches that are not located right in the same area as stuff you are using routinely) instead of a glorified detent? Though I suspect this would also succumb to muscle memory
The switches are already pretty distinct - but that only reduces failures, it can never eliminate them entirely.
> Or (at the cost of complexity) you could interlock with the throttle lever so that you can't flip the cutoff if the lever isn't at idle
More complexity also means more failure modes. You don't want it to be impossible to shut down the engines due to a broken throttle sensor.
And a gun that doesn't let you point it at your face. And a knife that doesn't let you cut yourself. And a car that doesn't let you accelerate into a static object. And...
Hey my car won’t let me accelerate into a static object. It’s so good it will even slam on the brakes when driving 5mph in a parking garage because it thinks parked cars are oncoming traffic.
"Sent into terrain in seconds by flipping a switch" is both too inaccurate and feels too cursory to take as impetus for serious design criticism, especially when the extensive preliminary report explicitly does not recommend any design changes with the current information.
Hilarious how Hacker News routinely bashes software managers who don’t understand a problem space and give vague and impossible goals. But somehow “just don’t let an aircraft fly itself into the ground” is a reasonable statement.
Is this Hacker News person in the room with us right now?
Are we in a room together?
If we are going to pretend that Hacker News is a single person who should have consistent opinions on different topics then we might as well pretend that we are in a room together.
You might as well refuse to place CNN and Fox News on the political spectrum with the same argument.
HN has somewhat democratic editorial tools and thus majority opinions on HN are very clear.
I want you to guess how many traffic accidents are caused by accidentally reversing when you intended to go forward.
Test your mental model against the real world. This is your opportunity.
Those are caused by operating the same lever in a slightly different manner. Not comparable to two completely differently designed levers placed far apart.
Same goes for accidental acceleration instead of braking. Two of the same kind of lever right next to each other.
Accidental acceleration while intending to turn on the wipers would be a fitting example, I don't think that happens though.
You’re just overlaying your mental model.
Think of the action as a stored function. Maybe they’ve always recalled the function as part of a certain list. It can be a case where the lists get confused rather than the modality of input (lever etc)
Then that would be pilot error, and an aggravating error.
Driving isn't trained to anywhere near the same standard.
Probably more training required to bake a cake than drive a car (hours wise).
If we had your typical driver fly a plane we'd be doomed to a lot of crashes.
I have baked cakes without ever been trained for it.
Landing gear controls are nothing like the fuel shutoffs. And they are in completely different locations. Landing gear controls are in front of the throttle, fuel shutoffs are aft of the throttles.
Is that "nothing like" though? You are saying they are in different places, ok, but are they similar in other ways? Are both controls the same shape? size? colour? texture?
Respectfully, it's not up to other people to disprove your toy theory. The question you're asking here can very easily be answered with a quick Google search.
The short answer is that they are _very_ different controls, that looks and operate in a completely different way, located in a different place, and it's completely unrealistic to think a pilot could have mistaken one for the other.
No, no, and no.
Different controls with different t shapes, operated in different ways, of different number, different size, and very different positions. One is down almost on the floor, and well rearward, the other is at stomach height and well forward.
The fuel cutoffs also require pulling the control out and over a guard.
God knows the number of times I confused my num lock key for my caps lock key, they are both keys after all!
The landing great lever is shaped like a wheel as a design affordance. It would be VERY hard to confuse
Very hard to confuse if you are thinking about it. Doesn't say anything about the possibility of an action slip.
Is there a video feed of the cockpit inside the black box?
If not there should be one as even my simple home wifi camera can record hours of hd video on the small sd card. And If there is, wouldn't that help to instantly identify such things?
No neither black box stores video. One stores audio on flash memory and the other stores flight details, sensors etc.
I don’t think video is a bad idea. I assume there is a reason why it wasn’t done. Data wise black boxes actually store very little data (maybe a 100mbs), I don’t know if that is due to how old they are, or the requirements of withstanding extremes.
This isn’t true. This was a 787. It does not use a separate recorder for voice and data (CVR, FDR).
(Most media outlets also got this wrong and were slow to make corrections. )
Rather, it uses a EAFR (Enhanced airborne flight recorder) which basically combines the functions. They’re also more advanced than older systems and can record for longer. The 787 has two of them - the forward one has its own power supply too.
There should be video as well, but I’m not sure what was recovered. Not necessarily part of the flight data recording, but there are other video systems.
https://www.geaerospace.com/sites/default/files/enhanced-air...
That's really interesting. From reading air crash reports there's a lot of times I've seen."Nothing is known about the last 30 seconds because the damage broke the connection to the flight recorders in the tail"
In the US, the NTSB has been recommending it for over 20 years. The pilot unions have been blocking it, due to privacy and other things.
I'm not in aviation. But my between-the-lines straightforward reading is that unions see it as something with downsides (legal liability) but not much upside. It could be that there are a million tiny regulations that are known by everyone to be nonsensical, perhaps contradictory or just not in line with reality and it's basically impossible to be impeccably perfect if HD high fps video observation is done on them 24/7. Think about your own job and your boss's job or your home renovation work etc.
Theoretically they could say, ok, but the footage can only be used in case the plane crashes or something serious happens. Can't use it to detect minor deviations in the tiniest details. But we know that once the camera is there, there will be a push to scrutinize it all the time for everything. Next time there will be AI monitoring systems that check for alertness. Next time it will be checking for "psychological issues". Next time they will record and store it all and then when something happens, they will in hindsight point out some moment and sue the airline for not detecting that psychological cue and ban the pilot. It's a mess. If there's no footage, there's no such mess.
The truth is, you can't bring down the danger from human factors to absolute zero. It's exceedingly rare to have sabotage. In every human interaction, this can happen. The answer cannot be 24/7 full-blown totalitarian surveillance state on everyone. You'd have to prove that the danger from pilot is bigger than from any other occupation group. Should we also put bodycam on all medical doctors and record all surgeries and all interactions? It would help with malpractice cases. How about all teachers in school? To prevent child abuse. Etc. Etc.
Regulation is always in balance and in context of evidence possibilities and jurisprudence "reasonableness". If the interpretation is always to the letter and there is perfect surveillance, you need to adjust the rules to be actually realistic. If observation is hard and courts use common sense, rules can be more strict and stupid because "it looks good on paper".
You also have to think about potential abuses of footage. It would be an avenue for aircraft manufacturers, airlines, FAA, etc to push more blame on the pilots, because their side becomes more provable but the manufacturing side is not as much. You could then mandate camera video evidence for every maintenance task like with door plugs.
I wonder how the introduction of police body cam footage changed regulations of how police has to act. Along the lines of "hm, stuff on this footage is technically illegal but is clearly necessary, let's update the rules".
Airlines would certainly try to surveil regularly, but if the video data is only sent to the sealed FDR, they'd need to tamper with the system.
Additionally, footage could be encrypted with the NTSB having the keys.
Or simply make it a crime to use the footage in non-accident situations (this should be applied to other forms of surveillance, too ...).
If you work in a job where the lives of hundreds could be ended in seconds due to an error or intentional action then there is no excuse to not have critical control surfaces recorded at all times. Non-commercial/private flights/flight instructors and trainees have cameras, trains have camera, stores have cameras, casinos have cameras, buses have cameras, workers who work for ride hailing services have cameras as do millions of other people who just drive.
Hopefully other countries will start deploying recording systems or start forcing manufacturers of planes to have these integrated into cockpits.
> The answer cannot be 24/7 full-blown totalitarian surveillance state on everyone.
Surveillance is actually pretty common in many high-risk environments. And piloting is very much not just any other job but an exceedingly rare situation where the lives of hundreds of people are in the hands of only two people without anyone else being able to do anything to influence the outcome.
That pilot unions don't want surveillance is to be expected (the union is there to act in the pilots interest) but ultimately it isn't just up to them.
> Should we also put bodycam on all medical doctors and record all surgeries and all interactions?
Yes. We are finally starting to do so for police. These are all situations where an individual or very small team has direct control over the life of others who can't defend themselves.
Not sure why something so important isn't included.
Heck they can make a back up directly to the cloud in addition to black box considering I'm able to watch YouTube in some flights nowadays.
ALPA (pilot union) has consistently objected to cockpit video recording. I believe other pilot unions have a generally similar stance.
So? Those unions act in the interests of pilots so that is to be expected. That doesn't mean that a regulator should be swayed by their objections.
My thoughts exactly.
In fact, you could add some AI to it, even, as an embedded system with a decent GPU can be bought for under $2000. It could help prevent issues from happening in the first place. Of course airgapped from the actual control system. But an AI can be very helpful in detecting and diagnosing problems.
If you shut off the engines a couple of dozen meters above ground shouldn’t every alarm be blaring or there should be some sort of additional lever you have to pull way out of the way to enable shutting off the engine that close to the ground.
Consider a case where the engine starts to violently vibrate. This can tear the structure apart. Delaying shutting off the engine can be catastrophic.
It's very hard to solve one problem without creating another. At some point, you just gotta trust the pilot.
If you read through the boeing procedures, if an engine fails just after take off you delay cutting throttle or hitting the cutoff until you have positive climb and pass a certain altitude. Specifically because a mistake here would be so incredibly catastrophic. The following number of steps and verbal cross checks for then shutting down the engine are quite daunting. Not something applicable here, but still interesting to learn about
That’s absolutely applicable here. It means that an engine cutoff shouldn’t be allowed at all during certain parts of flight. It’s not crazy to think that a design fix would be to prevent those engagements during certain parts of takeoff (a certain window). It’s fly by wire anyway so it could presumably be done programmatically.
MCAS was basically made to prevent user input that would send the plane into a dangerous angle. The computer overrode the inputs. So there’s precedent for something like it.
Do you mean the MCAS System that sent two planeloads of people to their deaths?
That MCAS system?
> The computer overrode the inputs.
This is incorrect. The manual stabilizer trim thumb switches override MCAS.
Are we not in agreement? MCAS overrode the inputs and the thumb switches could override MCAS?
The pilot's inputs are the thumb switches, and they override MCAS.
Additionally, the stab trim cutoff switch overrode both MCAS and the thumb switches.
Using both easily and successfully averts MCAS crashes, as proven in the first incident (there were three, but only two are reported on).
There were also a lot of MCAS near misses.
I only heard of one. I'm interested in others, if you have references.
https://www.dallasnews.com/business/airlines/2019/03/12/seve...
I just remember that it happened commonly enough to US pilots. American pilots always recovered quickly enough that it didn't make the news before the fatal crashes.
Thank you, but it's behind a paywall. I did find this:
https://www.nytimes.com/2019/09/18/magazine/boeing-737-max-c...
which has detailed information, but I don't trust the NYT. The article also erroneously reports that the MCAS trim rate is twice the speed of manual trim. The trim rate for both is 0.27 degrees per second.
MCAS autonomously adjusts trim downward. The trim switches override MCAS, but when released, MCAS can resume trimming down again. The trim adjustments don't "override" the pilot's elevator inputs (MCAS has no direct control over the elevators), but they can make the controls so heavy that it's impossible to pull up.
If MCAS is running the trim, the thumb switches override it.
MCAS affects the stabilizer, the thumb switches affect the stabilizer, the cutoff switch affects the stabilizer.
The elevators are controlled by the control column and the autopilot.
> The trim switches override MCAS, but when released, MCAS can resume trimming down again.
That is correct. That is why the procedure is to return the trim to normal with the thumb switches, then turn off the trim system. That's it. That's all there is to it.
> but they can make the controls so heavy that it's impossible to pull up.
Almost right - the trim has more authority than the elevators. The trim's ability to travel far is to provide great ability to get out of trouble. I don't really know what factors the aerodynamics guys used to calculate the max travel required. I do know there is a travel limiter on it (as I worked on that, too!) which reduces the max travel at higher speeds, because otherwise it can rip the tail section off, which is a big no-no.
There are sooo many constraints on the design of an airplane I sometimes wonder how anyone manages to make one that works at all. The Wright Bros calculated that their machine would fly, and it did, barely. Their contemporaries did seat of the pants design, which is why they failed.
> Almost right - the trim has more authority than the elevators.
Thank you, I'll update my brain and future explanations. :)
It's good that you're still around to correct misinformation about MCAS. I've seen so much misinformation about it, including from paid "experts".
The Wright brothers succeeded because they were pioneers in wind tunnels and aluminum engine blocks.
Thank you. I've had commercial pilots email me telling me I was correct and to keep on the good fight :-)
The Wrights did a lot more than that to be successful. Their innovations were:
1. using a wind tunnel to correctly get lift and drag coefficients for various wing sections (as you wrote)
2. first aviation engine (high power/weight ratio) (as you wrote)
3. first propeller theory, enabling 90% efficiency (other aviation propellers were 50% efficient)
4. first 3-axis control system
5. identified and solved adverse yaw problem
6. first research and development program, where problems were identified in advance, and a machine was developed to solve each problem, then the solutions were put together to make the 1903 Wright Flyer
7. kept meticulous notes on all their work and preserved the evidence of their success, such as photographs and notebooks. Exacting replicas have been built, and their flight characteristics match the Wright's results
[flagged]
Would it matter in this case since you would crash either ways. I’m talking about protection in a very specific situation where you make it harder to shut off both engines when you’re very close to the ground.
If the ground you are over is a good landing spot, your best chance is to cut off the fuel to that engine ASAP.
All I’m saying is in those situations it should involve another toggle or pedal that needs to be pushed to cut off the engines so it’s outside the realm of muscle memory.
Ok, but that also will delay the shutdown and if it's too complicated the pilot may forget it in his extreme stress.
You cant force individual action alignment with technology. People never learn this.
On an Airbus yes, engines won't stop if the thrust lever isn't on "idle".
Not so much on a Boeing.
even though that raising the gear is a up motion and fuelcut off is a down motion?
And fuel cutoff is _two_ down motions? That's the death knell for this theory, imo.
I don't think the theory is that the muscle memory sequences resemble each other.
Instead, it's that because muscle memory allows you to do things without thinking about it, you can get mixed up about which action you meant to perform and go through the whole process without realizing it.
Is actuating the fuel cutoff switches something that is done routinely in these aircraft, to the extent it could reasonably become muscle memory?
ETA: downthread it is mentioned that these switches are used on the ground to cut the engines
Seems akin to something like a parking brake. Something you only use at a stop, or rarely during an emergency.
They're pilots, they do hundreds of stops each year. In case of domestic pilots, even thousands. And with years of experience, switching off fuel control switches is basically muscle memory at this time now.
Was amused to see they have one of those too, with "parking brake" written on it.
Would anyone be surprised if an accomplished concert pianist played C Bb Bb instead of C E in a piece they had played thousands of times correctly?
The only difference here is that the consequences are death instead of mere head shaking.
Murder needs more proof than just performing the wrong action. Until then we should apply Hanlon's Razor.
That's a ridiculous analogy. The pilots aren't sitting in front of a uniform set of keys that they need to press in a specific order with a specific timing.
The mistake equivalent to what the pilot supposedly did would be if the pianist accidentally stuck a finger up his nose instead of playing the notes or something.
Quite, but the point is that even after doing something correctly a thousand times, someone can make a mistake that seems unbelievable.
The cutoff switches are operated every flight so the muscle memory is there, ready to be triggered at the wrong time.
All we know is that something went wrong in the pilot's head in at least a single moment that caused him to perform a ground action during takeoff.
Depressive murder-suicide is one possible explanation. Altered mental state is another: insomnia, illness, drugs/medications could all explain an extreme brain fart. Perhaps he just had food poisoning? It's India after all.
I keep reading "muscle memory" but the theory that one pilot shut down the engines instead of performing another action has nothing to do with muscle memory.
Muscle memory allows you to perform both actions effectively but doesn't make you confuse them. Especially when the corresponding sequence of callouts and actions is practiced and repeated over and over.
All of us have muscle memory for activating the left blinker in our car and pulling the handbrake, but has anyone pulled the handbrake when they wanted to signal left?
Another comment has the right analogy: has anyone here accidentally unplugged their mouse when they meant to hit caps lock?
i have several passwords i type all the time. sometimes i get them confused and type the wrong one to the wrong prompt. i type them by muscle memory, but i also think about them while typing and i think thoughts like "time to reach up and to the left on the keyboard for this password". I couldn't tell you the letter i'm trying to type, i just know to do that.
not all my passwords are up and to the left, some are down and to the right, but when i type the wrong one into the wrong place, i type it accurately, i'm just not supposed to be typing it.
"time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
My editor is MicroEmacs, which I've been using since the 1980s. I no longer remember what the commands are, but my fingers do.
I remember once writing a cheat sheet for the commands by looking at what my fingers were doing.
> "time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
If that were true, pilots would perform arbitrary motions all the time. Same with car drivers.
Typing something on a keyboard, especially when it's always in the same context, is always essentially the same physical action. The context of a password prompt is the same, the letters on the keyboard feel the same and are right next to each other.
Not comparable to pressing two very different buttons placed far apart, in a context when you'd never ever reach for them.
Sometimes I drive all the way home without being aware of what I did in between.
One time I almost drove to work instead of the shopping mall, because driving to work was basically subconscious. But my car doesn’t have safety features designed to stop me doing that. And I never did it twice in a row.
that makes it less likely, not impossible, we're trying to match against the data we have. I think distracted muscle memory is more likely than suicide and sounding innocent while lying about it
Not possible. Two fuel cutoffs. Two engines. Two intentional acts in rapid succession. Plane would have survived one cutoff. It is what it appears. Captain crashed the plane.
Each of the fuel switches on the 787 is equipped with a locking mechanism that is supposed to prevent accidental movement, experts said. To turn the fuel supply on, the switch must be pulled outward and then moved to a “RUN” position, where it is released and settles back into a locked position. To turn the fuel supply off, the switch must be pulled outward again, moved to the “CUTOFF” position and then released again.
https://www.nytimes.com/2025/07/11/world/asia/air-india-cras...
Or they could be inadvertently flipped if the "locking" version was not installed: (see the avherald link):
>>India's media report that the investigation is NOT focussing on a human action causing the fuel switches to appear in the CUTOFF position, but on a system failure. Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India.
https://ad.easa.europa.eu/blob/NM-18-33.pdf/SIB_NM-18-33_1
> Recommendations The FAA recommends that all owners and operators of the affected airplanes incorporate the following actions at the earliest opportunity: 1) Inspect the locking feature of the fuel control switch to ensure its engagement. While the airplane is on the ground, check whether the fuel control switch can be moved between the two positions without lifting up the switch. If the switch can be moved without lifting it up, the locking feature has been disengaged and the switch should be replaced at the earliest opportunity. 2) For Boeing Model 737-700, -700C, -800, and -900ER series airplanes and Boeing Model 737- 8 and -9 airplanes delivered with a fuel control switch having P/N 766AT613-3D: Replace the fuel control switch with a switch having P/N 766AT614-3D, which includes an improved locking feature.
I’m sorry to tell you this, but that appears to be an AI hallucination.
https://www.regulations.gov/document/FAA-2021-0273-0013
None of the attachments reference the fuel cutoff switches.
The peer comment to your own has a link to a real doc that supports the claim:
https://ad.easa.europa.eu/blob/NM-18-33.pdf/SIB_NM-18-33_1
No because the report says that the switches were turned off 1 second apart. This was a deliberate action.
> The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
I know it's probably not worth the hazmat tradeoff for such a rare event, but the F-16 has an EPU powered by hydrazine that can spool up in about a second.
The F-16 EPU is to keep the flight controls powered so the plane doesn't immediately become uncontrollable following engine failure. The EPU doesn't provide thrust of any kind.
