Air India 787 Crashes in Western India

[Himayeti]

A $300M plane that relies on mechanical safeguards for cutting off fuel to its engines in 2025 is worrisome.

A software-based safeguard is what should also be in place.

Other industries use this routinely.

Aviation: Airbus FBW - Limits unsafe pitch/roll

Medical : Infusion Pumps - Blocks overdose inputs

Automotive: Brake-Throttle Override - Ignores throttle under braking

Industrial: SCADA Valve Interlocks - Prevents overpressure discharge

Weapons: Nuclear Launch Protocols - Requires geographic + multi-auth triggers

Food for thought.

 

[Larry in TN]

The point is that the gear didn't go up even though many seconds passed between lift off and the cut-off, so that means there was something wrong.

The gear handle was found in the [DOWN] position. The gear doesn't come up when it is selected down.

Explain?

The pilot unions have opposed cameras in the cockpit.

if the locking mechanism is functioning properly does that time gap between E1 & E2 sound correct for manually throwing both?

It does.

Sounds a bit slow for accidental switching of both to me.

If they were bumped, and the stops failed, you would expect them to close at nearly the same time.

Interesting about the SAIB for the locking mechanism on those switches that was ignored

The problem was not serious enough to justify an airworthiness directive. If the problem was such that an unintentional bump would shut down the engines, I'm sure it would have been an AD.

 

[Larry in TN]

A software-based safeguard is what should also be in place.

A software-based system creates a large number of additional failure mode. A mechanical system which prevents inadvertent movement of the control is far more reliable.

For example, you don't want a software system which can prevent cutting off fuel in an engine fire because a faulty input is saying the airplane is in a phase of flight where cutoff is not allowed.

A software-based system, even if perfectly designed, can not stop an intentional act. If a pilot wants to crash his airplane, the only way we can prevent him from doing so is by not allowing him to enter the cockpit.

 

[Tools]

The suicide aspect is the least interesting from a safety perspective. First, ultimately they’re easy to troubleshoot after the fact.

But sadly, as a society we simply aren’t in a position to prevent these occurrences right now. Between the little understanding of mental illness, over reach of big pharma, our general litigious nature… it’s just too hard for the small reward. We seem to be doing better than other nations, I think…. Tragically, we need more info and data points. We definitely don’t need a knee jerk reaction.

This accident is still possibly root cause simple mistake and startle response. There’s a lot to learn. And fixable. And on a less consequential scale plainly common.

And there’s mechanical failure. If that’s the case, this is WILDLY interesting. Something really weird and knowing what it was will be huge.

 

[kyleb]

One thing I was wondering (small likelihood that it was the cause) is whether those switches could wear to a point where they don't always fall to "run" or "off". Could they have come to rest on the plateau of the guard mechanism and been bumped to "off" during takeoff? I assume the circuit defaults to "run" unless it sees an "off" signal.

 

[Jim K]

One thing I was wondering (small likelihood that it was the cause) is whether those switches could wear to a point where they don't always fall to "run" or "off". Could they have come to rest on the plateau of the guard mechanism and been bumped to "off" during takeoff? I assume the circuit defaults to "run" unless it sees an "off" signal.

That was along the lines of what I was thinking. OTOH, I'm sure there are even older and more tired Boeings in the Indian fleet.

 

[Kenny Phillips]

A $300M plane that relies on mechanical safeguards for cutting off fuel to its engines in 2025 is worrisome.

A software-based safeguard is what should also be in place.

Other industries use this routinely.

Aviation: Airbus FBW - Limits unsafe pitch/roll

Medical : Infusion Pumps - Blocks overdose inputs

Automotive: Brake-Throttle Override - Ignores throttle under braking

Industrial: SCADA Valve Interlocks - Prevents overpressure discharge

Weapons: Nuclear Launch Protocols - Requires geographic + multi-auth triggers

Food for thought.

Give us a list of all of the inadvertent engine shutdowns due to such switches.

 

[WDD]

How? A camera cannot stop an intentional act of sabotage.

