It is perhaps a sign of the times that while I do have direct experience with the type of switches that have become the center of investigation in the Air India Flight 171 crash, I have never actually touched one. I have moved them back and forth and successfully achieved the outcome that action is supposed to achieve and they’re one of those examples of simple engineering technology that just works.
In fact, those switches work so well that Honeywell pumps them out by the thousands for use in dozens of different aircraft types for the kinds of on/off duties that demand a high level of certainty when choosing that action. While they look like a regular toggle switch, they require the operator to lift the toggle against a moderately powerful spring to reach a detent that allows the toggle to be moved laterally to close or open the requisite contact.
The switch I moved was on the overhead panel of Bombardier Global 7500 and was part of the engine start procedure. I did this on the third floor of the Las Vegas Convention Center in a room that contained little more than the straight-back chair that I sat on in the middle of a meeting room. The only other objects in the room were a weird looking set of goggles connected to a laptop that generated a breathtaking 3-D environment of the Global’s flight deck. It faithfully replicated every switch, knob, handle and lever and its appropriate action as part of flight simulator manufacturer CAE’s virtual reality training device.
To move that switch I pinched the virtual image of the toggle between my pork chop fingers, pulled up and snapped it down into the new position in an action that seemed astonishingly normal. Of course the switches we’re talking about today are of the steel and plastic variety and they nestle under the thrust levers of a Boeing 787. I haven’t checked but I’d guess that even though they’re airliner parts they probably cost less than $100. Harbor Freight probably sells a knock-off pack of 10 for $8.99.
But now those switches are central to the loss of 260 lives, a $250 million airplane and an apartment block in Ahmedabad, India, and for wont of a slightly more advanced but equally numerous technology on that flight deck, we may never really, absolutely and for sure know what role, if any, they played in cutting off the fuel supply to those massive GE turbofans on the wings.
It is time to put video cameras that capture all pilot manipulations on the flight decks of all Part 121 airliners. That can be followed in stages by similarly equipping all other commercial passenger-carrying aircraft.
And the fact that such a common-sense action will be fought tooth and nail by just about everyone who owns, flies and fixes those aircraft is a source of constant amazement to me. It can’t just be cheapness. What is the underlying resistance to new ways of providing evidence that can answer fundamental questions about pilot actions? Are we really so afraid to take responsibility for those actions that we insist on having a way to get away with them?
Because there is no other explanation. Unions talk about privacy concerns. Since when was the flight deck, with its multitude of recorders, sensors and microphones ever considered private space? Airlines will moan about the cost, but if I can afford a decent action camera setup to capture my many foibles in lurching around in the 140, United, Delta and American can spring a few bucks for something similar.
If there ever was a case for a flight deck video suite, it’s the Air India crash. In seconds we would be able to determine who pulled the switches, if, indeed, someone did. All the Dreamliner and 777 pilots I’ve talked with were initially dead sure that human hands moved those switches, but even they acknowledge there might be some doubt about that now.
As with everything else it seems, those switches feed wires that end up at a computer, which has the final decision on whether the simple opening or closing of a circuit can proceed. That little box, strapped unceremoniously to the main fan housing of the massive engine, controls all things to do with the fuel, including its sudden absence, a handy feature if it’s on fire but a disaster a few seconds after the mains have air under them. A solder joint on that control unit is prone to cracking and airlines were advised to replace them in 2021.
This plane was said to be up to date on all those sorts of maintenance advisories, so I assume it was done. But the working theory heading around the airline blogs and forums is that it’s possible that a cracked solder joint interrupted the current from the switches under the Gs of rotation to stop the fuel flow long enough to shut down both engines. As far-fetched as it seems, it introduces enough doubt to lay waste to all the other depressing scenarios being bandied about and the arguments that flow from there. It raises a host of other questions and it places the cause of one of the worst airline crashes in history in the “probable” category rather than the certainty that would lead to much better prevention strategies.
Fifteen seconds of 4K video would remove all of that doubt and lay the foundations for the work needed to address the root cause of the fuel cutoff, whatever that might be. And the lack of that conclusive evidence will be a nagging itch that will never be satisfyingly scratched.
And for those who say we’ve built the safest mode of transportation ever conceived without videoing every pilot’s every move I say we can do better by taking that step.