The 787 and nearly every other commercial aircraft with powered flight controls [1] (fly-by-wire or traditional) has emergency power available via RAT and/or APU, and any fly-by-wire aircraft has batteries to keep the flight control computers running through engine failure to power supply being restored by the RAT and/or APU. Due to its unusually high use of electrical systems, the 787 has particularly large lithium batteries for these cases. There is no need for an additional EPU because the emergency systems already work fine (and did their jobs as expected in this case). You just can't recover from loss of nearly all engine thrust at that phase of takeoff. [2]
1. The notable exceptions to having a RAT for emergency flight controls are the 737 and 747 variants prior to the 747-8. In the 747 case, the four engines would provide sufficient hydraulic power while windmilling in flight and thus no additional RAT would be necessary. The 737 has complete mechanical reversion for critical flight controls, and so can be flown without power of any kind. There is sufficient battery power to keep backup instruments running for beyond the maximum glide time from altitude - at which point the aircraft will have "landed" one way or another.
2. There is only one exception of a certified passenger aircraft with a system for separate emergency thrust. Mexicana briefly operated a special version of the early 727 which would be fitted with rocket assist boosters for use on particularly hot days to ensure that single-engine-out climb performance met certification criteria. Mexicana operated out of particularly "hot and high" airports like Mexico City, which significantly degrade aircraft performance. On the worst summer days, the performance degradation would have been severe enough that the maximum allowable passenger/baggage/fuel load would have been uneconomical without the margin provided by the emergency rockets. I'm not aware of them ever being used on a "real" flight emergency outside of the testing process, and I think any similar design today would face a much higher bar to reach certification.
> at which point the aircraft will have "landed" one way or another.
Ah
Also we need more rocket thrust takeoff airplanes.
> the maximum allowable passenger/baggage/fuel load would have been uneconomical without the margin provided by the emergency rockets.
Your momma so fat…
But seriously, is there a commercial aircraft that can’t climb on only engine?
That is a somewhat complicated answer. The simplistic answer is that certification criteria require all turbine aircraft (turboprop or jet) to meet minimum climb performance following an engine failure at the worst part of takeoff. Multiengine piston aircraft (almost all of which are grandfathered in under prior rules anyways) are not required to do so. As a proportion of commercial passenger aircraft, multiengine piston aircraft are fortunately fairly rare in terms of passenger-miles flown, but they are still fairly common in certain markets.
However, that answer is hiding a lot of complexity. In a multiengine turboprop, single-engine climb performance is dependent on fathering the propeller of the dead engine(s); if you don't (or can't), you will probably crash.
In all aircraft, different takeoff conditions (ambient temperature, pressure, runway length) will result in different performance (maximum takeoff weight, runway length and takeoff thrust required). In some extreme conditions (e.g. "hot and high" airports like Mexico City or Denver) this can result in a reduction of maximum takeoff weight to ensure that engine-out climb performance is maintained. Generally aircraft used in these airports are designed and/or acquired with these conditions in mind, and thus the aircraft are still profitable to operate with the reduced MTOW.
I suspect any civil aviation engineer who goes "let's add hydrazine!" to fix problems has a fairly short career, lol.
Yeah, now you have at least two problems.
If you think a suicidal pilot can do a lot of damage just think what releasing a ton of hydrazine in a packed airport would do.
The prof from "chemicals I won't work with" has entered the chat...
To my knowledge, hydrazine is extremely toxic. Most likely no regulator will allow it on commercial aircraft.
The RAT was already out and doing its job. Adding hydrazine or a nuclear reactor isn't going to help matters when there's no thrust.
The only solution I can think of is emergency parachutes. Like lots of them. would also be useful for other types of in air engine/control failures.
At least it worked for me on Kerbal Space Program. At least sometimes.
This is an actual thing on smaller aircraft: https://en.m.wikipedia.org/wiki/Cirrus_Airframe_Parachute_Sy...
There's precedent.
https://www.youtube.com/watch?v=2_8qCTAjsDg [30s]
https://www.youtube.com/watch?v=zT58pzY41wA [15m]
The Cirrus system is deployed by rockets, allowing it to function at a very low altitude. They say that you should deploy it no matter what altitude you are at, and it will add at least some friction. The system has a very impressive track record.
However, at this altitude, with an airplane this heavy, you might have to put the rockets on the plane to decelerate enough to save lives.
This is for a tiny aircraft, not a jumbo jet. SF50 and the Honda Jet can autoland too.
Edit: I recently saw an SF50 YT video. It's pretty awesome with the V/X tail.
Wouldn't be able to save a fully-loaded 787 in low & slow conditions because the area of canopies needed to deploy would be several acres. And they'd add several tonnes.
I just want to call out that, whatever the facts of this case, pilot heroism is way more common than pilot murder. This is off the top of my head, so don't quote me on the precise details, I'm probably misremembering some things. But a few of my favorite examples:
- British Airways 5390: An incorrect repair causes the windshield of a plane to be blown out mid flight. A pilot is nearly sucked out. The head flight attendant holds onto his legs to keep him in the plane. The copilot and flight attendant think he is dead, but they keep the situation under control and land the plane.
Everyone survives - including the pilot.
https://www.youtube.com/watch?v=rGwHWNFdOvg
- United 232: An engine explodes in the tail of an MD-10. Due to rotten luck and weaknesses in the design, it takes out all three of the redundant hydraulic systems, rendering the control surfaces inoperable.
There's a pilot onboard as a passenger who, it just so happens, has read about similar incidents in other aircraft and trained for this scenario on his own initiative. He joins the other pilots in the cockpit and they figure out how to use the engines to establish rudimentary control.
They crash just short of the runway. 112 people die, but 184 people survive.
https://www.youtube.com/watch?v=pT7CgWvD-x4
- Pinnacle 3701: Two pilots mess around with an empty plane. They take it up to it's operational ceiling. While they're goofing off, they don't realize they're losing momentum. They try to correct too late and cannot land safely.
In their last moments they decide to sacrifice any chance they have to survive by not deploying their landing gear. They choose to glide for the maximum distance to avoid hitting houses, rather than maximizing how much impact is absorbed. They do hit a house but no one else is killed.
https://www.youtube.com/watch?v=DCMmCekKO_c
> British Airways 5390: An incorrect repair causes the windshield of a plane to be blown out mid flight. A pilot is nearly sucked out.
This one is a good illustration of how better design can help prevent accidents or make them less severe.
The error the maintenance people made was that when they replaced the window and the 90 screws that hold it on 84 of the screws they used were were 0.66 mm smaller in diameter than they should have been.
The window on that model plane was fitted from the outside, so the job of the screws was to hold it there against the force of the pressure difference at altitude. The smaller screws were too weak to do that.
If instead the designers of the plane had used plug type windows which are fitted from the inside then the pressure difference at altitude works to hold the window in place. Even with no screws it would be fine at altitude. Instead the job of the screws would be to keep gravity from making the window fall in when the plane is not high enough for the pressure difference to keep it in place.
My vague memory of the Air Emergency episode on this (AKA Air Crash Investigation, Air Disasters, Mayday, and maybe others depending on what country and channel you are watching it on) is that after this accident many aircraft companies switched to mostly using plug windows on new designs.
Aviation is full of those design choices. Similar to how a multi-engine propeller plane will use oil pressure to keep the props in the flying angle, which means that when oil pressure is lost (catastrophic engine failure) it will feather giving the other engine the best chances of keeping the plane flying with the least amount of drag. While on a single-engine plane it's installed exactly opposite, in case of oil pressure loss the prop goes to fine pitch giving you the best hope of creating some trust in case the engine may still be working.
Most of these things were figured out over 100 years of carefully analysing accidents and near accidents to continuously improve safety.
> the pressure difference at altitude works to hold the window in place
Curious, is the pressure difference actually greater than the force of 800km/h wind pushing on the window? Or is it just for side windows?
Dynamic pressure of wind is 1/2 p v^2 where p is the air density and v is the velocity.
At sea level p = 1.225 kg/m^3. It goes down as altitude goes up. At sea level the dynamic pressure at 800 km/hr would be about 4.4 PSI.
At 20000 ft the air density is about half that of sea level, so around 2.2 PSI wind pressure. It would be around 1.4 PSI at 35k ft.
At cruising altitude planes are typically about 8 PSI above the outside pressure.
It would be maybe an interesting project for someone more ambitious then me to get a speed vs altitude profile of a typical airline flight and an altitude vs cabin pressure profile and figure at what part of a typical flight the screws on a plug window are resisting the most force.
The outward pressure is about 5-6x greater than the force of air resistance at cruising altitude
> plug windows
Surprisingly hard to search for this phrase
This article covers the topic though:
https://www.witpress.com/elibrary/wit-transactions-on-the-bu...
Here's another one:
Air Canada 143
- Pilot calculated incorrect fuel due to metric/imperial unit mixup, and ran out of fuel midair.
- Said pilot performed an impossible glider-sideslip maneuver to rapidly bleed airspeed just-in-time for an emergency landing at an abandoned airfield, having to completely rely on eyeballing the approach.
- No fatalties or serious injuries.
https://www.youtube.com/watch?v=jVvt7hP5a-0
It was a series of events and failures rather than simply “pilot calculated incorrect”. And it was a bit more nuanced than metric/imperial conversion.
Via wiki (but accident section is more detailed):
“ The accident was caused by a series of issues, starting with a failed fuel-quantity indicator sensor (FQIS). These had high failure rates in the 767, and the only available replacement was also nonfunctional. The problem was logged, but later, the maintenance crew misunderstood the problem and turned off the backup FQIS. This required the volume of fuel to be manually measured using a dripstick. The navigational computer required the fuel to be entered in kilograms; however, an incorrect conversion from volume to mass was applied, which led the pilots and ground crew to agree that it was carrying enough fuel for the remaining trip. ”
https://en.m.wikipedia.org/wiki/Gimli_Glider
It's not an impossible maneuver. Glider pilots do this all the time especially if they don't have spoilers
Yes. On a plane which is designed to be a good glider. I highly doubt a 767 is designed to be a glider. It's definitely not impossible (after all, it was done successfully!), but certainly a very difficult (and undocumented) one on such a plane.
I don’t think there’s much connection between a plane’s ability to do a sideslip and how well it glides. A sideslip is just what naturally happens if you apply opposite aileron and rudder inputs. I think the issue is just that it’s a rather acrobatic maneuver to perform in a large passenger jet.
Yes an airliner is not designed for it and could easily get into a deadly spin when doing it. Especially engines out because you have two huge surfaces blocking airflow. A glider can do it pretty naturally because of its extremely low stall speed.
But I wouldn't call it impossible that's all.
Since a sideslip increses air resistance by essentially flying sideways, if I didn't know that it has been done, I'd say it might even break apart a (long, thin) plane that wasn't designed for it. And it still might, but at much higher speeds than close to landing.
It's not unheard of for airliners to use a sideslip when landing in a crosswind, so I don't think structural strength is likely to be an issue at landing speeds.
https://code7700.com/pdfs/bca/bca_cross_with_care_2015-06.pd...
Also with additional control difficulty due to reduced hydraulic pressure.
> On the Boeing 767, the control surfaces are so large that the pilots cannot move them with muscle power alone. Instead, hydraulic systems are used to multiply the forces applied by the pilots. Since the engines supply power for the hydraulic systems, in the case of a complete power outage, the aircraft was designed with a ram air turbine that swings out from a compartment located beneath the bottom of the 767,[10] and drives a hydraulic pump to supply power to hydraulic systems.
> As the aircraft slowed on approach to landing, the reduced power generated by the ram air turbine rendered the aircraft increasingly difficult to control.[16]
> The forward slip disrupted airflow past the ram air turbine, which decreased the hydraulic power available; the pilots were surprised to find the aircraft slow to respond when straightening after the forward slip.
I would say it is much much harder. The wing configuration of an aircraft dictates the minimum glide speed. The more angled (for a better word) the wing, the higher the speed it needs to be at to be able to glide and not stall.
You probably mean 'swept'? That's normally the term used.
Yes. Lapsus.
Mentour Pilot is a fantastic channel.
Anyone who does on-call should look into aviation disasters. Crew resource management, the aviate-navigate-communicate loop, it's all very applicable. ('WalterBright is an excellent source of commentary on applying lessons from the airline industry to software.)
But I did burn out on Mentour Pilot after a while, I just had my fill of tragedy.
A long time ago I had a colleague turn me on to Sidney Dekker’s “Drift Into Failure”, which in many ways covers system design taking into account the “human” element. You could think of it as the “realists” approach to system safety.
At the time we operated some industry specific, but national scale, critical systems and were discussing the balance of the crucial business importance of agility and rapid release cycles (in our industry) against system fragility and reliability.
Turns out (and I take no credit for the underlying architecture of this specific system, though I’ve been a strong advocate for this model of operating) if you design systems around humans who can rapidly identify and diagnose what has failed, and what the up stream and down stream impacts are, and you make these failures predictable in their scope and nature, and the recovery method simple, with a solid technical operations group you can limit the mean-time-to-resolution of incidents to <60s without having to invest significant development effort into software that provides automated system recovery.
The issue with both methods (human or technical recovery) is that both are dependent on maintaining an organizational culture that fosters a deep understanding of how the system fails, and what the various predictable upstream and downstream impacts are. The more you permit the culture to decay the more you increase the likelihood that an outage will go from benign and “normal” to absolutely catastrophic and potentially company ending.
In my experience companies who operate under this model eventually sacrifice the flexibility of rapid deployment for an environment where no failure is acceptable, largely because of an lack of appreciation for how much of the system’s design is dependent on an expectation of the fostering of the “appropriate” human element.
(Which leads to further discussion about absolutely critical systems like aviation or nuclear where you absolutely cannot accept catastrophic failure because it results in loss of life)
Extremely long story short, I completely agree. Aviation (more accurately aerospace) disasters, nuclear disasters, medical failures (typically emergency care or surgical), power generation, and the military (especially aircraft carrier flight decks) are all phenomenal areas to look for examples of how systems can be designed to account for where people may fail in the critical path.
Something I love about Mentour pilot is that he’s started doing videos on incidents where there was a near miss but no tragedy. Just as much to learn but without the ghoulish rubbernecking aspect.
[flagged]
Eh. His older videos are indeed phenomenal, but newer ones are "you won't believe what happened, right after this sponsor break"
In the particular case of his channel's subject matter, I actually kind of like the dramatic cliffhanger effect that (un)intentionally heightens the narrative's tension, since his video is telling a story. Compare to doing that for informational videos where there's no need for manufactured drama.
FUD. His videos are just as consistently good as they always have been. The sponsor sections can be easily skipped (hint: SponsorBlock).
still, its annoying and he does not need it either with the number of views he gets on Youtube.
I am not that person and can't talk about his finances, nor can you.
If it's content I otherwise can enjoy for free, I don't mind sitting through a short sponsor spot every now and then, or just skipping through it if I'm in a hurry, which is still better than TV ads in that regard.
If I saw something like that on a time sensitive video (e.g. proper CPR example) or something very short then I'd rightfully be upset, but this is not the case.
Also green dot aviation has some great videos. Excellent animations. A calmer style. Both are great.
If you're focused on whether or not the pilot cares (or is even alive), you've lost the plot. The point is to keep passengers alive regardless of the pilot.
There's no real point to considering what happens if the pilot wants to murder people on board. Of course they will succeed....
The thing is, people always want something to be done. And politicians want to do something. No matter what kind of action it is, someone knifed a kid on the street, we must ban knives of a certain length. A pilot downs a plane while the other leaves the cockpit - we must mandate two pilots always present. Someone hides explosives in his shoe - we must X-ray all shoes of all passengers forever. Etc.
The human brain can't take the idea that yeah an exceedingly rare thing happened and we're not going to do anything, because rare things do happen sometimes. And the medicine can be worse than the disease. We just accept that yeah, despite best efforts, some pilots will be hostile for whatever mental reasons. Not saying that is what happened in this case, but just saying that IF that happened.
We need more tradeoff thinking, instead of do something! thinking.
I'm seeing exactly this with the Texas floods. People are criticizing them for not installing an expensive warning system. "Do something!"
But they decided that based on the frequency of floods it was not the best place to spend money.
That was a bad decision. They had major problems during the winter of 2021 too. It's all well to talk about tradeoffs but clearly Texas has under prepared for major weather events and it's getting people killed (not to single them out - they're certainly not the only ones). It's not a coincidence that there were 2 catastrophes in 4 years.
Acknowledging tradeoffs doesn't mean there aren't real problems or that something doesn't need to be done, it's only meaningful when comparing different proposed solutions. What is your alternative to the early warning system with better tradeoffs?
> What is your alternative to the early warning system with better tradeoffs?
I know little about this, I'm simply responding to the people who constantly demand that people do something, anything, and insist that all possible actions be taken without consideration to their cost.
The real world is full of tradeoffs, and it's easy in hindsight to say "That was a bad decision", it's not that easy ahead of time.
The 2021 incident is why we know it was a bad decision. They had 4 years of warning. Extreme weather is going to continue becoming more common. Texas is going to continue to face extreme weather. If they don't prepare, people are going to die. It's not really acceptable to say that it's not economical to do something about that, or unnecessary based on outdated flooding models. When there's an urgent problem - yeah, you do have to do something about it. Tradeoffs are useful to decide what we do, not whether.
I think you do your argument a disservice by using that particular example. If you're going to imply some lives were simply uneconomical to save, and when challenged say that you aren't familiar enough with the matter to discuss what else could've been done, it just comes off callous. I'm not left with the impression you don't think the alarm system was necessary because you understand the tradeoffs.
The problem isn't that Texans are valuing their lives too much and insisting on too many safeguards. The problem is that the safeguards are insufficient.
I was deferring to the judgement of the local people.
I was not making my own decision on the tradeoffs.
Also, your implication that the tradeoff is lives is unfair, I don't think that's the tradeoff, rather I think they were expecting that other types of alerts would be sufficient.
You're deploying a recent disaster, that killed scores of people, as evidence that people want something done when it isn't appropriate - and you aren't even willing to take a stance on whether what was done was appropriate? That's pretty weak tea. It really undermines your argument. If you aren't willing to take a stand on that, use a different example. Otherwise you aren't saying anything.
You're calling on people to have more nuanced discussions that include tradeoffs, but you retreat immediately from the implication that we're discussing people's lives. That's trying to have your cake and eat it too. Tradeoffs are about balancing different budgets, and it's not just a monetary budget, one of those is a budget of people's lives.
You're not quite understanding me, and I can see it's because I was not very careful in how I wrote, and that's on me.
But I'm going to let this drop because I would basically have to start over to explain myself, and I don't think there's any useful purpose in doing so.
Almost 400 comments and no avherald link for reference?
https://avherald.com/h?article=528f27ec
> On Jul 12th 2025 (UTC) India's media report that the investigation is NOT focussing on a human action causing the fuel switches to appear in the CUTOFF position, but on a system failure. Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India. The stated MN4 computer with faulty soldering, that might weaken and lose contact due to the thermal stress after a number of cycles, interprets data and commands fuel metering valves - with the lost contact attaching the MN4 processor to the EEC intermittent electrical contact, loss of signal processing and engine control faults can occur. The SB writes under conditions for the SB: "An LOTC (Loss Of Thrust Control) event has occurred due to an EEC MN4 microprocessor solder ball failure." According to discussions in the industry it may be possible with the number of cycles VT-ANB had already completed, the solder balls were weakened sufficiently to detach the MN4 from the EEC momentarily due to loads during the takeoff rotation leading to the loss of control of thrust and shut down of the engines.
Still quite early in the investigation, and so many things to consider. I don't know why online communities have been so quick to gravitate towards the murder/suicide theory. I thought aviation enthusiasts of all people would want to keep an open mind until every other possibility is ruled out, however minuscule it might seem.
> I don't know why online communities have been so quick to gravitate towards the murder/suicide theory.
Because the hardware failure theories seem preposterously far-fetched and require an unnecessary multiplication of deities.
