News today that fuel was cut to both engines on the Air India Boeing 787 that crashed, killing 260 people in Amedabad, has triggered a round of public discussion and a whole lot of speculation about pilot intentionality, about which, more later.
In a preliminary report, the Air Accident Investigation Bureau of India confirms that the two switches located below the throttles “transitioned” sequentially from RUN to CUTOFF about 8 seconds after takeoff.
The report itself remains mum on how this happened. Fueling the speculation, though, is the next tidbit of information. The report paraphrases the conversation on the cockpit voice recording in which one pilot asks the other why he cut off the engines and the other pilot responds that he did not.
Before buttoning up the case, however, it is worth noting that much remains unknown, including whether there is any other mechanism by which the switches could move separate from pilot action. One clue emerges later in the report.
The accident airplane, VT-ANB, was subject to a voluntary inspection of the fuel control switch at the end of 2018, because Boeing had determined a number of fuel control switches, including the one on this airplane, “were installed with the locking feature disengaged.” Air India did not do the inspection because it was voluntary. It adds that the throttle control module was replaced in 2019 and again in 2023. Investigators do not circle back to confirm the status of the fuel control switch at the time of the accident, writing only that no defect has been reported.
But outside of the investigation, this skimmed-over report of trouble in a component at the heart of the mystery has triggered pushback from two quarters.
The Air Line Pilots’ Association of India released a statement Saturday morning chastizing both the official investigators and those reporting on the accident for the tone of the report, which “suggests a bias toward pilot error.”
Air India’s aviation community is busy discussing the possible ways the engine’s thrust control malfunction accommodation could have triggered engine shutdown outside of pilot action. I have seen the documents provided to those attending a 787 training lab on both the plane and the GE engines, which do suggest this is an avenue worth investigating.
Obviously, detecting a malfunction on what otherwise appeared to be a normal takeoff should not have happened. But these kinds of conversations among aviation professionals and armchair investigators remind people that aviation accidents are complicated. Jumping to conclude that Air India was the result of pilot error or pilot sabotage is unhelpful, and by the way, extremely unlikely.
During its investigation into the 2015 crash by pilot suicide of a GermanWings flight in France, the air accident bureau reported six similar events in which commercial pilots deliberately crashed planes with passengers aboard. Japan Airlines in 1982, Royal Air Maroc in 1994, SilkAir in 1997, EgyptAir and Air Botswana both in 1999, and LAM Airlines Flight 470 in 2013. These were all believed to be purposefully initiated by one of the pilots. With more than 800 billion flights since 1980, you can see just how unlikely is an intentional act by the pilot.
Acute confusion is another matter. It happens. Even to experience pilots. Both men on Flight 171 had significant hours in the 787. The captain had 85 hundred and the first officer 11 hundred. That said, the less experienced pilot was the pilot flying and therefore handling the throttles while the captain was the pilot monitoring. In reporting the exchange above about engine power, the preliminary report does not identify who is asking whom about the shutoff.
What is clear from Indian investigators is that the events on Flight 171 unfolded with dizzying speed.
Four seconds after achieving takeoff speed, the airplane is airborne. About 3 seconds later, the fuel cutoff switches are activated in sequence and the ram air turbine deploys. The flight is just 8 seconds old. Thirteen seconds from takeoff, engine one is powered on. Seventeen seconds – an attempt to restart engine two is made. Six seconds pass and the pilot declares Mayday. Five seconds later the plane crashes.
From takeoff to tragedy takes 32 seconds. Now there is time. Time enough to withhold judgment and investigate all the possibilities.
Good article. I learned a few things that I had not read elsewhere.
Interesting point about the potential for the cutoff switches not having the locking mechanisms installed. If that turned out to be the case it’s certainly possible that some non standard hand movement, for example the non flying pilot setting his hand behind the flap handle in anticipation of flap retraction could have inadvertently bumped them off?……
If enough inconclusive and conjured up speculation i.e. “someone, who, not me, turned off the fuel control switches” is spread about this accident, this will veer public opinion away from the original opinions. This is known as the “al dente” approach to accident investigation – throw enough stuff up against the wall and see if it sticks! Thenenough people will believe the direction this is going and eventually conclude that this was pilot error, alleviating the big corporation in question of any, or limited accountability.
Back in the old days, the fuel control valves were manually operated by the pilot. Next came electrical controls. Typically, the low pressure valves at the individual fuel tanks were operated electrically before starting engines and left on throughout the flight. The high pressure valve at the engine itself was operated manually and operated by the pilot.
These days we have Full Authority Digital Engine Controls (FADEC) and Thrust Control Malfunction Accommodation (TCMA). It is all computer controlled. The TCMA controls the FADEC and can override the pilot’s controls. It can even shut down the engine without the pilot knowing about it.
The 787 is fitted with TCMA and FADEC. The evidence in the Preliminary Report points to a malfunction in the TCMA / FADEC system whereby it shut down both engines just after take off. It was done even though the pilots’ fuel control switches were in the RUN position.
It is clear that automation has gone too far. We must not take the pilot “out of the loop.” The entire design philosophy requires a rethink.
Apparently these switches can’t possibly be moved inadvertently: each is spring-loaded into the RUN detent. To move to CUTOFF the switch must be grasped between finger & thumb, pulled out (against the spring) then, while pulling, moved to the other position, then released.
If one pilot asked the other the question indicated, presumably the asker was the pilot flying who had *seen* the other guy move the switches. Otherwise the question would be more like “What the hell is going on?”
As for the numerous examples of pilot suicide, there’s also MH370, probably the deadliest.
Apparently there are grounds for legitimate doubt about whether SilkAir was intentional.