Comment by decimalenough

Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.

> If it was an issue with the switches, we also would have seen an air worthiness directive being issued.

I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.

If this is what actually happened it would be the second in recent memory: https://en.wikipedia.org/wiki/Germanwings_Flight_9525.

My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.

A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.

The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.

He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.

Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.

I'm not disagreeing with you I think this was manually done

But here's the thing a "near zero chance" when we are talking about an actual event changes the math

Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident

Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure

So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded

[flagged]

Only the captain was extremely experienced, the FO was a rookie. He wouldn't have had enough hours for an European airline

It could have been unimportant to them

There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.

Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.

Between (0, 2)s. Apparently the times are rounded down, so it could be :42.001 and :43.999, or :42.999 and :43.001

One second. (Runway four is frequently zero four because radios.)

The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.

Doing it accidentally is impossible.

No.

They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.

at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again

Yes, and it restarts the engines, but it takes on the order of seconds; too long at that altitude. One of the pilots did that, but it was too late.

Turbines take a while to spin up again, it's not like start/stop in a car.

In older turbine aircraft this would cause a hot start or worse. It would be interesting to know what the FADEC systems do in this case.

The affected table includes these models as well: 787-8, -9, and -10

And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:

"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."

So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.

Entirely different kind of flying altogether

> I wonder if a built in delay would make sense for safety.

(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)

Low altitude, stall, and impact with terrain certainly will.

And with how low and slow they were during takeoff, those would have been going off almost instantly.

On pprune there is a professional pilot that says they had multiple instances of inadverent switching off fuel switches. They do it every startup, shutdown and training captains (the captain on this flight was pilot not flying, he had >10k hours) do it all the time in the sim to trigger engine out scenario during training

Bad analogy because pilots are trained and rehearse and practice memory items until they are instinctual.

> impossible by design.

Deflecting that the human is the weakest part of the system. One or other may have panicked and made a mistake, made a mistake unintentionally, went crazy and doomed the flight, or intentionally doomed the flight for some socioeconomic reasons. These are speculative possibilities that we don't know yet, and may never know; we only know what has definitely happened from the evidence per the investigation. It's standing way out over one's feet to declare from an armchair that it was "definitely" X or Y before the investigation is complete.

> cannot be mistaken for something else

Assumption. Big ass assumption.

Pilot are trained until actions are instinctual and certain memory items are almost unconscious. But pilots are still people and people are fallible and make mistakes, and sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.

> It's not arrogance to assume the most likely conclusion is true

You don't know this. This is beyond the capability to know and is therefore pure speculation. That is the definition of arrogance.

The most likely scenario is not necessarily the truth. It still remains pure speculation and nothing else.

The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.

For whatever reason, the Egypt Air 990 pilot initiated his murder-suicide by pulling the thrust to idle and then flipping the fuel cutoff switches.

I imagine it would be more difficult to fly into terrain without a cooperative co pilot than cutting the fuel just after take off.

i worked in many companies but I always remember one , where during a public chat in the middle of an open office the programmer next to me (who was always conniving but I just ignored it ), said incorrectly something akin to " yes I know all about that source control its... based on locking " , the whole point was that although locking technically occurs, the SC would allow different coders to work on it at the same time. The non technical manager said correctly, "no the whole point is that the codebase isnt locked", to which the programmer replied " yeah thats what I mean".

In that moment I realised he was just bare faced lying right infront of everyone, about a technical subject, only HE should be the expert in, and to this day I am perplexed why his contract kept being renewed.

Eventually I was let go ( he possibly suggested I be let go ) for an incident that was unrelated to me.

This is all fine, but i learnt 5 years on he was still being paid a top 1% salary at the same company.

I promise the point isnt that I am jealous, its that this guy, who was a sub par coder and liar, somehow managed to keep his job whilst everyone else lost theirs and earnt untold amount in England ( where salaries are always low).

My goodness - I just remembered he was found by police driving a vehicle seemingly under the influence on a motorway, work found out after the police called them, and somehow he turned up the next day at work , lied about it, and STILL kept his job.

I am only mentioning this guy , because he was NOT a nepotist hire, he was just some guy who would lie and somehow people were ok with it. I still think of him often and wish I could have learnt more from his abilities just out of interest.

While unlikely, there have been issues before that took decades to surface (e.g. Aloha Airlines where a 737 manufactured more than a decade earlier became a cabriolet due to Boeing underestimating sea water corrosion and short flight cycles), or the 737 rudder issues where the planes were also 10+ years old.

WalterBright is not totally unfamiliar with the aviation world...:

> Bright is the son of the United States Air Force pilot Charles D. Bright

> Bright graduated from Caltech in 1979 with a Bachelor of Science in Mechanical Engineering and a minor in Aeronautical Engineering

> He worked for Boeing for 3 years on the development of the 757 stabilizer trim system

I've turned on the windshield wipers when reaching to turn on the headlights. Fortunately, neither were critical subsystems.

And now some pilots are dead.

Just allow cockpit video recorders, and if they're ever used for anything, the pilots (or their heirs) get $250k in cash.

And Pilots end up dead because of it.

Are you actually using a tragedy like this to launch an assault on organized labour?