Your ghost in the machine needs to be “just so” so that it can cause both switches to be read in “cutoff” nearly simultaneously. Then, 10 seconds later one of the switches needs to be read in “run”, then 4 seconds after that the second one needs to read “run”. You also need to explain why there have been zero single engine failures of this type before this double failure.
The ghost also needs to explain why one pilot asked the other “why did you cutoff?” instead of something like “what happened to the engines?” (which is the more natural response, unless you already know the switches are in cutoff).
There's also maintenance lapses, faulty repairs, defective parts, and as far as software goes I can think of n number reasons how a ghost can manifest itself inside program logic. This is a new gen plane that relies more on software than any other before, and has in fact seen a couple of incidents with loss of thrust, both related to software. I think it's more prudent to be asking hard questions around these than to outright dismiss it as an open and shut case. Besides, the murder/suicide angle is the least interesting outcome. Because there's nothing you can do after that, other than to just move on.
There's also the timing. Maybe there's something specific about takeoff that makes it more likely for the failure to occur. However, assuming there's not, then the odds of this occuring at takeoff (the worst possible time) instead of any other time are extremely low. Takeoff accounts for a tiny percent of the plane's operation.
As explained in the text, take off loads aka g force from the plane rotating. That's the feeling that you get when the plane takes off and it pushes you into your seat.
I personally don't buy it. Why then did the switches just work after being toggled. Why did the switches go to shutoff one after the other. Why did the pilot question why the other pilot set it to shutoff? Then there's the catastrophic nature of the timing, 10 seconds earlier and they would have skidded off the runway. 10 seconds later, the engines would've relit and regained enough thrust. If there's one thing pilots are experts in, it's what to do to get yourself killed in your airframe of choice. This was calculated down to the second.
Something else that's going on, there's a bot network alive and well on twitter blaiming boeing and all things under the sun except pilot mass murder. Yet occams razor, a mentally ill pilot shut off the fuel at the right time to doom the aircraft seems tragically possible.
My concern would be that the investigation in this case is more likely to be biased towards a system failure. Disgracing a major flag carrier is something very few regulars have the independence and courage to get away with.
The way i read what avherald highlighted is that a part that the manufacturer said should be replaced wasn't and failed as the manufacturer said it will. So it would point to the airline maintenance right now.
What the bbc says is truncated and omits the info about the failing part, so people can point towards murder suicide because they don't have all the info.
Which is why you should always read avherald first...
The avherald is reporting second hand reports of the Indian media. The EEC MN4 microcontroller is located on a control board on each engine. A dual failure seems improbable.
The fuel cutoff switches are of a similar design to the 737 and most other Boeing aircraft. A failure in that design seems less likely than the most charitable explanation, that the copilot inadvertently went into the wrong mode of muscle memory.
The interim report does mention the SIAB NM-18-33. If you read that document it specifically says that the fuel cut-offs were installed with the locking feature deactivated on some 737 aircraft. It's a pretty big leap to that causing this incident. Someone or some thing would still need to have touched the switches to move them.
> The avherald is reporting second hand reports of the Indian media.
... which is more than the bbc one paragraph news item does?
10 years ago the dynamics could perhaps be as you sketched between regulators and the carrier but today it is more complex.
Air India was government owned company till 2020s when it was sold back to the TATA group from whom it was originally nationalized from in the 1960s.
Stakeholders like regulators, employees individually could have different PoV or interests in the change .
Regulatory leadership could just as easily want to prove why this de nationalization was bad if so inclined as they could be for not wanting embarrass the flag carrier.
So it would be hard to categorically say that regulator has vested interest in protecting the flag carrier
The one thing automatic system failure theory can't explain is whether there is a reverse connect from the machine back to the switches where if the machine decides to cut off fuel, would the physical switches toggle to cut-off or stay in run position while the fuel is actually cut off, this would require an actuator setup to flip the switches from inside the system which there is no documentation of if that is even support let alone reported?
They are simple toggle switches without actuators. The switches are Honeywell P/N 4TL837-3D. Source[1]. Data sheet[2].
[1] https://ad.easa.europa.eu/blob/NM-18-33.pdf
[2] https://www.mouser.com/datasheet/2/187/honeywell_hwscs06627_...
Do your lights control your switches?
Respectfully, media reports on what the investigation is focusing on should be taken with a grain of salt unless said media is known to be reputable and have credible sources.
If they had a credible indication of a technical failure that causes engines to randomly shut down, they would have already grounded 787 fleets, which hasn't happened.
Kneejerk patriotic reaction ?
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally, they need to be unlocked first by pulling them out.
> In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
And both pilots deny doing it.
It's difficult to conclude anything other than murder-suicide.
https://ad.easa.europa.eu/ad/NM-18-33
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
https://www.youtube.com/live/SE0BetkXsLg?si=LPss_su3PVTAqGCO
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.
Nope. First of all, the FO was the “pilot flying” and thusly controls the throttle. The fuel shutoffs are on the left side, well clear of the range of motion throttle operation for the right seat.
If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.
Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.
Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.
And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)
The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.
You are wrong. The fuel shutoff switches are directly beneath the throttle levers, and they move down to cutoff, which is exactly the direction a hand beneath the throttle would move to accidentally switch them to cutoff.
Secondly, while the FO was flying the airplane and thus would have control of the throttles during rollout, the captain would certainly have his hand beneath the throttles in an observer position during at least part of the takeoff. And during takeoff, procedure would have the captain take over control of the throttle levers until rotation while the FO handled the yoke with both hands.
blancolirio[0] has two excellent video examples of 787 takeoffs within the cockpit showing FO-pilot takeoffs and both officers' actions during takeoff.
Page 10 of the Air India preliminary report[1] shows a picture of the fuel cutoff switches -- clearly labeled "FUEL CONTROL" with "RUN" in the up position and "CUTOFF" in the down position -- directly beneath the throttle levers.
[0] https://www.youtube.com/watch?v=wA_UZeHZwSw [1] https://aaib.gov.in/What's%20New%20Assets/Preliminary%20Repo...
The fuel cutoff switches are directly behind the throttles, in a central position. Maybe you’re thinking of the stab cutout switches?
This. There are no flip-covers on the switches in any of the photos I've seen. Additionally, it looks like the side guards are only on the left and right sides of the pair of cutoff switches, not in-between the two switches. So if one bumped one switch, seems like it would be very easy to bump them both.
There's a metal nib on the switch and switch housing preventing it from being bumped. There's also a spring holding it down so it can't bounce up. The distance and required force makes switching them at the same time impossible, thus the 1 second difference. This was absolutely an intentional act.
Lookit the damn(ing) pictures:
https://www.xuefeiji.org/public/uploads/weixin_mpimgs/e3/e36...
One can easily switch them with two fingers at the same time. I tried (with similar switches.): Works. If the locking mechanism fails, even unintentionally. Getting loose, wristworn jewlery snatched and then pull: Works.
My question to Boeing is: Why did you cover the neighbouring (stabilizer cut-off, IIRC) switches with red springloaded flip-covers, but not the fuel cut-off switches?
If this is what actually happened it would be the second in recent memory: https://en.wikipedia.org/wiki/Germanwings_Flight_9525.
Third, since there's no other plausible explanation for this and China has classified the report.
https://en.wikipedia.org/wiki/China_Eastern_Airlines_Flight_...
Fourth? https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_370#M...
Fifth. https://en.wikipedia.org/wiki/EgyptAir_Flight_990
Sixth (and this one is pretty indisputable): https://en.wikipedia.org/wiki/LAM_Mozambique_Airlines_Flight...
We dont know about that one at all.
we do here on HN :)
Hence the question mark
please. pilot puts everyone to sleep but himself, turns everything off, then does a flyby of his hometown and then puts himself to sleep? the only one more obvious is the german one.
without a black box all of this is supposition.
We know the transponder was manually turned off because of the intermediate mode. The only reason for this is intentional disappearance.
It feels quite uncomfortable to me. I remember using this exact example of why the changes after the German wings crash wouldn't prevent a murder suicide in the future.
> If it was an issue with the switches, we also would have seen an air worthiness directive being issued.
I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.
The issue with the 737 MAX became evident within months of the plane's launch. By contrast, the Dreamliner has accumulated over a decade of flying history across over 1000 aircraft with precisely zero fatal accidents.
Absence of evidence isn't evidence of absence.
The fact that the pilots denied that they had shut the switch (one asking the other why they had done so and the other denying it), and that they restarted the engines should be taken into account. Ok, murder suicide is definitely on the table but I would want to see some other reasons for believing that this is so.
Sorry to nitpick, but for a good Bayesian, absence if evidence is evidence of absence. If you want the aphorism to be technically correct, you should say "absence of proof is not proof of absence".
A note on the terminology: "evidence" is a piece of data that suggests a conclusion, while not being conclusive by itself. Whereas "proof" is a piece of data that is conclusive by itself.
For a long time my wife refused to accept that Tree Kangaroos existed and insisted that I'd made them up. When the internet came along she looked them up and treated me strangely for a while.
What things that you have never seen do you not believe in?
(not the OP) Giant isopods. They're not real. I know there are pictures of what are supposed to be giant isopods but they are not real animals, instead they're clearly fake models of made-up animals.
Look at this:
https://en.wikipedia.org/wiki/Giant_isopod#/media/File:Bathy...
Clearly some kind of plastic model. I mean its eyes are gleaming menacingly. Or look at this one:
https://en.wikipedia.org/wiki/Giant_isopod#/media/File:Giant...
Seriously, wikipedia? Seriously? That's clearly a hoax.
Giant isopods are. not. real.
A proof is a "piece of data"? Oh boy.
https://en.wikipedia.org/wiki/Proof_theory
https://en.wikipedia.org/wiki/Model_theory
https://en.wikipedia.org/wiki/Mathematical_proof
tl;dr: not a piece of data.
Yes, but things age. And as they age they can fail simply due to wear that wasn't determined to be a problem before they got to that point.
A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.
The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.
He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.
Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.
My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.
I'm not disagreeing with you I think this was manually done
But here's the thing a "near zero chance" when we are talking about an actual event changes the math
Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident
Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure
So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded
We could also suggest that aliens in the cockpit did it — about the same probability. Two switches, on independent circuits, both failing within one second of each other in the exact same way?
I love when people try to sound smart but instead they just prove their ignorance
No. If the probability of component failure is 1 in x, then the probability both fail at the same time is at least 1 in x^2.
[flagged]
260 souls is well into the territory of horrible terror attacks. By comparison, only 14 people died from the sarin gas attacks on the Tokyo subway.
Only the captain was extremely experienced, the FO was a rookie. He wouldn't have had enough hours for an European airline
He had 1100 hours on the 787 alone. 3200 hours altogether. Most media sources just went with the former figure as his overall experience.
This is not true at all.
Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
It could have been unimportant to them
No it could not. Is your conclusion coming from a decade of piloting or maintaining commercial aircraft?
If not, why are you speculating with zero knowledge?
As hominem, did Captain Steeeeve's experience mean anything when he talked about the flaps?
What is "01 second" as quoted above? If it's 1 second, you could possibly conclude that it was intentional. If it's 0.1 second you might think it was an accident and the lock was disengaged.
There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.
Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.
If the time was :11 and :12 there’s between 0.01 and 2 seconds between. If they were both at :11 then it’s between 0.01 and 1 second.
Between (0, 2)s. Apparently the times are rounded down, so it could be :42.001 and :43.999, or :42.999 and :43.001
One second. (Runway four is frequently zero four because radios.)
You don’t inadvertently turn off both switches. The linked SAIB was in 2018 and addresses faulty installations, not a failure after use. And preflight over thousands of flights would have detected if the switches had a failed locking mechanism. And for both to fail at once? Practically impossible. Also the recommended inspection — that was almost 7 years ago. If a major airline didn’t comply with the SAIB, that’s on them, not Boeing. There hasn’t been a single reported instance of fuel switches being accidentally switched off on any Boeing airliner — in 320 million flight hours over the past 10 years.
Is it easy to inadvertantly move both switches in such a scenario?
The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.
Doing it accidentally is impossible.
Here's also a video showing operation of the switches: https://www.youtube.com/watch?v=33hG9-BCJVQ
No.
Well, can you move it back, when accidentally activated?
They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
Yes, and it restarts the engines, but it takes on the order of seconds; too long at that altitude. One of the pilots did that, but it was too late.
More like 30 seconds. Just throttling an already running engine up from idle (which is quite a bit above zero throttle in most respects) takes seconds.
Turbines take a while to spin up again, it's not like start/stop in a car.
In older turbine aircraft this would cause a hot start or worse. It would be interesting to know what the FADEC systems do in this case.
Same manufacturer, Air India 171 was a 787-8 though.
The affected table includes these models as well: 787-8, -9, and -10
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
https://ad.easa.europa.eu/blob/NM-18-33.pdf/SIB_NM-18-33_1
Here is the full SAIB on the Boeing fuel control switches. This report lists the part 4TL837-3D as the switch used on 787s, and is the part mentioned in the preliminary report on the accident.
The SAIB does single out the part 766AT613-3D, but that's for suggesting a replacement for it as 766AT614-3D.
Per the Honeywell catalog for 4TL837-3D, if is a Snap Action toggle switch. The base model doesn't have a locking mechanism, which is available as an option
still, it at least shows that there's been issues with the locking mechanism in the past. inadvertently bumping something that was assumed to be locked is a simpler theory; i find it hard to believe that a murder suicider would take this route, when the china nosedive option is easier, faster, and has a higher chance of success.
The preliminary report says the switches were triggered a second apart, so it would have to have been faulty switches and two inadvertent bumps. That seems unlikely to me.
Within a second apart. If I read the report right. The time resolution of the recorder?
And yes, it does sound like it was probably intentional. I would still like to see an engineering review of the switch system. Are they normally open or normally closed, In the end the switch instructs the FADEC to cut the fuel, but where does the wiring go in the meantime? what software is in the path? would the repair done before the flight be in that area?(pilot defect report for message STABS POS XCDR), and perhaps compromised the wires?
Cutting fuel just after takeoff leaves almost zero time for the other pilot to recover.
it only guarantees an accident it doesn’t guarantee death of the pilot, at such low altitude and speed anyone can survive as the one passenger did .
Why would anyone risk potentially surviving a sabotage like that ?
A fully fueled plane crashing in takeoff guarantees a huge fire.
That doesn’t mean the cockpit will burn .
The wings hosts the engine and a good portion of the fuel is quite a bit back from the nose in a big plane like 787. The engines lost power and hit just 180 knots just 4 seconds after the plan lifted off. The plane could have just easily broken up differently where the nose crashed in a different spot than where the fire would likely start.
At such a slow speed and altitude they could even have well crashed inside the airport perimeter and got a quicker/ better emergency response from the fire units at the airport.
Attempting this during takeoff or landing when the pilot monitoring is fully engaged and closely observing would be most difficult to execute .
It's interesting to try to imagine a device that would prevent that, without causing more issues.
My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?
I think engine fires are still more common than suicidal pilots and inadvertant fuel shutoff activations.
The idea would be something that is ONLY operational after V₁ and until some safe height.
Or maybe a design that prevents both switches being off (flip flop?) for X minutes after wheel weight is removed?
Again, it’s probably pointless but it’s an interesting thought exercise.
Suicidal pilots are apparently more common than we’d want.
It’s a pointless exercise though - if one of the pilots wants to crash the plane, there’s almost nothing that can possibly be done. Only if someone can physically restrain them and remove them from the controls.
There’s always going to be many ways they could crash the plane, such a feature wouldn’t help. The pilots are the only people you can’t avoid fully trusting on the plane.
It's only pointless if we assume crashing was the intended result of the pilot. If the switches failed, or the pilot activated the switches by mistake, it's worth considering options for handling the inputs.
There's a balance of accidents to be found, I think. There are likely cases where fuel does need to be cut off to both engines, and preventing that would lead to accidents that might have been recoverable. This case shows that cutting off fuel to both engines during takeoff is likely unrecoverable. There have been cases where fuel is cutoff to the wrong engine, leading to accidents. Status quo might be the right answer, too.
So basically we need software that can 100% autonomously fly a plane. Software that is extremely reliable and trustworthy, basically. Software with multiple fallback options. Multiple AI agents verifying every action this software takes. Plus, ground-based teams monitoring the agents and the autonomous flight software.
Not AI, AI is less trustworthy than normal software almost by definition.
Formally verified traditional algorithms.
> Again, it’s probably pointless but it’s an interesting thought exercise.
Coming up with ad-hoc solutions is easy, especially the less you know about a complex system and its constraints. I'd say it's not an interesting exercise unless you consider why a solution might not exist already, and what its trade-offs and failure modes are. Otherwise, all you're doing is throwing pudding against a wall, which can of course be fun.
That’s the whole fun part - come up with an “obvious” solution and the try to figure out the problems or risks it would cause.
For example, an obvious solution is that the switch can't be changed from "RUN" to "CUTOFF" when the throttle isn't at idle - this could be done with a mechanical detent because they're right next to each other. Simple!
But now you've introduced additional failure modes - throttle sticks wide open and the engine is vibrating and needs to be shut down - so maybe you make it that the shutdown switch can work for ONE engine at any throttle position, but if TWO get turned off, both throttles have to be off, but that introduces ...
The flip flop thing is a neat idea since a single engine can typically maintain level flight and two burning engines is rare.
Or you simply interlock the engine cutoff with the thrust lever position, any position other than idle prevents shutdown. This all goes through the flight computers already.
If there’s a fire or similar problem the fire handles will cut off fuel without the normal shutdown procedure, but the normal switches only need to be used at idle thrust.
I wonder if Airbus has this logic, since their philosophy is to override the pilot commands if they’d endanger the aircraft (which has its own issues of course) where’s Boeing will alert the pilots and still perform the action. I don’t have access to that information.
According to AI, Airbus places these switches on the overhead panel, so that alone would make it harder to inadvertently move them. Apparently, Airbus "protections do not extend to mechanical or FADEC‑controlled systems like the engine‑fuel shutoff valves. If you deliberately pull and flip the ENG MASTER lever to OFF, the FADEC will immediately close the LP and HP fuel valves and the engine will flame out. If you then return the lever to RUN (and you meet relight conditions), it will automatically relight."
And that's why you don't trust AI.
As another commenter said the Airbus engine start/stop controls are located behind the thrust levers, and according to the A350 operations manual which I got my hands on there are two conditions required for the FADEC to command engine shut down: Run switch to off, thrust lever to idle.
So if that's correct on an Airbus aircraft you can't just switch off the engines when they're commanded to produce thrust. This also seems to be backed up by the difference in the guards for those controls in the Airbus cockpits.
Well, AI is plain wrong. Fuel cutoff switches on Airbus are in the same position as in Boeing planes, below the throttle.
> My preliminary idea is a "fuel bladder" for take-off that inflates
Will the bladder be marketed by Kramerica Industries?
Thanks for pointing it out.
Yes, the S.A.I.B. was about the switch, which is used in many airplanes, and _should_ be checked and replaced. But they didn't. Because it wasn't mandatory. So my guess is those 50-70€ per switch were too expensive for the airline?
They reported that they replaced the whole middle console twice, so I cannot accept the 'it's pricey' or 'it's non-mandantory' as an excuse.
Hackers gona hack, so I'd like to get my hands on those switches, or better the whole fuel control panel. The pictures don't let me see or feel if a loose front panel could lift those shiny glowy locking knobs up by, say, 2.3mm and therefore unlock those switches, for example.
Only picture I could find online about this malfunctioning switch:
https://www.xuefeiji.org/public/uploads/weixin_mpimgs/e3/e36...
which looks like a really nasty 'mechanical inadequacy': half of the locking mechanism is the shiny glowy knobs. And they could _turn_. WTHolyF!? What where they smoking when designing or reviewing this?