It will give more clarity on how it was done and by whom, to help the investigation and better any remedy needed. Voice recording was instituted not because it was all that was needed, but because it was all the technology at the time would support.

 

[JimLAFB]

Here’s a close up (best I could do) of the switches in question. You can see there’s a significant lip that the switch has to be pulled out to clear. Maybe 1/8-3/16”. And the spring tension is relatively high pulling the switch. I’d say it’s pretty difficult, if not near impossible to activate the switches inadvertently. View attachment 142822

View attachment 142823

The AAIB report shows a different switch as exemplar on page 10, Fig 13. It seems to have a ramp which prevents cutting off without lifting but allows moving to run freely. I can't discern any detent on the left mishap switch in that Fig. Low resolution however. But AAIB know what the configuration is.

 

[Nikhiln25]

One other thing I’m thinking about.. if there was a faulty locking mechanism on both switches that failed, I would assume there would be clear indication they failed to lock and engage when the attempt to restart was made

 

[Ed Haywood]

They'll definitely be looking for those switches in the wreckage.

 

[ArrowFlyer86]

A professional pilot accidentally shutting off the fuel to both engines? Two simultaneous switch failures? Faulty locking mechanisms impacting both switches a second or so apart? At the worst possible time?

IDK, I feel like Occams Razor tells us it's intentional suicide, planned to be executed at the most delicate and unforgiving phase of flight. It's unfortunate, but I doubt there's another reasonable explanation. Time will tell.

 

[bonefishpete]

A professional pilot accidentally shutting off the fuel to both engines? Two simultaneous switch failures? Faulty locking mechanisms impacting both switches a second or so apart? At the worst possible time?

IDK, I feel like Occams Razor tells us it's intentional suicide, planned to be executed at the most delicate and unforgiving phase of flight. It's unfortunate, but I doubt there's another reasonable explanation. Time will tell.

It’s funny that so many here still thinking it’s an accident. I hope it is but facts so far rule it out.

 

[TCABM]

….IDK, I feel like Occams Razor tells us it's ….

Pilot error is the simplest explanation; it’s still relatively rare for a pro pilot to get to the suicidal stage and still hold a medical, much less be in the cockpit.

I’d hazard there’s also less than a dozen documented (worldwide)instances of flight crew killing themselves in an airliner full of pax. Pilot error happens much more regularly.

We could assume there’s more, but we’re getting out of Occam’s theory when you start doing that.

It’s easier for us to accept an intention act than a massive f-up, though.

 

[popPilot]

The gear handle was found in the [DOWN] position. The gear doesn't come up when it is selected down.

You missed the point. The point is why it wasn't retracted if everything was fine before the cutoff.
I'm rewatching the video and I'm starting to notice this thing started just before rotate(I see slowdown and also the dust from the left side upon takeoff), there's something else here guys.
That and the so called TCMA system with the 2019 787 ANA Japan incident.... Just the one path that makes more sense to me with the current available data.

 

[ArrowFlyer86]

Pilot error is the simplest explanation; it’s still relatively rare for a pro pilot to get to the suicidal stage and still hold a medical, much less be in the cockpit.

I’d hazard there’s also less than a dozen documented (worldwide)instances of flight crew killing themselves in an airliner full of pax. Pilot error happens much more regularly.

We could assume there’s more, but we’re getting out of Occam’s theory when you start doing that.

It’s easier for us to accept an intention act than a massive f-up, though.

The thing to me is that it's not just a massive f-up. It's a massive f-up at literally the worst, most unrecoverable time for there to be an F-up.
I don't think you could engineer a better time to guarantee disaster than killing the fuel on a loaded jet 3 seconds after takeoff. To me that's just too coincidental to even think of it as an accident.

And it sounds like these aren't simple switches you can accidentally fat-finger -- you have to commit to the action. And do both of them. I have a hard time believing someone qualified to be in the cockpit of a 787 would do that by accident.
But stranger things have happened...

 

[Matthew]

What was the experience level of the FO? How many hours in that airplane?

Could he have just transitioned from an aircraft that had some other controls in that area and by habit he pulled both levers thinking he was doing something else? That might explain the confusion and “I didn’t!” response.

