Preliminary report into Air India crash released

So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally, they need to be unlocked first by pulling them out.

> In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.

And both pilots deny doing it.

It's difficult to conclude anything other than murder-suicide.

> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC.

Damn. That's pretty quick to diagnose and take action.

Boeing's probably gonna have a big sigh of relief over this one.

Is it possible it could have been an accident or a mistake by one of the pilots? How intention-proofed are engine cutoffs?

well hold your horses there... from the FAA in their 2019 report linked above:

> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.

> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown

Murder-suicide looks like the likely conclusion, given that flipping the cutoff switches requires a very deliberate action. That said, it's not entirely impossible that due to stress or fatigue the pilot had some kind of mental lapse and post-flight muscle memory (of shutting off the engines) kicked in when the aircraft lifted off.

I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.

The conversation would suggest that the switches were in CUTOFF position, but there is also a display that summarizes the engine status.

There is no conversation that mentions flipping the switch to RUN again.

EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.

You can do them both with one hand.

Pilots unions are dead against it.

Possible, and if so it is too early to conclude it was murder-suicide.

See also: https://www.thehindu.com/news/national/dgca-slaps-80-lakh-fi...

08:08:35 Vr

08:08:39 Liftoff

08:08:42 Engine 1 cut-off

08:08:42 Engine 2 cut-off

08:08:47 minimum idel speed reached

?? One pilot to other: why cut-off. Other: Did not do it

08:08:52 Engine 1 run

08:08:52 Engine 2 run

1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.

Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.

The big question is whether the switches were moved or something made it seem as if the switches were moved.

That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.

They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.

Still... that has its own set of risks and failure modes to consider.

This sounds to me like an electronics issue - an intermittent, inadvertent state transition likely due to some PCB component malfunction

Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.

If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.

https://www.aerosociety.com/news/ana-787-engine-shutdown/

Edit: It also seems like the engine cutoff is immediate after the toggle. I wonder if a built in delay would make sense for safety.

It’s worth noting that Premeditation or “intention” doesn’t have to factor into this.

Studies of survivors of impulse suicides (jumping off of bridges etc) indicate that many of them report having no previous suicidal ideation, no intention or plan to commit suicide, and in many cases no reported depression or difficulties that might encourage suicide.

Dark impulses exist and they don’t always get caught in time by the supervisory conscious process. Most people have experienced this in its more innocuous forms, the call of the void and whatnot, but many have also been witness to thoughtless destructive acts that defy reason and leave the perpetrator confused and in denial.

My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?

Just allow cockpit video recorders, and if they're ever used for anything, the pilots (or their heirs) get $250k in cash.

And with how low and slow they were during takeoff, those would have been going off almost instantly.

The 787 is 15 years old, and this particular plane was 10 years old. It always seemed unlikely to be a major, new issue. My money was actually on maintenance.

(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)

Or maybe a design that prevents both switches being off (flip flop?) for X minutes after wheel weight is removed?

Again, it’s probably pointless but it’s an interesting thought exercise.

Suicidal pilots are apparently more common than we’d want.

https://en.wikipedia.org/wiki/China_Eastern_Airlines_Flight_...

Or more precisely, the signals which come from them were found to behave as such.

Without any audible record of turning the switches off, I wouldn't blame the pilots without first checking the wiring and switches themselves for faults. This reminds me of the glitches caused by tin whiskers.

You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.

In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.

The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.

How so? It is just as likely to be an intermitted electronic malfunction.

I mean, it's not impossible, but it sure the hell is improbable.

There’s always going to be many ways they could crash the plane, such a feature wouldn’t help. The pilots are the only people you can’t avoid fully trusting on the plane.

I wonder if there have been cases where a pilot had to cut fuel before the computer could detect anything abnormal? I do realize that defining "abnormal" is the hardest part of this algorithm.

But I'm an advocate of KISS. At a certain point you have to trust the pilot is not going to something extremely stupid/suicidal. Making overly complex systems to try to protect pilots from themselves leads to even worse issues, such as the faulty software in the Boeing 737-MAX.