In this fine post here, if you can read chinese or click the translation button on your browser:
https://www.xuefeiji.org/bbs/show-294.html
(CAVE: I'm not inside boeing's tech support system so I cannot verify this from the original maintainance manual, since they seem to be practically guarded as trade secrets...)
I tried to order some of those switches (766AT613-3D and 766AT614-3D) and hope they get delivered ... this year. Anyone here got their hands on those switches to test their feel when handling or their resiliency?
(My hypothesis is:
Hand on throttle, Hand pushes throttle full forward to start, Hand rests on throttle while accellerating, then pilot does the routine rotate and plane takes of and all is fine and Hand lets go of throttle, Hand falls on both switches directy behind the throttle: Click-click-WTF?-BOOM.)
Of Course almost anyone involved in the airplane industry would prefer this to be a clear-cut case of 'pilot error' or 'Terrorism/Insanity' - but that doesn't exnorate the manufacturer or owner of building and flying an airplane where the engines can be shut off while taking off, IMHO.
As an aside, I especially like the disclaimers on the last page of Honeywells catalogue (this one: https://www.farnell.com/datasheets/2604543.pdf) - don't use it for anything safety-of-live related. - if it breaks because we delivered junk, we'll replace the switch - nothing else.
(I'm paraphrasing. Some laywers migth find a way to get out of this. I hope Boeing doesn't.)
They don't mention the locking mechanism being disabled
Totally different airplane with a totally different flight deck, designed generations apart. The fact that the manufacturer is the same is irrelevant.
You are trying to draw parallels between the ignition switch in a 1974 Ford Pinto and a 2025 Ford Mustang as if there could be a connection. No.
There Is a connection: The same type and make of switches, which already where officially found to be prone to subtle malfunction and ought to be checked and replaced. Read the SAIB. Look at the switches. https://www.xuefeiji.org/public/uploads/weixin_mpimgs/e3/e36...
Your argument of being "totally different" flight decks or fordy ignition switches aside (ignoring that one is allowed to to drive both mentioned cars using the same license, but not two different generations of airplanes, ignoring that the biological concept of generation implies kinship), this affair reminds me of https://en.m.wikipedia.org/wiki/General_Motors_ignition_swit...
And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:
"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."
So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.
Entirely different kind of flying altogether
One would assume a toggle like that would come with blaring alarms and blinking lights… right? Right??
Edit: It also seems like the engine cutoff is immediate after the toggle. I wonder if a built in delay would make sense for safety.
> I wonder if a built in delay would make sense for safety.
(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)
Low altitude, stall, and impact with terrain certainly will.
And with how low and slow they were during takeoff, those would have been going off almost instantly.
> It's difficult to conclude anything other than murder-suicide.
You're leaping into the minds of others and drawing conclusions of their intent. One of them moved the levers. It could've been an unplanned reaction, a terrible mistake, or it could've been intentional. We may never know the intention even with a comprehensive and complete investigation. To claim otherwise is arrogance.
The car equivalent is being on a highway and "mistakenly" pulling the hand brakes, except that there are 2 hand brakes and you need to first unlock both of them.
That's very hard to do by panic and mistake, if not impossible by design.
Nope, I strongly disagree with that comparison. One doesn't need to pull up a big stick in hand using elbow and shoulder to flip this fuel switch _down_. Would a car's hand brake stop your engine if it's thumb-push-button lock failed silently and you happen to let something fall on it, like a hand? no. But this little fuel switch would.
On pprune there is a professional pilot that says they had multiple instances of inadverent switching off fuel switches. They do it every startup, shutdown and training captains (the captain on this flight was pilot not flying, he had >10k hours) do it all the time in the sim to trigger engine out scenario during training
I pull my handbrake every time I park my car, but never mistake it for the windshield wiper while the car is moving
There is no shortage of people who press the wrong pedal or button in a car or elsewhere. But of course it could never happen to you, you're special!
You moved the goalposts from "do something catastrophic by doing something completely unrelated to what you were trying to do" to "press the wrong pedal or button in a car or elsewhere"
We're talking about taking an action in a different place in the cockpit controls that has safeties built in to prevent accidental use... like pulling a handbrake by accident while the car is moving when you meant to put your wipers on
Bad analogy because pilots are trained and rehearse and practice memory items until they are instinctual.
> impossible by design.
Deflecting that the human is the weakest part of the system. One or other may have panicked and made a mistake, made a mistake unintentionally, went crazy and doomed the flight, or intentionally doomed the flight for some socioeconomic reasons. These are speculative possibilities that we don't know yet, and may never know; we only know what has definitely happened from the evidence per the investigation. It's standing way out over one's feet to declare from an armchair that it was "definitely" X or Y before the investigation is complete.
Forget my words then and take those from aviation experts.
The fact that a pilot would cut off fuel from both engines, in sequence while taking off is virtually impossible to happen unless deliberate.
Hence the hand brake comparison, it does not come natural to use it while driving.
Bare in mind there have been there have been what, 100+ million flights? so "virtually impossible" things can, and will happen
It was done. Yes. There is no way to determine from the evidence why it was done, how much conscious or not thought was put into it, or the thought process behind it.
> One of them moved the levers. It could've been an unplanned reaction, a terrible mistake, or it could've been intentional.
Fuel levers are designed to only be moved deliberately; they cannot be mistaken for something else by a professional pilot. It's literally their job to know where these buttons are, what they do, and when to (not) push them.
It's not arrogance to assume the most likely conclusion is true, despite how uncomfortable that outcome may be.
> cannot be mistaken for something else
Assumption. Big ass assumption.
Pilot are trained until actions are instinctual and certain memory items are almost unconscious. But pilots are still people and people are fallible and make mistakes, and sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.
> It's not arrogance to assume the most likely conclusion is true
You don't know this. This is beyond the capability to know and is therefore pure speculation. That is the definition of arrogance.
> sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.
By this logic it would be impossible to ever find anyone guilty of murder (or any other nefarious action) with intent unless they explicitly state that it was in fact their intent. Obviously this is not how justice works anywhere, because at some point you have to assume that the overwhelmingly most likely reason for doing an action was the true reason.
If someone pulls out a gun, cock it, aim it at someone and pull the trigger, killing the other person, should we hold off any judgement because they might have done it purely mechanically while in their head thinking about the lasagna they are going to cook tonight and not realizing what they were doing ?
The fuel cut off switches have a unique design, texture and sequence of action that need to be taken to actuate them, they don’t behave like any other switch. Pilot are also absolutely not trained to engage with those particular switches until it’s instinctual.
Courts do not seek to establish the truth. They aim for a reasonable balance between false positives (innocents convicted of crimes they didn't commit) and false negatives (criminals allowed to go free). In practice, the false positive rate is probably around 5%, and innocents go to prison all the time.
Air accident investigations mostly deal with one-in-a-billion freak occurrences. Commercial aviation so safe and reliable that major accidents rarely happen without a truly extraordinary cause.
Yet Occam's razor still applies
That's not what Occam's razor means. It means that after you have exhausted all options to rule out competing hypotheses, you choose the simplest one that remains, for the time being.
Consider some explanations that are consistent with the evidence presented so far. And remember that the purpose of the investigation is to come up with actionable conclusions.
1. One of the pilots randomly flipped and crashed the plane for no reason. In this case, nothing can be done. It could have happened to anyone at any time, and we were extraordinarily unlucky that the person in question was in position to inflict massive casualties.
2. Something was not right with one of the pilots, the airline failed to notice it, and the pilot decided to commit a murder-suicide. If this was the case, signs of the situation were probably present, and changes in operating procedures may help to avoid similar future accidents.
3. One of the pilots accidentally switched the engines off. The controls are designed to prevent that, but it's possible that improper training taught the pilot to override the safeties instinctively. In this case, changes to training and/or cockpit design could prevent similar accidents in the future.
Because further investigation may shed light on hypotheses 2 and 3, it's premature to make conclusions.
Given the fly by wire nature of 787 there is an also fourth option.
The physical switch was not touched at all , and the software has a bug under some rare conditions which cut off the supply to both engines.
Extremely unlikely, since we can hear the other pilot ask why he turned the fuel switches. If it was an electrical glitch, he wouldn’t be able to see that they are in the cutoff position.
All we know is the pilot flying is only asking whether the pilot monitoring if he cut off
- We don't know if he meant the switch specifically at all. He could also have meant engines or thrust in general. There are many other visual signals and UX indicators to know if engines are spinning down. Thrust levels, to RPM to falling speed, change in angle of attack, rate of climb, even engine noise, vibrations you expect at full thrust etc.
- We also don't know if the switch was physically in cut off position in the first place or even if was the pilot noticed that specific visual signal and meant that when he spoke.
If it was a software issue, it is possible the switch was properly positioned, and software issue cut engine was cutoff, the display screens and other lights would show that.
In such a scenario, the pilot(s) would have likely checked with each other first if they did something as in the audio and manually tried restarting the engine as they seem to have done.
I am not saying it is a bug or any specific fault scenario, Just that it too early, we don't yet have enough information to say what is likely at all.
I think there are a couple of factors that disprove these theories:
- The specific mention of "cut off" in the CVR is very telling. If both pilots were genuinely surprised, you'd expect they'd say something like "engine failure" or "loss of thrust" first. Noone thinks the engines have been shut down as a knee-jerk reaction to a sudden loss of thrust.
- If investigators had the slightest indication there's a software or hardware bug out there that randomly causes dual engine failures, an emergency airworthiness directive would have been issued by now. This hasn't happened.
> an emergency airworthiness directive would have been issued by now. This hasn't happened.
737 Max incidents proved it isn’t always the case.
This is also not the NTSB or FAA doing direct investigation . Without certainty no one is issuing a directive, at this stage it is simply too early and only a possibility
I wouldn’t read so much intent during high stress part of takeoff from two non native speakers
> 737 Max incidents proved it isn’t always the case.
> This is also not the NTSB or FAA doing direct investigation . Without certainty no one is issuing a directive, at this stage it is simply too early and only a possibility
You are mistaken. The first MAX crash resulted in emergency directives being issued barely a week after the crash. That investigation was conducted by the Indonesian authorities, not US ones.
Emergency directives aren't issued when there's complete certainty, quite the opposite. Hence the "emergency" bit.
> I wouldn’t read so much intent during high stress part of takeoff from two non native speakers
I agree there's some fuzziness since the exact transcription wasn't provided. But "why did you cut out the engines" is by no means a normal question when facing sudden thrust loss.
Exactly. 80% chance it was the one who asked who didn't do it, but we'll never know.
I think that's some extreme speculation bordering on conspiracy theory that would need evidence to back up.
> You don't know this.
That it isn’t certain doesn’t change anything about it being pretty likely.
Unpleasant, but I suppose at least it means we won’t suddenly see other planes falling out of the sky due to fuel switches being set to off.
It’s the explanation that requires the fewest explanations and assumptions I’d say.
The most likely scenario is not necessarily the truth. It still remains pure speculation and nothing else.
Yeah and the other pilot flipped the switches back on and one of the engines started spooling up but it was too late.
Murder-suicide looks like the likely conclusion, given that flipping the cutoff switches requires a very deliberate action. That said, it's not entirely impossible that due to stress or fatigue the pilot had some kind of mental lapse and post-flight muscle memory (of shutting off the engines) kicked in when the aircraft lifted off.
> post-flight muscle memory (of shutting off the engines) kicked in
Possible, and if so it is too early to conclude it was murder-suicide.
See also: https://www.thehindu.com/news/national/dgca-slaps-80-lakh-fi...
The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.
that doesn’t tell us they were fresh. Only that they hadn’t flown. They could’ve slept 0 hours before or any number of things.
Sure, and aliens could also be involved.
However, the only relevant evidence that exists suggests they had enough rest. You don't build verdicts on suppositions, you build them on proven facts.
This does not guarantee you will reach the truth, but it's miles better than admitting every baseless hypothesis that comes up.
Aren't you the one building on suppositions? We know that they don't have flight hours. We cannot conclude what condition they were in aside from that.
to jump from "they could be tired or hungover" to "yeah or aliens" is very dishonest. Especially for a very fresh matter where we know very little, all our assumptions are just that, and nothing we writes has any bearing on anything.
This is preliminary report. They will look deeper into this.
Don't sentence people on unfinished investigations. This is why most trials are not public, because of people like you.
I'm glad you read my other comment [1].
1: https://news.ycombinator.com/item?id=44539508
> because of people like you
No. Bad.
0.1% of airline pilots fly intoxicated, and probably many more fly hangover which is an undetectable condition.
There is speculation that in the Air France flight 447 that crashed into the ocean en route to Paris, one or the pilots only had 1h of rest because of partying the night before. Of course it’s all speculative, and however unlikely it is, eventually it’s bound to happen that we get pilots with poor mental clarity in charge of large Boeings with hundreds of lives on board. Unfortunately it only takes one lapse of judgement to compromise the flight profile of a large airliner, even if corrected after a few seconds.
https://generalaviationnews.com/2014/11/06/vanity-fair-the-h...
At some point I think we need to accept more control from automation. The model where ultimate authority reverts to a single input is a cop out. That could be pilot input, sensor input or even direction from ATC. They will all provide false data on occasions. When that data contradicts 99% of the other data then the safest option is to ignore it. And that doesn't just mean with compromised humans but with normal human weakness. Fully understanding the aircraft, its state, its systems and the minds of its crew is impossible.
In this case I wonder if the fuel cut off switches could be replaced by buttons for particular situations. Have an engine fire button or a shut down whilst on the ground button. Let the pilot provide input on state and let the automation decide what to do with that. Obviously this is not a solution to suicidal or murderous behaviour. But it could be a solution to all the low probability edge cases.
> Murder-suicide looks like the likely conclusion
But why cutoff the fuel instead of flying into terrain? It's such a passive action
I imagine it would be more difficult to fly into terrain without a cooperative co pilot than cutting the fuel just after take off.
For whatever reason, the Egypt Air 990 pilot initiated his murder-suicide by pulling the thrust to idle and then flipping the fuel cutoff switches.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC.
Damn. That's pretty quick to diagnose and take action.
Boeing's probably gonna have a big sigh of relief over this one.
> Boeing's probably gonna have a big sigh of relief over this one.
The 787 is 15 years old, and this particular plane was 10 years old. It always seemed unlikely to be a major, new issue. My money was actually on maintenance.
While unlikely, there have been issues before that took decades to surface (e.g. Aloha Airlines where a 737 manufactured more than a decade earlier became a cabriolet due to Boeing underestimating sea water corrosion and short flight cycles), or the 737 rudder issues where the planes were also 10+ years old.
> Damn. That's pretty quick to diagnose and take action.
I have to imagine that “You are flying” and “You just cut off all fuel to the engines” must generate a pretty obvious claxon of warnings.
I once worked with a software engineer who would do things and then bald face lie about it. This reminds me of that person.
Me: “The build is breaking right after you checked in. Why did you do that?” Him:”I did not do so.” Me: “The commit shows it as you. And when I rolled back everything builds.” Him:”It must have been someone else.”
That person was really annoying.
I’ve worked with some chronic liars. They would deny reality no matter how much evidence you had.
The weirdest thing was how often it worked for them. In each case their lying eventually caught up with them, but in some cases they’d get away with lying for years.
It’s amazing how often someone would have clear evidence against what they were saying, but the people in positions of authority just wanted to de-escalate the situation and move on. They could turn anything into an ambiguous he-said she-said situation, possibly make a scene, and then make everyone so tired of the drama that they just wanted to move on.
i worked in many companies but I always remember one , where during a public chat in the middle of an open office the programmer next to me (who was always conniving but I just ignored it ), said incorrectly something akin to " yes I know all about that source control its... based on locking " , the whole point was that although locking technically occurs, the SC would allow different coders to work on it at the same time. The non technical manager said correctly, "no the whole point is that the codebase isnt locked", to which the programmer replied " yeah thats what I mean".
In that moment I realised he was just bare faced lying right infront of everyone, about a technical subject, only HE should be the expert in, and to this day I am perplexed why his contract kept being renewed.
Eventually I was let go ( he possibly suggested I be let go ) for an incident that was unrelated to me.
This is all fine, but i learnt 5 years on he was still being paid a top 1% salary at the same company.
I promise the point isnt that I am jealous, its that this guy, who was a sub par coder and liar, somehow managed to keep his job whilst everyone else lost theirs and earnt untold amount in England ( where salaries are always low).
My goodness - I just remembered he was found by police driving a vehicle seemingly under the influence on a motorway, work found out after the police called them, and somehow he turned up the next day at work , lied about it, and STILL kept his job.
I am only mentioning this guy , because he was NOT a nepotist hire, he was just some guy who would lie and somehow people were ok with it. I still think of him often and wish I could have learnt more from his abilities just out of interest.
Yeah, in the UK you lose your job when you make a fuss, not when you misbehave. That's my experience.
In most places you lose your job when you don't do it well.
> So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally
FAA issued a Special Airworthiness Information Bulletin SAIB NM-18-33 in 2018 warning that on several Boeing models including the 787 the locking mechanism of the fuel switches could be inoperative.
https://www.aviacionline.com/recommended-versus-mandatory-th...
Per FAA the checks were recommended but not mandatory.
Does the Flight Data Recorder consider the physical position of the fuel switches or does it get the information from some fly-by-wire part that could be buggy?
The conversation would suggest that the switches were in CUTOFF position, but there is also a display that summarizes the engine status.
There is no conversation that mentions flipping the switch to RUN again.
EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
> EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
Pilots unions are dead against it.
And now some pilots are dead.
Just allow cockpit video recorders, and if they're ever used for anything, the pilots (or their heirs) get $250k in cash.
And Pilots end up dead because of it.
Are you actually using a tragedy like this to launch an assault on organized labour?
What, do you want them to hem and haw and refuse to answer?
Saying the union drove a decision is hardly "an assault on organized labor".
Why is that outrageous?
You have to admit this is a smart demagogue!
[dead]
I've had discussions on HN with people who insisted that having a video camera always pointed out the control tower at the runway was some sort of impossibility. Despite every 7-11 having such a system.
This would leave accident investigators with a lot of work to do to try to figure out how a collision happened.
Airlines are decades behind on tech. You can get satellite internet almost anywhere on the planet and GPS can give you ten-foot accurate positioning, but we've still _lost_ planes because we haven't mandated a system that sends the realtime position of the plane over the satellite internet. The days of limited storage are still going strong in the industry.
There are reasons they don’t. This is a deceptively difficult problem
Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
And by stations, I mean aircraft. There are a TON. Current constellations probably wouldn’t even be able to handle half the current aircraft transmitting all at once. Bandwidth, in the physical sense, becomes a limiting factor
Coverage (different constellations have different coverage, which means planes would not have transmit guarantees depending on flight path). So you’d have huge gaps anyways
There have been alternative solutions posed, some of which are advancing forward. For example, GPS aware ELTs that only transmit below certain altitudes. But even that has flaws
Anyways I think we’ll see it in the next decade or two, but don’t hold your breath
There's somewhere around 15 thousand relevant planes in the air at any time.
If you sent two updates a minute over Iridium, using their 25 byte message plan, you'd be looking at a megabyte per minute for the entire planet. That's such a tiny fraction of what that single constellation can do.
Most airplanes regularly crossing oceans already do have satcom.
The cost of hardware and additional fuel consumption due to drag aren’t nothing, but the data used itself is essentially a rounding error. (Iridium for example has tiny antennas, and SBD data costs about a dollar per kilobyte, and position data is tiny.)
Of course, that’s all little help when a pilot acts adversarial; on MH370, the breakers for both satcom and transponder were likely pulled, for example.
Yep. Inmarsat has this data for most of the world widebody fleet, and had it for MH370... except when transmission stopped. It's not publicly shared information, because that's what the ADS-B transponder they're all equipped with is for...
> Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
You get free Starlink on several airlines now, so won't that be a solved problem soon?