Last year a Cessna 206 survey plane crashed in the Australian Outback and there were no witnesses. Hell, there was nothing but snakes and kangaroos as far as the eye could see. It took rescuers five hours to get to the scene, but the ever pragmatic Aussies said in the report a faster response wouldn’t have made any difference to the outcome. The pilot survived the crash and pulled himself out of the wreck but died a short time later.
The 206 had a SpiderTracks route tracker but no sensors or recorders of any other kind. The investigators inspected the wreck, made their measurements and filed a two-page report that said they had no idea what actually happened but it was probably an aerodynamic stall while the pilot maneuvered to line up for a grid.
By contrast, the Air India 171 investigation will cover hundreds of pages and include the most granular technical details about every aspect of those few seconds of flight using the most up-to-date technology ever conceived for this kind of work. But in the end, we won’t know any more about the cause than we do about the loss of that survey pilot in his 206 in the middle of the desert.
Having a video camera in the cockpit would not help in a case like this since if it was suicide by pilot the perpetrator would pull the circuit breaker for the video system.
Almost willing to bet, Boeing with its current PR issues, would love to see cameras, if simply for the convenience of screaming pilot error/ suicide. And any and all monitoring would be fought tooth to nail by those on the other side.
The question as to why the fuel cutoff was even possible without further acknowledgement in the most critical phase of the flight, is puzzling.
From previous comments I gather, that there appears to be no scenario during which the airplane could shut these two switches off by itself (reboot, electronic error/ fault, parameter mismatch). Additionally, a fuel cut off switch can be disabled unless the power lever is on idle or the aircraft is at altitude with sufficient speed.
There is a FADEC operational that basically watches countless parameters and when the pilots request a certain power, FADEC decides by itself whats reasonable, safe, economic and what is not. One may hope, that both fuel cut off switches being moved to off, at close to max power in T/O config, is considered bit unreasonable?
Every PC/ Laptop/ Tablet confirms a users actions by asking the user to acknowledge a shutdown. Even a forced shutdown requires prolonged pushing of the powerbutton. This way, the act of killing the system is deliberate and on purpose. Nobody will be able to claim this happened “by accident”.
The preliminary accident report smells on the possibility of switches missing the pull up and out of detent feature. There was a SAIB which Air India chose to ignore, yet the panel was replaced twice for unknown reasons.
My question centers on the various other failsafe systems actively preventing catastrophic outcomes, IOW, the computers checking for plausibility prior to executing input. Why not put a additional guard up against deliberate or accidental fuel cut-off?
Of course, its not fair to expect suicidal nutcases occupying the pointy end of a mass transportation device, but maybe times are changing and there is a need for more automation, not less…
So, you can’t imagine a scenario where the pilot does not have access to that breaker? How many pilots have “pulled the circuit breaker” on the CVR or FDR?
Given the poor stewardship of CVR recordings or various local FOI regulations I‘d certainly hate the thought of a clip showing me being squashed circulating on social media.
As for reasonable, the Embraer E-Jets won’t react to the engine shut-off switch if the thrust lever isn‘t in idle.
I‘d assume further investigations to reveal whether one pilot might have had a motive / medical condition that could explain a suicidal action. Even with a video there‘d be no way to tell us why he moved those switches.
Agree with the cameras, it’s just a matter of time. There will be an acceptable solution, I’m sure. The next generation of pilots will accept it as part of the job. Our neighborhood bus has them. Trains have them. Monitored flight is here to stay. Pilots whined at FOQA, now it’s common and accepted. Oh and BTW, OK to use your own Go-Pro, apparently.
On another subject, there is not one single switch in such a cockpit that “costs less than $100”. Several thousands, most likely. I’m used to corporate jet part prices and they are mind blowing, with every order.
It’s always tempting to make fiscal decisions when it’s other people’s money–politicians are especially good at that. I would agree with the sentiment expressed here if we were talking about the cost of your average GoPro camera or something similar. That’s not what we’re talking about here. Whatever system you install would have to be hardened to survive a crash, and since it would be installed on a certified aircraft it would have to be certified by the FAA. For a preview of THAT process just talk to any of the plethora of companies reported on here at AvWeb.com trying to get FAA-certification for the products they’d like to sell.
Even after getting one certified (who would pay for that?) airlines would still have to pay for the devices, aircraft modifications, installation, and testing. I found an inexpensive CVR after a brief Google search that sells for $5K. Figure double that for aircraft mods and installation, and we’re up to $15K per. With a fleet of over 1000 aircraft, that’s $15 million to equip United Airlines’ fleet, and that’s not even counting device development and certification costs.
