But if he did, would have done hours of retraining in a simulator?

> I suspect you've never driven an older vehicle with the shifter on the steering column.

Or a new Mercedes ;)

That's just your brain associating the bathroom with the act of brushing your teeth, and therefore doing it automatically upon the trigger of entering the bathroom. It bears no resemblance to the accidental activation of a completely different button.

The other poster's correction: "it’s like brushing your teeth with razor" is apt. Touching the fuel cutoff switches is not part of any procedure remotely relevant to the takeoff, so there's no trigger present that would prompt the automatic behavior.

If someone confused their steering wheel for the brake you'd probably be surprised - there are indeed errors that are essentially impossible for a competent person to make by mistake. No idea about the plane controls, though.

If I were to apply OPs assertion to your actions it’s like brushing your teeth with razor. I guess that’s what they meant.

Even humans have fixed action patterns. Much behavior is barely under conscious control.

[dead]

Those are caused by operating the same lever in a slightly different manner. Not comparable to two completely differently designed levers placed far apart.

Same goes for accidental acceleration instead of braking. Two of the same kind of lever right next to each other.

Accidental acceleration while intending to turn on the wipers would be a fitting example, I don't think that happens though.

Driving isn't trained to anywhere near the same standard.

Probably more training required to bake a cake than drive a car (hours wise).

If we had your typical driver fly a plane we'd be doomed to a lot of crashes.

Because there's no difference in actions needed to do so. A similar mistake is throwing away a useful item while holding onto a piece of trash. The action is the same, it's just the item in question that's different.

This is not what happened here at all. The actions needed to activate the fuel cutoff switches are not similar to any other action a pilot would want to make during takeoff.

Probably time to design a plane that can't be sent into terrain in seconds by flipping a switch.

I don't think the theory is that the muscle memory sequences resemble each other.

Instead, it's that because muscle memory allows you to do things without thinking about it, you can get mixed up about which action you meant to perform and go through the whole process without realizing it.

Would anyone be surprised if an accomplished concert pianist played C Bb Bb instead of C E in a piece they had played thousands of times correctly?

The only difference here is that the consequences are death instead of mere head shaking.

Murder needs more proof than just performing the wrong action. Until then we should apply Hanlon's Razor.

i have several passwords i type all the time. sometimes i get them confused and type the wrong one to the wrong prompt. i type them by muscle memory, but i also think about them while typing and i think thoughts like "time to reach up and to the left on the keyboard for this password". I couldn't tell you the letter i'm trying to type, i just know to do that.

not all my passwords are up and to the left, some are down and to the right, but when i type the wrong one into the wrong place, i type it accurately, i'm just not supposed to be typing it.

"time to do that thing i've practiced, reach to the left". shuts two engines off by muscle memory.

Sometimes I drive all the way home without being aware of what I did in between.

If you read through the boeing procedures, if an engine fails just after take off you delay cutting throttle or hitting the cutoff until you have positive climb and pass a certain altitude. Specifically because a mistake here would be so incredibly catastrophic. The following number of steps and verbal cross checks for then shutting down the engine are quite daunting. Not something applicable here, but still interesting to learn about

Would it matter in this case since you would crash either ways. I’m talking about protection in a very specific situation where you make it harder to shut off both engines when you’re very close to the ground.

Something I love about Mentour pilot is that he’s started doing videos on incidents where there was a near miss but no tragedy. Just as much to learn but without the ghoulish rubbernecking aspect.

A long time ago I had a colleague turn me on to Sidney Dekker’s “Drift Into Failure”, which in many ways covers system design taking into account the “human” element. You could think of it as the “realists” approach to system safety.

At the time we operated some industry specific, but national scale, critical systems and were discussing the balance of the crucial business importance of agility and rapid release cycles (in our industry) against system fragility and reliability.

Turns out (and I take no credit for the underlying architecture of this specific system, though I’ve been a strong advocate for this model of operating) if you design systems around humans who can rapidly identify and diagnose what has failed, and what the up stream and down stream impacts are, and you make these failures predictable in their scope and nature, and the recovery method simple, with a solid technical operations group you can limit the mean-time-to-resolution of incidents to <60s without having to invest significant development effort into software that provides automated system recovery.

