Comment by lazystar
2 days ago
https://ad.easa.europa.eu/ad/NM-18-33
well hold your horses there... from the FAA in their 2019 report linked above:
> The Boeing Company (Boeing) received reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The fuel control switches (or engine start switches) are installed on the control stand in the flight deck and used by the pilot to supply or cutoff fuel to the engines. The fuel control switch has a locking feature to prevent inadvertent operation that could result in unintended switch movement between the fuel supply and fuel cutoff positions. In order to move the switch from one position to the other under the condition where the locking feature is engaged, it is necessary for the pilot to lift the switch up while transitioning the switch position. If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown. Boeing informed the FAA that the fuel control switch design, including the locking feature, is similar on various Boeing airplane models. The table below identifies the affected airplane models and related part numbers (P/Ns) of the fuel control switch, which is manufactured by Honeywell.
> If the locking feature is disengaged, the switch can be moved between the two positions without lifting the switch during transition, and the switch would be exposed to the potential of inadvertent operation. Inadvertent operation of the switch could result in an unintended consequence, such as an in-flight engine shutdown
https://www.youtube.com/live/SE0BetkXsLg?si=LPss_su3PVTAqGCO
Both of these extremely-experienced pilots say that there was near zero chance that the fuel switches were unintentionally moved. They were switched off within one second of each other, which rules out most failure scenarios.
If it was an issue with the switches, we also would have seen an air worthiness directive being issued. But they didn’t, because this was a mass murder.
Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.
Nope. First of all, the FO was the “pilot flying” and thusly controls the throttle. The fuel shutoffs are on the left side, well clear of the range of motion throttle operation for the right seat.
If the Captain were controlling throttles, it for some reason he could contort his wrist to accidentally open the red cutoff switch guards, the switches themselves move in the opposite direction of the pivot of the switch guard. And to have that happen to both switches — one second apart. That would be astronomically (not to mention anatomically) improbable: you can’t have your hand on the throttle and also be dragging your arm on the switches unless the pilot has an extra elbow.
Further more, the 787 has auto throttles, at takeoff the pilot advances the throttles to N1, then all the way through climb out the auto throttles control the throttle unless manually disengaged.
Also a “bumpy runway” wouldn’t do anything because if those switches were activated on the roll out, the engines would shut down almost immediately: that’s the point of those switches to kill fuel flow immediately not minutes later.
And no there isn’t a report of the safety locks not working properly on the 787. The report to which you are referring was in 2018 and that was an issue with a very few 737 switches that were improperly installed. The switches didn’t fail after use, they were bad at install time. Exceedingly unlikely that a 787 was flying for 12 years with faulty switches. (Notwithstanding the fact they they are completely different part numbers.)
The 787 that crashed had been in service since 2013 which means if that were a problem in that plane, however unlikely, with hundreds of thousands of flight hours, inspections, and the 2018 Airworthiness Bulletin — that problem would have been detected and corrected years ago.
3 replies →
> If it was an issue with the switches, we also would have seen an air worthiness directive being issued.
I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.
The issue with the 737 MAX became evident within months of the plane's launch. By contrast, the Dreamliner has accumulated over a decade of flying history across over 1000 aircraft with precisely zero fatal accidents.
6 replies →
If this is what actually happened it would be the second in recent memory: https://en.wikipedia.org/wiki/Germanwings_Flight_9525.
Third, since there's no other plausible explanation for this and China has classified the report.
https://en.wikipedia.org/wiki/China_Eastern_Airlines_Flight_...
10 replies →
It feels quite uncomfortable to me. I remember using this exact example of why the changes after the German wings crash wouldn't prevent a murder suicide in the future.
My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.
A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.
The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.
He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.
Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.
I'm not disagreeing with you I think this was manually done
But here's the thing a "near zero chance" when we are talking about an actual event changes the math
Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident
Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure
So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded
We could also suggest that aliens in the cockpit did it — about the same probability. Two switches, on independent circuits, both failing within one second of each other in the exact same way?