If the forces experienced at rotation are enough to knock these switches into the off position, one would expect a mx history showing the same (bumpy taxiway etc). Hopefully digging into Air India’s records on this aircraft will show something of this nature versus the darker picture I’ve imagined.
If a pilot is committing suicide why would he even care about being filmed? Sure, let’s put video cameras in the cockpit but the ultimate solution will be totally automated airplanes. Modern airliners are so reliable and the accident rate so low, that most of what is left is pilot-related. I will grieve the day as much as anyone but there is no denying that automated aircraft will ultimately be safer that those flown by human pilots.
Snooze cam - just like ADSB that was supposed to be only used for safety, one can imagine all sorts of mission creep for such a “snooze cam”. Maybe even add a passenger channel so the passengers can have a cockpit view from the back rows.
We can beat around the bush on mental health, automation or the lack of automation.
A fact remains, that todays airliners are marvelous machines stuffed with thinking, sensing and ultimately deciding electronics. When the plane senses a stall, it pushes the nose down. When FADEC thinks 91% power is enough, 91% power is what you get.
Heck, SAFE technology enables most beginners in the RC world to keep and play with their toys a second time. The plane will do what it can to rescue itself. Most of them will RTH and many will even land by themselves.
But we keep telling the public, that disallowing a fuel cutoff to both engines during the beginning phase of a departure is OUTRAGEOUS in a flying computer screen with wings, carrying hundreds of people.
We have had 100+ years to figure out that we just can not idiot-proof everything, because the answer will just be a bigger idiot.
In the end, even if there was a deliberate act to kill those engines, the plane should and could have rejected it, due to its configuration.
As to the investigation, the CVR audio when properly analyzed will reveal if the switches were moved, they make a small but distinct click. The NTSB audio people are very good at analyzing minute details of CVR audio.
As to idiot proofing airplanes, I am reminded when the Piper Arrow came out and Flying magazine crowed it would take a “special idiot” to land an Arrow gear up. It only took three weeks for that special idiot to be found.
We really do not “need to know” everything.
If the switches were off then the plane goes down.
Beyond that reality, all the rest will always be speculation.
As a retired airline pilot I am 100% TOTALLY AIN’T NO WAY I WANT A CAMERA! As someone said “I would find the CB (they would wire it another way) and pull it”. It is only wanted by those who don’t truly understand the operations involved. I am old enough to remember the hubbub over Voice Recorders…“Oh but Captain, we totally can ensure you that the recordings will NEVER ever be made public…how long did that last?” I do not want my family’s last contact with me being a voice recording of the crash or a video of my plane/body being ripped to shreds…don’t tell me it won’t be made public. YOU put a camera in your car, office, house, bathroom, bedroom … you name it…Privacy is gone. Was this one suicide? Don’t know and there is nothing anyone can do in that situation to stop it. The Egypt Air dive into the ocean, the German Wings dive into the mountains…nothing can be done to stop those. This suggestion is being made by people that are totally in the dark as to human nature. PS. That is why I do not allow videoing in my cockpit now.
I’m just trying to figure out what a “Part 21 airliner” is. And a few other things in there as well.
Or maybe Russ needs to sit back and think a while after he’s written something before he hits “SEND”.
From Russ:
Yep, I do need to do that and thought I had. What else, Ron. Need to fix them.
With the reading and comprehension issues these days, a Part 21 airline is basically a Part 121 airline without the 1.
Maybe one switch could fail. But not both within .1 second of each other. The DFDR confirms that both switches were selected off. The CVR will clarify who asked the question “Why…” And we go from there. Cameras in the cockpit? Sure, why not a YouTube live event for every flight? I’ll admit cameras would make a nice place to hang my hat.
Cockpit cameras can improve discipline when used for safety. But a camera is not enough. I support cockpit video, an aural warning, and a panel-mounted fuel cutoff RUN–CUTOFF annunciator. Retrofit the fleet, they should have been standard instrumentation from day one.