Free to passengers doesn’t mean free to the airline, and Starlink in commercial airliners is very new.
sure but if the airline already pays for the service for passengers surely it can be used for the planes as well
Not necessarily. Required certifications, SLAs etc. for safety critical systems are vastly different from those only handling passenger entertainment/connectivity. For example, Iridium has been around for almost 30 years now (launched in 1998), but it only became certified for safety of life applications at sea in 2019, and for aviation around 2010.
Many planes still use completely separate systems for non-critical communication (often Ku or Ka band based geostationary satelliets) and for ATC or operational communication (usually L-band based Inmarsat or Iridium) as a result.
> Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
I can pay $10 to have internet for the entire flight. Reasonably low bandwidth of course, but if I can splurge $10, the airline can.
> Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)
That’s nonsense. Even when I’m flying right over the north pole my airline will give me unlimited in-flight internet for $20. Maybe antartica has worse reception, but cost isn’t the issue.
Yes there is.
> It's difficult to conclude anything other than murder-suicide.
Remember that incident where a cop pulled out his taser and tased the suspect? Except he pulled out his pistol and fired it.
The taser looks nothing like a pistol, feels nothing like it, yet it is still possible to confuse the two in the heat of the moment.
It’s always easy in those threads to see who’s familiar with the world of aviation and who’s not.
No it’s not comparable to a cop that confuses things in the heat of the moment. Not anywhere close to be relatable.
If it was, planes would be crashing down the sky quite often (and it would have been fixed for decades already).
WalterBright is not totally unfamiliar with the aviation world...:
> Bright is the son of the United States Air Force pilot Charles D. Bright
> Bright graduated from Caltech in 1979 with a Bachelor of Science in Mechanical Engineering and a minor in Aeronautical Engineering
> He worked for Boeing for 3 years on the development of the 757 stabilizer trim system
So? The comparison still makes no sense. Those switches cannot be accidentally flipped, and they are in a place where the pilots' hands have no action to take at all during that period. That is very different from mixing up two similar weapons in a similar location.
Location of the switches: https://media.cnn.com/api/v1/images/stellar/prod/c-gettyimag...
Here is a video of a takeoff and climb in a 787: https://youtu.be/TTZozTaWiRo
The pilots have no business with their hands in the area of those switches in that phase of the flight (9:30+ in the video). They don't even have to touch the throttle, and even if they did, that's a long way from where you touch the throttle down to the base where those switches are. Which you can't just flip either.
How is that even remotely similar to that cop's situation?
> Those switches cannot be accidentally flipped
Yes, unbelievable things can happen. There are crashes where the pilot got discombobulated and a crash resulted.
For another example, there are at least two crashes I recall (and I am sure there are many more) where the pilot pulled back to recover from a stall despite being trained endlessly to push forward to recover. (And they killed everyone on board.) Pilots get confused by what an alarm means, and do the wrong thing. Pilots assume the autopilot is on but they had accidentally turned it off. Sometimes people get crazy urges to do the wrong thing (there's a word for that: cacoethes).
These things are rare, but when there are millions of flights, rare things happen.
Interesting. "Cacoethes" means "malignant" in Greek. I didn't know the other meaning in English.
I cheated and looked up the word myself, and just had to use it!
What were they confusing the switches with though? Are there two other switches they would be toggling at that phase?
Perhaps they were very very confused and thought they had just arrived at the terminal?
I've turned on the windshield wipers when reaching to turn on the headlights. Fortunately, neither were critical subsystems.
This is why the pilot doing the action annunciates it and the other pilot checks it. Pilots are trained not to silently do things.
Also, a cop who can either read or write can't be expected to not make mistakes.
Suicide is quite a stretch without any supporting evidence from the pilots' backgrounds. I would take mental fog, cognitive overload, wrong muscle memory, even a defective fuel cutoff system over suicide.
>mental fog, cognitive overload, wrong muscle memor
Agreed. The sequence of events also supports this.
I believe one of the pilots made a terrible muscle memory mistake and cutoff the fuel instead of raising the landing gear. This would explain why the landing gear was never raised, why the pilot who was accused of cutting off the fuel denied it (in his mind he had only retracted the landing gear) and why the engines were turned back on after presumably realizing the mistake.
This also makes sense with why nobody on the recording mentions re engaging the fuel switches
The pilot denies shutting off the fuel, then realises he'd done it accidentally and quietly reenables them hoping there's enough time to save them
Were the landing gear switches and fuel cutoff switches pretty close to each other here?
Not really. Landing gear switches are above the throttle between the screens¹, fuel cutoff switches are below it².
¹) https://youtu.be/RbmFmWqqq0c?t=19
²) https://youtu.be/33hG9-BCJVQ?t=5
(I'm not an expert, I just watched these videos)
Not that humans are known to behave rationally when trying to commit suicide, but it’s interesting that the switches were re-engaged successfully without protest or a fight. It’s just an interesting detail to wonder about.
The reasoning I’ve heard is: it didn’t matter anymore, the damage was already done and there was no way any attempts at recovering from it would have been successful.
There would have been an inaction on the part of the pilot that did this, but it is not mentioned in the CVR transcript.
Hard to believe the other pilot wouldn’t have said anything.
Recovering the airplane and have some people survive the crash are two very different things.
and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec
Or more precisely, the signals which come from them were found to behave as such.
Without any audible record of turning the switches off, I wouldn't blame the pilots without first checking the wiring and switches themselves for faults. This reminds me of the glitches caused by tin whiskers.
But from the audio recording it seems like one pilot is noticing them bering in the CUTOFF position, and asking why (and moving it back). If the switch was actually in RUN, but some other issue caused the signal to be sendt, the pilot would see it beeing in the RUN position, not CUTTOF.
Are they looking at the physical switch or data about the state of the engine displayed in some other fashion?
This is very clearly EAFR data, so the logical/electrical switch state. Nothing about the mechanical state of the switches has been mentioned, except a picture that shows their final state to be in the RUN position (which makes sense given the relight procedure was ongoing).
From what I understand, the relight procedure involves cycling these back to CUTOFF and then to RUN anyway. So it is not clear if they were mechanically moved from RUN to CUTOFF preceding the loss of thrust, or cycled during relight.
Where can I listen to this recording?
You can't yet - what we have is this sentence from the report: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."
It's not a direct quote or transcript, it's reported speech.
I agree, there's a significant distinction between "the switches were (physically) flipped" and "the circuit was opened/closed".
In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.
The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.
My understanding from what we've been reading is that these are physical switches that cannot be moved using remote triggers. Wildly speculating, there _may_ be a possibility that the _effect_ of the switch may be triggered remotely, if it's a signal being read by a control unit or computer of some sort that then actuates the specific electromechanical components. But it would seem impossible to move a physical switch to do it.
As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.
Any switch becomes irrelevant if a saboteur has access to the behind-the-panel wires that the switch operates.
But I presume that would leave physical evidence which would have been discovered by now. Presume, but cannot be certain.
If that was the case, it does seem a bit odd that there was a one second gap. But yeah, still worth investigating, if that’s even possible given the extensive damage.
> And both pilots deny doing it. > It's difficult to conclude anything other than murder-suicide.
You’re trying to prove a negative here.
I am not familiar with the 787 operations, but there are a few issues that need to be sorted out first: - altitude when pilots start the after takeoff checklist
- if there are any other switches that are operated in tandem in the general vicinity of where the engine cutoff switches are
- if the cutoff switches had the locking mechanisms present, and if not, if they could be moved inadvertently by the pilot flying hand
Discarding other possibilities in an investigation can have adverse consequences.
Did you ever always push the right buttons every time?
The switches have lockout mechanisms that prevent accidental triggering. I'm not a pilot, but these guys are, and they find it exceedingly unlikely that anyone would switch both off by accident:
https://www.youtube.com/live/SE0BetkXsLg?feature=shared
You have to time it spy movie right to ensure dying.
This is what I am debating.
There are too many variables you need to account for.
For example, I want an expert opinion about the tone in the cockpit when the other pilot said “No, I did not touch it” or what was said. Is it calm? Surprised? Cold?
> Did you ever always push the right buttons every time?
A whole world full of 787’s is pushing the right buttons every single day. If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.
> If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.
Well, of course I talk about an accidental touch of the wrong buttons.
Flying is very safe, but at the same time, you will never know how many near misses happen daily that don't become accidents.
Actually we do https://en.wikipedia.org/wiki/List_of_US_aircraft_near-miss_...
Nice. But how about what happened in the cockpit that was never reported? Or something that was not seen by others?
Have you ever turned your car off when you meant to turn on the windshield wiper?
I turned off my car several times because I forgot I turned it on in the first place. In all fairness, it was always when I was parked.
I wonder if the switches are still in tact after the crash? Can they verify that the switches are mechanically sound? If so, seems highly likely it was intentional.
There are pictures of them in the report.
I'd suspect the wiring leading from the switches to the engine controllers first, especially since it looked like both circuits cut out nearly at the same time.
This is speculation again since I don't really know, but my understanding of aviation engineering is that there would be two separate controllers for each engine connected to these two switches. At no point would they be connected to the _same_ control unit. The really short time (~1s) between the two being cutoff is the difficult thing to explain here.
Are the wires leading up to those switches on the console also kept separate, or are they just bundled together as part of the same harness (presumably before it splits to go to the engines)? I think that's also important in understanding the possible failure modes.
> It's difficult to conclude anything other than murder-suicide.
The balance of probability might tend to support that hypothesis. However I'm wondering if it was just something involuntary. My ex for instance who learned to drive on a stick shift would randomly stall the engine after a few weeks driving an automatic.
> It's difficult to conclude anything other than murder-suicide.
Is it possible it could have been an accident or a mistake by one of the pilots? How intention-proofed are engine cutoffs?
You have to pull the switches out (against a spring) to be able to move them over a notch and flip them. Not really something you can just mistake for another switch or bump into by accident.
I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.
Is it possible to rest the switch on the notch? Does the switch make contact if the switch is in the RUN position but the switch is not completely down?
That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?
Just trying to think of some semi-plausible non-active causes.
Report says the switches went to cutoff one second apart from each other. Can a human do the physical operation on two switches that quickly?
The timing is really curious.
08:08:35 Vr
08:08:39 Liftoff
08:08:42 Engine 1 cut-off
08:08:42 Engine 2 cut-off
08:08:47 minimum idel speed reached
?? One pilot to other: why cut-off. Other: Did not do it
08:08:52 Engine 1 run
08:08:52 Engine 2 run
1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.
Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The big question is whether the switches were moved or something made it seem as if the switches were moved.
Well in the murder-suicide scenario it makes sense for the culprit to turn them off as quickly as possible. The longer time to turn them on could plausibly be a struggle or simply needing to fly the plane while reaching for each switch individually.
Assuming the person trying to kill themselves and a plane load of people would respond in an expected way to inquiry is also just a mistake.
It's not a rational decision, so there's no reason to expect rational decision making or explanation on the output.
Too many are willing to accept the Bart Simpson excuse of "I didn't do it" at face value.
> Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The workload is pretty high during the takeoff phase. The engines react right away when fuel flow is stopped. The engine displays can have some lag before data is updated.
Relighting an engine at low speed is not feasible - most need 230-250kts IAS before attempting the operation. Maybe you could do it if the APU was still running and could provide compressed air, but it takes about 20-30 seconds to start up amd then probably 5-10 more to spool up to full thrust. I am speculating here a bit, but the pilot did not have enough time to save the plane even if he did everyting right and as fast as humanly possible.
All this aside is overshadowed by the limited amount of time the pilot flying (I would assume the captain in this case since there was only one ATPL pilot in the cockpit) had to troubleshoot the issue of a dual engine failure - as this is what would have felt to him - during takeoff.
> I would assume the captain
The report states the FO was pilot flying.
My bad. I assumed it was the captain since the report says the FO only has a CPL license. And I was a bit surprised he could fly on a comercial airplane with only that kind of license and not an ATPL one.
There's a good photo of them here; https://theaircurrent.com/aviation-safety/ai171-investigatio...
You can do them both with one hand.
Are you completely sure you can considering that they are spring loaded and they are like 7-10cm apart judging by the size of other controls?
I don't understand your question. I have done this myself, am I completely sure?
Did you mean to say you can activate the switches with one hand simultaneously? That is probably what the above commenter assumed you meant. Since lifting and twisting two switches simultaneously with one hand seems challenging.
Above commenter said _quickly_, not simultaneously
Jesus...
joey: Can you switch them quickly?
snypher: You can do them with one hand. [Ed. This is ambiguous and could be read as "one hand, simultaneously". In fact, doing it with one hand non-simultaneously would be a weird claim to make of a simple knob. See also ajb's comment below.]
zihotki: Really? They are not close together and have a spring mechanism. [Ed. Seems to believe snypher is claiming simultaneous operation.]
snypher: I am confused by the response.
Me: [Tries to facilitate clarification]
> This is ambiguous and could be read as "one hand, simultaneously"
Not within the context of the thread.
Context is both these switches being turned off with a 1 second gap. Doing it with one hand simultaneously would possibly explain it, otherwise it doesn’t seem relevant.
> Context is both these switches being turned off with a 1 second gap. Doing it with one hand simultaneously would possibly explain it
It would. So would switching both quickly in succession. One second is a long time—I can adjust power, prop, fuel pump and flaps in about that time.
What I gathered from comments here is it's not a simple flick of the switch and it actually takes some effort to turn them off. Can you really do it twice within the span of 1 second?
You pull it out and flip it. It’s not easy to do inadvertently. But it’s also not convoluted—you want to be able to quickly cutoff if there is an engine fire.
Are you kidding? You don't understand that 'simultaneous' is <1 second?
It didn't happen simultaneously so this is irrelevant.
It is relevant to the interaction I replied to.
You’re the only one who said “simultaneously.”
See above.
I wonder if they could theoretically rest on top of the notch, not fully locked into either position and flip accidentally. No idea how the switches behave when not all the way up or down, but the notch looks pretty long and flat so it could be possible.
Something like this could maybe happen to one switch, it's unlikely but possible. But two independent switches at the same time?
Good point, that is very unlikely. I was just wondering if it's possible at all.
Those switches are the size of a thumb. No one is moving those - separately, mind you - and not realize what is going on.
If you do them both with one hand, would they not be moved at the same instant rather than 1 second apart?
They require a per-switch motion, so unlikely.
Is there just one set of switches? Or do both pilots have their own set?
Only one set.
It could be defective switch springs, fatigue-induced muscle memory error, or something else. The pilot who did it saying he did not may not have realized what he did. It's pretty common under high workload when you flip the wrong switch or move a control the wrong way to think that you did what you intended to do, not what you actually did.
That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.
They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.
Still... that has its own set of risks and failure modes to consider.
When your engine catches on fire/blows apart on takeoff you want to cut fuel as fast as possible.
If its both engines you're fucked anyway if its shortly after takeoff.
But I'm an advocate of KISS. At a certain point you have to trust the pilot is not going to something extremely stupid/suicidal. Making overly complex systems to try to protect pilots from themselves leads to even worse issues, such as the faulty software in the Boeing 737-MAX.
Was thinking this same thing. A minute feels like a long time to us (using a Garmin as the example said) but a decent number of airplane accidents only take a couple minutes end to end between everything being fine and the crash. Building an insulation layer between the machine and the experts who are supposed to be flying it only makes it less safe by reducing control.
First, the fire handles would override any delay and cut fuel (and other things) immediately.
Second: the window of time where you don't have enough altitude (aka time) to restart is relatively small. So this could easily be a temporary protection.
It is difficult to find exact data on this but restart to significant thrust seems to be in the 30-60s range. If you run the numbers on climb rate and glide time the possible danger zone is relatively small, a few minutes after takeoff at most.
Is this an extremely rare event? Yes. But most other accident causes are also rare, regardless of whether they are pilot error or mechanical.
For example: you might think no pilot would deploy the thrust reversers in flight but system protection errors and/or mechanical failures have conspired to allow it and a bunch of people paid in blood to learn that reverser deployment in flight at altitude was actually unrecoverable - contrary to conventional wisdom at the time. It turned out everyone was flying around with a "kill everyone now" mechanism. In some cases with a much lower margin of safety than previously believed due to the aforementioned "conventional wisdom" that if it happened it wouldn't be a big deal.
Know what else isn't normally a big deal (relatively speaking)? Accidental shutdown of both engines. Because a single engine shutdown is easily recovered and the aircraft can fly on one engine. And dual engine shutdown is easily recovered with a restart if you have enough altitude. But it turns out there's a small window after takeoff where it is fatal.
Somewhat relatedly shutting down the wrong engine in an engine failure scenario is so common they explicitly train crews to slow down and not immediately shut down an engine after failure because rushing just leads to dual engine loss.
Proposed algorithm: If the flight computer thinks the engine looks "normal", then blare an alarm for x seconds before cutting the fuel.
I wonder if there have been cases where a pilot had to cut fuel before the computer could detect anything abnormal? I do realize that defining "abnormal" is the hardest part of this algorithm.
The incident with Sully landing in the Hudson is an interesting one related to this. They had a dual birdstrike and both engines were totally obliterated and had no thrust at all, but it came up later in the hearing that the computer data showed that one engine still had thrust due to a faulty sensor, so that type of sensor input can't really be trusted in a true emergency/edge case, especially if a sensor malfunctions while an engine is on fire or something.
As a software engineer myself I think it's interesting that we feel software is the true solution when we wouldn't accept that solution ourselves. For example typically in a company you do code reviews and have a release gating process but also there's some exception process for quickly committing code or making adjustments when theres an outage or something. Could you imagine if the system said "hey we aren't detecting an outage, you sure about that? why don't you go take a walk and get a coffee, if you still think there's an outage in 15 minutes from now we will let you make that critical change".
If the computer could tell perfectly whether the engine “looks normal” or not, there wouldn’t be any need for a switch. If it can’t, the switch most likely needs to work without delay in at least some situations.
In safety-critical engineering, you generally either automate things fully (i.e. to exceed human capabilities in all situations, not just most), or you keep them manual. Half-measures of automation kill people.
But humans can't tell perfectly either and would be responding to much of the same data that automation would be.
I wonder if they could have buttons that are about the situation rather than the technical action. Have a fire response button. Or a shut down on the ground button.
But it does seem like half measure automation could be a contributing factor in a lot of crashes. Reverting to a pilot in a stressful situation is a risk, as is placing too much faith in individual sensors. And in a sense this problem applies to planes internally or to the whole air traffic system. It is a mess of expiring data being consumed and produced by a mix of humans and machines. Maybe the missing part is good statistical modelling of that. If systems can make better predictions they can be more cautious in response.
If the warning period is short enough is it possible it's always beneficial or is 2-3 seconds of additional fuel during a undetected fire more dangerous?
If engine_status == normal and last_activation greater than threshold time
Else Shut off immediately EndOverride warning time by toggling again.
Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.
There is a relatively short window where dual engine shutdown is unrecoverable. Once you have a bit of altitude (and these jets climb at 2000-3000fpm) you have time for a restart and as thrust comes back sink rate will decrease even on one engine.
My proposal is during this window if dual engine shutdown is commanded don't do it. Treat it like it is happening - show the EICAS message, give the alert, but don't actually do the shutdown until the window has passed. This gives the pilots 10 seconds of startle factor then a bit of time to flip the switch back on.
Single engine shutdown would still behave as today so sure if one engine eats a fan blade shut it down. Not that it matters, the engine computer is going to cut fuel in that case anyway.
Insert a delay only for shutting down the remaining engine and only for X seconds after transition to air mode. A delay that the fire handle overrides.
Just a tiny bit of insurance. There aren't any emergency scenarios at low altitude where engine shutdown works but pulling the fire handle does not. You are coming right back to land at the airport no matter what.
This makes me wonder. Is there no audible alarm when the fuel is set to cutoff?