Me: “The build is breaking right after you checked in. Why did you do that?” Him:”I did not do so.” Me: “The commit shows it as you. And when I rolled back everything builds.” Him:”It must have been someone else.”

That person was really annoying.

Remember that incident where a cop pulled out his taser and tased the suspect? Except he pulled out his pistol and fired it.

The taser looks nothing like a pistol, feels nothing like it, yet it is still possible to confuse the two in the heat of the moment.

That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?

Just trying to think of some semi-plausible non-active causes.

This would leave accident investigators with a lot of work to do to try to figure out how a collision happened.

And yes, it does sound like it was probably intentional. I would still like to see an engineering review of the switch system. Are they normally open or normally closed, In the end the switch instructs the FADEC to cut the fuel, but where does the wiring go in the meantime? what software is in the path? would the repair done before the flight be in that area?(pilot defect report for message STABS POS XCDR), and perhaps compromised the wires?

Doing it accidentally is impossible.

It's not a rational decision, so there's no reason to expect rational decision making or explanation on the output.

There's 0 reason to conclude murder-suicide, there's an infinitude of things that could have the same result, and both pilots denied it to eachother: how is that presented as proof?

I hope I don't need to explain why the fact no one knew in advance the Las Vegas shooter was going to shoot has ~0 similarities with the situation as we know it, and banal similarities with every murder.

Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)

And by stations, I mean aircraft. There are a TON. Current constellations probably wouldn’t even be able to handle half the current aircraft transmitting all at once. Bandwidth, in the physical sense, becomes a limiting factor

Coverage (different constellations have different coverage, which means planes would not have transmit guarantees depending on flight path). So you’d have huge gaps anyways

There have been alternative solutions posed, some of which are advancing forward. For example, GPS aware ELTs that only transmit below certain altitudes. But even that has flaws

Anyways I think we’ll see it in the next decade or two, but don’t hold your breath

If someone is speculating about how such a problem might be solved while not trying to conceal their lack of direct experience, I'm fine with it, but not everyone is.

If someone is accusing the designers of being idiots, with the fix "obvious" because reasons, well, yeah, that's unhelpful.

This is not "reasoning from first principles". In fact, I don't think there is any reasoning in the comment.

There is an implication that an obvious solution exists, and then a brief description of said solution.

I am all for speculation and reasoning outside of one's domain, but not low quality commentary like "ugh can't you just do what garmin did".

This is not a throwaway, I'm a lurker, but was compelled to comment. IMHO HN is not the place for "throwaway" ad hominems.

You get free Starlink on several airlines now, so won't that be a solved problem soon?

No it’s not comparable to a cop that confuses things in the heat of the moment. Not anywhere close to be relatable.

If it was, planes would be crashing down the sky quite often (and it would have been fixed for decades already).

You are trying to draw parallels between the ignition switch in a 1974 Ford Pinto and a 2025 Ford Mustang as if there could be a connection. No.

joey: Can you switch them quickly?

snypher: You can do them with one hand. [Ed. This is ambiguous and could be read as "one hand, simultaneously". In fact, doing it with one hand non-simultaneously would be a weird claim to make of a simple knob. See also ajb's comment below.]

zihotki: Really? They are not close together and have a spring mechanism. [Ed. Seems to believe snypher is claiming simultaneous operation.]

snypher: I am confused by the response.

Me: [Tries to facilitate clarification]

"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."

So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.

You're leaping into the minds of others and drawing conclusions of their intent. One of them moved the levers. It could've been an unplanned reaction, a terrible mistake, or it could've been intentional. We may never know the intention even with a comprehensive and complete investigation. To claim otherwise is arrogance.

Will the bladder be marketed by Kramerica Industries?

That's very hard to do by panic and mistake, if not impossible by design.

Not within the context of the thread.

Fuel levers are designed to only be moved deliberately; they cannot be mistaken for something else by a professional pilot. It's literally their job to know where these buttons are, what they do, and when to (not) push them.

