Preliminary report into Air India crash released

> It's difficult to conclude anything other than murder-suicide.

Is it possible it could have been an accident or a mistake by one of the pilots? How intention-proofed are engine cutoffs?

You have to pull the switches out (against a spring) to be able to move them over a notch and flip them. Not really something you can just mistake for another switch or bump into by accident.

I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.

Report says the switches went to cutoff one second apart from each other. Can a human do the physical operation on two switches that quickly?

There's a good photo of them here; https://theaircurrent.com/aviation-safety/ai171-investigatio...

You can do them both with one hand.

The timing is really curious.

08:08:35 Vr

08:08:39 Liftoff

08:08:42 Engine 1 cut-off

08:08:42 Engine 2 cut-off

08:08:47 minimum idel speed reached

?? One pilot to other: why cut-off. Other: Did not do it

08:08:52 Engine 1 run

08:08:52 Engine 2 run

1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.

Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.

The big question is whether the switches were moved or something made it seem as if the switches were moved.

It could be defective switch springs, fatigue-induced muscle memory error, or something else. The pilot who did it saying he did not may not have realized what he did. It's pretty common under high workload when you flip the wrong switch or move a control the wrong way to think that you did what you intended to do, not what you actually did.

That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.

They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.

Still... that has its own set of risks and failure modes to consider.

Are you completely sure you can considering that they are spring loaded and they are like 7-10cm apart judging by the size of other controls?

Well in the murder-suicide scenario it makes sense for the culprit to turn them off as quickly as possible. The longer time to turn them on could plausibly be a struggle or simply needing to fly the plane while reaching for each switch individually.

I don't understand your question. I have done this myself, am I completely sure?

If you do them both with one hand, would they not be moved at the same instant rather than 1 second apart?

Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.

They require a per-switch motion, so unlikely.

Did you mean to say you can activate the switches with one hand simultaneously? That is probably what the above commenter assumed you meant. Since lifting and twisting two switches simultaneously with one hand seems challenging.

Armchair safety/human factors engineering, gotta love HN.

It didn't happen simultaneously so this is irrelevant.

When your engine catches on fire/blows apart on takeoff you want to cut fuel as fast as possible.

Was thinking this same thing. A minute feels like a long time to us (using a Garmin as the example said) but a decent number of airplane accidents only take a couple minutes end to end between everything being fine and the crash. Building an insulation layer between the machine and the experts who are supposed to be flying it only makes it less safe by reducing control.

It is relevant to the interaction I replied to.

This is a place that puts "Hacker" in the name despite the stigma in the mainstream. Given the intended meaning of the term, I would naturally expect this to be a place where people can speculate and reason from first principles, on the information available to them, in search of some kind of insight, without being shamed for it.

You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.

Above commenter said _quickly_, not simultaneously

Is there just one set of switches? Or do both pilots have their own set?

Proposed algorithm: If the flight computer thinks the engine looks "normal", then blare an alarm for x seconds before cutting the fuel.

I wonder if there have been cases where a pilot had to cut fuel before the computer could detect anything abnormal? I do realize that defining "abnormal" is the hardest part of this algorithm.

If its both engines you're fucked anyway if its shortly after takeoff.

But I'm an advocate of KISS. At a certain point you have to trust the pilot is not going to something extremely stupid/suicidal. Making overly complex systems to try to protect pilots from themselves leads to even worse issues, such as the faulty software in the Boeing 737-MAX.

Is it possible to rest the switch on the notch? Does the switch make contact if the switch is in the RUN position but the switch is not completely down?

That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?

Just trying to think of some semi-plausible non-active causes.

Assuming the person trying to kill themselves and a plane load of people would respond in an expected way to inquiry is also just a mistake.

It's not a rational decision, so there's no reason to expect rational decision making or explanation on the output.

For me it's mainly about intent/unearned confidence.

If someone is speculating about how such a problem might be solved while not trying to conceal their lack of direct experience, I'm fine with it, but not everyone is.

If someone is accusing the designers of being idiots, with the fix "obvious" because reasons, well, yeah, that's unhelpful.

(Different user here) Hacker News' "culture" is one of VC tech bros trying to identify monopolies to exploit, presumably so they can be buried with all their money when they die. There's less critical thinking here than you'd find in comments sections for major newspapers.

> That said Boeing could take a page out of the Garmin GI275

This is not "reasoning from first principles". In fact, I don't think there is any reasoning in the comment.

There is an implication that an obvious solution exists, and then a brief description of said solution.

I am all for speculation and reasoning outside of one's domain, but not low quality commentary like "ugh can't you just do what garmin did".

This is not a throwaway, I'm a lurker, but was compelled to comment. IMHO HN is not the place for "throwaway" ad hominems.

You’re the only one who said “simultaneously.”

Jesus...

joey: Can you switch them quickly?

snypher: You can do them with one hand. [Ed. This is ambiguous and could be read as "one hand, simultaneously". In fact, doing it with one hand non-simultaneously would be a weird claim to make of a simple knob. See also ajb's comment below.]

zihotki: Really? They are not close together and have a spring mechanism. [Ed. Seems to believe snypher is claiming simultaneous operation.]

snypher: I am confused by the response.