 

[Rick A]

Pilot error is the simplest explanation; it’s still relatively rare for a pro pilot to get to the suicidal stage and still hold a medical, much less be in the cockpit.

I’d hazard there’s also less than a dozen documented (worldwide)instances of flight crew killing themselves in an airliner full of pax.

Yes, mass killing by a suicidal pilot are rare, but it seems to happen more with international airline pilots than American. Not sure about the availability of drugs (legal or illegal) in India for someone who decides to self medicate, but I doubt too many nations (especially 2nd & 3rd world) have as rigorous a process of obtaining drugs covertly (i.e., psychotropics) compared with the USA. And as stringent and honest as an American 1st Class Medical licensing process.

 

[Lindberg]

The thing to me is that it's not just a massive f-up. It's a massive f-up at literally the worst, most unrecoverable time for there to be an F-up.
I don't think you could engineer a better time to guarantee disaster than killing the fuel on a loaded jet 3 seconds after takeoff. To me that's just too coincidental to even think of it as an accident.

This is a very good example of survivorship bias. The f*** ups that happen when they don't matter, you don't hear about.

 

[Den60]

Give us a list of all of the inadvertent engine shutdowns due to such switches.

I've read that the switches in that 787 and other AI 787s may not have had the "pull to lift" buttons and that the FAA sent out an advisory to operators that this may affect some aircraft. But, it was not mandatory. You have a rather inexperienced FO. Could he have inadvertently hit the switches when doing something else. It says that both switches went to cutoff within one second. Seems the "pull to lift" buttons would take longer to do that even if deliberate.

 

[nauga]

They'll definitely be looking for those switches in the wreckage.

They've found them. From the prelim:

"The thrust lever quadrant sustained significant thermal damage. Both thrust levers were found near the aft (idle) position. However, the EAFR data revealed that the thrust levers remained forward (takeoff thrust) until the impact. Both fuel control switch were found in the “RUN”position. (fig.13) The reverser levers were bent but were in the “stowed” position. The wiring from the TO/GA switches and autothrottle disconnect switches were visible, but heavily damaged."

It will be interesting to see what the investigation turns up WRT the locking mechanisms.

What was the experience level of the FO? How many hours in that airplane?

Also from the prelim: 3403 total, 1128 in type.

Nauga,
in the library

 

[geezer]

Reading provides so much information that others lack.

 

[Larry in TN]

it’s still relatively rare for a pro pilot to get to the suicidal stage and still hold a medical, much less be in the cockpit.

Not rare enough.

Germanwings 9525, 2015, French Alps, Co-pilot suicide/murder-suicide
LAM Mozambique 470, 2013, Namibia, Pilot suicide
EgyptAir 990, 1999, Atlantic Ocean, Co-pilot deliberate control (disputed by Egypt)
SilkAir 185, 1997, Indonesia, Pilot suicide (officially undetermined in Indonesia)
Royal Air Maroc 630, 1994, Morocco, Pilot suicide
Japan Airlines 350, 1982, Japan, Pilot deliberate action (mental illness)

Then there's MH370 where pilot suicide is strongly suspected.

 

[3393RP]

A $300M plane that relies on mechanical safeguards for cutting off fuel to its engines in 2025 is worrisome.

A software-based safeguard is what should also be in place.

Other industries use this routinely.

Aviation: Airbus FBW - Limits unsafe pitch/roll

Medical : Infusion Pumps - Blocks overdose inputs

Automotive: Brake-Throttle Override - Ignores throttle under braking

Industrial: SCADA Valve Interlocks - Prevents overpressure discharge

Weapons: Nuclear Launch Protocols - Requires geographic + multi-auth triggers

Food for thought.

Earlier in the thread you were militating about software and the risks it represented in critical processes. Now it's the solution.

The fact remains there are functions in complex systems that are controlled by humans. Improper operation by humans in these systems, whether unintentional or nefarious, can result in a large loss of life.