It's not arrogance to assume the most likely conclusion is true, despite how uncomfortable that outcome may be.

I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.

The cost of hardware and additional fuel consumption due to drag aren’t nothing, but the data used itself is essentially a rounding error. (Iridium for example has tiny antennas, and SBD data costs about a dollar per kilobyte, and position data is tiny.)

Of course, that’s all little help when a pilot acts adversarial; on MH370, the breakers for both satcom and transponder were likely pulled, for example.

In safety-critical engineering, you generally either automate things fully (i.e. to exceed human capabilities in all situations, not just most), or you keep them manual. Half-measures of automation kill people.

You’re trying to prove a negative here.

I am not familiar with the 787 operations, but there are a few issues that need to be sorted out first: - altitude when pilots start the after takeoff checklist

- if there are any other switches that are operated in tandem in the general vicinity of where the engine cutoff switches are

- if the cutoff switches had the locking mechanisms present, and if not, if they could be moved inadvertently by the pilot flying hand

Discarding other possibilities in an investigation can have adverse consequences.

Did you ever always push the right buttons every time?

FAA issued a Special Airworthiness Information Bulletin SAIB NM-18-33 in 2018 warning that on several Boeing models including the 787 the locking mechanism of the fuel switches could be inoperative.

https://www.aviacionline.com/recommended-versus-mandatory-th...

Per FAA the checks were recommended but not mandatory.

This kind of attitude gets innocent people behind bars for life. Disgusting.

It's difficult to conclude anything until the investigation is finished and I hope the ones who are carrying it out are as levelheaded, neutral and professional as possible.

For instance, you might deliberately kill yourself by driving your car really fast into something solid, but you probably wouldn't try to do that while backing out of the garage.

However, the only relevant evidence that exists suggests they had enough rest. You don't build verdicts on suppositions, you build them on proven facts.

This does not guarantee you will reach the truth, but it's miles better than admitting every baseless hypothesis that comes up.

Hard to believe the other pilot wouldn’t have said anything.

Recovering the airplane and have some people survive the crash are two very different things.

> impossible by design.

Deflecting that the human is the weakest part of the system. One or other may have panicked and made a mistake, made a mistake unintentionally, went crazy and doomed the flight, or intentionally doomed the flight for some socioeconomic reasons. These are speculative possibilities that we don't know yet, and may never know; we only know what has definitely happened from the evidence per the investigation. It's standing way out over one's feet to declare from an armchair that it was "definitely" X or Y before the investigation is complete.

All the controls would be on a giant touchscreen, with the fuel switches behind a hamburger button (that responded poorly and erratically to touch gestures). Even a suicidal pilot wouldn't be able to activate it.

Assumption. Big ass assumption.

Pilot are trained until actions are instinctual and certain memory items are almost unconscious. But pilots are still people and people are fallible and make mistakes, and sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.

> It's not arrogance to assume the most likely conclusion is true

You don't know this. This is beyond the capability to know and is therefore pure speculation. That is the definition of arrogance.

Don't sentence people on unfinished investigations. This is why most trials are not public, because of people like you.

As a software engineer myself I think it's interesting that we feel software is the true solution when we wouldn't accept that solution ourselves. For example typically in a company you do code reviews and have a release gating process but also there's some exception process for quickly committing code or making adjustments when theres an outage or something. Could you imagine if the system said "hey we aren't detecting an outage, you sure about that? why don't you go take a walk and get a coffee, if you still think there's an outage in 15 minutes from now we will let you make that critical change".

The fact that a pilot would cut off fuel from both engines, in sequence while taking off is virtually impossible to happen unless deliberate.

Hence the hand brake comparison, it does not come natural to use it while driving.

1: https://news.ycombinator.com/item?id=44539508

The workload is pretty high during the takeoff phase. The engines react right away when fuel flow is stopped. The engine displays can have some lag before data is updated.

