> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally, they need to be unlocked first by pulling them out.
> In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
And both pilots deny doing it.
It's difficult to conclude anything other than murder-suicide.
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
still, it at least shows that there's been issues with the locking mechanism in the past. inadvertently bumping something that was assumed to be locked is a simpler theory; i find it hard to believe that a murder suicider would take this route, when the china nosedive option is easier, faster, and has a higher chance of success.
The preliminary report says the switches were triggered a second apart, so it would have to have been faulty switches and two inadvertent bumps. That seems unlikely to me.
It's interesting to try to imagine a device that would prevent that, without causing more issues.
My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?
Not that humans are known to behave rationally when trying to commit suicide, but it’s interesting that the switches were re-engaged successfully without protest or a fight. It’s just an interesting detail to wonder about.
The reasoning I’ve heard is: it didn’t matter anymore, the damage was already done and there was no way any attempts at recovering from it would have been successful.
Yeah and the other pilot flipped the switches back on and one of the engines started spooling up but it was too late.
Murder-suicide looks like the likely conclusion, given that flipping the cutoff switches requires a very deliberate action. That said, it's not entirely impossible that due to stress or fatigue the pilot had some kind of mental lapse and post-flight muscle memory (of shutting off the engines) kicked in when the aircraft lifted off.
The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC.
Damn. That's pretty quick to diagnose and take action.
Boeing's probably gonna have a big sigh of relief over this one.
> Boeing's probably gonna have a big sigh of relief over this one.
The 787 is 15 years old, and this particular plane was 10 years old. It always seemed unlikely to be a major, new issue. My money was actually on maintenance.
and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec
Or more precisely, the signals which come from them were found to behave as such.
Without any audible record of turning the switches off, I wouldn't blame the pilots without first checking the wiring and switches themselves for faults. This reminds me of the glitches caused by tin whiskers.
I agree, there's a significant distinction between "the switches were (physically) flipped" and "the circuit was opened/closed".
In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.
The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.
If that was the case, it does seem a bit odd that there was a one second gap. But yeah, still worth investigating, if that’s even possible given the extensive damage.
Does the Flight Data Recorder consider the physical position of the fuel switches or does it get the information from some fly-by-wire part that could be buggy?
The conversation would suggest that the switches were in CUTOFF position, but there is also a display that summarizes the engine status.
There is no conversation that mentions flipping the switch to RUN again.
EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
Airlines are decades behind on tech. You can get satellite internet almost anywhere on the planet and GPS can give you ten-foot accurate positioning, but we've still _lost_ planes because we haven't mandated a system that sends the realtime position of the plane over the satellite internet. The days of limited storage are still going strong in the industry.
I wonder if the switches are still in tact after the crash? Can they verify that the switches are mechanically sound? If so, seems highly likely it was intentional.
You have to pull the switches out (against a spring) to be able to move them over a notch and flip them. Not really something you can just mistake for another switch or bump into by accident.
I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.
Did you mean to say you can activate the switches with one hand simultaneously? That is probably what the above commenter assumed you meant. Since lifting and twisting two switches simultaneously with one hand seems challenging.
?? One pilot to other: why cut-off. Other: Did not do it
08:08:52 Engine 1 run
08:08:52 Engine 2 run
1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.
Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The big question is whether the switches were moved or something made it seem as if the switches were moved.
Well in the murder-suicide scenario it makes sense for the culprit to turn them off as quickly as possible. The longer time to turn them on could plausibly be a struggle or simply needing to fly the plane while reaching for each switch individually.
It could be defective switch springs, fatigue-induced muscle memory error, or something else. The pilot who did it saying he did not may not have realized what he did. It's pretty common under high workload when you flip the wrong switch or move a control the wrong way to think that you did what you intended to do, not what you actually did.
That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.
They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.
Still... that has its own set of risks and failure modes to consider.
Was thinking this same thing. A minute feels like a long time to us (using a Garmin as the example said) but a decent number of airplane accidents only take a couple minutes end to end between everything being fine and the crash. Building an insulation layer between the machine and the experts who are supposed to be flying it only makes it less safe by reducing control.
This is a place that puts "Hacker" in the name despite the stigma in the mainstream. Given the intended meaning of the term, I would naturally expect this to be a place where people can speculate and reason from first principles, on the information available to them, in search of some kind of insight, without being shamed for it.
You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.
Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.
A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.
Do you know if the mechanical position of the switch guarantees its electronic state without any possibility for hardware malfunction? If no, then you are claiming a person made one of the most grave acts of inhumanity ever.
This sounds to me like an electronics issue - an intermittent, inadvertent state transition likely due to some PCB component malfunction
The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated. Malice looke very likely to me. An investigation into the pilots life may turn something up, I guess.
It’s worth noting that Premeditation or “intention” doesn’t have to factor into this.
Studies of survivors of impulse suicides (jumping off of bridges etc) indicate that many of them report having no previous suicidal ideation, no intention or plan to commit suicide, and in many cases no reported depression or difficulties that might encourage suicide.
Dark impulses exist and they don’t always get caught in time by the supervisory conscious process. Most people have experienced this in its more innocuous forms, the call of the void and whatnot, but many have also been witness to thoughtless destructive acts that defy reason and leave the perpetrator confused and in denial.
> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated
How so? It is just as likely to be an intermitted electronic malfunction.
And then 10s later the switches magically fixed themselves? The likely not electronically connected switches since that would compromise engine redundancy?
It is, and one would expect that a single switch failure would be far more probable, so how often have we had switch failure single engine cutoff in the 787?
it makes sense to me that the pilot who said "I did not do it" actually did do it without realizing it, was supposed to be putting the landing gear up when he committed a muscle memory mistake. it happened around the time the landing gear should be up, and this explanation matches what was said in the cockpit, and the fact that the landing gear wasn't retracted. I think this idea was even floated initially by the youtube pilot/analysts I watch but dismissed as unlikely.
One of the nice things about finally having the preliminary report is I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk at work because the preliminary report solidly disproved all of them so far. If anyone even had and stuck with an idea matching this report it wouldn't have stood out in the conversations anyways.
The collection of comments on this post remind me it'll just be a brand new set of random guesses until the final report is released. Or worse - the final report reaches no further conclusions and it just has to fade out of interest naturally over time.
> There is no possible way to confuse these two actions.
This is obviously an overstatement. Any two regularly performed actions can be confused. Sometimes (when tired or sick or distracted) I've walked into my bathroom intending to shave, but mistakenly brushed my teeth and left. My toothbrush and razor are not similar in function or placement.
Studying how humans make errors is a fascinating field. Simply banning someone who's made a "slip" error as hypothesized wouldn't actually reduce the likelihood of this error occurring in the future. These sorts of errors are stochastic and could happen to anyone at any time. Preventing them requires a lot of thought.
The landing gear lever is rather prominently featured in the 787 in a panel central to the cockpit layout so that either pilot can easily reach it. For decades and across many manufacturers, the landing gear lever has traditionally featured a knob that deliberately resembles an airplane wheel. It's very hard to mistake it for anything else. It's actuated by simply moving it up or down.
The fuel control switches are behind the throttle stalks above the handles to release the engine fire suppression agents. These switches are markedly smaller and have guards on each side protecting them from accidental manipulation. You need to reach behind and twirl your fingers around a bit to reach them. Actuating these switches requires pulling the knob up sufficiently to clear a stop lock before then rotating down. There are two switches that were activated in sequence and in short order.