Shutting off both engines would display "ENG SHUTDOWN" in yellow text (caution) on the EICAS. If only one engine was shut down, it would say "ENG SHUTDOWN L" or "ENG SHUTDOWN R".
Any of these would trigger an unmistakable audible "BLEEP BLEEP BLEEP" to draw your attention to the screen so that you could see what the caution was. These messages are right next to the engine N1 indications anyway, so it would be immediately obvious that one or more of the engines was spooling down.
I'm doing it all the time while rebasing commits or force pushing to my branch. Sometimes I would just click the wrong buttons and end up having to stay late to clean the mess. It's a great thing I'm not a pilot. I would be dead by now.
[flagged]
Please don't sneer, including at the rest of the community.
https://news.ycombinator.com/newsguidelines.html
This is a place that puts "Hacker" in the name despite the stigma in the mainstream. Given the intended meaning of the term, I would naturally expect this to be a place where people can speculate and reason from first principles, on the information available to them, in search of some kind of insight, without being shamed for it.
You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.
For me it's mainly about intent/unearned confidence.
If someone is speculating about how such a problem might be solved while not trying to conceal their lack of direct experience, I'm fine with it, but not everyone is.
If someone is accusing the designers of being idiots, with the fix "obvious" because reasons, well, yeah, that's unhelpful.
For the record I don't think the designers of the switch or Boeing are idiots. The switches have guard notches and the throttle quad has metal guard edges to help prevent accidental activation.
As far as we know this is the first accidental dual engine cutoff at low altitude; with just a bit more altitude (not sure of how much exactly) the engine that had restarted and was ramping would have started producing enough thrust to arrest their descent. That makes the margin of "unrecoverable" a lot smaller than you might initially think.
Bottom line is it is worth considering implementing some protection here:
The benefit being elimination of the small window after takeoff where accidental dual engine shutdown is unrecoverable.Obviously before implementing something like this the proper engineering and failure analysis has to be done.
I don't think most think they know better but it's frankly fun to speculate and this is a casual space rather than the serious bodies tasked with actually chewing over this problem in earnest.
> That said Boeing could take a page out of the Garmin GI275
This is not "reasoning from first principles". In fact, I don't think there is any reasoning in the comment.
There is an implication that an obvious solution exists, and then a brief description of said solution.
I am all for speculation and reasoning outside of one's domain, but not low quality commentary like "ugh can't you just do what garmin did".
This is not a throwaway, I'm a lurker, but was compelled to comment. IMHO HN is not the place for "throwaway" ad hominems.
First I am a pilot. Not commercial or jet rated but I like to think I have a tiny bit more insight than average.
The point of what GI275 does is as a backup instrument you are much more likely to need it when the electrical system fails or is turned off due to fire. Yet if it just remains on until shutdown pilots would frequently forget to turn it off on the ground, resulting in its battery being worn out. Because it is considered critical it delays its own shutdown. Long enough for you to notice in flight but not so long it wears out the battery (which might result in only a few minutes of power in a real emergency).
My entire point was that engine restarts take some time. If both engines eat a blade or catch fire you are screwed anyway so whether or not the fuel cutoff switch does anything at 1500ft is irrelevant. But that is so rare I don't think we have any events on record. So it might be worth inserting a delay - enough to account for standard climb rates to achieve enough altitude to make restart likely or at least possible. The delay would only be for the second engine shutdown and only for time T after going into air mode. And if the system gets it wrong, thinking the other engine is shutdown when it is not pulling the fire handle would override any delay - and pulling the fire handle is part of any engine failure or departed aircraft procedure I know of. In other words you wouldn't even need to change the QRH or emergency checklists in most cases.
I noted that engineering for aviation is complex and everything has failure modes to consider. Privately I went through several iterations of this idea and discarded them for problems with failure modes and complexity. What I proposed is boiled down to the minimal thing that would have saved this flight.
The other thing I'll say is there is a reason the computer will auto-extend some flaps/slats at slow speed even if you put the handle to zero. And there's a reason auto-throttle provides protection. And with the exception of the 737 the computer auto-starts the APU on dual engine failure. And any attempt to deploy thrust reversers in the air is ignored. And stick pushers exist for good reason.
We put in all kinds of measures to override human decisions to prevent mistakes and errors.
> This is not "reasoning from first principles".
It literally is. Accidental/malicious activation can be catastrophic, therefore it must be guarded against. First principles.
The shutoff timer screen given as an example is a valid way of accomplishing it. Not directly applicable to aircraft, but that's not the point.
> "ugh can't you just do what garmin did"
That's your dishonest interpretation of a post that offers reasonable, relevant suggestions. Don't tell me I need to start quoting that post to prove so. It's right there.
(Different user here) Hacker News' "culture" is one of VC tech bros trying to identify monopolies to exploit, presumably so they can be buried with all their money when they die. There's less critical thinking here than you'd find in comments sections for major newspapers.
This is false, and if this stereotype was ever based in anything real, that era ended in the early 2010s.
The modal HN reader now is a tech employee or freelancer.
[flagged]
Please don't sneer, including at the rest of the community.
https://news.ycombinator.com/newsguidelines.html
Yeah, people shouldn't bat ideas around and read replies from other people about why those ideas wouldn't work. Somebody might learn something, and that would be bad.
Reminds me of 2017 Las Vegas shooting. The perpetrator looked and acted completely normal till the day of shooting and all his issues like anxiety or losing money was nothing far from ordinary. And what seems all of a sudden did a well planned shooting and didn't bother to leave a note or tell his story.
Free memento mori: you're both free-associating.
There's 0 reason to conclude murder-suicide, there's an infinitude of things that could have the same result, and both pilots denied it to eachother: how is that presented as proof?
I hope I don't need to explain why the fact no one knew in advance the Las Vegas shooter was going to shoot has ~0 similarities with the situation as we know it, and banal similarities with every murder.
Using that reasoning all airplane crashes have a lot in common too.
Doesn’t mean the ones where you cannot determine the reason and have to speculate don’t suck.
Could you explain more? There's too many negatives in that last sentence for my decaffeinated early morning brain. I'm titillated by the idea there's a way to justify making up things so I really want to parse it.
It means, sometimes the best you will get is speculation, because there’s no definite answers to be had.
E.g. it’d be nice if just hearing the CVR meant you knew the exact cause. Unfortunately not the case here.
Given the recent boundless incompetence by Boeing why not ask if their is any way for such to fail out of scope of the normal interface?
[flagged]
Or a mechanical failure
Both switches, at slightly different times? Seems pretty unlikely.
A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.
But why does the pilot then comment that they are in the CUTTOF position and move it to RUN? A mechanical failure would have to also move the physical switch in the cockpit for the audio recording to make sence.
You have the exact CVR audio? The report says "one of the pilots is heard asking the other why did he cutoff" which I interpreted to mean one of them noticed the engines shutting down, and asked the other if he did that.
Then he would have asked the other pilot why the engines are shutting down. It seems a lot more probable that he glanced at the switches before asking such an explicit question.
Without listening to the CVR audio and knowing what they actually said, there's no evidence either way, and AFAIK they have not released that.
From the preliminary report, quote: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."
I'm trying to understand your complaint here... you think you need to hear their voices with your own ears to believe it?
We know that the switches physically moved from the run to the cutoff position because one of the pilots noted that they were in the wrong position. We know that they were moved back to the run position because they found in that position. I don't understand how a short could explain that - it really seems like someone would have had to physically move the switches.
What we have is reported speech: "In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."
So we don't know the exact words used. Did he say for example, "Why did you move the switches to cutoff" or did he ask "Why did you cut off the engines"? If there are indeed two shorts (astronomically low as those probabilities are), the other pilot would say "I didn't", look around confused and then (possibly?) flip both of them down and back up? Which could explain the 4s delay in pulling them back up.
Speculation, but since we do not have actual transcripts or recordings, all I'm doing is answering speculation with more speculation.
Do we know that the pilot noticed they were in the wrong physical position, or did some other status indicate the engie fuel had been cut? I would be surprised if there was only one channel for this information
In the last mentour pilot livestream, they showed the simulator and both engines, and there's a little graphic near the cutoffs showing engine state and performance. Also, in _this_ livestream as soon as the report was released, Ben mentions in response to a question that if you cut off the engine, a lot of electrical systems are going to face power cuts, so there will be alarms blaring all over the cockpit. So, yes. There are many channels of information here.
It amazes me that some people can ever make it out the door if they spend all their lives contemplating a series of increasingly unlikely possibilities.
Serious question: why is it so difficult to fathom that a deranged pilot could decide to commit suicide by plane?
Not difficult, but can you close an investigation on that note without going over other possibilities?
What if there's another safety lesson to be learnt here?
The investigation isn’t closed. A preliminary report is usually required to be released within a few weeks of an incident.
To answer your question: because it is a very rare occurence.
It's not that rare, and there are institutional factors (such as seeking treatment for psychosis being career-ending for a pilot) that incentivize serious pilot mental health crises being untreated.
All commercial plane crashes are very rare occurrences.
This is highly reminiscent to me of this case. [0] The co-pilot accidentally hit the wrong switch and then quietly corrected his mistake later, without resetting the previous switch (which led to feathering).
[0] https://en.wikipedia.org/wiki/Yeti_Airlines_Flight_691
>It's difficult to conclude anything other than murder-suicide.
This kind of attitude gets innocent people behind bars for life. Disgusting.
It's difficult to conclude anything until the investigation is finished and I hope the ones who are carrying it out are as levelheaded, neutral and professional as possible.
Cutting the engines within seconds of leaving the ground doesn't fit suicide very well. I'd expect something more like flying into the side of a mountain or heading really far out into the Indian ocean until you vanish from radar and cause a big mystery.
For instance, you might deliberately kill yourself by driving your car really fast into something solid, but you probably wouldn't try to do that while backing out of the garage.
I think it is opposite. Flying into a mountain & etc would require one pilot to somehow incapacitate another pilot. Cutting fuel off, if done on takeoff, is not recoverable (engines can’t relight and spin up quickly enough).
OK, that makes a kind of sense, altitude would spoil the plan, if a suicidal pilot's only plan was to cut the engines.
See Germanwings 9525 for an example of a conclusive suicide with no doubt from all the evidence.
See me obliquely referencing that with "flying into the side of a mountain".
It's interesting to see how people manage incomplete information.
You could have made the same assumptions after the first MCAS crash, much like boeing assumed pilot error. It's easy, comforting and sometimes kills people because it makes you stop looking.
So you're telling me that those switches don't have a voice that says "fuel cutoff switches transitioned" like in the movies? That's bad design
I know this thread runs the gamut of armchair experts, pretend experts, and actual experts and there's no telling who is which but I really want to know why the downvotes and why this is not a good idea.
The idea is to notify for crucial settings, replace vocal confirmation (probably) already in the SOP anyway, reducing mistakes in bad faith or otherwise.
Don't some planes already have an automated announcement for seatbelts on?
Only reason I can think of why it's not there yet is the cost (whether $$$ or design opportunity) of cramming that in the already-cramped cockpit.
My first instinct is that the suggestion is overfitted due to hinsight bias. This particular accident happened to involve these particular switches so let's add a warning to these switches. Duh!
Some problems that immediately come to mind:
- For which settings is there going to be a voice confirmation? Is their confirmation more important than all the other audio warnings?
- During emergency situations, when pilot workload is high, will these only add to that workload, making the emergency even worse?
- Will the pilots get so used to hearing these every day that their brains will simply tune them out as background noise?
Really though, if a pilot wishes to doom an aircraft, there's 1000 different ways they could do so. The solution to this problem likely lies in the pilot mental health management department, rather than the fuel cut off switch audio warning one.
Pretty obviously a bad joke and a bad idea IMO. I did not personally downvote, but I think it deserves its current score.
Look at the timeline of the events. The switches were shut off, noticed to be shut off, and restored to the proper position within 10 seconds with the current system. Insufficient notification that the switches have been turned off was clearly not a problem in need of a solution. It would be slower and more challenging to understand an automated verbal announcement than the surely extremely obvious sudden lack of thrust and all engine dials rapidly dropping to zero.
So it wouldn't contribute at all to solving this particular case, would only be a slightly annoying distraction in the more normal case of normal aircraft shut-down after completing its flights, and would be a potentially hazardous distraction in the intended emergency case of engine is on fire and fuel must be cut off immediately, where there's probably a bunch of other extremely important and urgent things to pay attention to and do other than a silly automated warning telling you what you just did.
It's a joke about the design of safety systems involving actual human lives (movies being more safe). I get an audible warning on my laptop if i hit a key for too long for God's sake. These companies are a joke.
WHOOP WHOOP
TERRAIN, TERRAIN! PULL UP! PULL UP! (WHOOP WHOOP)
Wait till the final report is out and what resolution they come up with then we'll see who the joke is on
Do you know if the mechanical position of the switch guarantees its electronic state without any possibility for hardware malfunction? If no, then you are claiming a person made one of the most grave acts of inhumanity ever.
This sounds to me like an electronics issue - an intermittent, inadvertent state transition likely due to some PCB component malfunction
The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated. Malice looke very likely to me. An investigation into the pilots life may turn something up, I guess.
It’s worth noting that Premeditation or “intention” doesn’t have to factor into this.
Studies of survivors of impulse suicides (jumping off of bridges etc) indicate that many of them report having no previous suicidal ideation, no intention or plan to commit suicide, and in many cases no reported depression or difficulties that might encourage suicide.
Dark impulses exist and they don’t always get caught in time by the supervisory conscious process. Most people have experienced this in its more innocuous forms, the call of the void and whatnot, but many have also been witness to thoughtless destructive acts that defy reason and leave the perpetrator confused and in denial.
> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated
How so? It is just as likely to be an intermitted electronic malfunction.
For both switches on seperate systems and wires that are independant.
I mean, it's not impossible, but it sure the hell is improbable.
And then 10s later the switches magically fixed themselves? The likely not electronically connected switches since that would compromise engine redundancy?
The other pilot likely flipped them back - but at that point, it was impossible to avoid crashing.
intermittent state switching is absolutely a thing in (poorly designed/manufactured/tested/QC'd) electronics
It is, and one would expect that a single switch failure would be far more probable, so how often have we had switch failure single engine cutoff in the 787?
All this rests on whether we have CVR audio of the pilot(s) manipulating the switches.
The rodents were remorseful and fixed the cables in the meantime. /s
Murder-suicide has happened on a few occasions. How many times has your malfunction occurred on an aircraft fuel system?
Not precisely the electrical malfunction, but dual engine shutdown has occurred, fortunately after landing:
https://www.aerosociety.com/news/ana-787-engine-shutdown/
That doesn't seem to be a malfunction at all.
Different engine (those are Trents and this was a GEnx), but yeah, that _did_ happen.
There is also audio of the pilots discussing the issue.
Here's another point of view: https://x.com/BDUTT/status/1944012769323626682
The four Indian pilots on her show are clearly not convinced that the pilots are to blame.
As they mention, it's important to know what else was spoken in the cockpit. Quite possible that there's more, and that might have implicated the pilots. However, if that's not the case, this is a very poorly worded report.
This is BBC, they have a history of being uncharitable when it comes to reporting on their erstwhile colonies. Jumping to a conclusion about pilot's fault when the recorded dialogues show both had no idea who cut it off (leaving ground for a possibility of some malfunction) is irresponsible, especially when the report could have been worded better without needing to reach a definitive conclusion.
Both pilots have a long history of flying, a lot of experience, so while there is a chance one of them did it unknowingly, it's a small one in my opinion. Because it's not just a small switch, but a multi step procedure. The reporting on such a sensitive issue has been shocking to say the very least,
Where in the BBC coverage are the pilots blamed? Sounds like you might have a bit of a chip on your shoulder, and indeed it sounds like you are the one who is biased towards a particular conclusion (namely that the Indian pilots bear no blame).
i see the confusion. Initially the title of the video on BBC youtube channel was:
> BREAKING Air India crash: Pilot cut off fuel to engines - no fault with plane | BBC
and then they changed it to:
> Fuel switches cut off before Air India crash, preliminary report says | BBC News
You can decide. I had noticed it then. It was also noticed by many others as the story started getting traction and there are many x accounts (and probably elsehwere too) which would corroborate the same.
I'm completely ignorant about this matter, but why is it even possible to cut off fuel while taking off? Shouldn't there be a control that completely disables this? Is there actually a situation where cutting off both engines could be necessary and wouldn't lead to a catastrophe?
The general principle of aircraft control is that the pilot has the final say on how it is operated, not the designer, because you never know when you will need to take extraordinary measures. And the pilot generally prefers to return to the ground safely.
This is true for boing, but not true dor Airbus design philosophy. Airbus tends to limit the pilot control inout pushing the plane out of safe operation conditions. I'm not sure of it's possible/not possible to cut the engine fuel supply during take-off in any Airbus though.
I'm assuming fuel being cut off is salvageable if not in the middle of a densely populated city, especially if above a plain or water. So it could be the favorable option in case of an engine fire.
Also, such complexity would introduce additional points of failure - as a sister comment mentions, a faulty altimeter (or whatever sensor) could prevent you from cutting off fuel when you need to.
> if not in the middle of a densely populated city, especially if above a plain or water
What is on the ground below does not matter at that point - how far above that ground you are is what is important. More altitude is more time.
This flight was less than 200 meters up in the air. Sully's flight that you probably remember, that made a successful emergency landing on the river, was about 860 meters high, giving them much more time - about 3.5 minutes of glide time, vs. 32 seconds in the air, total, for the Air India flight.
Okay, maybe there is little hope of making an ideal landing. But the likelihood of it being a fatal accident is significantly reduced without the building in the equation, no?
Given the amount of fuel on board the answer is probably “not by much”.
Nope, the odds are pretty much the same, even on water. It helps to reduce the body count on the ground though.
Engine fire requires you to cut fuel to the affected engine.
Pretty sure nearly all runbooks have you first move the thrust lever to idle before cutting off fuel. That suggests you shouldn't be able to cut fuel independently of the throttle.
Is cutting off fuel while taking off a better solution than letting them burn?
Sometimes? If you have enough altitude to trade for speed then after the cutoff you could glide to a hypothetical miraculously-placed runway right in front of you, vs. having fire quickly consume the entire plane if you don't cutoff..
It is if you don’t want the wing spar to fail!
Airbus liners don't allow cutting fuel with trust lever on.
This is actually very clever and elegant!
Well.. except that it means you can’t turn off the engines if the throttle encoder fails.
Actually the parent comment was wrong:
You can physically cut off fuel without pulling the thrust lever to idle, because the two are separate controls.
However, it’s against procedure to do so - even dangerous. Throttle should always be at idle before pulling the cutoff switch, because otherwise excessive pressure can be created in the fuel system.
Essentially this is just a best practice, but there is no interlock between throttle and fuel cut off.
Then I got intrigued by your comment in case the throttle encoder fails. Turns out there is double redundancy on the throttle encoder (if one computer fails, the next one takes over), and if both fail the airplane will run on the last known setting at which point the only possible action that can be taken is to cut off the fuel (or keep it running with the last known throttle level).
In this regard both Boeing and Airbus follow the same implementation and there is no difference whatsoever between them.
Perhaps something they I have learned is that cutting off fuel during max throttle position (take off) may have damaged the fuel system of the Air India airplane because of big pressure in the lines and that may have interfered with the restart of the engines when the fuel valve was opened again.
So many garbage takes here - this report wants to imply pilot error and without all the data/audio that remains a remote possibility but the truth is it is far more likely that this plane experienced a total electric failure following liftoff and the onboard computer entered some form a failsafe mode which set the fuel valves to a default closed state.
The pilots were likely immediately trying to relight the engines which is the correct reponse but sadly they didn't have the altitude to see the process through.
My guess is the truth here (i.e. Boeing equipment malfunction) or at least the framing of it is being used as a chip in trade deal negotiations which are active and ongoing.