@jjbaker. Well said, Jason. You clearly explained what many missed. There’s no reason a modern FADEC-managed system should accept both fuel cutoff switches moving to OFF during high-power takeoff. Your point about the lack of detents or confirmation logic was spot on. If the aircraft questioned inputs the way you do, it might have stopped an inappropriate switch position—and the loss of 260 souls. For want of a nail…
TWO things definitively contradict the premises made in that preposterous “what if” article: 1) One of the two pilots VISUALLY confirmed the movement to the switches and asked the other why he moved them. 2) The two switches after being SEQUENTIALLY turned to cutoff from the run position were then also SEQUENTIALLY returned from the cutoff to the run position; multiple mechanical joints acting in timed sequence…just TWICE and ONLY TWICE for a total of FOUR sequential actions? You’d really have to be an idiot to NOT KNOW… Also, the rotation G premise is nullified by the change in switch position being sensed 4 seconds after rotation. So, WE know what happened, for all but less than 1% who are just fantasizers, that a pilot moved those switches. For me it was likely the one who was next stuck with taking care of a shutin for the rest of his life, but either way.
The fact that most remaining accidents are pilot related does not mean that eliminating pilots would reduce accidents. Pilots are an integral part of preventing accidents, they aren’t sacks of potatoes along for the ride.
You might as well say “left engines are responsible for half of all engine related malfunctions. Let’s get rid of all the left engines.”
Jerry, if memory serves, the crazy jumpseater on the FedEx plane pulled a breaker before he wielded the axe that he thought would have killed both pilots. That would, logically, have been the voice recorder breaker.
Speaking for myself, I could care less if there was a video camera in the cockpit, and for the entire aircraft. American Airlines has a thousand planes and equipping those would be very expensive. But for what benefit? The report today about the Air India crash states that the fuel valves were turned off after rotation then turned back on so a vudeo would not have helped here.
At which point the suicidal pilot would just hit the fire bottles, same effect.
Mandating CCTV camera’s and recorders in cockpits of aircraft that are already mandated to be equipped with CVR and FDR will require an act of congress. No FAA administrator know to man will ever hold this hot potato.
Even issuing a proposal for rule making (NPRM) which can be used as a trial balloon as it gathers stakeholder feedback, will require an act of God.
Pilot groups historically have vehemently opposed video recordings in the flight deck claiming they pose an opportunity for misuse including prosecution (we don’t trust you).
Chances are the NTSB recommendation to equip aircraft in 2000 will remain open for another 25 years. (I hope not).
Systems where CB’s are pulled should immediately alert on the EICAS (Engine Indicating and Crew Alerting System) in modern aircraft.
Current Embraer makes require the THROTTLE be idle before a cutoff switch can throw its signal.
Camera would not prevent this.
That logic of throttles, held forward could.
Will you now petition Boeing and Airbus to make that massive change?
I might argue that even WITH video there is a reasonable chance that we’d never know. I’ve been in airplanes deliberately equipped for video for the purpose of capturing data for certification (and later potentially product advertising) and it takes a lot of cameras to get a decent “picture” of everything that’s going on in the flight deck. To get the full detailed view of every control within reach or sight of a crew of two takes something close to ten cameras, unless we have them wear body cameras like police officers. Even then, it gets real hard to see if a pilot merely touched a button or actually pressed that button. On top of that, the storage space, even in the modern age, for ten cameras for 25 hours will be significant. Significantly more that the storage capacity of today’s crash survivable memory modules.
Captain Kirk is correct about mistrust of video in the cockpit. The Lexington Ky accident showed how during a civil lawsuit, a judge can order access to existing voice and data recordings from NTSB. ADS-B shows how the FAA is not limiting data for safety use only. Any video camera in the cockpit would just become another coat hangar. Congress would have to mandate no access to Judges in civil or criminal lawsuits and immunity to actions any video camera would record. Makes me glad that I am getting close to retirement from pt135 flying.
I’d like to wait for the full CVR transcript presented in the context of the full report. Preliminary reports by their nature paraphrase. One example of ill-definition at this phase, what language was the intracockpit talk?
…which, if the video coverage is sufficient, you’d see happen.
Maybe not, but the most interesting observation would be if no one touched them…
S’pose the price tag for this accident will be well in excess of $15 mil?
Topic cooks down to a few simple questions: Can a culpability be tagged on Boeing by some smart attorneys? Was a SAIB the appropriate measure to address the functionality of these switches in such close (and historically normal) proximity to the power levers? Was it reasonable to expect that nobody would ever move these switches during departure either by accident or on purpose?
The next question is how much money and effort it will take to avoid asking why a flying smart device had absolutely no sytems in place, to prevent this shutdown.