There are reasons they don’t. This is a deceptively difficult problem

Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)

And by stations, I mean aircraft. There are a TON. Current constellations probably wouldn’t even be able to handle half the current aircraft transmitting all at once. Bandwidth, in the physical sense, becomes a limiting factor

Coverage (different constellations have different coverage, which means planes would not have transmit guarantees depending on flight path). So you’d have huge gaps anyways

There have been alternative solutions posed, some of which are advancing forward. For example, GPS aware ELTs that only transmit below certain altitudes. But even that has flaws

Anyways I think we’ll see it in the next decade or two, but don’t hold your breath

This also makes sense with why nobody on the recording mentions re engaging the fuel switches

The pilot denies shutting off the fuel, then realises he'd done it accidentally and quietly reenables them hoping there's enough time to save them

Were the landing gear switches and fuel cutoff switches pretty close to each other here?

There would have been an inaction on the part of the pilot that did this, but it is not mentioned in the CVR transcript.

Hard to believe the other pilot wouldn’t have said anything.

Recovering the airplane and have some people survive the crash are two very different things.

Where can I listen to this recording?

Are they looking at the physical switch or data about the state of the engine displayed in some other fashion?

My understanding from what we've been reading is that these are physical switches that cannot be moved using remote triggers. Wildly speculating, there _may_ be a possibility that the _effect_ of the switch may be triggered remotely, if it's a signal being read by a control unit or computer of some sort that then actuates the specific electromechanical components. But it would seem impossible to move a physical switch to do it.

As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.

You have to time it spy movie right to ensure dying.

This is what I am debating.

There are too many variables you need to account for.

For example, I want an expert opinion about the tone in the cockpit when the other pilot said “No, I did not touch it” or what was said. Is it calm? Surprised? Cold?

> If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.

Well, of course I talk about an accidental touch of the wrong buttons.

Flying is very safe, but at the same time, you will never know how many near misses happen daily that don't become accidents.

I turned off my car several times because I forgot I turned it on in the first place. In all fairness, it was always when I was parked.

This is speculation again since I don't really know, but my understanding of aviation engineering is that there would be two separate controllers for each engine connected to these two switches. At no point would they be connected to the _same_ control unit. The really short time (~1s) between the two being cutoff is the difficult thing to explain here.

Is it possible to rest the switch on the notch? Does the switch make contact if the switch is in the RUN position but the switch is not completely down?

That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?

Just trying to think of some semi-plausible non-active causes.

Report says the switches went to cutoff one second apart from each other. Can a human do the physical operation on two switches that quickly?

When your engine catches on fire/blows apart on takeoff you want to cut fuel as fast as possible.

Armchair safety/human factors engineering, gotta love HN.

Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.

I'm doing it all the time while rebasing commits or force pushing to my branch. Sometimes I would just click the wrong buttons and end up having to stay late to clean the mess. It's a great thing I'm not a pilot. I would be dead by now.

Using that reasoning all airplane crashes have a lot in common too.

Doesn’t mean the ones where you cannot determine the reason and have to speculate don’t suck.

A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.

Not difficult, but can you close an investigation on that note without going over other possibilities?

What if there's another safety lesson to be learnt here?

To answer your question: because it is a very rare occurence.

OK, that makes a kind of sense, altitude would spoil the plan, if a suicidal pilot's only plan was to cut the engines.

See me obliquely referencing that with "flying into the side of a mountain".

My first instinct is that the suggestion is overfitted due to hinsight bias. This particular accident happened to involve these particular switches so let's add a warning to these switches. Duh!

Some problems that immediately come to mind:

- For which settings is there going to be a voice confirmation? Is their confirmation more important than all the other audio warnings?

- During emergency situations, when pilot workload is high, will these only add to that workload, making the emergency even worse?

- Will the pilots get so used to hearing these every day that their brains will simply tune them out as background noise?

Really though, if a pilot wishes to doom an aircraft, there's 1000 different ways they could do so. The solution to this problem likely lies in the pilot mental health management department, rather than the fuel cut off switch audio warning one.

Pretty obviously a bad joke and a bad idea IMO. I did not personally downvote, but I think it deserves its current score.

Look at the timeline of the events. The switches were shut off, noticed to be shut off, and restored to the proper position within 10 seconds with the current system. Insufficient notification that the switches have been turned off was clearly not a problem in need of a solution. It would be slower and more challenging to understand an automated verbal announcement than the surely extremely obvious sudden lack of thrust and all engine dials rapidly dropping to zero.

So it wouldn't contribute at all to solving this particular case, would only be a slightly annoying distraction in the more normal case of normal aircraft shut-down after completing its flights, and would be a potentially hazardous distraction in the intended emergency case of engine is on fire and fuel must be cut off immediately, where there's probably a bunch of other extremely important and urgent things to pay attention to and do other than a silly automated warning telling you what you just did.

Wait till the final report is out and what resolution they come up with then we'll see who the joke is on

> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated

How so? It is just as likely to be an intermitted electronic malfunction.

Not precisely the electrical malfunction, but dual engine shutdown has occurred, fortunately after landing:

https://www.aerosociety.com/news/ana-787-engine-shutdown/

intermittent state switching is absolutely a thing in (poorly designed/manufactured/tested/QC'd) electronics

The other pilot likely flipped them back - but at that point, it was impossible to avoid crashing.

All this rests on whether we have CVR audio of the pilot(s) manipulating the switches.

The rodents were remorseful and fixed the cables in the meantime. /s