The issue with both methods (human or technical recovery) is that both are dependent on maintaining an organizational culture that fosters a deep understanding of how the system fails, and what the various predictable upstream and downstream impacts are. The more you permit the culture to decay the more you increase the likelihood that an outage will go from benign and “normal” to absolutely catastrophic and potentially company ending.

In my experience companies who operate under this model eventually sacrifice the flexibility of rapid deployment for an environment where no failure is acceptable, largely because of an lack of appreciation for how much of the system’s design is dependent on an expectation of the fostering of the “appropriate” human element.

(Which leads to further discussion about absolutely critical systems like aviation or nuclear where you absolutely cannot accept catastrophic failure because it results in loss of life)

Extremely long story short, I completely agree. Aviation (more accurately aerospace) disasters, nuclear disasters, medical failures (typically emergency care or surgical), power generation, and the military (especially aircraft carrier flight decks) are all phenomenal areas to look for examples of how systems can be designed to account for where people may fail in the critical path.

Walter would be better served working on the garbage collector for D than going off on aviation lessons for software.

In the particular case of his channel's subject matter, I actually kind of like the dramatic cliffhanger effect that (un)intentionally heightens the narrative's tension, since his video is telling a story. Compare to doing that for informational videos where there's no need for manufactured drama.

FUD. His videos are just as consistently good as they always have been. The sponsor sections can be easily skipped (hint: SponsorBlock).

This is for a tiny aircraft, not a jumbo jet. SF50 and the Honda Jet can autoland too.

Edit: I recently saw an SF50 YT video. It's pretty awesome with the V/X tail.

Maybe as the PIC was guarding the lower end of the throttle he rested the rest of his hand on the panel cover below the throttle and, while pushing forward on the throttle, let the side of his hand slide down right onto the switches, the likeliness of which would have been exacerbated by a rough runway or a large bump. It's unlikely the left and right part of his hand would have contacted the cutoff switches at the same time, hence the delay between the two switches being actuated. Of course this relies on the safety locks not working properly, which is something that hand been reported.

> If it was an issue with the switches, we also would have seen an air worthiness directive being issued.

I do not trust these air worthiness directives 100.0%. The 737 Max also required two catastrophic failures before it was grounded.

If this is what actually happened it would be the second in recent memory: https://en.wikipedia.org/wiki/Germanwings_Flight_9525.

My buddy says the same, he’s a 787 captain for United. Essentially impossible to accidentally turn off those switches. My buddy isn’t “evidence” of course, but actual airline captains are all saying similar things.

I'm not disagreeing with you I think this was manually done

But here's the thing a "near zero chance" when we are talking about an actual event changes the math

Maybe there's a combination of vibration and manufacturing defect or assembly fault or "hammer this until it works" that can cause the switches to flip. Very unlikely? Yes. Still close to 0% but much more likely in the scenario of an accident

Of course AAIB/NTSB etc didn't have any time to investigate the mechanical aspects of this failure

So yeah it was probably done intentionally but the "switches turning off by themselves" should not be excluded

A few years ago I was working at a company that used a robotic arm when an accident occurred. The robot was powered off for maintenance but suddenly turned on, pinned a worker's arm, and threw him against a wall. His arm had numerous fractures and he had severe head injuries but survived.

The other worker in the building was in absolute shambles and couldn't understand what had happened. The CCTV footage was then checked and showed that worker looking at the other while reaching for the power switch and turning on the machine. The switch was not locked out and tagged out, but it was the only switch like it on the whole panel, large and required significant force to turn. No way to accidentally bump it, and the video showed him clearly turning the handle.

He was obviously fired, but no criminal charges were ever brought against him. He had no plausible motive for wanting the other man dead, was severely distraught over the incident. It was simultaneously obvious that he had turned the lever deliberately and had not meant to turn the leaver. A near-lethal combination of muscle memory and a confusion caused the accident. If the lever had been locked and tagged out, that probably would have interrupted his muscle memory and prevented the accident, but it wasn't.

Point is, something can be simultaneously impossible to do inadvertently, but still done mistakenly. A switch designed to never be accidentally bumped, to require specific motions to move it, can still be switched by somebody making a mistake.

[flagged]

Only the captain was extremely experienced, the FO was a rookie. He wouldn't have had enough hours for an European airline

It could have been unimportant to them

There is no electronic lock as far as I know, as many people seem to assume. It's a mechanical notch that you have to physically pull the switch past to operate it. The lock failures described in the air worthiness directive was about this mechanical stop or notch not being installed.