With most people obviously avoiding the reading-excursion into the preliminary accident report and barely skimming the actual reporting, its probably best to post more idiotic pictures on Facebook, make fun of it and hope Boeing doesn’t get pulled into it.
Both pilots had ample time on type, both transitioned to the 787 from Airbus. Both passed their breathalizer tests and rest times were reportedly adequate.
The flight progressed normally until the aircraft decided/ allowed the fuel cut to both engines during takeoff was reasonable.
The 787 will inhibit flap movement at the wrong speeds and deliver alerts when attempting to depart without flaps. But it will smile, nod and kill two engines during departure. I can’t even shut my I-Phone down without the damn phone asking if I may be cramping and may rather call emergency services.
Those left behind have every right to get answers to the question of who is ultimately responsible for this accident.
Even if one of the pilots decided to pull the plug on 260 people by extended suicide, the current system and level of scrutiny failed its purpose.
That’s exactly MY position Jason. An airplane that looks like THIS and there’s no automation in between those switches and the actual fuel shutoff function … I ain’t believing it. There’s more to this story.
Cameras will be a good addition : they will tell us what exactly happened. They will not stop bad things from happening. We need new passenger carrying airplanes to be fully automated and centrally managed, with just 1 pilot on board to assist when the automation or central control goes belly-up. If the military can fly their B737 sized drones over Afghanistan from a container in Arizona (or was that Nevada?), surely the technology is there. I am very disappointed in the prevailing attitude from pilots : when it comes to making a choice between their wallet and pax safety, they seem to opt for the $$$. Makes me feel like its not just Air India, Egyptair, Fedex and Germanwings that have an issue with pilot mental health.
Whether or not it makes sense to install cameras wasn’t the point of my post. My point is it’s easy to characterize a task as something simple and cheap when you’re not the one doing the work or paying for it.
Thank you for pointing out how nonsensical this would be from an operational point. Cameras would be a plethora of riches for the news networks. The ability to take video completely out of context and use it to scare the public, creating move viewership, would be priceless.
Imagine the opener. “Pilot lets flight attendant take over control of aircraft while pilots goes into passenger cabin to talk with passengers. They would then show the pilot and FA passing each other in the doorway. Of course, completely ignoring the other pilot at the controls. Don’t think that would happen? 2 recent examples.
Sure we’ll know. The preliminary report omitted almost all of the CVR transcript. At some point, the AIAA will have to come clean and reveal the entire cockpit audio transcript. The recorded nosies and pilot interchanges will tell the story.
Right now, they’re hiding and hoping that they can deflect blame from pilot error, or pilot evil.
Flaps don’t need to be “shut down” immediately to contain a fire or prevent a vibrating engine from disintegrating into an uncontained failure after a bird strike. Engines do. What do you want the engine shutdown system to look like? The requirement to input a code that calls dispatch asking for permission to move every switch on the aircraft?
You are basically advocating for pilots to be replaced by automated systems because pilots cannot be trusted to be competent or mentally healthy. Good luck with that.
Could there have been a 3rd person in the cockpit (jump seat)?
Thats some beautiful trolling… however inaccurate and misplaced it may be.
I am advocating for simple verification measures on action items which can (and just did) have catastrophic consequences.
It will take more than a single camera. A single camera with a view of both pilots would have to be placed behind, and centered on the throttle quadrant. A jumpseater would obstruct that view. And if a pilot was intent on committing evil, what’s to prevent them from coloring over the lens with a sharpie most of us carry, or hanging your coat/hat/tie in such a way that it obstructs the view? Cameras may have a roll in crashes caused by pilot error, but have their own limitations when crashes are caused by pilot evil.
Yes, automation will continue to progress as time goes on, but at least one Pilot will be on the flight deck for the foreseeable future. Sensor technology for things such as weather is still lacking for fully autonomous flight. Current weather radar, while very good, still involves Pilot interpretation looking out the window and experience. Would a completely autonomous aircraft have made the decision to land in the Hudson River? The bottom line is, you can build more logic in to the Start Switches, to prevent accidental or deliberate manipulation at inappropriate times, but there are literally hundreds of ways to bring an airliner down if one of the Pilots decides to do it.
So ill informed. Those drones do not have human beings on board! Do you have any idea how many of those drones you talk about crash? Neither do I, because no humans are on board, so no one really cares? What makes an aircraft remotely flown by a human any safer than one flown by a human/humans on board? The answer is nothing! The reason the drones are flown remotely, by a Pilot, is to prevent them from losing the Pilot in the event the aircraft gets shot down.