The pilot monitoring is responsible for raising the gear in response to the pilot flyings' instruction.
I would find it very difficult to believe this was a muscle memory mistake. At the very least, I would want to more evidence supporting such a proposition.
This idea strikes me as even more unlikely than someone shifting their moving vehicle into reverse while intending to activate the window wipers.
If you shut off the engines a couple of dozen meters above ground shouldn’t every alarm be blaring or there should be some sort of additional lever you have to pull way out of the way to enable shutting off the engine that close to the ground.
i have several passwords i type all the time. sometimes i get them confused and type the wrong one to the wrong prompt. i type them by muscle memory, but i also think about them while typing and i think thoughts like "time to reach up and to the left on the keyboard for this password". I couldn't tell you the letter i'm trying to type, i just know to do that.
not all my passwords are up and to the left, some are down and to the right, but when i type the wrong one into the wrong place, i type it accurately, i'm just not supposed to be typing it.
"time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
that makes it less likely, not impossible, we're trying to match against the data we have. I think distracted muscle memory is more likely than suicide and sounding innocent while lying about it
> The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
I know it's probably not worth the hazmat tradeoff for such a rare event, but the F-16 has an EPU powered by hydrazine that can spool up in about a second.
Each of the fuel switches on the 787 is equipped with a locking mechanism that is supposed to prevent accidental movement, experts said. To turn the fuel supply on, the switch must be pulled outward and then moved to a “RUN” position, where it is released and settles back into a locked position. To turn the fuel supply off, the switch must be pulled outward again, moved to the “CUTOFF” position and then released again.
Fire, probably. But also, how complicated would you make the system if you needed to prevent certain switches from working during certain times of flight? At some point... we're all just in the hands of the people in the cockpit.
There may be a good reason to cut fuel to one engine shortly after takeoff.
You could have a system that prevents both switches being thrown, and only in the specific window after takeoff, but you’ve also now added two additional things that can fail.
Disable the fuel system cutoff controls during the takeoff climb phase of flight. Once the aircraft loses contact with the runway, these controls shouldn't function without tripping certain thresholds (speed & altitude), or following a two-man procedure that is physically impossible to execute solo. In any other flight regime, the controls function as originally designed.
The danger of a burning engine is irrelevant if you are heading into terrain.
Now you created a fuel system cutoff control inhibition system which may malfunction in its own ways, e.g., refuse to cut off fuels from a burning engine because it thinks the plane is too low due to faulty altimeter reading.
It's safe to state these fuel cutoff switches aren't to be touched in-flight unless the word 'fire' is said beforehand. Even then, you only perform fuel cutoff for the flaming engine. If the copilot was busy with takeoff, there is exactly one other person in the entire world that could have flipped both switches. We may never know which one flipped them back.
Since everyone seems to be dancing around the issue, here are the facts as they stand:
- There is no chance that the fuel switches were turned off by accident.
- They were off for about five seconds. One pilot asked “why did you turn them off?” and the other said “I didn’t.”
- They were flipped back on five seconds later. So, ten seconds of off time total.
- It takes a long time for jet engines to spool up; it’s not like a propeller, where the thrust comes back instantly. Ten seconds at 600ft was a death sentence.
- This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
So the big question is, who was flying? The report doesn’t say. (EDIT: actually, the report says the co-pilot was the pilot flying; thanks for the correction.)
In the cockpit, one person is designated “pilot flying” and the other “pilot monitoring.” During takeoff, the pilot flying is completely focused on takeoff. This would be the perfect opportunity to betray your colleague as the pilot monitoring.
- The younger of the two was pilot flying. That means the older person was pilot monitoring.
- This person was also a few flights away from retirement.
(They’re experienced pilots who are quite certain the switches were moved intentionally, but they carefully go out of their way not to label it as an act of malice. But, as one of them say, “maybe it was the brain fart of the century” — but the implication is, probably not.)
One of the pilots singlehandedly slaughtered ~300 people. You can believe what you’d like at this stage, but personally, I’d put money on it being the older of the two.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Even taking intent for granted, to deny suicide in a case like this would be to suppose that the person responsible expected to survive while everyone else died. What could possibly support that conclusion?
He appears to have meant something like “this isn’t just common murder-suicide: it is a particularly heinous version of murder-suicide that I wish there were a stronger word for” but phrased it confusingly.
The report says the black box reports the fuel cutoff switches being activated. That doesn't necessarily mean that either of the two pilots activated them, it just means that the fly-by-wire system reacted to a fuel cutoff event.
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cutoff.
In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
> That doesn't necessarily mean that either of the two pilots activated them
It does:
1. Those switches have physical interlocks and cannot be manipulated by any computer system.
2. The flight data recorder is measuring the position of the switches; they aren't inferring the position from some system state. There's a "position of this switch" channel.
The switches were physically moved in the cockpit, that's basically ground truth. The question now is who and why.
What is the path of the wires from the switch onward? Do they go into a digital input of the flight computer, or do they directly feed the fuel control valves?
The 787 entered service with an improved fly-by-wire flight control system. Rather than mechanical processes, the systems convert flight deck crew inputs into electrical signals. Still, there were additional advancements with the type."
Can't find a definitive source right now, but everything is implying there are discrete lines - at least one for command signal to the FADECs, and a separate sense line to the DFDAU for packaging up and sending to the EAFR. That lines up with design philosophy on this stuff of sensing control input data as close to the source as you can get.
Thanks for looking. I worked for Boeing (satellites, not airplanes) for a good part of my career, and I was there when Dennis Muilenburg pushed through his cost saving measures. It was the same culture that created the problems with the 737-MAX. Experienced design engineers were replaced/outsourced and the culture of safety was sacrificed. One example here:
787 (Dreamliner) was pushing hard for weight reduction, and it would not surprise me at all if the switch output fed a digital computer input rather than routing directly to the fuel shutoff valves, but I don't have any direct knowledge of this.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Why wouldn’t this qualify as a murder-suicide, assuming your theory is correct?
I guess I let my emotions get in the way. But nobody seems to be saying that we’ve witnessed one of the worst acts of mass murder in history. Most of the notorious serial killers don’t come close to killing 300 people.
It feels qualitatively different than someone pointing a gun at someone else and then themselves, which is usually what pops to mind when you hear “murder-suicide”.
As someone with no qualifications on this beyond occasionally playing some flight simulators, I can't think of a reason you would ever intentionally move the switches in flight (barring an emergency like a leak or fire or something) and unintentionally doing so seems extremely unlikely since generally "switches meant to be operated on the ground" are located well out of the way of "switches meant to be operated in flight". Though I believe Boeing does have them by the thrust levers, every type of fuel control switch I've seen has some sort of guard or mechanism that makes it effectively impossible to move the switch by simply bumping it.
So I can't imagine how it could have been done accidentally.
The switches require that you pull them out, move them to the end position and then push them back down, and it was two switches. It could have still took off on one engine. This is essentially the turn off plane switch. It would seem to almost impossible that it would be an accident.
I am, and I’m willing to stake my reputation on it. If I’m wrong, I’ll hang up my hat and never cover live news again.