Report PDF here: https://aaib.gov.in/What's%20New%20Assets/Preliminary%20Repo...
mirror https://web.archive.org/web/20250711203907/https://aaib.gov....
Not accessible. Have they heard about S3 ?
It loads for me, so I think the link will be useful for some people at least.
It's getting hugged by the world and they didn't use a CDN apparently.
Video would definitively show whether either pilot moved these switches or if some other mechanism caused the movement. The aviation industry has consistently resisted cockpit video recording despite decades of available technology. The pilot unions argue privacy concerns, but cases like this demonstrate the value it would have. Current audio captured the pilots' denials, but without visual confirmation we may never be able to definitively determine who turned the engines off.
Is this really the reason they object video recording in the cockpit ?
If so I agree it's not a good enough reason.
Its more about concerns about Airlines using video to micro-manage pilots. I too would hate it if my manager was watching my every move while working so I can empathize.
that could be easily solved though. is the data in the black box being analyzed after each flight by the employer ?
Please provide sources for your claims.
Which claim? It is self-evident that video footage would show if a pilot turned the engines off intentionally or accidentally.
The pilot's union opposes cockpit video recording for silly reasons.
https://www.ainonline.com/aviation-news/air-transport/2024-0...
Throttle control module (TCM) was replaced twice in the past 2019 and 2023 which is not very usual.
Now pure speculation, both pilots have long record of flying, you have to literally pull up and move each fuel control switches to cut off. Either one of the pilots did this intentionally or control unit was faulty. Considering past history and pilot experience, my bet is on faulty controls but we will never know.
They can be tested if there's a mechanical failure ifthe switches survived the crash.
Excellent analysis here, those switches are stout, no one is moving them by accident:
https://www.youtube.com/watch?v=wA_UZeHZwSw
Except when they are not:
From the avherald link:
>Service Bulletins by Boeing issued in year 2018 recommending to upgrade the fuel switches to locked versions to prevent inadvertent flip of the switches, as well as the FAA/GE issued Service Bulletin FAA-2021-0273-0013 Attachment 2 relating to loss of control issue (also see above) were NOT implemented by Air India.
You've linked to something regarding an ECU component. Nothing about fuel switches. "This Service Bulletin provides instructions to replace the EEC MN4 bridge ball grid array (BGA) microprocessor"
Because that maintenance check is an optional one as stipulated by Boeing. I don't think most users of the 787 themselves carry out the check, so singling out Air India for this alone is just bad faith
In this YouTube short you can see the pilot switching both fuel cutoff to run
https://www.youtube.com/shorts/bd4Bler36Nk
there's literally two other similar switches right next to those?
The switches on the lower panel that are switched, are the fuel cutoffs
But they don't look protected or hard to switch?
No they don't, do they. That also corroborates the fact that they could be both switched to CUTOFF within a second, like the report states. That impossibility was raised by parallel threads here. In the video they are both switched on even faster than 1 sec apart, or, at least it feels like it.
They are hard to switch. You need to lift them to switch.
The pilot is toggling the switch on.
Toggling it off presumably requires more power and is multiple actions.
You move those switches down apparently. I don't think so.
Up/Forward ==> Run ==> Fuel supply is on
Down/Backwards ==> Cutoff ==> Fuel supply is off
https://www.reddit.com/r/indianaviation/comments/1lxxatc/fue...
I mean, there doesn’t seem to be a different amount of force necessary.
What makes me more inclined to suicide is that this might have been the perfect time to do this so that even a small interruption in fuel would be catastrophic.
If this is the case, you have to then think about why this pilot would want suicide but also murder all aboard the plane. It's a bit irrational if they wanted to just suicide - you can easily just cut your own throat, hang yourself, or jump off a tall building.
There are already 5 other cases of pilot suicide with a full plane.
People do irrational things, especially if they are mentally unwell - https://en.wikipedia.org/wiki/Germanwings_Flight_9525
Look at financial motive. Some insurance payout stipulation or pension obligation to his family may have been boosted by death on the job.
It's a mistake to try to rationalize suicide. People frequently make irrational decisions.
This report is outlining the known facts of the flight at present. The main one being the movement of the fuel switches to the off position did occur a few seconds after take-off, almost certainly by one of the pilots. And this was the primary cause of the crash. However, blame has not been apportioned and the reason for why is not known.
blancolrio puts its well: https://www.youtube.com/watch?v=wA_UZeHZwSw
Three things:- 1) Pilot clearly said I didn't do it. 2) Report talks about the second switch being turned off in a second. 3) Known advisory on switches getting flipped.
If you see these three together, it becomes easy to deduce that based on point 2, switch was not human induced as the actions required take more than a second. Next the third point, advisory was for this exact scenario which played out, though rare but still it shouldn't have been just an advisory, but more than that.
The switches are right next to each other and have a very short throw[1]- it would definitely be possible to do them in under a second and it looks possible to throw them together.
IMO that looks like a spot that would be pretty difficult to hit accidentally even if the ward failed. You'd have to push them down and the throttles are in the way.
Doesn't mean the switch couldn't have failed in some other way- eg the switch got stuck on the ward but was still able to activate with a half-throw, and spring pressure pushed it back into off during a bump. But switches generally only activate when fully thrown, and failing suddenly at the exact same time is not really what you would expect.
[1]: https://www.reddit.com/r/indianaviation/comments/1lxra3g/b78...
> it becomes easy to deduce that based on point 2, switch was not human induced
This just isn’t correct at all. The evidence isn’t conclusive but if a human operated switch was flipped, and one of the humans present says to the other one hey why did you do that, then Ockham’s razor points to a human flipping the switch.
It’s not the only option, but it’s certainly the most likely.
> as the actions required take more than a second
Where do you get this from? You have to pull up the switch with two fingers and move it to the other position and put it back in. This doesn't seem to take more than a second if deliberate.
To me, it points to a Germanwings-style sabotage. And the "I didn't do it" seems to be a lie. Not very confident in it, just the likeliest to me. Though one can ask why not just push the nose down instead. Maybe he thought that's too easy for the other pilot to counteract. The fuel switches are more out-of-mind and more startling to change.
> And the "I didn't do it" seems to be a lie.
As has been pointed out elsewhere, even if one of the pilots did deliberately move the switches, it's not clear from the reporting so far if that's the same pilot who responded to the question. In other words, it's possible one pilot flipped the switches and then asked the other pilot why he cut off the fuel to misdirect and create more confusion.
Edit: Of course this is all speculation, we don't know if the switches were moved deliberately and if so which pilot did so and which pilot was which in the exchange. More investigation is clearly needed.
And there’s motive to create misdirection: most life insurance policies have exclusions for suicide.
If there was any worry that 787 switch lockouts are not working properly, wouldn't they release an immediate bulletin for inspections on all aircraft? It seems like the lack of any bulletins implies the lack of any suspicion on hardware problems.
The advisory was for the lock being disengaged meaning you would still need to manually move it. it wasn't for being moved by factors such as vibrations also If it was from vibration how would a crash impact not move them back to cut off?
In this phase of flight the pilot’s hands should be nowhere near the thrust levers let alone the fuel cutoff switches. There is no way they could accidentally knock them with their hands.
On the contrary, it's quite normal that the PF's hands are on the throttle levers throughout the climb (until the switch to automation), which are directly in front of the cutoff switches.
They could be close for retracting the flaps. Completely different control though.
> the actions required take more than a second
Not sure where this is asserted? These aren't complicated mechanisms, it's just a pull lock, right? Pilots flip the switches twice on every flight at startup/shutdown, it's a routine action.
1) but what else would they say if they did do it?
These airplanes reject a lot of the pilot inputs if they don’t align with the expectations. Any idea why the system even allows the cut engine fuel input at that time of flight? Sounds to me that it should be just ignored. Even if both engines were on fire while climbing that early, what could cutting fuel offer?
In case of engine fire they need to cut fuel
In general yes. But that early in the takeoff sequence cutting fuel will only kill you. If the engines can still provide thrust, I would take it.
Why can the pilot shut off the fuel during takeoff?
Fire, probably. But also, how complicated would you make the system if you needed to prevent certain switches from working during certain times of flight? At some point... we're all just in the hands of the people in the cockpit.
I can't put my car into reverse gear while driving down the freeway.
Sure, but you can open the door, pull the handbrake, or turn the wheel so hard you lose control of the vehicle. These are all similarly preventable, but maybe not worth the risk of being unable to open the door, brake or steer if the safety mechanism fails closed, or if your situation is outside the foresight of its designer.
Also, you don't need multiple certifications and 1500 hours of experience to drive a car.
On a Tesla (and presumably other cars) opening the door engages Park.
There's no handbrake to pull, and turning the wheel so hard to lose control is next to impossible. Maybe on an oily wet or loose surface.
On my Tesla Model Y there's a hand brake on the push button of the right lever. On the left hand lever there's another push button, the windshield wiper liquid. Guess what have I mistakenly, and scarely, done twice already when driving at highway speeds when my windshield was a little dusty?
New designs are prone to ill decision-making from engineers, drivers and pilots alike. Every pathway of let's do it differently is the beginning of a journey of fine-tuning loops until stability.
There are very few failure scenarios that are life threatening in a car.
A friend did exactly that in a manual transmission, doing 100km/h.
She was mad and said she has to jam it hard ( going for 5th and missed), but it went into reverse. And the gearbox literally hit the road when she let out the clutch.
There’s no good reason to do that.
There may be a good reason to cut fuel to one engine shortly after takeoff.
You could have a system that prevents both switches being thrown, and only in the specific window after takeoff, but you’ve also now added two additional things that can fail.
You also can't reverse a plane while flying it...
This is a rather odd comparison. You can slam the brakes, yank the steering week, and do all sorts of things to intentionally make the car crash.
You can put the reversers on for a tactical descent though :P
They look nice, but they can be turned on the C17 (and probably other military airplanes).
Commercial airplanes have safeguards against in-flight thrust reverser deployment. That is why they only work in tandem with the ground sensing systems - like the airplane must firmly believe both main landing gears to be physically on the ground for both reversers to be operational.
Remember the "surging" incidents where the driver insisted he was stepping on the brake but was actually stepping on the gas?
Remember when the driver pushed nothing but the tesla kept driving or braking?
You can turn the ignition off. The reversers will not unlock on an airliner that's airborne either.
Completely uneducated guess but if one engine bursts into flames you might want to kill the fuel.
Suggest a system that would prevent this, but only this, without causing other risks.
Disable the fuel system cutoff controls during the takeoff climb phase of flight. Once the aircraft loses contact with the runway, these controls shouldn't function without tripping certain thresholds (speed & altitude), or following a two-man procedure that is physically impossible to execute solo. In any other flight regime, the controls function as originally designed.
The danger of a burning engine is irrelevant if you are heading into terrain.
Now you created a fuel system cutoff control inhibition system which may malfunction in its own ways, e.g., refuse to cut off fuels from a burning engine because it thinks the plane is too low due to faulty altimeter reading.
I don't think so. A moderately hard landing with an engine(s) smoldering because they were on fire but had their fuel cut off is probably survivable for most of the passengers. A moderately hard landing with the engine(s) a raging inferno pouring burning fuel all over the place because the fuel couldn't be cut off or took too long to do so is much less survivable.
Putting complex and fallible restrictions on safety-critical controls like fuel cutoff is usually a bad idea overall.
> The danger of a burning engine is irrelevant if you are heading into terrain.
Not quite. When you hit the ground you do not want any fuel leaks or hot surfaces as much as possible. That is why for example engines are shutdown when doing an emergency belly landing, to try abd prevent the airplane from bursting into flames.
Sounds good, but I'm not sure I trust Boeing outsourced software developers to implement that absolutely correctly.
Another comment mentioned that with an Airbus you first have to move the thrust lever to idle before you're able to cutoff the fuel.
That seems sensible and relatively easy to implement without screwing it up.
At least an audible alert.
Exactly
Yeah that would have completed prevented this scenario /s
Engine overheating even on idle thrust (if this happens after V1, you would idle it and continue the takeoff anyway; you are beyond the point at which you can safely abort).
Engine oil leak has drained the oil completely and the engine is about to fail catastrophically (unlikely on takeoff but you never know).
Engine is on fire (out of all of the things that can go wrong with an engine during takeoff, this is very likely).
Engine has blown up (ditto).
Engine is missing from the aircraft (not likely, but engines have fallen from planes on takeoff before).
Debris / Ash / etc is in the engine (not likely).
Severe fuel leak (not something I'd worry about during takeoff).
Probably other reasons I can't think of.
What you are really asking is: would we, the passengers, be safer without human pilots?
Eventually, yes. Soon? Maybe.
Dog and a pilot. The pilot is there to make sure everything is ok and the dog is there to bite the pilot if he tries touching anything
As long as you also eliminate the possibility of maintenance problems and defects in automation, and have perfect microscale weather forecasts, and still have overrides for the human safety pilot that can still... wait a minute.
> Why can the pilot shut off the fuel during takeoff?
Engine failure during takeoff.
Engine fire.
The NYTimes states that there was an advisory on the switches but that the FAA had not deemed them unsafe. It also states that on this plane the switches were changed in 2023.
In the 787, each engine has an independent control oil circuit switch. This switch needs to be pulled out, moved, and then pressed to take effect; I feel that this is difficult to complete in about a second.
I recall something similar to this happened in the USA in 2023. An off-duty pilot in the cockpit tried to pull that fuel shut-off handle (edit: I'm informed it's a different fuel shut-off mechanism), but was overpowered by the other two:
> "Both pilots then saw Emerson grab on to the red fire handles, also known as the “T-handles,” which are used to extinguish engine fires and shut off all fuel to the engines, potentially turning the plane into a glider, the pilots told federal investigators."
> "“If the T-handle is fully deployed, a valve in the wing closes to shut off fuel to the engine. In this case, the quick reaction of our crew to reset the T-handles ensured engine power was not lost,” Alaska Airlines said in a statement."
> "One pilot struggled with Emerson for about 25 or 30 seconds before the off-duty pilot “quickly settled down,” according to the complaint."
https://www.latimes.com/california/story/2023-10-24/off-duty...
That's not the same one, that's the big red FIRE ones on the overhead panel. They're not reversible and are under a plastic cover. As far as I know these ones are. They're also used to just switch them off at the end of a flight which can of course be reversed. But I guess in this case there wasn't enough time. They only had 30 seconds.
Quote:
The preliminary report suggests this is pilot error.From my (limited) understanding you cannot really switch these off inadvertently as they require a couple of actions in order to be switched off. So it would mean one of the pilots switched these off (and they were a few seconds later switched on again but it was too late).
But there was audio, too, and one pilot asked the other "why did you switch these off" and the second one said "I didn't".
Was there are third one in the jump seat?
Sounds likely that one of them was sabotaging the flight.
The report only said the copilot was flying and the pilot was monitoring.
It does not suggest that. It only says they were turned off and no other conclusion given.
It's safe to state these fuel cutoff switches aren't to be touched in-flight unless the word 'fire' is said beforehand. Even then, you only perform fuel cutoff for the flaming engine. If the copilot was busy with takeoff, there is exactly one other person in the entire world that could have flipped both switches. We may never know which one flipped them back.
Fire isn't the only instantly severe problem with engines. Another is violent shaking if, say, part of the rotating assembly came off.
Yep. Fan blade off, shroud separation, HP disc separation, compressor stall, FOD ingestion/bird strike, EGT rise, oil system issues. Very unlikely events but still possible events that need a prepared response to and capabilities to manage the aircraft. The presumption is that the crew is trained, diligent, disciplined, and concerned with survival. Without that, aircraft would need to be unmanned and flown by AI lacking in ability to handle any unforeseen events creatively.
I'm not sure you want a creative AI flying a plane anyway.
I don't want AI planes either, but the alternative of unmanned is ground-based drone operators who lack the survival interests of being on the planes. As such, I want non-AI flown planes with sane, stable, rested, practiced, experienced, sober pilots on the plane that isn't overly complicated and is reliable.
You can call it Schroedinger Airlines :))
You may or may not reach your destination. Or something like that.
Just leave the door closed at all times, and then there's no definitive problem.
There is a visual cue in the case of fire so the pilot won't turn off the wrong engine.
Why didn't they turn them back on then? Or does it take too long to spin up again even if they are still spooling down? This is one of the worst possible moments for this to happen of course. Low speed, low altitude, lots of drag...
They did, about 10 seconds later (which is both incredibly short and an eternity). But the engines almost immediately start losing thrust and it takes them much more time to restart. At the end of the flight, FDR records that one engine was gaining thrust, and the other was attempting to spin up, but it was too late and they didn't have enough glide time for both to gain enough thrust to climb.
Yeah 30 seconds is not much. This is really the worst phase of flight for this to happen. 30 seconds later and the plane would have had much more altitude and energy
The India AAIB website (https://aaib.gov.in/) is not responding ... For anyone who read the report, was there information about the age & experience of the pilots?
56 years old, 15638 hours (8596 on this type) and 32 years old, 3403 hours (1128 on this type). Page 11 of the PDF report.
Report mirror as the site seems to be down:
https://celsoazevedo.com/files/2025/Preliminary_Report_VT_AN...
So for all the bad rep $BA gets, it was just pure incompetence by unqualified pilots? Best to not fly Indian-based airlines
I have to wonder how much more time they would have had if the landing gear had been retracted early since the gear adds a lot of drag.
It’s interesting to see how many people are bending over backwards here to avoid coming to the obvious conclusion. If this was pilot suicide, it’s a terrible thing. If it was somehow an error (which seems very unlikely) or two defective controls (which seems even more unlikely), then it remains a tragedy. But I don’t need to do mental gymnastics to come up with implausible hypotheticals.
This comment stream on HN is not a jury. We don’t have to refrain from making judgments right now about what happened. There is nothing wrong with rational people reaching a preliminary conclusion based on available evidence.
Rational people should also remain open to revising their judgments/conclusions if new information becomes available.
And we shouldn’t demand any specific consequences for anyone absent a trial.
It’s nowhere near an obvious conclusion. A failure with the locking mechanism or muscle memory confusion are just as likely, and probably other theories I’m not thinking of. More investigation is clearly needed, which is why this is called a preliminary report.
Dual failure of the locking mechanism is extremely unlikely. These are not switches that are regularly used so a muscle memory issue also seems very unlikely (but is still the most likely non-suicide scenario)
If the switches have an unknown design flaw then it’s unknown how likely it is they’d both fail simultaneously
My understanding is these switches are used routinely during the shutdown procedure or did I get that wrong?
These switches are used at the end of literally every flight
The biggest problem with these theorising comment threads is the confidence people who know nothing about flying spout their theories
(I know nothing about flying)
Muscle memory? That’s grasping. How many times have you been pulling onto the highway and accidentally turned off your ignition?
I’d buy “mechanical defect” if it was only one switch. Two? At the exact same time? During takeoff? Nope.
[dead]
So what's the status of full self driving airplanes (aka autopilot , or maybe autodriver to avoid the bad connotations)
Is it really desirable though? Sure, it might eliminate human error, but it also probably eliminate pilots saving planes. I don't think an autopilot would have put US Airways Flight 1549 into the Hudson.
It's a philosophical matter: even when we have self-driving cars boats and aeroplane a human should always make the final decision.
reached v1, then when airborn fuel cut off. Seems like there was a FAA report like in 2018 that recommended few airplane models (incl this one) to check the fuel valves correctly, seems like air india didn't do it. Turns out it was made by Honeywell
All evidence suggests that the plane was fully functional. The switches were moved by one of the pilots.
Wondering if it is save to fly with Air India at the moment
Well, shit. Suicidal?
And this can't possibly be all the audio if the other pilot noticed the switch position, I would expect a lot more cussing and struggle.
So they didn't notice the switch position? The switch was in the right position but not really? Is this a rarely used switch that one might not look at (or know where to look) during regular use?