Between (0, 2)s. Apparently the times are rounded down, so it could be :42.001 and :43.999, or :42.999 and :43.001

Many systems log samples at an intervale of one sample per second. I could easily envision a transition event where a bump or brush of something sufficiently toggles one switch and then a fraction of a second later the other.

One second. (Runway four is frequently zero four because radios.)

The switches are spring-loaded, notched in place, and have a rubber knob on the top. A pilot must squeeze the knob, remove the switch from its ON notch, press the switch, click it into the OFF notch, then release the knob.

Doing it accidentally is impossible.

No.

They were moved back to the run position 10 seconds after being switched off, and the engines were in the very early stages of restarting by the time of the crash. It was too late.

In older turbine aircraft this would cause a hot start or worse. It would be interesting to know what the FADEC systems do in this case.

Yes, and it restarts the engines, but it takes on the order of seconds; too long at that altitude. One of the pilots did that, but it was too late.

at least one of the pilots did. according to the preliminary report, the switches were only in the cutoff position for 10 seconds before being switched back to the run position and the engines started to spin up again

Turbines take a while to spin up again, it's not like start/stop in a car.

The affected table includes these models as well: 787-8, -9, and -10

And yet the preliminary report for the incident in question includes reference to that bulletin, indicates that the switches in the accident aircraft were of a very similar design and subject to advisory inspections:

"The FAA issued Special Airworthiness Information Bulletin (SAIB ) No. NM -18-33 on December 17, 2018, regarding the potential disengagement ofthe fuel control switch locking feature. This SAIB was issued based on reports from operators of Model 737 airplanes that the fuel control switches were installed with the locking feature disengaged. The airworthiness concern was not considered an unsafe condition that would warrant airworthiness directive (AD) by the FAA. The fuel control switch design , including the locking feature, is similar on various Boeing airplane models including part number 4TL837-3D which is fitted in B787-8 aircraft VT-ANB. As per the information from Air India, the suggested inspections were not carried out asthe SAIB was advisory and not mandatory. The scrutiny ofmaintenance records revealed that the throttle control module was replaced on VT-ANB in 2019 and 2023. However, the reason for the replacement was not linked to the fuel control switch. There has been no defect reported pertaining to the fuel control switch since 2023 on VT-ANB."

So while I agree that this being the cause sounds unlikely, referencing the switch issue is something relevant enough for the report itself.

Entirely different kind of flying altogether

> I wonder if a built in delay would make sense for safety.

(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)

Low altitude, stall, and impact with terrain certainly will.

And with how low and slow they were during takeoff, those would have been going off almost instantly.

On pprune there is a professional pilot that says they had multiple instances of inadverent switching off fuel switches. They do it every startup, shutdown and training captains (the captain on this flight was pilot not flying, he had >10k hours) do it all the time in the sim to trigger engine out scenario during training

Bad analogy because pilots are trained and rehearse and practice memory items until they are instinctual.

> impossible by design.

Deflecting that the human is the weakest part of the system. One or other may have panicked and made a mistake, made a mistake unintentionally, went crazy and doomed the flight, or intentionally doomed the flight for some socioeconomic reasons. These are speculative possibilities that we don't know yet, and may never know; we only know what has definitely happened from the evidence per the investigation. It's standing way out over one's feet to declare from an armchair that it was "definitely" X or Y before the investigation is complete.

> cannot be mistaken for something else

Assumption. Big ass assumption.

Pilot are trained until actions are instinctual and certain memory items are almost unconscious. But pilots are still people and people are fallible and make mistakes, and sometimes act unreasonably. Intent cannot be determined without clear evidence or statements because that's now how thoughts locked away in people's minds work.

> It's not arrogance to assume the most likely conclusion is true

You don't know this. This is beyond the capability to know and is therefore pure speculation. That is the definition of arrogance.

The most likely scenario is not necessarily the truth. It still remains pure speculation and nothing else.

The report shows 0 flight hours during the prior 24 hours for both pilots, and 7 hours and 6 hours each for the previous 7 days. It seems they were both fresh pilots for this flight.