Verification procedures have been in place before moving fuel control switches for eighty years. You don’t seem to understand that safe operation aircraft, and countless other vehicles and systems, require trained, competent professionals. You’re attitude is no different than the Karens who insist on firearms designed for protection of law abiding citizens be unloaded, locked in a safe, and left at home by officers going on patrol.
I can see that you really have no idea what you are talking about. If you had ever flown an airliner with these switches, you would realize that these switches, as designed, are simple and very reliable. The ONLY way these switches can be moved to CUTOFF, is by a deliberate act. Adding layers of software logic would just reduce the reliability and then we would be facing the possibility of Hal, turning OFF the fuel supply at an inappropriate time. I for one am a fan of the KISS method of Keep It Simple Stupid. So go ahead, build your software logic in to this simple switch and the next suicidal Pilot will come up another one of the thousand ways to bring down an airliner if he so chooses!
Yes. We need to know if the fuel switches were turned off. If the pilot who turned them off, tries to pull the circuit breaker, the video will show that, too.
You and I are on the same page! Clearly, you have been in this industry for awhile. Thanks for input, not just some armchair QB
Has there been definitive published statement from Boeing, saying that HAL did not/ could not shut these two engines down?
The suicide/ mass murder narrative carries as much water as the simplicity or reliability of these switches or some other technical issue having lead to this accident.
Indeed you are. I imagine the FO was on your side, until those last few seconds of his life where he thought : “damn, remote control would have stopped this maniac from flipping these switches and we would all just have lived happily ever after”. You dis my comment but go on yourself in a another comment that “at least one pilot will be on the flight deck”…make up your mind will ya… or do you think pax would accept a pilot as a single point of failure ? Anyway, hope you don’t mind other opinions too much.
Kudos to Russ for raising this, it’s sparked one of the best technical discussions I’ve seen here in a while.
I took a rough count of the 25 or so people who’ve commented:
What really stands out is that the most technically sharp voices, like jjbaker, FirstAutoLander, and Larry_S, all say the same thing: the system should not have allowed both engines to shut down without some kind of check or resistance.
The 787 has a strong safety record, one of the best for widebody jets. That’s why this incident stands out. The plane didn’t break, but it also didn’t step in when it should have. Not calling it a failure. But it’s a missing layer of protection, and that’s something worth fixing.
Who would have imagined? Apparently, the ergonomists didn’t.
Anyone professional pilot or engineer who knows the systems knows that your premise is inept. In fact, the system description, including EEC PMA power and spar valve power has already been posted here.
There is a lot of internet mob and AI generated nonsense being spewed to deflect blame.
Guess what? A pilot could have done the same exact thing on any Airbus.
Referencing #1, on any Boeing there are a plethora of lights and cautions for engine failure.
I’ve already described why this is the case, having to do with catastrophic failures. Some of you are making the case that ejection seats should require a key, passcode and safety pin removal before a pilot can pull the handle. There have been inadvertent seat actuations by maintenance personal and pilots sitting on deck, egressing from cockpits. So the logic is let’s remove the functionality of the seat because someone might get hurt.
There are lights in the fuel control switches to indicate which engine has detected a fire. It’s not hard, unless you have an incompetent, or yes, suicidal pilot.
A similar response occurred after the Germanwings suicide. European ATC wanted to be able to take over and fly airliners from the ground. When they were informed that they would now be accountable for failing to properly execute such a responsibility, they suddenly wanted no part of it.
This is not a failure of ergonomics. It’s a failure of pilots.
Yeah, a pilot could do this on an Airbus too. That is a poor excuse, it means more aircraft have the same flaw.
If the system lets both engines get shut off right after takeoff with no warning, no lockout, and no pushback, that’s a design problem. Full stop.
This isn’t about adding passwords to switches. It’s about not letting one bad move take down 260 people while the airplane just nods and goes along with it.
Blaming pilots skips over the point of cockpit design. Humans make mistakes. Sometimes worse. The system’s job is to prevent the ones that kill.
The 787’s a solid airplane. Doesn’t mean it can’t have a blind spot. This sure looks like one.
A failure of ergonomics.