That cannot be completely excised by adding layers of oversight by computers. It's impossible. In this particular instance, fuel cutoff devices in turbine powered airliners have been in use for over half a century, and operated as intended over a billion times.

Is the added cost and complexity contemplated by your advocacy the solution for preventing a repetition of this event? I doubt it. What about the myriad of other possibilities available in a cockpit for performance of a similar act?

 

[KE5BM]

Alaska Airlines in 2023 - Jumpseat pilot under the influence attempts to close fuel valves in flight

 

[KE5BM]

Earlier in the thread you were militating about software and the risks it represented in critical processes. Now it's the solution.

The fact remains there are functions in complex systems that are controlled by humans. Improper operation by humans in these systems, whether intentional or nefarious, can result in a large loss of life.

That cannot be completely excised by adding layers of oversight by computers. It's impossible. In this particular instance, fuel cutoff switches in turbine powered airliners have been in use for over half a century, and operated as intended over a billion times.

Is the added cost and complexity contemplated by your advocacy the solution for preventing a repetition of this event? I doubt it. What about the myriad of other possibilities available in a cockpit for performance of a similar act?

I'll take mechanical fail-safes over software ones every day of the week and twice on Sundays.

 

[Bob Noel]

I'll take mechanical fail-safes over software ones every day of the week and twice on Sundays.

quoted for emphasis

 

[TCABM]

Not rare enough...

While I agree, pilot error occurs orders of magnitudes more often at every level, without needing all the stars to align.

 

[AKiss20]

It’s funny that so many here still thinking it’s an accident. I hope it is but facts so far rule it out.

So far being the imperative word. Let’s let investigations continue and evidence to be examined before reaching conclusions.

For those who would say that speculation costs nothing, I remind you of the Reddit “we did it” and Boston bomber fiasco. Maybe this is a horrific pilot suicide, but if that becomes the narrative and some information later comes out disproving it, imagine the impact on the FO’s family. Imagine the entire world thinking your loved one murdered 200 people only for their name to be cleared in the court of evidence but not in the court of public opinion. I’m not saying this will or will not happen, only that jumping to conclusions can have a cost.

 

[3393RP]

What might have been the outcome if operation of fuel shut off valves had been inhibited on Pan Am 843? Passenger movie footage showed there was a vigorous fire burning on an already damaged wing when the pilots interrupted the fuel flow.

Pan Am Flight 843 - Wikipedia

en.m.wikipedia.org

 

[billsgs126]

So far being the imperative word. Let’s let investigations continue and evidence to be examined before reaching conclusions.

For those who would say that speculation costs nothing, I remind you of the Reddit “we did it” and Boston bomber fiasco. Maybe this is a horrific pilot suicide, but if that becomes the narrative and some information later comes out disproving it, imagine the impact on the FO’s family. Imagine the entire world thinking your loved one murdered 200 people only for their name to be cleared in the court of evidence but not in the court of public opinion. I’m not saying this will or will not happen, only that jumping to conclusions can have a cost.

Richard Jewell - Wikipedia

en.wikipedia.org

 

[sarangan]

It’s interesting how this discussion has shifted from “there’s too much automation in the cockpit” (assuming the engines failed due to a software glitch) to “we need even more automation” (to prevent pilots from making mistakes).

 

[Rick A]

Alaska Airlines in 2023 - Jumpseat pilot under the influence attempts to close fuel valves in flight

FedEx - Deranged jumpseat pilot attacks the pilots with an ax. Injured pilots subdue the attacker and land the aircraft.

 

[Warlock]

Pilot error is the simplest explanation; it’s still relatively rare for a pro pilot to get to the suicidal stage and still hold a medical, much less be in the cockpit.

Rare but happens…lost my Arrow to an FAA Employee who was an ATP and had a recent physical…basically murder/ suicide and of course Kidnapping/Alcohol, stolen funds and warrants out for his arrest…still dealing with the aftermath myself.

 

[flyingron]

The problem was not serious enough to justify an airworthiness directive. If the problem was such that an unintentional bump would shut down the engines, I'm sure it would have been an AD.