Relighting an engine at low speed is not feasible - most need 230-250kts IAS before attempting the operation. Maybe you could do it if the APU was still running and could provide compressed air, but it takes about 20-30 seconds to start up amd then probably 5-10 more to spool up to full thrust. I am speculating here a bit, but the pilot did not have enough time to save the plane even if he did everyting right and as fast as humanly possible.

All this aside is overshadowed by the limited amount of time the pilot flying (I would assume the captain in this case since there was only one ATPL pilot in the cockpit) had to troubleshoot the issue of a dual engine failure - as this is what would have felt to him - during takeoff.

The idea is to notify for crucial settings, replace vocal confirmation (probably) already in the SOP anyway, reducing mistakes in bad faith or otherwise.

Don't some planes already have an automated announcement for seatbelts on?

Only reason I can think of why it's not there yet is the cost (whether $$$ or design opportunity) of cramming that in the already-cramped cockpit.

    warn then shut off

Override warning time by toggling again.

The weirdest thing was how often it worked for them. In each case their lying eventually caught up with them, but in some cases they’d get away with lying for years.

It’s amazing how often someone would have clear evidence against what they were saying, but the people in positions of authority just wanted to de-escalate the situation and move on. They could turn anything into an ambiguous he-said she-said situation, possibly make a scene, and then make everyone so tired of the drama that they just wanted to move on.

From what I understand, the relight procedure involves cycling these back to CUTOFF and then to RUN anyway. So it is not clear if they were mechanically moved from RUN to CUTOFF preceding the loss of thrust, or cycled during relight.

[0] https://en.wikipedia.org/wiki/Yeti_Airlines_Flight_691

If there’s a fire or similar problem the fire handles will cut off fuel without the normal shutdown procedure, but the normal switches only need to be used at idle thrust.

I wonder if Airbus has this logic, since their philosophy is to override the pilot commands if they’d endanger the aircraft (which has its own issues of course) where’s Boeing will alert the pilots and still perform the action. I don’t have access to that information.

Formally verified traditional algorithms.

https://www.youtube.com/live/SE0BetkXsLg?feature=shared

> Bright is the son of the United States Air Force pilot Charles D. Bright

> Bright graduated from Caltech in 1979 with a Bachelor of Science in Mechanical Engineering and a minor in Aeronautical Engineering

> He worked for Boeing for 3 years on the development of the 757 stabilizer trim system

There's a balance of accidents to be found, I think. There are likely cases where fuel does need to be cut off to both engines, and preventing that would lead to accidents that might have been recoverable. This case shows that cutting off fuel to both engines during takeoff is likely unrecoverable. There have been cases where fuel is cutoff to the wrong engine, leading to accidents. Status quo might be the right answer, too.

Saying the union drove a decision is hardly "an assault on organized labor".

That it isn’t certain doesn’t change anything about it being pretty likely.

Unpleasant, but I suppose at least it means we won’t suddenly see other planes falling out of the sky due to fuel switches being set to off.

No. Bad.

A whole world full of 787’s is pushing the right buttons every single day. If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.

I have to imagine that “You are flying” and “You just cut off all fuel to the engines” must generate a pretty obvious claxon of warnings.

That’s nonsense. Even when I’m flying right over the north pole my airline will give me unlimited in-flight internet for $20. Maybe antartica has worse reception, but cost isn’t the issue.

Doesn’t mean the ones where you cannot determine the reason and have to speculate don’t suck.

Agreed. The sequence of events also supports this.

I believe one of the pilots made a terrible muscle memory mistake and cutoff the fuel instead of raising the landing gear. This would explain why the landing gear was never raised, why the pilot who was accused of cutting off the fuel denied it (in his mind he had only retracted the landing gear) and why the engines were turned back on after presumably realizing the mistake.

If you sent two updates a minute over Iridium, using their 25 byte message plan, you'd be looking at a megabyte per minute for the entire planet. That's such a tiny fraction of what that single constellation can do.

This is what I am debating.

There are too many variables you need to account for.

For example, I want an expert opinion about the tone in the cockpit when the other pilot said “No, I did not touch it” or what was said. Is it calm? Surprised? Cold?

