Preliminary report into Air India crash released

well hold your horses there... from the FAA in their 2019 report linked above:

> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.

> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown

Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.

If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.

Edit: It also seems like the engine cutoff is immediate after the toggle. I wonder if a built in delay would make sense for safety.

My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?

And with how low and slow they were during takeoff, those would have been going off almost instantly.

(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)

Or maybe a design that prevents both switches being off (flip flop?) for X minutes after wheel weight is removed?

Again, it’s probably pointless but it’s an interesting thought exercise.

Suicidal pilots are apparently more common than we’d want.

https://en.wikipedia.org/wiki/China_Eastern_Airlines_Flight_...

There’s always going to be many ways they could crash the plane, such a feature wouldn’t help. The pilots are the only people you can’t avoid fully trusting on the plane.

And yes, it does sound like it was probably intentional. I would still like to see an engineering review of the switch system. Are they normally open or normally closed, In the end the switch instructs the FADEC to cut the fuel, but where does the wiring go in the meantime? what software is in the path? would the repair done before the flight be in that area?(pilot defect report for message STABS POS XCDR), and perhaps compromised the wires?

Doing it accidentally is impossible.

You are trying to draw parallels between the ignition switch in a 1974 Ford Pinto and a 2025 Ford Mustang as if there could be a connection. No.

"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."

So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.

Will the bladder be marketed by Kramerica Industries?

I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.

If there’s a fire or similar problem the fire handles will cut off fuel without the normal shutdown procedure, but the normal switches only need to be used at idle thrust.

I wonder if Airbus has this logic, since their philosophy is to override the pilot commands if they’d endanger the aircraft (which has its own issues of course) where’s Boeing will alert the pilots and still perform the action. I don’t have access to that information.

Formally verified traditional algorithms.

There's a balance of accidents to be found, I think. There are likely cases where fuel does need to be cut off to both engines, and preventing that would lead to accidents that might have been recoverable. This case shows that cutting off fuel to both engines during takeoff is likely unrecoverable. There have been cases where fuel is cutoff to the wrong engine, leading to accidents. Status quo might be the right answer, too.

As another commenter said the Airbus engine start/stop controls are located behind the thrust levers, and according to the A350 operations manual which I got my hands on there are two conditions required for the FADEC to command engine shut down: Run switch to off, thrust lever to idle.

So if that's correct on an Airbus aircraft you can't just switch off the engines when they're commanded to produce thrust. This also seems to be backed up by the difference in the guards for those controls in the Airbus cockpits.

Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.

The fact that the pilots denied that they had shut the switch (one asking the other why they had done so and the other denying it), and that they restarted the engines should be taken into account. Ok, murder suicide is definitely on the table but I would want to see some other reasons for believing that this is so.

If not, why are you speculating with zero knowledge?

A note on the terminology: "evidence" is a piece of data that suggests a conclusion, while not being conclusive by itself. Whereas "proof" is a piece of data that is conclusive by itself.

But here's the thing a "near zero chance" when we are talking about an actual event changes the math

Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident

Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure

So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded

Coming up with ad-hoc solutions is easy, especially the less you know about a complex system and its constraints. I'd say it's not an interesting exercise unless you consider why a solution might not exist already, and what its trade-offs and failure modes are. Otherwise, all you're doing is throwing pudding against a wall, which can of course be fun.

The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.

He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.

Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.

For example, an obvious solution is that the switch can't be changed from "RUN" to "CUTOFF" when the throttle isn't at idle - this could be done with a mechanical detent because they're right next to each other. Simple!

But now you've introduced additional failure modes - throttle sticks wide open and the engine is vibrating and needs to be shut down - so maybe you make it that the shutdown switch can work for ONE engine at any throttle position, but if TWO get turned off, both throttles have to be off, but that introduces ...

If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.

Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.

Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.

And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)

The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.