Pilots are drilled from day one that the fuel switches are sacred. After a few accidents where one engine failed and the pilot accidentally turned off the remaining functional engine, the training was overhauled so that it would be impossible for it to be an easy action done by mistake. One pilot is required to ask the other for confirmation before toggling the switch, I believe. It wouldn’t be something you’d do from muscle memory.
> If I’m wrong, I’ll hang up my hat and never cover live news again.
It easy to say that when you know there's likely no way to prove or disprove whether it as an accident or not. Unless a pilot left a note stating his future intentions, there's no way to determine their state of mind.
Someone took their hand, pulled one spring-loaded switch into the off position, and then did it the other switch moments later. Is there any way that could be accidental?
If there was no mechanical failure, the only remaining possibility is deliberate action. And if it was mechanical failure, we’d see an emergency air worthiness directive being issued, which we haven’t.
People do things bizarre, inexplicable things all the time. It's called a brain fart... the human brain is complicated, sometimes wires just get crossed.
Honestly I think the chances are good that you're right, but the way you're presenting it as absolutely certain strikes me as overconfident, borderline arrogant.
Also, what's with the whole "staking your reputation" thing? What reputation? Are you some kind of famous journalist? Is there some reason we should care about you "covering live news" ? Serious questions -- I personally have no idea who you are.
I also don't recognize this guy's name, but I do find it ironic that his profile is possibly the most well-linked to a other identities I've ever seen on HN: https://news.ycombinator.com/user?id=sillysaurusx
It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
The victims also deserve to be acknowledged. At this point the overwhelming body of evidence points to a deliberate act. Pilots are trained never to touch the fuel switches in flight, and (I believe) there is a verbal confirmation required before toggling. This captain had over 8,000 hours.
The reason I’m so confident is because I trust the system. It’s designed so that if either of the two pilots do anything, they verbally call it out, e.g. "gear up." A callout like that followed by fuel switch cutoff would indicate it was accidental. But as far as I know, there was no callout.
The pilot flying is also the one who asks for gear up and such. It’s the job do the pilot monitoring to perform those actions.
Suppose it was accidental. That would mean the pilot flying was fiddling with switches instead of flying; that’s against SOP. Or it would mean the pilot monitoring was performing uncommanded actions, which is also against SOP. It’s not something that happens on a whim. Both are contradictions, hence, no accident.
As for being overconfident or arrogant, what matters to me is accuracy, and passing along that accuracy. No one seemed to be willing to publicly call this a malicious action, so I did. If I’m wrong, you can be sure I’ll feel terrible for weeks, post an apology in the thread that shows I was wrong, and then bow out in disgrace, never to cover news again.
People here did the same thing when the common belief was that there was a non-zero chance of nuclear war. I was one of the few voices in that thread saying absolutely not, stop stressing yourself out for no reason.
I’m simply one voice of many. As always, it’s up to the reader to decide what to believe.
> It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
Then why not either wait until there's more information or temper your remarks by acknowledging there's still ambiguity? That would directly hedge against spreading misinformation, whereas staking your reputation on it and then shutting up if you're wrong only works after the misinformation has spread and doesn't seem very productive.
I think the right response to realizing you've spread misinformation (in the event that you turn out to be mistaken [I think it's 60-40 in favor of deliberate]) is to temper your statements and rededicate yourself to checking the facts, not removing yourself from the discussion altogether. And if you were keeping your mouth shut, wouldn't you continue to see discussions you could meaningfully contribute to, and after a while wouldn't you wonder whether anyone was really benefitting from your silence?
I was about to leave a big reply, but then I remembered that the guidelines ask that we only comment when feeling intellectual curiosity. That’s not what I’m feeling now, so I’ll go spend the evening with my daughter. I hope you have a nice evening as well.
The report indicates the cut off switches were found, and were in the RUN position. However, the report does not indicate if the locking mechanism was functional; given the thermal damage, it might not be possible to determine.
I'm also interested in the earlier switch defects where the switches were installed with the locking mechanism disengaged on some 737s and inspection was advised for 787, but the incident aircraft was not inspected.
The airworthiness directive for that [1] indicates switches with locking disengaged should be replaced, but I wonder if it's possible to reingage the locking somehow, which could result in a situation where the locking wasn't engaged, the switches changed inadverdently and then when restored the run position the lock was engaged... that's a big reach, of course.
All that said, assuming the switch was working as designed, there's a semantic argument around deliberate and intentional. If the switch requires specific action, it's fair to call it deliberate action; but if the switcher thought they were activating a different switch, it's not murder.
Either way, there's no sense rushing to a conclusion of murder. Assuming one of the pilots activated the switch, they have already died and they are beyond the effects of human judgement; so we may as well wait for further information.
You mention "brain fart". There is certainly a long history of pilots selecting the wrong lever, or wrong switch. So, it is possible the pilot who denied switching the fuel off thought he had switched something else.
My understanding is that after several incidents of pilots shutting off the wrong engine, the training was overhauled so that from day one they treat fuel switches as sacred. I heard that it’s required to ask for confirmation before toggling the switch, just to be absolutely certain. It’s not really something that can be done by muscle memory during flight, and especially not during takeoff.
If he was trying to do something else, he would have called it out. E.g. an audible “gear up.”
Also, it took 10 and 14 seconds to switch them back on. If it was an accidental switch, you would think it would have been quicker to switch them back.
I have a couple of those type of switches, though smaller, in my parts bin. They were from some piece of surplus equipment that got junked. Where I've seen them used is in a crowded control panel where they might just get bumped. The two red plastic levers to the left are another type of safety switch: The lever is spring loaded, and covers the handle of a toggle switch.
In my view it would be quite hard to move them by accident, and probably not possible to move at once.
It would be interesting to know if the plane has any other switches of the same type, that are routinely activated.
Sadly not. It’s a physical switch with no capability of a remote toggle. The flight data recorder clearly shows one was toggled off within a second of the other, which rules out almost every non-intentional scenario.
Is this a switch that has a dedicated connection to the corresponding cutoff valve? Or does it go through some common digital bus that passes commands? If so, how well is this bus protected?
Another commentator has pointed out that the flight data recorder records two signals - one for the switch itself, and one for the actual valve movement.
I take your point that we should always be suspicious of complicated, digital buses, and this is not the final report, so there’s still plenty of time to uncover weirdness. However, if the flight date reporter shows the switch being thrown, and then a few milliseconds later, shows the valve starting to close, and the same sequence happening shortly there after on the second switch and valve, I feel this would really limit the likelihood of any digital shenanigans.
It's an entirely different shape, different location, and different motion from any other switch they could be looking for. Suicide is a way more likely explanation.
As we just reported, the report says that according to data from the flight recorder both the fuel control switches, which are normally used to switch the engines on or off when on the ground, were moved from the run to the cutoff position shortly after takeoff. This caused both engines to lose thrust.
The preliminary report suggests this is pilot error.
From my (limited) understanding you cannot really switch these off inadvertently as they require a couple of actions in order to be switched off. So it would mean one of the pilots switched these off (and they were a few seconds later switched on again but it was too late).
But there was audio, too, and one pilot asked the other "why did you switch these off" and the second one said "I didn't".
They only ever got a few hundred feet off the ground.