10 seconds between OFF and ON.
Dual engine failure on takeoff gives them about as much time to react as if the front passenger grabbed the steering wheel while on a windy mountain road and yanked them off a cliff.
It only takes a few seconds to completely screw everyone, but a bit longer for the consequences to occur.
From what I've read, it comes on the display as a warning
Yes
The switch had to be operated deliberately, but still a UX fail on a modern aircraft if cutting off fuel to the engines does not result in an audible alert/alarm which both pilots can hear - especially at that altitude.
It would not make any difference. They were too low and did not have enough time to recover. They immediately switched back to on. Two captains is discussing it here (https://www.youtube.com/watch?v=SE0BetkXsLg).
Are you sure there wasn't an audible alarm?
The switches were re-engaged within 10 seconds so isn't it possible they quickly heard a warning alarm, realised the issue and fixed it? (Of course, not quick enough in this case)
Another reason to automate humans away.
[dead]
More discussion: https://news.ycombinator.com/item?id=44536691
[dead]
[dead]
[flagged]
[flagged]
Studying how humans make errors is a fascinating field. Simply banning someone who's made a "slip" error as hypothesized wouldn't actually reduce the likelihood of this error occurring in the future. These sorts of errors are stochastic and could happen to anyone at any time. Preventing them requires a lot of thought.
Human factors portion of the investigation.
[dead]
[flagged]
The report says the co-pilot was flying.
The report says the black box reports the fuel cutoff switches being activated. That doesn't necessarily mean that either of the two pilots activated them, it just means that the fly-by-wire system reacted to a fuel cutoff event.
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cutoff.
In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
The other pilot responded that he did not do so."
> That doesn't necessarily mean that either of the two pilots activated them
It does:
1. Those switches have physical interlocks and cannot be manipulated by any computer system.
2. The flight data recorder is measuring the position of the switches; they aren't inferring the position from some system state. There's a "position of this switch" channel.
The switches were physically moved in the cockpit, that's basically ground truth. The question now is who and why.
What is the path of the wires from the switch onward? Do they go into a digital input of the flight computer, or do they directly feed the fuel control valves?
https://simpleflying.com/boeing-787-technical-features-guide...
" Advanced electric controls
The 787 entered service with an improved fly-by-wire flight control system. Rather than mechanical processes, the systems convert flight deck crew inputs into electrical signals. Still, there were additional advancements with the type."
Can't find a definitive source right now, but everything is implying there are discrete lines - at least one for command signal to the FADECs, and a separate sense line to the DFDAU for packaging up and sending to the EAFR. That lines up with design philosophy on this stuff of sensing control input data as close to the source as you can get.
Thanks for looking. I worked for Boeing (satellites, not airplanes) for a good part of my career, and I was there when Dennis Muilenburg pushed through his cost saving measures. It was the same culture that created the problems with the 737-MAX. Experienced design engineers were replaced/outsourced and the culture of safety was sacrificed. One example here:
https://www.cnn.com/2019/04/30/politics/boeing-sensor-737-ma...
787 (Dreamliner) was pushing hard for weight reduction, and it would not surprise me at all if the switch output fed a digital computer input rather than routing directly to the fuel shutoff valves, but I don't have any direct knowledge of this.
In that case, it could be true both that neither pilot manipulated the switch and that the system recorded a dual fuel cutoff.
Then why do we see the pilots notice the cutoff, move the switches back, and the engines respond as expected? The switched cannot move themselves. We’d expect to hear more commentary and confusion if the cutoff was active and the switches still in Run.
There would have likely been an indication on the glass cockpit displays that the fuel had been cut off, perhaps the pilot flying noticed this and asked the captain.
Yes, there is, but the reaction to that would be to look at the position the cutoff switches were in. We didn’t hear “wtf, they’re in Run” - the report says they just moved them from Cutoff to Run and the engines responded as expected.
I think you have to really reach to make this not pilot error. I know it’s appealing to call this a Boeing problem, but the evidence just from this prelim report is very compelling.
If you think it’s not pilot error, you can make some fake Manifold dollars: https://manifold.markets/JohnHughes/what-will-be-the-officia...
Until we hear the actual CVR audio, I don't think we can assume much. They are under a very high stress at that point in the flight, and while the "WTF?" might be going through their minds, all they could've resorted to is toggling the switches off and on again.
No, lacking other evidence (e.g. CVR recording) it doesn't mean they have been moved. The wiring in between the switches and the engine+FDR could've also developed an intermittent fault.
The fact that your car's engine stops doesn't mean you turned the ignition switch off. Anyone who has had to troubleshoot a car with intermitent electrical faults knows that.
We have other evidence - the crew noticed, and then moved them back to the Run position, and the engines responded as you’d expect.
The switches physically moved, and there is no motor to actuate them without physical intervention.
I don’t understand this part of your post:
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Why wouldn’t this qualify as a murder-suicide, assuming your theory is correct?
I guess I let my emotions get in the way. But nobody seems to be saying that we’ve witnessed one of the worst acts of mass murder in history. Most of the notorious serial killers don’t come close to killing 300 people.
It feels qualitatively different than someone pointing a gun at someone else and then themselves, which is usually what pops to mind when you hear “murder-suicide”.
You’re correct though, it qualifies.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Even taking intent for granted, to deny suicide in a case like this would be to suppose that the person responsible expected to survive while everyone else died. What could possibly support that conclusion?
He appears to have meant something like “this isn’t just common murder-suicide: it is a particularly heinous version of murder-suicide that I wish there were a stronger word for” but phrased it confusingly.
Maybe that one guy who survived did it? Are there fuel cutoff switches near seat 11A?
As someone with no qualifications on this beyond occasionally playing some flight simulators, I can't think of a reason you would ever intentionally move the switches in flight (barring an emergency like a leak or fire or something) and unintentionally doing so seems extremely unlikely since generally "switches meant to be operated on the ground" are located well out of the way of "switches meant to be operated in flight". Though I believe Boeing does have them by the thrust levers, every type of fuel control switch I've seen has some sort of guard or mechanism that makes it effectively impossible to move the switch by simply bumping it.
So I can't imagine how it could have been done accidentally.
> it was one of the most horrific mass murder in history
This implies intent.
> One pilot asked “why did you turn them off?” and the other said “I didn’t.”
To me this reads like an unintentional error with colossol implications.
Are you suggesting there was malicious intent and then a delibrately crafted denial by the perpetrator?
I am, and I’m willing to stake my reputation on it. If I’m wrong, I’ll hang up my hat and never cover live news again.
Pilots are drilled from day one that the fuel switches are sacred. After a few accidents where one engine failed and the pilot accidentally turned off the remaining functional engine, the training was overhauled so that it would be impossible for it to be an easy action done by mistake. One pilot is required to ask the other for confirmation before toggling the switch, I believe. It wouldn’t be something you’d do from muscle memory.
> If I’m wrong, I’ll hang up my hat and never cover live news again.
It easy to say that when you know there's likely no way to prove or disprove whether it as an accident or not. Unless a pilot left a note stating his future intentions, there's no way to determine their state of mind.
Someone took their hand, pulled one spring-loaded switch into the off position, and then did it the other switch moments later. Is there any way that could be accidental?
If there was no mechanical failure, the only remaining possibility is deliberate action. And if it was mechanical failure, we’d see an emergency air worthiness directive being issued, which we haven’t.
People do things bizarre, inexplicable things all the time. It's called a brain fart... the human brain is complicated, sometimes wires just get crossed.
Honestly I think the chances are good that you're right, but the way you're presenting it as absolutely certain strikes me as overconfident, borderline arrogant.
Also, what's with the whole "staking your reputation" thing? What reputation? Are you some kind of famous journalist? Is there some reason we should care about you "covering live news" ? Serious questions -- I personally have no idea who you are.
> I personally have no idea who you are
I also don't recognize this guy's name, but I do find it ironic that his profile is possibly the most well-linked to a other identities I've ever seen on HN: https://news.ycombinator.com/user?id=sillysaurusx
Well, you do now. :)
It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
The victims also deserve to be acknowledged. At this point the overwhelming body of evidence points to a deliberate act. Pilots are trained never to touch the fuel switches in flight, and (I believe) there is a verbal confirmation required before toggling. This captain had over 8,000 hours.
The reason I’m so confident is because I trust the system. It’s designed so that if either of the two pilots do anything, they verbally call it out, e.g. "gear up." A callout like that followed by fuel switch cutoff would indicate it was accidental. But as far as I know, there was no callout.
The pilot flying is also the one who asks for gear up and such. It’s the job do the pilot monitoring to perform those actions.
Suppose it was accidental. That would mean the pilot flying was fiddling with switches instead of flying; that’s against SOP. Or it would mean the pilot monitoring was performing uncommanded actions, which is also against SOP. It’s not something that happens on a whim. Both are contradictions, hence, no accident.
As for being overconfident or arrogant, what matters to me is accuracy, and passing along that accuracy. No one seemed to be willing to publicly call this a malicious action, so I did. If I’m wrong, you can be sure I’ll feel terrible for weeks, post an apology in the thread that shows I was wrong, and then bow out in disgrace, never to cover news again.
People here did the same thing when the common belief was that there was a non-zero chance of nuclear war. I was one of the few voices in that thread saying absolutely not, stop stressing yourself out for no reason.
I’m simply one voice of many. As always, it’s up to the reader to decide what to believe.
> It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
Then why not either wait until there's more information or temper your remarks by acknowledging there's still ambiguity? That would directly hedge against spreading misinformation, whereas staking your reputation on it and then shutting up if you're wrong only works after the misinformation has spread and doesn't seem very productive.
I think the right response to realizing you've spread misinformation (in the event that you turn out to be mistaken [I think it's 60-40 in favor of deliberate]) is to temper your statements and rededicate yourself to checking the facts, not removing yourself from the discussion altogether. And if you were keeping your mouth shut, wouldn't you continue to see discussions you could meaningfully contribute to, and after a while wouldn't you wonder whether anyone was really benefitting from your silence?
I was about to leave a big reply, but then I remembered that the guidelines ask that we only comment when feeling intellectual curiosity. That’s not what I’m feeling now, so I’ll go spend the evening with my daughter. I hope you have a nice evening as well.
Sorry if I touched a nerve, wasn't my intention. My question was genuine and not intended to needle or carp. I hope you have a nice evening as well.
> It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
I understand that you appear earnest. However, your history of multi-accounting on this site makes your promise to never post on a given topic again meaningless to me, because I have no expectation that you wouldn’t continue to post about it on other accounts that we don’t know about at this time, possibly because they haven’t even been created yet.
The report indicates the cut off switches were found, and were in the RUN position. However, the report does not indicate if the locking mechanism was functional; given the thermal damage, it might not be possible to determine.
I'm also interested in the earlier switch defects where the switches were installed with the locking mechanism disengaged on some 737s and inspection was advised for 787, but the incident aircraft was not inspected.
The airworthiness directive for that [1] indicates switches with locking disengaged should be replaced, but I wonder if it's possible to reingage the locking somehow, which could result in a situation where the locking wasn't engaged, the switches changed inadverdently and then when restored the run position the lock was engaged... that's a big reach, of course.
All that said, assuming the switch was working as designed, there's a semantic argument around deliberate and intentional. If the switch requires specific action, it's fair to call it deliberate action; but if the switcher thought they were activating a different switch, it's not murder.
Either way, there's no sense rushing to a conclusion of murder. Assuming one of the pilots activated the switch, they have already died and they are beyond the effects of human judgement; so we may as well wait for further information.
[1] https://ad.easa.europa.eu/blob/NM-18-33.pdf/SIB_NM-18-33_1
The CVR might be pretty illuminating.
The switches require that you pull them out, move them to the end position and then push them back down, and it was two switches. It could have still took off on one engine. This is essentially the turn off plane switch. It would seem to almost impossible that it would be an accident.
Not possible it's an "I bumped it" type of accident, maybe.
It's quite possible it's a "performed the wrong muscle memory at the worst possible moment" type of accident. This is unlikely, but anyone who thinks such a mistake is impossible doesn't know anything about human factors.
Unlikely just means "low probability." There are thousands of flights per day, so it's only a matter of time.
I mean lots of people in prison say they are innocent
These are not facts. These are mostly speculation.
You mention "brain fart". There is certainly a long history of pilots selecting the wrong lever, or wrong switch. So, it is possible the pilot who denied switching the fuel off thought he had switched something else.
My understanding is that after several incidents of pilots shutting off the wrong engine, the training was overhauled so that from day one they treat fuel switches as sacred. I heard that it’s required to ask for confirmation before toggling the switch, just to be absolutely certain. It’s not really something that can be done by muscle memory during flight, and especially not during takeoff.
If he was trying to do something else, he would have called it out. E.g. an audible “gear up.”
Also, it took 10 and 14 seconds to switch them back on. If it was an accidental switch, you would think it would have been quicker to switch them back.
If you look at the photo https://theaircurrent.com/aviation-safety/ai171-investigatio... it would be pretty hard to get them by mistake.
I have a couple of those type of switches, though smaller, in my parts bin. They were from some piece of surplus equipment that got junked. Where I've seen them used is in a crowded control panel where they might just get bumped. The two red plastic levers to the left are another type of safety switch: The lever is spring loaded, and covers the handle of a toggle switch.
In my view it would be quite hard to move them by accident, and probably not possible to move at once.
It would be interesting to know if the plane has any other switches of the same type, that are routinely activated.
There’s no way even the clumsiest person could accidentally pull both out, rotate, and push back in, accidentally within 1 second.
Is there a possibility that they got hacked and remotely toggled ?
Sadly not. It’s a physical switch with no capability of a remote toggle. The flight data recorder clearly shows one was toggled off within a second of the other, which rules out almost every non-intentional scenario.
Happily not. If this were possible, it would open up a whole universe of problems.
Is this a switch that has a dedicated connection to the corresponding cutoff valve? Or does it go through some common digital bus that passes commands? If so, how well is this bus protected?
Another commentator has pointed out that the flight data recorder records two signals - one for the switch itself, and one for the actual valve movement.
I take your point that we should always be suspicious of complicated, digital buses, and this is not the final report, so there’s still plenty of time to uncover weirdness. However, if the flight date reporter shows the switch being thrown, and then a few milliseconds later, shows the valve starting to close, and the same sequence happening shortly there after on the second switch and valve, I feel this would really limit the likelihood of any digital shenanigans.
Ok but you used 'sadly' incorrectly I presume.
What if he mistook the switch for a different switch?
It's an entirely different shape, different location, and different motion from any other switch they could be looking for. Suicide is a way more likely explanation.
And, it's _two_ switches.
Even if the plane had no power, why couldn't they have glided it down safely?
It did glide briefly, the glide path took it directly into a school building.
Right after takeoff at low altitude is basically the worst place for this to happen. Speed and altitude are low so gliding is going to be a short distance and happen quickly.
If there had been a perfect empty long flat grass field in that location it may have been salvageable, but also right after takeoff the plane usually has a heavy fuel load which makes for a much riskier landing.
Edit: This article has a map showing the glide path:
https://www.theguardian.com/world/2025/jun/12/air-india-flig...
They only ever got a few hundred feet off the ground.
Yes of course the plane glided once the engines stopped, producing thrust, just like all planes do. But just like all planes, and all gliders, gliding means trading altitude for velocity - giving up precious height every second in order to maintain flight. At that stage in the flight, they just didn’t have enough to give. If the same thing had happened at 30,000 feet, it would be a non-event. They would glide down a few thousand feet as the engines spool back up and once they return to full power, everything will be back to normal. Or if for some reason, the engines were permanently cooked, you’d have maybe 20 to 30 minutes of glide time so you’ve got a lot of time to look around and find a flat spot. But you just don’t have enough time for all that to happen When you’re a few hundred feet off the ground.
Speed can be traded for altitude, and altitude can be traded for speed. If you have neither, you're dead.
Engine failure shortly after takeoff is a major cause of fatal accidents.
I’ll take this as an honest question. The simple answer: too much mass, no clear landing path, not enough speed or altitude to turn to find one and glide to it. In short, not enough time. Once the engines cut, that thing probably dropped like a brick.
Impossible. Low and slow conditions with insufficient energy to 180 return or crash land safely straight ahead in any form. The power loss happened at the most critical phase of flight. Plus, they were on the heavy side.
how do you "safely" glide into a city?
It's simple - just don't fly Boeing - ever.
You know what? I'm just not going to fly - ever.
Your choice but safer to fly than drive the same journey. Commercial airliners anyway.
Yes I acknowledge this. But I also retain control to the very last moment. I don't have to bank on the driver of my vehicle not being suicidal. If I feel another driver is dangerous, I can just stop. This obviously doesnt prevent all accidents but I've never been in a serious one.
That being said ive flown plenty of times. My fear comes from lacking any control and just finding out mid-flight were going down through no fault of my own. I wouldn't want to know, but then again air France 447 is terrifying too.
You still have to rely on other drivers not being actually suicidal. Just to give one terrifying example scenario: you will pass hundreds, if not thousands of other drivers driving in the opposite direction in the course of a long journey. Any motorist driving in the opposing lane has the ability to engage other drivers in a head-on collision at any time by making a relatively trivial maneuver. Given human reaction times, and the very high closing velocity of such a collision, you ability to avoid this would seem to be non-existent. You certainly couldn't "just stop" to prevent it.
This is all true. It doesn't really apply to my personal driving situation where I can't recall the last time I personally was on a road with a speed limit above 40. I drive less than half the days a week. Thats part of maintaining control for me. I can't set plane schedules. I can drive when there's less drivers and on slow roads.
Also, there are numerous situations you're leaving out where just stopping(or just slowing down) does solve the safety issue. Far more than a suicidal driver choosing me as their target.
The report says the co-pilot was flying so it's most likely the pilot cut the fuel?
Correct. Which means it’s the older of the two.
The report does not identify which pilot said what. Attempting to extrapolate their identities is speculation.
The report specifically says the FO was flying. The conversation is immaterial since the person who cut the fuel could have made either statement.
Report page that matters: https://x.com/exodusorbitals/status/1943782924576309732
Most importantly it's extremely problematic that BBC is pushing the pilot error angle subtly! This is a preliminary report! No news organization should spread opinion pieces based on this. Somehow it feels like Boeing paid BBC to shift the narrative.
We should all wait for the final report. Pilot error or Machine fault, either way it's a huge tragedy.
Where did you see that? You say subtle. What does that mean?
It's a fact that there are no recommendations to manufacturers or airlines yet. If they had found anything seriously suspicious they would already issue recommendations as soon as possible, not just in the final report, not even just at the prelim report, but as fast as possible. Grounding planes, forcing maintenance etc. That has not happened.
It's easy to fall in the other direction and jump on the Boeing hate bandwagon. It's become a trendy thing online.
The report contains significant evidence that one of the pilots switched off the engines.
It doesn’t rule out other options, and it doesn’t explain why they might have done that or if it was inadvertent but it’s still new information, and presenting new important information is what the news is for.
A simple wrong flip of a switch killed 260 people and leaving 1 lone survivor who walked away from the plane crash nearly unscathed.
Dudes is extremely lucky or the character from Unbreakable.
A flip of two switches, in sequence, with a locking mechanism on each switch.
As an amateur UI designer I'm really surprised the plane allows a crash to be initiated without as much as an "Are you sure?" check.
This is a completely computer run plane, and it surely has enough information to know this is a disastrous thing to do.
There's literally hundreds of such settings. When you get into the combinations there's such a multitude of scenarios that you certainly can't have dedicated code for everything.
I suppose you could have it attempt to run a full forward-looking flight simulation to predict but part of the reason for there being so many controls is to deal with situations where the plane isn't acting like it should be, situations which would invalidate the simulation.
UI designers have to make it work for the lowest common denominator. Pilot training weeds out the LCD and trains for any gaps in knowledge.