Hi, first time responder to your comments. I usually always agree with your thoughtful and well informed position on thingsThe switches need to stay the way they are. In the small likelihood that there is a dual engine failure the most expedient way to restart is to “reboot” the system by turning off then immediately on. BTW there is a master warning and associated warning EICAS message indicating engine has Been shut down
What exactly do we need video for? It is established fact that the fuel valves were placed off one after the other, then on. The CVR conversation confirms this. They wouldn’t be talking about the cutoffs if the engines randomly shut themselves off because of bad solder. What exactly would video add to this discussion? We’d know a little sooner which pilot moved them? What in the end does that solve? A pilot moved the switches when the switches are not to be moved.
Hate to break it to all of the armchair quarterbacks out there but as someone who plays in the arena there’s a certain amount of competence, skill, and motivation required in order to ride the ride. It is utterly impossible to design any machine so that no training is required, and it is absolutely reasonable to expect that the training program can and should identify anyone who cannot meet that most basic bar.
There is simply no way to design any machine that both allows for human intervention and also somehow can divine human intention. That machine will never exist.
You may then ask why not remove the human from the equation, but this ignores the failure rate of automation. Yes, Virginia, the failure rate. Who here has flown even 100 hours in an aircraft with automation without once having to disengage the automation because it was not doing precisely what was needed? Anyone? Bueller… Bueller….
This is the availability heuristic in action, folks. We all remember the times the automation works, but forgive and forget its constant failures. But yes, please tell me more about how airliners will get rid of the filthy, stupid, greasy, idiotic pilots in X amount of time. Maybe offer me a ride in your flying car while you’re at it.
The fact of the matter is people have strengths and weaknesses. Machines (yes machines, you can give them whatever nerdy cool kid name like automation, machine learning, AI, it’s all the same human made garbage) have strengths and weaknesses. Conveniently, humans tend to be strong in areas where machines are weak and equally conveniently, vice versa. Thus the optimal solution is and always has been finding the right balance between the two. All automation is brittle. All human is unreliable. The two together are how we got to 99.99999% reliability in countries like the US that take some degree of care in what humans they pick for the mix.
The fun part is when the first fully automated aircraft finds a way to make the first fully automated smoking hole in the ground, everyone will still find a way to blame people. Strange how that works…..
Tom, appreciate the kind reply. You are correct: in a real emergency, pilots need direct control, and the switches can stay. But this wasn’t a fire, surge, or damage scenario. It was both engines being shut down at full takeoff power, under 300 feet AGL, with no system challenge or pause. So I’ll explain my view after some research.
According to the AAIB Preliminary Report (June 2025):
What failed:
This isn’t about removing pilot authority. It’s about breaking the chain when one wrong move could cost 260 lives.
What fixes it:
Add a simple logic gate to block a second engine shutdown when all three of the following conditions are met:
If the crew needs to shut both down, they still can, by pulling the power back or flipping a guarded override. But the aircraft should not follow both shutdown commands blindly at full power and low altitude.
Why power setting matters:
Why altitude matters:
The 787 is one of the safest aircraft flying. But this wasn’t a hardware failure. It was and remains a logic gap.
And it’s one that can be fixed.
Writing about systemic errors/ faults is often very complicated, because the reader has to be capable of logical and critical thinking and most importantly, read and comprehend what the text says.
Its much easier to just ignore all the discovered facts and call people “Karen” for asking very simple questions. People who are not willing to accept the “Keep Holy Boeing Innocent” doctrine, are accused of being unqualified, called names and clueless.
But… where are we now?
As it stands, the questions regarding the SAIB/ Switches remain unanswered. If the mechanical blocking of these switches was dysfunctional, flipping them could have happened by accident and without awareness of the person doing it. I am not the only person, asking about this. (Click)
As it stands, no statement from anybody/ anywhere within Boeing, confirms, that there could not have been a technical/ electronic fault causing the shut-off valves to be moved to OFF.
As it stands, a flying computer accepted/ executed a dual engine fuel cut with no indication justifying that action during the most critical phase of the flight with factually 0 chance to recover the aircraft. Bark, huff and puff all you want… but explain WHY this was possible in easy to understand terms. Lawyers WILL ask this question, soon enough.
Russ shared his personal opinion about cameras in the cockpit. While I am capable to accept someone elses opinion on something, I do not share the sentiment. Nobody wants to be under constant surveillance. Yet, footage may reveal both pilots physical actions in HD and zoomable.
We began investigating accidents to locate and erase errors and systemic failure and learn from them. Human factors, Technical Factors, Maintenance, Systems, Crew, Weather… everything. The goal? Find out what happened and avoid a repeat.