Yes of course the plane glided once the engines stopped, producing thrust, just like all planes do. But just like all planes, and all gliders, gliding means trading altitude for velocity - giving up precious height every second in order to maintain flight. At that stage in the flight, they just didn’t have enough to give. If the same thing had happened at 30,000 feet, it would be a non-event. They would glide down a few thousand feet as the engines spool back up and once they return to full power, everything will be back to normal. Or if for some reason, the engines were permanently cooked, you’d have maybe 20 to 30 minutes of glide time so you’ve got a lot of time to look around and find a flat spot. But you just don’t have enough time for all that to happen When you’re a few hundred feet off the ground.
It did glide briefly, the glide path took it directly into a school building.
Right after takeoff at low altitude is basically the worst place for this to happen. Speed and altitude are low so gliding is going to be a short distance and happen quickly.
If there had been a perfect empty long flat grass field in that location it may have been salvageable, but also right after takeoff the plane usually has a heavy fuel load which makes for a much riskier landing.
I’ll take this as an honest question. The simple answer: too much mass, no clear landing path, not enough speed or altitude to turn to find one and glide to it. In short, not enough time. Once the engines cut, that thing probably dropped like a brick.
The India AAIB website (https://aaib.gov.in/) is not responding ... For anyone who read the report, was there information about the age & experience of the pilots?
And this can't possibly be all the audio if the other pilot noticed the switch position, I would expect a lot more cussing and struggle.
So they didn't notice the switch position? The switch was in the right position but not really? Is this a rarely used switch that one might not look at (or know where to look) during regular use?
Dual engine failure on takeoff gives them about as much time to react as if the front passenger grabbed the steering wheel while on a windy mountain road and yanked them off a cliff.
It only takes a few seconds to completely screw everyone, but a bit longer for the consequences to occur.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
So the fuel supply was cut off intentionally. The switches in question are also built so they cannot be triggered accidentally, they need to be unlocked first by pulling them out.
> In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.
And both pilots deny doing it.
It's difficult to conclude anything other than murder-suicide.
https://ad.easa.europa.eu/ad/NM-18-33
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
https://www.youtube.com/live/SE0BetkXsLg?si=LPss_su3PVTAqGCO
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
If this is what actually happened it would be the second in recent memory: https://en.wikipedia.org/wiki/Germanwings_Flight_9525.
Third, since there's no other plausible explanation for this and China has classified the report.
https://en.wikipedia.org/wiki/China_Eastern_Airlines_Flight_...
Fourth? https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_370#M...
Fifth. https://en.wikipedia.org/wiki/EgyptAir_Flight_990
[dead]
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
Is it easy to inadvertantly move both switches in such a scenario?
No.
Well, can you move it back, when accidentally activated?
Turbines take a while to spin up again, it's not like start/stop in a car.
Yes, and it restarts the engines, but it takes on the order of seconds; too long at that altitude. One of the pilots did that, but it was too late.
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
Same manufacturer, Air India 171 was a 787-8 though.
The affected table includes these models as well: 787-8, -9, and -10
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
still, it at least shows that there's been issues with the locking mechanism in the past. inadvertently bumping something that was assumed to be locked is a simpler theory; i find it hard to believe that a murder suicider would take this route, when the china nosedive option is easier, faster, and has a higher chance of success.
The preliminary report says the switches were triggered a second apart, so it would have to have been faulty switches and two inadvertent bumps. That seems unlikely to me.
Cutting fuel just after takeoff leaves almost zero time for the other pilot to recover.
It's interesting to try to imagine a device that would prevent that, without causing more issues.
My preliminary idea is a "fuel bladder" for take-off that inflates with enough fuel to get the plane to a recoverable altitude, maybe a few thousand feet?
I think engine fires are still more common than suicidal pilots and inadvertant fuel shutoff activations.
The idea would be something that is ONLY operational after V₁ and until some safe height.
Or maybe a design that prevents both switches being off (flip flop?) for X minutes after wheel weight is removed?
Again, it’s probably pointless but it’s an interesting thought exercise.
Suicidal pilots are apparently more common than we’d want.
The flip flop thing is a neat idea since a single engine can typically maintain level flight and two burning engines is rare.
Thanks for pointing it out.
They don't mention the locking mechanism being disabled
One would assume a toggle like that would come with blaring alarms and blinking lights… right? Right??
Edit: It also seems like the engine cutoff is immediate after the toggle. I wonder if a built in delay would make sense for safety.
> I wonder if a built in delay would make sense for safety.
(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)
Low altitude, stall, and impact with terrain certainly will.
And with how low and slow they were during takeoff, those would have been going off almost instantly.
Not that humans are known to behave rationally when trying to commit suicide, but it’s interesting that the switches were re-engaged successfully without protest or a fight. It’s just an interesting detail to wonder about.
The reasoning I’ve heard is: it didn’t matter anymore, the damage was already done and there was no way any attempts at recovering from it would have been successful.
Yeah and the other pilot flipped the switches back on and one of the engines started spooling up but it was too late.
Murder-suicide looks like the likely conclusion, given that flipping the cutoff switches requires a very deliberate action. That said, it's not entirely impossible that due to stress or fatigue the pilot had some kind of mental lapse and post-flight muscle memory (of shutting off the engines) kicked in when the aircraft lifted off.
> post-flight muscle memory (of shutting off the engines) kicked in
Possible, and if so it is too early to conclude it was murder-suicide.
See also: https://www.thehindu.com/news/national/dgca-slaps-80-lakh-fi...
The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.
that doesn’t tell us they were fresh. Only that they hadn’t flown. They could’ve slept 0 hours before or any number of things.
> The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
> As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC.
Damn. That's pretty quick to diagnose and take action.
Boeing's probably gonna have a big sigh of relief over this one.
> Boeing's probably gonna have a big sigh of relief over this one.
The 787 is 15 years old, and this particular plane was 10 years old. It always seemed unlikely to be a major, new issue. My money was actually on maintenance.
and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec
Or more precisely, the signals which come from them were found to behave as such.
Without any audible record of turning the switches off, I wouldn't blame the pilots without first checking the wiring and switches themselves for faults. This reminds me of the glitches caused by tin whiskers.
I agree, there's a significant distinction between "the switches were (physically) flipped" and "the circuit was opened/closed".
In this case, it may be a moot distinction, particularly if no physical evidence of fault or tampering has been discovered in investigation. But, in theory, very important - there's a lot of potential grey-area between the two statements.
The proximity of the incident to the ground may also increase the possible attack vectors for simple remote triggers.
If that was the case, it does seem a bit odd that there was a one second gap. But yeah, still worth investigating, if that’s even possible given the extensive damage.
Does the Flight Data Recorder consider the physical position of the fuel switches or does it get the information from some fly-by-wire part that could be buggy?
The conversation would suggest that the switches were in CUTOFF position, but there is also a display that summarizes the engine status.
There is no conversation that mentions flipping the switch to RUN again.
EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
> EDIT: Why is there no Cockpit Video Recorder? The days of limited storage are over.
Pilots unions are dead against it.
And now some pilots are dead.
Just allow cockpit video recorders, and if they're ever used for anything, the pilots (or their heirs) get $250k in cash.
Are you actually using a tragedy like this to launch an assault on organized labour?
[dead]
Airlines are decades behind on tech. You can get satellite internet almost anywhere on the planet and GPS can give you ten-foot accurate positioning, but we've still _lost_ planes because we haven't mandated a system that sends the realtime position of the plane over the satellite internet. The days of limited storage are still going strong in the industry.