2 replies →
[flagged]
260 souls is well into the territory of horrible terror attacks. By comparison, only 14 people died from the sarin gas attacks on the Tokyo subway.
Only the captain was extremely experienced, the FO was a rookie. He wouldn't have had enough hours for an European airline
This is not true at all.
Perhaps there are more qualifying statements that you meant to include? The certification and type rating requirements certainly differ between agencies, but in terms of raw number of flight hours it’s easy to find that this statement is false.
He had 1100 hours on the 787 alone. 3200 hours altogether. Most media sources just went with the former figure as his overall experience.
These switches are operated at startup and shutdown. So pretty much daily. By pilots and likely maintenance crews. Such a defect with not to unnoticed for long
It could have been unimportant to them
No it could not. Is your conclusion coming from a decade of piloting or maintaining commercial aircraft?
If not, why are you speculating with zero knowledge?
1 reply →
What is "01 second" as quoted above? If it's 1 second, you could possibly conclude that it was intentional. If it's 0.1 second you might think it was an accident and the lock was disengaged.
There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.
Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.
If the time was :11 and :12 there’s between 0.01 and 2 seconds between. If they were both at :11 then it’s between 0.01 and 1 second.
Between (0, 2)s. Apparently the times are rounded down, so it could be :42.001 and :43.999, or :42.999 and :43.001
One second. (Runway four is frequently zero four because radios.)
Is it easy to inadvertantly move both switches in such a scenario?
The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.
Doing it accidentally is impossible.
Here's also a video showing operation of the switches: https://www.youtube.com/watch?v=33hG9-BCJVQ
No.
Well, can you move it back, when accidentally activated?
They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.
at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again
Yes, and it restarts the engines, but it takes on the order of seconds; too long at that altitude. One of the pilots did that, but it was too late.
More like 30 seconds. Just throttling an already running engine up from idle (which is quite a bit above zero throttle in most respects) takes seconds.
Turbines take a while to spin up again, it's not like start/stop in a car.
In older turbine aircraft this would cause a hot start or worse. It would be interesting to know what the FADEC systems do in this case.
Same manufacturer, Air India 171 was a 787-8 though.
The affected table includes these models as well: 787-8, -9, and -10
The only affected models were 737s with the 766AT613-3D fuel control switch. The bulletin recommended that other models be inspected and any defects reported. It's unclear if any 787s were discovered to have the issue. Also the preliminary report mentions that the switches were replaced in 2019 and 2023, after the 2018 bulletin.
25 replies →
Thanks for pointing it out.
Totally different airplane with a totally different flight deck, designed generations apart. The fact that the manufacturer is the same is irrelevant.
You are trying to draw parallels between the ignition switch in a 1974 Ford Pinto and a 2025 Ford Mustang as if there could be a connection. No.
And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:
"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."
So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.
Entirely different kind of flying altogether
You don’t inadvertently turn off both switches. The linked SAIB was in 2018 and addresses faulty installations, not a failure after use. And preflight over thousands of flights would have detected if the switches had a failed locking mechanism. And for both to fail at once? Practically impossible. Also the recommended inspection — that was almost 7 years ago. If a major airline didn’t comply with the SAIB, that’s on them, not Boeing. There hasn’t been a single reported instance of fuel switches being accidentally switched off on any Boeing airliner — in 320 million flight hours over the past 10 years.
They don't mention the locking mechanism being disabled
One would assume a toggle like that would come with blaring alarms and blinking lights… right? Right??
Edit: It also seems like the engine cutoff is immediate after the toggle. I wonder if a built in delay would make sense for safety.
> I wonder if a built in delay would make sense for safety.
(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)
Low altitude, stall, and impact with terrain certainly will.
And with how low and slow they were during takeoff, those would have been going off almost instantly.