Me: [Tries to facilitate clarification]

Yeah, people shouldn't bat ideas around and read replies from other people about why those ideas wouldn't work. Somebody might learn something, and that would be bad.

See above.

> This is ambiguous and could be read as "one hand, simultaneously"

Not within the context of the thread.

Context is both these switches being turned off with a 1 second gap. Doing it with one hand simultaneously would possibly explain it, otherwise it doesn’t seem relevant.

If the computer could tell perfectly whether the engine “looks normal” or not, there wouldn’t be any need for a switch. If it can’t, the switch most likely needs to work without delay in at least some situations.

In safety-critical engineering, you generally either automate things fully (i.e. to exceed human capabilities in all situations, not just most), or you keep them manual. Half-measures of automation kill people.

If Boeing only had the foresight to hire an army of HN webshitters to design the cockpit, this disaster could have been averted.

All the controls would be on a giant touchscreen, with the fuel switches behind a hamburger button (that responded poorly and erratically to touch gestures). Even a suicidal pilot wouldn't be able to activate it.

Only one set.

The incident with Sully landing in the Hudson is an interesting one related to this. They had a dual birdstrike and both engines were totally obliterated and had no thrust at all, but it came up later in the hearing that the computer data showed that one engine still had thrust due to a faulty sensor, so that type of sensor input can't really be trusted in a true emergency/edge case, especially if a sensor malfunctions while an engine is on fire or something.

As a software engineer myself I think it's interesting that we feel software is the true solution when we wouldn't accept that solution ourselves. For example typically in a company you do code reviews and have a release gating process but also there's some exception process for quickly committing code or making adjustments when theres an outage or something. Could you imagine if the system said "hey we aren't detecting an outage, you sure about that? why don't you go take a walk and get a coffee, if you still think there's an outage in 15 minutes from now we will let you make that critical change".

> Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.

The workload is pretty high during the takeoff phase. The engines react right away when fuel flow is stopped. The engine displays can have some lag before data is updated.

Relighting an engine at low speed is not feasible - most need 230-250kts IAS before attempting the operation. Maybe you could do it if the APU was still running and could provide compressed air, but it takes about 20-30 seconds to start up amd then probably 5-10 more to spool up to full thrust. I am speculating here a bit, but the pilot did not have enough time to save the plane even if he did everyting right and as fast as humanly possible.

All this aside is overshadowed by the limited amount of time the pilot flying (I would assume the captain in this case since there was only one ATPL pilot in the cockpit) had to troubleshoot the issue of a dual engine failure - as this is what would have felt to him - during takeoff.

If engine_status == normal and last_activation greater than threshold time

    warn then shut off

Else Shut off immediately End

Override warning time by toggling again.

If the warning period is short enough is it possible it's always beneficial or is 2-3 seconds of additional fuel during a undetected fire more dangerous?

I don't think most think they know better but it's frankly fun to speculate and this is a casual space rather than the serious bodies tasked with actually chewing over this problem in earnest.

I wonder if they could theoretically rest on top of the notch, not fully locked into either position and flip accidentally. No idea how the switches behave when not all the way up or down, but the notch looks pretty long and flat so it could be possible.

This makes me wonder. Is there no audible alarm when the fuel is set to cutoff?

Those switches are the size of a thumb. No one is moving those - separately, mind you - and not realize what is going on.

Too many are willing to accept the Bart Simpson excuse of "I didn't do it" at face value.

Something like this could maybe happen to one switch, it's unlikely but possible. But two independent switches at the same time?

> This is not "reasoning from first principles".

It literally is. Accidental/malicious activation can be catastrophic, therefore it must be guarded against. First principles.

The shutoff timer screen given as an example is a valid way of accomplishing it. Not directly applicable to aircraft, but that's not the point.

> "ugh can't you just do what garmin did"

That's your dishonest interpretation of a post that offers reasonable, relevant suggestions. Don't tell me I need to start quoting that post to prove so. It's right there.

Good point, that is very unlikely. I was just wondering if it's possible at all.

> I would assume the captain

The report states the FO was pilot flying.

But humans can't tell perfectly either and would be responding to much of the same data that automation would be.

I wonder if they could have buttons that are about the situation rather than the technical action. Have a fire response button. Or a shut down on the ground button.

But it does seem like half measure automation could be a contributing factor in a lot of crashes. Reverting to a pilot in a stressful situation is a risk, as is placing too much faith in individual sensors. And in a sense this problem applies to planes internally or to the whole air traffic system. It is a mess of expiring data being consumed and produced by a mix of humans and machines. Maybe the missing part is good statistical modelling of that. If systems can make better predictions they can be more cautious in response.

I'm doing it all the time while rebasing commits or force pushing to my branch. Sometimes I would just click the wrong buttons and end up having to stay late to clean the mess. It's a great thing I'm not a pilot. I would be dead by now.

My bad. I assumed it was the captain since the report says the FO only has a CPL license. And I was a bit surprised he could fly on a comercial airplane with only that kind of license and not an ATPL one.