Yes there is.
I wonder if the switches are still in tact after the crash? Can they verify that the switches are mechanically sound? If so, seems highly likely it was intentional.
There are pictures of them in the report.
> It's difficult to conclude anything other than murder-suicide.
Is it possible it could have been an accident or a mistake by one of the pilots? How intention-proofed are engine cutoffs?
You have to pull the switches out (against a spring) to be able to move them over a notch and flip them. Not really something you can just mistake for another switch or bump into by accident.
I'd liken it to turning off the ignition by turning the key while driving your car. Possibly something that could happen if you're really fatigued, but requires quite a mental lapse.
Report says the switches went to cutoff one second apart from each other. Can a human do the physical operation on two switches that quickly?
There's a good photo of them here; https://theaircurrent.com/aviation-safety/ai171-investigatio...
You can do them both with one hand.
Are you completely sure you can considering that they are spring loaded and they are like 7-10cm apart judging by the size of other controls?
I don't understand your question. I have done this myself, am I completely sure?
Did you mean to say you can activate the switches with one hand simultaneously? That is probably what the above commenter assumed you meant. Since lifting and twisting two switches simultaneously with one hand seems challenging.
Above commenter said _quickly_, not simultaneously
It didn't happen simultaneously so this is irrelevant.
It is relevant to the interaction I replied to.
If you do them both with one hand, would they not be moved at the same instant rather than 1 second apart?
They require a per-switch motion, so unlikely.
The timing is really curious.
08:08:35 Vr
08:08:39 Liftoff
08:08:42 Engine 1 cut-off
08:08:42 Engine 2 cut-off
08:08:47 minimum idel speed reached
?? One pilot to other: why cut-off. Other: Did not do it
08:08:52 Engine 1 run
08:08:52 Engine 2 run
1 second to switch them both off and then 4 seconds to switch them both on. No one admitted to switch them off. They are probably going with fine comb over the audio and also the remains of the chared switches.
Looks like the engines react very quickly to cut-off so it is not clear whether the question about the cut-off is prompted by a glance to the switches or the feel of the airplane.
The big question is whether the switches were moved or something made it seem as if the switches were moved.
Well in the murder-suicide scenario it makes sense for the culprit to turn them off as quickly as possible. The longer time to turn them on could plausibly be a struggle or simply needing to fly the plane while reaching for each switch individually.
It could be defective switch springs, fatigue-induced muscle memory error, or something else. The pilot who did it saying he did not may not have realized what he did. It's pretty common under high workload when you flip the wrong switch or move a control the wrong way to think that you did what you intended to do, not what you actually did.
That said Boeing could take a page out of the Garmin GI275. When power is removed it pops up a "60s to shutdown dialog" that you can cancel. Even if you accidentally press SHUTDOWN it only switches to a 10s countdown with a "CANCEL" button.
They could insert a delay if weight on wheels is off. First engine can shutdown when commanded but second engine goes on 60s delay with EICAS warning countdown. Or just always insert a delay unless the fire handle is pulled.
Still... that has its own set of risks and failure modes to consider.
When your engine catches on fire/blows apart on takeoff you want to cut fuel as fast as possible.
Was thinking this same thing. A minute feels like a long time to us (using a Garmin as the example said) but a decent number of airplane accidents only take a couple minutes end to end between everything being fine and the crash. Building an insulation layer between the machine and the experts who are supposed to be flying it only makes it less safe by reducing control.
Armchair safety/human factors engineering, gotta love HN.
This is a place that puts "Hacker" in the name despite the stigma in the mainstream. Given the intended meaning of the term, I would naturally expect this to be a place where people can speculate and reason from first principles, on the information available to them, in search of some kind of insight, without being shamed for it.
You don't have to like that culture and you also don't have to participate in it. Making a throwaway account to complain about it is not eusocial behaviour, however. If you know something to be wrong with someone else's reasoning, the expected response is to highlight the flaw.
Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.
Or a mechanical failure
Both switches, at slightly different times? Seems pretty unlikely.
A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.
Do you know if the mechanical position of the switch guarantees its electronic state without any possibility for hardware malfunction? If no, then you are claiming a person made one of the most grave acts of inhumanity ever.
This sounds to me like an electronics issue - an intermittent, inadvertent state transition likely due to some PCB component malfunction
The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated. Malice looke very likely to me. An investigation into the pilots life may turn something up, I guess.
It’s worth noting that Premeditation or “intention” doesn’t have to factor into this.
Studies of survivors of impulse suicides (jumping off of bridges etc) indicate that many of them report having no previous suicidal ideation, no intention or plan to commit suicide, and in many cases no reported depression or difficulties that might encourage suicide.
Dark impulses exist and they don’t always get caught in time by the supervisory conscious process. Most people have experienced this in its more innocuous forms, the call of the void and whatnot, but many have also been witness to thoughtless destructive acts that defy reason and leave the perpetrator confused and in denial.
> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated
How so? It is just as likely to be an intermitted electronic malfunction.
There is also audio of the pilots discussing the issue.
Murder-suicide has happened on a few occasions. How many times has your malfunction occurred on an aircraft fuel system?
Not precisely the electrical malfunction, but dual engine shutdown has occurred, fortunately after landing:
https://www.aerosociety.com/news/ana-787-engine-shutdown/
That doesn't seem to be a malfunction at all.
And then 10s later the switches magically fixed themselves? The likely not electronically connected switches since that would compromise engine redundancy?
All this rests on whether we have CVR audio of the pilot(s) manipulating the switches.
intermittent state switching is absolutely a thing in (poorly designed/manufactured/tested/QC'd) electronics
It is, and one would expect that a single switch failure would be far more probable, so how often have we had switch failure single engine cutoff in the 787?
The other pilot likely flipped them back - but at that point, it was impossible to avoid crashing.
So you're telling me that those switches don't have a voice that says "fuel cutoff switches transitioned" like in the movies? That's bad design
it makes sense to me that the pilot who said "I did not do it" actually did do it without realizing it, was supposed to be putting the landing gear up when he committed a muscle memory mistake. it happened around the time the landing gear should be up, and this explanation matches what was said in the cockpit, and the fact that the landing gear wasn't retracted. I think this idea was even floated initially by the youtube pilot/analysts I watch but dismissed as unlikely.
One of the nice things about finally having the preliminary report is I get to stop hearing all of the same assumptions/theories/YouTuber said/"a guy I know got a leaked report"/etc in water cooler talk at work because the preliminary report solidly disproved all of them so far. If anyone even had and stuck with an idea matching this report it wouldn't have stood out in the conversations anyways.
The collection of comments on this post remind me it'll just be a brand new set of random guesses until the final report is released. Or worse - the final report reaches no further conclusions and it just has to fade out of interest naturally over time.
There is no possible way to confuse these two actions. There's a reason a wheel is attached to the gear lever.
> There is no possible way to confuse these two actions.
This is obviously an overstatement. Any two regularly performed actions can be confused. Sometimes (when tired or sick or distracted) I've walked into my bathroom intending to shave, but mistakenly brushed my teeth and left. My toothbrush and razor are not similar in function or placement.
you probably shouldn't be a pilot, bub
Studying how humans make errors is a fascinating field. Simply banning someone who's made a "slip" error as hypothesized wouldn't actually reduce the likelihood of this error occurring in the future. These sorts of errors are stochastic and could happen to anyone at any time. Preventing them requires a lot of thought.