You could have made the same assumptions after the first MCAS crash, much like boeing assumed pilot error. It's easy, comforting and sometimes kills people because it makes you stop looking.

As another commenter said the Airbus engine start/stop controls are located behind the thrust levers, and according to the A350 operations manual which I got my hands on there are two conditions required for the FADEC to command engine shut down: Run switch to off, thrust lever to idle.

So if that's correct on an Airbus aircraft you can't just switch off the engines when they're commanded to produce thrust. This also seems to be backed up by the difference in the guards for those controls in the Airbus cockpits.

It literally is. Accidental/malicious activation can be catastrophic, therefore it must be guarded against. First principles.

The shutoff timer screen given as an example is a valid way of accomplishing it. Not directly applicable to aircraft, but that's not the point.

> "ugh can't you just do what garmin did"

That's your dishonest interpretation of a post that offers reasonable, relevant suggestions. Don't tell me I need to start quoting that post to prove so. It's right there.

The pilot denies shutting off the fuel, then realises he'd done it accidentally and quietly reenables them hoping there's enough time to save them

Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.

Some problems that immediately come to mind:

- For which settings is there going to be a voice confirmation? Is their confirmation more important than all the other audio warnings?

- During emergency situations, when pilot workload is high, will these only add to that workload, making the emergency even worse?

- Will the pilots get so used to hearing these every day that their brains will simply tune them out as background noise?

Really though, if a pilot wishes to doom an aircraft, there's 1000 different ways they could do so. The solution to this problem likely lies in the pilot mental health management department, rather than the fuel cut off switch audio warning one.

Well, of course I talk about an accidental touch of the wrong buttons.

Flying is very safe, but at the same time, you will never know how many near misses happen daily that don't become accidents.

Location of the switches: https://media.cnn.com/api/v1/images/stellar/prod/c-gettyimag...

Here is a video of a takeoff and climb in a 787: https://youtu.be/TTZozTaWiRo

The pilots have no business with their hands in the area of those switches in that phase of the flight (9:30+ in the video). They don't even have to touch the throttle, and even if they did, that's a long way from where you touch the throttle down to the base where those switches are. Which you can't just flip either.

How is that even remotely similar to that cop's situation?

The fact that the pilots denied that they had shut the switch (one asking the other why they had done so and the other denying it), and that they restarted the engines should be taken into account. Ok, murder suicide is definitely on the table but I would want to see some other reasons for believing that this is so.

If not, why are you speculating with zero knowledge?

There is speculation that in the Air France flight 447 that crashed into the ocean en route to Paris, one or the pilots only had 1h of rest because of partying the night before. Of course it’s all speculative, and however unlikely it is, eventually it’s bound to happen that we get pilots with poor mental clarity in charge of large Boeings with hundreds of lives on board. Unfortunately it only takes one lapse of judgement to compromise the flight profile of a large airliner, even if corrected after a few seconds.

https://generalaviationnews.com/2014/11/06/vanity-fair-the-h...

¹) https://youtu.be/RbmFmWqqq0c?t=19

²) https://youtu.be/33hG9-BCJVQ?t=5

(I'm not an expert, I just watched these videos)

The balance of probability might tend to support that hypothesis. However I'm wondering if it was just something involuntary. My ex for instance who learned to drive on a stick shift would randomly stall the engine after a few weeks driving an automatic.

In that moment I realised he was just bare faced lying right infront of everyone, about a technical subject, only HE should be the expert in, and to this day I am perplexed why his contract kept being renewed.

Eventually I was let go ( he possibly suggested I be let go ) for an incident that was unrelated to me.

This is all fine, but i learnt 5 years on he was still being paid a top 1% salary at the same company.

I promise the point isnt that I am jealous, its that this guy, who was a sub par coder and liar, somehow managed to keep his job whilst everyone else lost theirs and earnt untold amount in England ( where salaries are always low).