While I can't vouch for India, it the us a MANDATORY bulletin is obligatory on the air carriers (as opposed to us small fry where it is just a recommendation).

 

[geezer]

As I posted earlier, that whole panel was replaced about a year ago on this 787. The replacement parts must be the better parts.

 

[Albany Tom]

Yeah, this is not looking good guys, this might be another MAX type flaw, but this time with the fuel control. There's a interesting point brought up by few indian pilots on this video at 14:00.
The point is that the gear didn't go up even though many seconds passed between lift off and the cut-off, so that means there was something wrong.


btw, what happened with that 787 engine shutdown incident years agon in Japan?

What? I'm trying to figure out what any of that has to do with anything I wrote, what the Max problems could possibly have to do with this accident, what the landing gear has to do with the fuel switches, and what a pilot's nationality has to do with absolutely anything at all.

 

[Daleandee]

As I posted earlier, that whole panel was replaced about a year ago on this 787. The replacement parts must be the better parts.

Not sure how they do things on that side of the planet but quality of parts might come into play here ... do they have a Radio Shack over that way?

 

[35 AoA]

FedEx - Deranged jumpseat pilot attacks the pilots with an ax. Injured pilots subdue the attacker and land the aircraft.

Thought it was a hammer, but well could have been an axe. Guy failed out of Navy flight training in Meridian, and then somehow made his way back to the majors on the civilian side. Well before my time, but I'd guess he had mental illness or at least personality problems dating back to him washing out of the Navy program.

 

[flyingcheesehead]

And either pilot could be the culprit since either the first pilot (probably the captain who was probably not PIC)

Um... What? The Captain is, by definition, PIC. FO is SIC.

Did you mean PF?

did it and yet asked the other pilot why knowing this is recorded on the CVR in order to deflect blame (my first guess) or the first pilot actually observed the second pilot performing these actions and asked why. In either scenario the CVR tells us that there was a pilot action and not an unintended avionics action.

It's definitely going to be difficult to conclusively determine which pilot moved the switches.

Yeah, this is not looking good guys, this might be another MAX type flaw, but this time with the fuel control. There's a interesting point brought up by few indian pilots on this video at 14:00.
The point is that the gear didn't go up even though many seconds passed between lift off and the cut-off, so that means there was something wrong.

Um... I thought it was only 3-4 seconds from weight off wheels to the switches going? It's perfectly normal for the gear to stay down that long.

A $300M plane that relies on mechanical safeguards for cutting off fuel to its engines in 2025 is worrisome.

A software-based safeguard is what should also be in place.

A software-based system creates a large number of additional failure mode. A mechanical system which prevents inadvertent movement of the control is far more reliable.

For example, you don't want a software system which can prevent cutting off fuel in an engine fire because a faulty input is saying the airplane is in a phase of flight where cutoff is not allowed.

A software-based system, even if perfectly designed, can not stop an intentional act. If a pilot wants to crash his airplane, the only way we can prevent him from doing so is by not allowing him to enter the cockpit.

I would disagree. A combination of mechanical, electrical, and software (not necessarily all 3) can largely guard against this sort of accident.

This isn't *that* difficult: If one switch is moved from RUN to CUTOFF, then fuel gets cut off. This still lets the pilots deal with an emergency fire situation just as they do now. If anything, maybe it could verify thrust on the remaining engine so that in an engine failure scenario, the pilots don't cut off the wrong engine.

If the second switch gets moved from RUN to CUTOFF, it would have to meet a few additional requirements before just cutting the engine off, such as an engine fire indication, a minimum altitude, etc.

This sort of a setup would not prevent the first engine from being intentionally cut off, but it would prevent the second one from being intentionally cut off at an unrecoverable altitude.

What might have been the outcome if operation of fuel shut off valves had been inhibited on Pan Am 843? Passenger movie footage showed there was a vigorous fire burning on an already damaged wing when the pilots interrupted the fuel flow.

There was only one engine at issue there... And I think that any additional safety systems should defer to the pilots when it comes to shutting off fuel to the first engine. The computers don't need to start thinking about it until the pilots try to shut off two engines, or all engines with thrust.