[dead]
Sometimes people put cleaning liquid in the fridge.
Given a long enough span of time, every possible fuck up eventually will happen.
Probably time to design a plane that can't be sent into terrain in seconds by flipping a switch.
"Sent into terrain in seconds by flipping a switch" is both too inaccurate and flippant to take as serious design criticism.
The landing gear lever is rather prominently featured in the 787 in a panel central to the cockpit layout so that either pilot can easily reach it. For decades and across many manufacturers, the landing gear lever has traditionally featured a knob that deliberately resembles an airplane wheel. It's very hard to mistake it for anything else. It's actuated by simply moving it up or down.
The fuel control switches are behind the throttle stalks above the handles to release the engine fire suppression agents. These switches are markedly smaller and have guards on each side protecting them from accidental manipulation. You need to reach behind and twirl your fingers around a bit to reach them. Actuating these switches requires pulling the knob up sufficiently to clear a stop lock before then rotating down. There are two switches that were activated in sequence and in short order.
The pilot monitoring is responsible for raising the gear in response to the pilot flyings' instruction.
I would find it very difficult to believe this was a muscle memory mistake. At the very least, I would want to more evidence supporting such a proposition.
This idea strikes me as even more unlikely than someone shifting their moving vehicle into reverse while intending to activate the window wipers.
If you shut off the engines a couple of dozen meters above ground shouldn’t every alarm be blaring or there should be some sort of additional lever you have to pull way out of the way to enable shutting off the engine that close to the ground.
even though that raising the gear is a up motion and fuelcut off is a down motion?
And fuel cutoff is _two_ down motions? That's the death knell for this theory, imo.
i have several passwords i type all the time. sometimes i get them confused and type the wrong one to the wrong prompt. i type them by muscle memory, but i also think about them while typing and i think thoughts like "time to reach up and to the left on the keyboard for this password". I couldn't tell you the letter i'm trying to type, i just know to do that.
not all my passwords are up and to the left, some are down and to the right, but when i type the wrong one into the wrong place, i type it accurately, i'm just not supposed to be typing it.
"time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.
Would anyone be surprised if an accomplished concert pianist played C Bb Bb instead of C E in a piece they had played thousands of times correctly?
The only difference here is that the consequences are death instead of mere head shaking.
Murder needs more proof than just performing the wrong action. Until then we should apply Hanlon's Razor.
Sometimes I drive all the way home without being aware of what I did in between.
that makes it less likely, not impossible, we're trying to match against the data we have. I think distracted muscle memory is more likely than suicide and sounding innocent while lying about it
> The EGT was observed to be rising for both engines indicating relight. Engine 1’s core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery.
I know it's probably not worth the hazmat tradeoff for such a rare event, but the F-16 has an EPU powered by hydrazine that can spool up in about a second.
I suspect any civil aviation engineer who goes "let's add hydrazine!" to fix problems has a fairly short career, lol.
Yeah, now you have at least two problems.
Each of the fuel switches on the 787 is equipped with a locking mechanism that is supposed to prevent accidental movement, experts said. To turn the fuel supply on, the switch must be pulled outward and then moved to a “RUN” position, where it is released and settles back into a locked position. To turn the fuel supply off, the switch must be pulled outward again, moved to the “CUTOFF” position and then released again.
https://www.nytimes.com/2025/07/11/world/asia/air-india-cras...
Why can the pilot shut off the fuel during takeoff?
Fire, probably. But also, how complicated would you make the system if you needed to prevent certain switches from working during certain times of flight? At some point... we're all just in the hands of the people in the cockpit.
I can't put my car into reverse gear while driving down the freeway.
There’s no good reason to do that.
There may be a good reason to cut fuel to one engine shortly after takeoff.
You could have a system that prevents both switches being thrown, and only in the specific window after takeoff, but you’ve also now added two additional things that can fail.
Completely uneducated guess but if one engine bursts into flames you might want to kill the fuel.
What you are really asking is: would we, the passengers, be safer without human pilots?
Eventually, yes. Soon? Maybe.
Suggest a system that would prevent this, but only this, without causing other risks.
Disable the fuel system cutoff controls during the takeoff climb phase of flight. Once the aircraft loses contact with the runway, these controls shouldn't function without tripping certain thresholds (speed & altitude), or following a two-man procedure that is physically impossible to execute solo. In any other flight regime, the controls function as originally designed.
The danger of a burning engine is irrelevant if you are heading into terrain.
Now you created a fuel system cutoff control inhibition system which may malfunction in its own ways, e.g., refuse to cut off fuels from a burning engine because it thinks the plane is too low due to faulty altimeter reading.
Sounds good, but I'm not sure I trust Boeing outsourced software developers to implement that absolutely correctly.
It's safe to state these fuel cutoff switches aren't to be touched in-flight unless the word 'fire' is said beforehand. Even then, you only perform fuel cutoff for the flaming engine. If the copilot was busy with takeoff, there is exactly one other person in the entire world that could have flipped both switches. We may never know which one flipped them back.
Report mirror as the site seems to be down:
https://celsoazevedo.com/files/2025/Preliminary_Report_VT_AN...
Since everyone seems to be dancing around the issue, here are the facts as they stand:
- There is no chance that the fuel switches were turned off by accident.
- They were off for about five seconds. One pilot asked “why did you turn them off?” and the other said “I didn’t.”
- They were flipped back on five seconds later. So, ten seconds of off time total.
- It takes a long time for jet engines to spool up; it’s not like a propeller, where the thrust comes back instantly. Ten seconds at 600ft was a death sentence.
- This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
So the big question is, who was flying? The report doesn’t say. (EDIT: actually, the report says the co-pilot was the pilot flying; thanks for the correction.)
In the cockpit, one person is designated “pilot flying” and the other “pilot monitoring.” During takeoff, the pilot flying is completely focused on takeoff. This would be the perfect opportunity to betray your colleague as the pilot monitoring.
- The younger of the two was pilot flying. That means the older person was pilot monitoring.
- This person was also a few flights away from retirement.
Source: https://www.youtube.com/live/SE0BetkXsLg?si=LPss_su3PVTAqGCO
(They’re experienced pilots who are quite certain the switches were moved intentionally, but they carefully go out of their way not to label it as an act of malice. But, as one of them say, “maybe it was the brain fart of the century” — but the implication is, probably not.)
One of the pilots singlehandedly slaughtered ~300 people. You can believe what you’d like at this stage, but personally, I’d put money on it being the older of the two.
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Even taking intent for granted, to deny suicide in a case like this would be to suppose that the person responsible expected to survive while everyone else died. What could possibly support that conclusion?
He appears to have meant something like “this isn’t just common murder-suicide: it is a particularly heinous version of murder-suicide that I wish there were a stronger word for” but phrased it confusingly.
The report says the co-pilot was flying.
The report says the black box reports the fuel cutoff switches being activated. That doesn't necessarily mean that either of the two pilots activated them, it just means that the fly-by-wire system reacted to a fuel cutoff event.
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cutoff.
In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff.
The other pilot responded that he did not do so."