My goodness - I just remembered he was found by police driving a vehicle seemingly under the influence on a motorway, work found out after the police called them, and somehow he turned up the next day at work , lied about it, and STILL kept his job.

I am only mentioning this guy , because he was NOT a nepotist hire, he was just some guy who would lie and somehow people were ok with it. I still think of him often and wish I could have learnt more from his abilities just out of interest.

A note on the terminology: "evidence" is a piece of data that suggests a conclusion, while not being conclusive by itself. Whereas "proof" is a piece of data that is conclusive by itself.

But why cutoff the fuel instead of flying into terrain? It's such a passive action

By this logic it would be impossible to ever find anyone guilty of murder (or any other nefarious action) with intent unless they explicitly state that it was in fact their intent. Obviously this is not how justice works anywhere, because at some point you have to assume that the overwhelmingly most likely reason for doing an action was the true reason.

If someone pulls out a gun, cock it, aim it at someone and pull the trigger, killing the other person, should we hold off any judgement because they might have done it purely mechanically while in their head thinking about the lasagna they are going to cook tonight and not realizing what they were doing ?

The fuel cut off switches have a unique design, texture and sequence of action that need to be taken to actuate them, they don’t behave like any other switch. Pilot are also absolutely not trained to engage with those particular switches until it’s instinctual.

I can pay $10 to have internet for the entire flight. Reasonably low bandwidth of course, but if I can splurge $10, the airline can.

The report states the FO was pilot flying.

It's not a direct quote or transcript, it's reported speech.

But here's the thing a "near zero chance" when we are talking about an actual event changes the math

Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident

Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure

So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded

As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.

Air accident investigations mostly deal with one-in-a-billion freak occurrences. Commercial aviation so safe and reliable that major accidents rarely happen without a truly extraordinary cause.

Coming up with ad-hoc solutions is easy, especially the less you know about a complex system and its constraints. I'd say it's not an interesting exercise unless you consider why a solution might not exist already, and what its trade-offs and failure modes are. Otherwise, all you're doing is throwing pudding against a wall, which can of course be fun.

In this case I wonder if the fuel cut off switches could be replaced by buttons for particular situations. Have an engine fire button or a shut down whilst on the ground button. Let the pilot provide input on state and let the automation decide what to do with that. Obviously this is not a solution to suicidal or murderous behaviour. But it could be a solution to all the low probability edge cases.

So we don't know the exact words used. Did he say for example, "Why did you move the switches to cutoff" or did he ask "Why did you cut off the engines"? If there are indeed two shorts (astronomically low as those probabilities are), the other pilot would say "I didn't", look around confused and then (possibly?) flip both of them down and back up? Which could explain the 4s delay in pulling them back up.

Speculation, but since we do not have actual transcripts or recordings, all I'm doing is answering speculation with more speculation.

What if there's another safety lesson to be learnt here?

The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.

He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.

Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.

I wonder if they could have buttons that are about the situation rather than the technical action. Have a fire response button. Or a shut down on the ground button.

But it does seem like half measure automation could be a contributing factor in a lot of crashes. Reverting to a pilot in a stressful situation is a risk, as is placing too much faith in individual sensors. And in a sense this problem applies to planes internally or to the whole air traffic system. It is a mess of expiring data being consumed and produced by a mix of humans and machines. Maybe the missing part is good statistical modelling of that. If systems can make better predictions they can be more cautious in response.

For example, an obvious solution is that the switch can't be changed from "RUN" to "CUTOFF" when the throttle isn't at idle - this could be done with a mechanical detent because they're right next to each other. Simple!

But now you've introduced additional failure modes - throttle sticks wide open and the engine is vibrating and needs to be shut down - so maybe you make it that the shutdown switch can work for ONE engine at any throttle position, but if TWO get turned off, both throttles have to be off, but that introduces ...

If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.

Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.

Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.

And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)

The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.

E.g. it’d be nice if just hearing the CVR meant you knew the exact cause. Unfortunately not the case here.

TERRAIN, TERRAIN! PULL UP! PULL UP! (WHOOP WHOOP)