Whichever way you turn it (and under all possible circumstances for cause) the current system failed its purpose. That may be harsh, but its true.
It takes 10 minutes to determine a list of configurations under which a dual engine shutoff is guaranteed to be catastrophic. Thats when I expect the plane to act up and complain/ refuse, just like it does in countless other situations.
Well, put one fuel switch on the captain’s side and one on the fo’s side.
Hmm – I thought the big question was not whether the switches actuated (they must have?) but whether it was accidental or intentional. Doubtful that video would definitively answer that question.
I am confused. If each switch had to be pulled and then moved to the cutoff position, how could they both be done at the same time, within a small fraction of a second? With two hands? That seems highly improbable.
Still need more information.
A fully automated airliner with no pilots!! And incidentally, no passengers, either!
@Richard: According to the AAIB Preliminary Report (June 2025), the two fuel control switches were not moved at the same time:
So, no, they weren’t toggled “at the same time.” The sequence was right first, then left, a second apart. This timing strongly suggests deliberate action by one pilot using one hand, not accidental contact or simultaneous movement.
See animation. https://www.youtube.com/watch?v=AHsQDRUCMiU&t=125s
Where do these numbers originate?
The cut off (1) happened “immediately after” 180 knots (08:08:42) which is 7 seconds after Vr.
Individual switch (1) was moved back to ON ~ 10 seconds later (08:08:52) and switch (2) following 4 seconds later (08:08:56) for a total of 14-15 seconds before both switches were back in normal operation mode.
The prelim is very hazy on the exact timeline and especially on who said what.
CA was PM and FO was PF. By the time of rotation, PF’s hands would have been manipulating the yoke and not on or near the powerlevers.
Last but not least, language spoken on the flight deck is undefined and even though available, no CVR is in known circulation. No transfer of aircraft control was recorded.
The linked video seems like a especially desperate attempt to monetize this accident.
@jjBaker:
I’m going off the timeline outlined in the AAIB Preliminary Report and echoed by multiple sources, and several aviation analysts. The sequence, right engine CUTOFF around 4 seconds after liftoff, left engine at 5, both returned to RUN at ~15 seconds—wasn’t invented. It’s been cited and discussed publicly.
My reply to Richard (anoldpilot) was focused on explaining how the switches could be moved close together in time, not claiming they were flipped simultaneously, just quickly, one after the other.
If the final report revises that sequence, fine. But for now, I’m working with what’s been documented. Not speculating. Not making anything up. Just addressing the facts as they’ve been presented. The video has good graphics and helps visualize the times and motions, that’s why I presented it.
Didn’t mean to imply anyone had “invented” anything, I just looked at the timespan between Vr (at which point PF would leave the power levers) and the actual first indication of a transition from RUN to OFF and then back on. It took 1 second or less to switch them off, but 4 seconds the other way around.
Oh well, 1-2 years from now, we’ll be wiser.
May the most popular narrative win.
So, it sounds like deliberate action cannot be ruled out yet…
260 people died. We know the engines were shut down—but not who did it or why. A cockpit video cam would have shown the hands, the switches, and the intent. No guessing, just facts.
Fully Autonomous aircraft solves this problem. It’s just a matter of time.
I am sure you are willing to give up whatever job you have to a robot, right? Fair is fair.
How do you know that? All accidents are caused by people. Right? That’s why we call them accidents and not acts of god. The automation system is made by people, not by gods.
How many millions of hours of testing have been done with a fully-automated airliner to prove that you can reduce the already unbelievably low fatal accident rate in the US of average less than ten deaths per year for about 300 million passengers?
Where is your data?
I don’t think you have enough. Perhaps someday you might.
Enter the Stig Shift #78’ (Aircraft Maintenance Adventures) gives one of the best, easiest-to-understand explanations of what happened with the FUEL RUN–CUTOFF switches and how they work with the systems.
The camera debate was mostly a side issue. What really matters, and what most of the thread focused on, is whether the system design allowed a mistake, or whether it was pilot error, and who’s responsible when things go wrong. Watching the part from time-stamp 15:00 to 22:00 min really opened my eyes and made me rethink a few things. Thanks to my friend D.W. for the heads up.
Worth watching: https://www.youtube.com/watch?v=-ur234kwnhk&t=900s
The simplest, most factual explanation of the systems functionality seen to date. Kudos to Stig!