> That doesn't necessarily mean that either of the two pilots activated them
It does:
1. Those switches have physical interlocks and cannot be manipulated by any computer system.
2. The flight data recorder is measuring the position of the switches; they aren't inferring the position from some system state. There's a "position of this switch" channel.
The switches were physically moved in the cockpit, that's basically ground truth. The question now is who and why.
What is the path of the wires from the switch onward? Do they go into a digital input of the flight computer, or do they directly feed the fuel control valves?
https://simpleflying.com/boeing-787-technical-features-guide...
" Advanced electric controls
The 787 entered service with an improved fly-by-wire flight control system. Rather than mechanical processes, the systems convert flight deck crew inputs into electrical signals. Still, there were additional advancements with the type."
Can't find a definitive source right now, but everything is implying there are discrete lines - at least one for command signal to the FADECs, and a separate sense line to the DFDAU for packaging up and sending to the EAFR. That lines up with design philosophy on this stuff of sensing control input data as close to the source as you can get.
Thanks for looking. I worked for Boeing (satellites, not airplanes) for a good part of my career, and I was there when Dennis Muilenburg pushed through his cost saving measures. It was the same culture that created the problems with the 737-MAX. Experienced design engineers were replaced/outsourced and the culture of safety was sacrificed. One example here:
https://www.cnn.com/2019/04/30/politics/boeing-sensor-737-ma...
787 (Dreamliner) was pushing hard for weight reduction, and it would not surprise me at all if the switch output fed a digital computer input rather than routing directly to the fuel shutoff valves, but I don't have any direct knowledge of this.
I don’t understand this part of your post:
> This was not suicide, or murder-suicide; it was one of the most horrific mass murders in history, in which the guy that did it happened to lose his life in the process.
Why wouldn’t this qualify as a murder-suicide, assuming your theory is correct?
I guess I let my emotions get in the way. But nobody seems to be saying that we’ve witnessed one of the worst acts of mass murder in history. Most of the notorious serial killers don’t come close to killing 300 people.
It feels qualitatively different than someone pointing a gun at someone else and then themselves, which is usually what pops to mind when you hear “murder-suicide”.
You’re correct though, it qualifies.
As someone with no qualifications on this beyond occasionally playing some flight simulators, I can't think of a reason you would ever intentionally move the switches in flight (barring an emergency like a leak or fire or something) and unintentionally doing so seems extremely unlikely since generally "switches meant to be operated on the ground" are located well out of the way of "switches meant to be operated in flight". Though I believe Boeing does have them by the thrust levers, every type of fuel control switch I've seen has some sort of guard or mechanism that makes it effectively impossible to move the switch by simply bumping it.
So I can't imagine how it could have been done accidentally.
> it was one of the most horrific mass murder in history
This implies intent.
> One pilot asked “why did you turn them off?” and the other said “I didn’t.”
To me this reads like an unintentional error with colossol implications.
Are you suggesting there was malicious intent and then a delibrately crafted denial by the perpetrator?
The switches require that you pull them out, move them to the end position and then push them back down, and it was two switches. It could have still took off on one engine. This is essentially the turn off plane switch. It would seem to almost impossible that it would be an accident.
I am, and I’m willing to stake my reputation on it. If I’m wrong, I’ll hang up my hat and never cover live news again.
Pilots are drilled from day one that the fuel switches are sacred. After a few accidents where one engine failed and the pilot accidentally turned off the remaining functional engine, the training was overhauled so that it would be impossible for it to be an easy action done by mistake. One pilot is required to ask the other for confirmation before toggling the switch, I believe. It wouldn’t be something you’d do from muscle memory.
> If I’m wrong, I’ll hang up my hat and never cover live news again.
It easy to say that when you know there's likely no way to prove or disprove whether it as an accident or not. Unless a pilot left a note stating his future intentions, there's no way to determine their state of mind.
Someone took their hand, pulled one spring-loaded switch into the off position, and then did it the other switch moments later. Is there any way that could be accidental?
If there was no mechanical failure, the only remaining possibility is deliberate action. And if it was mechanical failure, we’d see an emergency air worthiness directive being issued, which we haven’t.
People do things bizarre, inexplicable things all the time. It's called a brain fart... the human brain is complicated, sometimes wires just get crossed.
Honestly I think the chances are good that you're right, but the way you're presenting it as absolutely certain strikes me as overconfident, borderline arrogant.
Also, what's with the whole "staking your reputation" thing? What reputation? Are you some kind of famous journalist? Is there some reason we should care about you "covering live news" ? Serious questions -- I personally have no idea who you are.
> I personally have no idea who you are
I also don't recognize this guy's name, but I do find it ironic that his profile is possibly the most well-linked to a other identities I've ever seen on HN: https://news.ycombinator.com/user?id=sillysaurusx
Well, you do now. :)
It’s mostly a very public "If I’m wrong, I won’t ever do this again." I’ve been writing informative HN comments since 2008 on various accounts. It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
The victims also deserve to be acknowledged. At this point the overwhelming body of evidence points to a deliberate act. Pilots are trained never to touch the fuel switches in flight, and (I believe) there is a verbal confirmation required before toggling. This captain had over 8,000 hours.
The reason I’m so confident is because I trust the system. It’s designed so that if either of the two pilots do anything, they verbally call it out, e.g. "gear up." A callout like that followed by fuel switch cutoff would indicate it was accidental. But as far as I know, there was no callout.
The pilot flying is also the one who asks for gear up and such. It’s the job do the pilot monitoring to perform those actions.
Suppose it was accidental. That would mean the pilot flying was fiddling with switches instead of flying; that’s against SOP. Or it would mean the pilot monitoring was performing uncommanded actions, which is also against SOP. It’s not something that happens on a whim. Both are contradictions, hence, no accident.
As for being overconfident or arrogant, what matters to me is accuracy, and passing along that accuracy. No one seemed to be willing to publicly call this a malicious action, so I did. If I’m wrong, you can be sure I’ll feel terrible for weeks, post an apology in the thread that shows I was wrong, and then bow out in disgrace, never to cover news again.
People here did the same thing when the common belief was that there was a non-zero chance of nuclear war. I was one of the few voices in that thread saying absolutely not, stop stressing yourself out for no reason.
I’m simply one voice of many. As always, it’s up to the reader to decide what to believe.
> It’s a big deal to me not to spread misinformation or be mistaken in a situation like this.
Then why not either wait until there's more information or temper your remarks by acknowledging there's still ambiguity? That would directly hedge against spreading misinformation, whereas staking your reputation on it and then shutting up if you're wrong only works after the misinformation has spread and doesn't seem very productive.
I think the right response to realizing you've spread misinformation (in the event that you turn out to be mistaken [I think it's 60-40 in favor of deliberate]) is to temper your statements and rededicate yourself to checking the facts, not removing yourself from the discussion altogether. And if you were keeping your mouth shut, wouldn't you continue to see discussions you could meaningfully contribute to, and after a while wouldn't you wonder whether anyone was really benefitting from your silence?
I was about to leave a big reply, but then I remembered that the guidelines ask that we only comment when feeling intellectual curiosity. That’s not what I’m feeling now, so I’ll go spend the evening with my daughter. I hope you have a nice evening as well.
The report indicates the cut off switches were found, and were in the RUN position. However, the report does not indicate if the locking mechanism was functional; given the thermal damage, it might not be possible to determine.
I'm also interested in the earlier switch defects where the switches were installed with the locking mechanism disengaged on some 737s and inspection was advised for 787, but the incident aircraft was not inspected.
The airworthiness directive for that [1] indicates switches with locking disengaged should be replaced, but I wonder if it's possible to reingage the locking somehow, which could result in a situation where the locking wasn't engaged, the switches changed inadverdently and then when restored the run position the lock was engaged... that's a big reach, of course.
All that said, assuming the switch was working as designed, there's a semantic argument around deliberate and intentional. If the switch requires specific action, it's fair to call it deliberate action; but if the switcher thought they were activating a different switch, it's not murder.
Either way, there's no sense rushing to a conclusion of murder. Assuming one of the pilots activated the switch, they have already died and they are beyond the effects of human judgement; so we may as well wait for further information.
[1] https://ad.easa.europa.eu/blob/NM-18-33.pdf/SIB_NM-18-33_1
The CVR might be pretty illuminating.
I mean lots of people in prison say they are innocent
You mention "brain fart". There is certainly a long history of pilots selecting the wrong lever, or wrong switch. So, it is possible the pilot who denied switching the fuel off thought he had switched something else.
My understanding is that after several incidents of pilots shutting off the wrong engine, the training was overhauled so that from day one they treat fuel switches as sacred. I heard that it’s required to ask for confirmation before toggling the switch, just to be absolutely certain. It’s not really something that can be done by muscle memory during flight, and especially not during takeoff.
If he was trying to do something else, he would have called it out. E.g. an audible “gear up.”
Also, it took 10 and 14 seconds to switch them back on. If it was an accidental switch, you would think it would have been quicker to switch them back.
If you look at the photo https://theaircurrent.com/aviation-safety/ai171-investigatio... it would be pretty hard to get them by mistake.
I have a couple of those type of switches, though smaller, in my parts bin. They were from some piece of surplus equipment that got junked. Where I've seen them used is in a crowded control panel where they might just get bumped. The two red plastic levers to the left are another type of safety switch: The lever is spring loaded, and covers the handle of a toggle switch.
In my view it would be quite hard to move them by accident, and probably not possible to move at once.
It would be interesting to know if the plane has any other switches of the same type, that are routinely activated.
There’s no way even the clumsiest person could accidentally pull both out, rotate, and push back in, accidentally within 1 second.
These are not facts. These are mostly speculation.
Is there a possibility that they got hacked and remotely toggled ?
Sadly not. It’s a physical switch with no capability of a remote toggle. The flight data recorder clearly shows one was toggled off within a second of the other, which rules out almost every non-intentional scenario.
Happily not. If this were possible, it would open up a whole universe of problems.
Is this a switch that has a dedicated connection to the corresponding cutoff valve? Or does it go through some common digital bus that passes commands? If so, how well is this bus protected?
Another commentator has pointed out that the flight data recorder records two signals - one for the switch itself, and one for the actual valve movement.
I take your point that we should always be suspicious of complicated, digital buses, and this is not the final report, so there’s still plenty of time to uncover weirdness. However, if the flight date reporter shows the switch being thrown, and then a few milliseconds later, shows the valve starting to close, and the same sequence happening shortly there after on the second switch and valve, I feel this would really limit the likelihood of any digital shenanigans.
What if he mistook the switch for a different switch?
It's an entirely different shape, different location, and different motion from any other switch they could be looking for. Suicide is a way more likely explanation.
And, it's _two_ switches.
A simple wrong flip of a switch killed 260 people and leaving 1 lone survivor who walked away from the plane crash nearly unscathed.
Dudes is extremely lucky or the character from Unbreakable.
A flip of two switches, in sequence, with a locking mechanism on each switch.
Quote:
The preliminary report suggests this is pilot error.From my (limited) understanding you cannot really switch these off inadvertently as they require a couple of actions in order to be switched off. So it would mean one of the pilots switched these off (and they were a few seconds later switched on again but it was too late).
But there was audio, too, and one pilot asked the other "why did you switch these off" and the second one said "I didn't".
Was there are third one in the jump seat?
Sounds likely that one of them was sabotaging the flight.
The report only said the copilot was flying and the pilot was monitoring.
It does not suggest that. It only says they were turned off and no other conclusion given.
Even if the plane had no power, why couldn't they have glided it down safely?
They only ever got a few hundred feet off the ground.
Yes of course the plane glided once the engines stopped, producing thrust, just like all planes do. But just like all planes, and all gliders, gliding means trading altitude for velocity - giving up precious height every second in order to maintain flight. At that stage in the flight, they just didn’t have enough to give. If the same thing had happened at 30,000 feet, it would be a non-event. They would glide down a few thousand feet as the engines spool back up and once they return to full power, everything will be back to normal. Or if for some reason, the engines were permanently cooked, you’d have maybe 20 to 30 minutes of glide time so you’ve got a lot of time to look around and find a flat spot. But you just don’t have enough time for all that to happen When you’re a few hundred feet off the ground.
It did glide briefly, the glide path took it directly into a school building.
Right after takeoff at low altitude is basically the worst place for this to happen. Speed and altitude are low so gliding is going to be a short distance and happen quickly.
If there had been a perfect empty long flat grass field in that location it may have been salvageable, but also right after takeoff the plane usually has a heavy fuel load which makes for a much riskier landing.
I’ll take this as an honest question. The simple answer: too much mass, no clear landing path, not enough speed or altitude to turn to find one and glide to it. In short, not enough time. Once the engines cut, that thing probably dropped like a brick.
how do you "safely" glide into a city?
The India AAIB website (https://aaib.gov.in/) is not responding ... For anyone who read the report, was there information about the age & experience of the pilots?
56 years old, 15638 hours (8596 on this type) and 32 years old, 3403 hours (1128 on this type). Page 11 of the PDF report.
The report says the co-pilot was flying so it's most likely the pilot cut the fuel?
Correct. Which means it’s the older of the two.
The report does not identify which pilot said what. Attempting to extrapolate their identities is speculation.
The report specifically says the FO was flying. The conversation is immaterial since the person who cut the fuel could have made either statement.
Report PDF here: https://aaib.gov.in/What's%20New%20Assets/Preliminary%20Repo...
mirror https://web.archive.org/web/20250711203907/https://aaib.gov....
Not accessible. Have they heard about S3 ?
It loads for me, so I think the link will be useful for some people at least.
Well, shit. Suicidal?
And this can't possibly be all the audio if the other pilot noticed the switch position, I would expect a lot more cussing and struggle.
So they didn't notice the switch position? The switch was in the right position but not really? Is this a rarely used switch that one might not look at (or know where to look) during regular use?
10 seconds between OFF and ON.
Dual engine failure on takeoff gives them about as much time to react as if the front passenger grabbed the steering wheel while on a windy mountain road and yanked them off a cliff.
It only takes a few seconds to completely screw everyone, but a bit longer for the consequences to occur.
From what I've read, it comes on the display as a warning
[dead]
[dead]
More discussion: https://news.ycombinator.com/item?id=44536691
Indian media and social media is going to bot and mass downvote any mention of wrongdoing by Indians. It’s clearly an intentional act
Report page that matters: https://x.com/exodusorbitals/status/1943782924576309732