I imagine it would be more difficult to fly into terrain without a cooperative co pilot than cutting the fuel just after take off.

i worked in many companies but I always remember one , where during a public chat in the middle of an open office the programmer next to me (who was always conniving but I just ignored it ), said incorrectly something akin to " yes I know all about that source control its... based on locking " , the whole point was that although locking technically occurs, the SC would allow different coders to work on it at the same time. The non technical manager said correctly, "no the whole point is that the codebase isnt locked", to which the programmer replied " yeah thats what I mean".

In that moment I realised he was just bare faced lying right infront of everyone, about a technical subject, only HE should be the expert in, and to this day I am perplexed why his contract kept being renewed.

Eventually I was let go ( he possibly suggested I be let go ) for an incident that was unrelated to me.

This is all fine, but i learnt 5 years on he was still being paid a top 1% salary at the same company.

I promise the point isnt that I am jealous, its that this guy, who was a sub par coder and liar, somehow managed to keep his job whilst everyone else lost theirs and earnt untold amount in England ( where salaries are always low).

My goodness - I just remembered he was found by police driving a vehicle seemingly under the influence on a motorway, work found out after the police called them, and somehow he turned up the next day at work , lied about it, and STILL kept his job.

I am only mentioning this guy , because he was NOT a nepotist hire, he was just some guy who would lie and somehow people were ok with it. I still think of him often and wish I could have learnt more from his abilities just out of interest.

While unlikely, there have been issues before that took decades to surface (e.g. Aloha Airlines where a 737 manufactured more than a decade earlier became a cabriolet due to Boeing underestimating sea water corrosion and short flight cycles), or the 737 rudder issues where the planes were also 10+ years old.

And now some pilots are dead.

Just allow cockpit video recorders, and if they're ever used for anything, the pilots (or their heirs) get $250k in cash.

And Pilots end up dead because of it.

Are you actually using a tragedy like this to launch an assault on organized labour?

There are reasons they don’t. This is a deceptively difficult problem

Cost is a big one (satellite data is still quite a bit more expensive than you think, especially with many stations)

And by stations, I mean aircraft. There are a TON. Current constellations probably wouldn’t even be able to handle half the current aircraft transmitting all at once. Bandwidth, in the physical sense, becomes a limiting factor

Coverage (different constellations have different coverage, which means planes would not have transmit guarantees depending on flight path). So you’d have huge gaps anyways

There have been alternative solutions posed, some of which are advancing forward. For example, GPS aware ELTs that only transmit below certain altitudes. But even that has flaws

Anyways I think we’ll see it in the next decade or two, but don’t hold your breath

WalterBright is not totally unfamiliar with the aviation world...:

> Bright is the son of the United States Air Force pilot Charles D. Bright

> Bright graduated from Caltech in 1979 with a Bachelor of Science in Mechanical Engineering and a minor in Aeronautical Engineering

> He worked for Boeing for 3 years on the development of the 757 stabilizer trim system

This also makes sense with why nobody on the recording mentions re engaging the fuel switches

The pilot denies shutting off the fuel, then realises he'd done it accidentally and quietly reenables them hoping there's enough time to save them

Were the landing gear switches and fuel cutoff switches pretty close to each other here?

There would have been an inaction on the part of the pilot that did this, but it is not mentioned in the CVR transcript.

Hard to believe the other pilot wouldn’t have said anything.

Recovering the airplane and have some people survive the crash are two very different things.

Where can I listen to this recording?

Are they looking at the physical switch or data about the state of the engine displayed in some other fashion?

My understanding from what we've been reading is that these are physical switches that cannot be moved using remote triggers. Wildly speculating, there _may_ be a possibility that the _effect_ of the switch may be triggered remotely, if it's a signal being read by a control unit or computer of some sort that then actuates the specific electromechanical components. But it would seem impossible to move a physical switch to do it.

As an analogy, if you have a smart lock, you can remotely trigger the _effect_ of turning the key using (let's say a bluetooth control), but if a key is inserted into the keyhole, unless there is two-way mechanical linkage, that key _will not turn_.

You have to time it spy movie right to ensure dying.

This is what I am debating.

There are too many variables you need to account for.

For example, I want an expert opinion about the tone in the cockpit when the other pilot said “No, I did not touch it” or what was said. Is it calm? Surprised? Cold?

> If we’re talking about accidentally pressing buttons it seems we’d have seen incidents before.

Well, of course I talk about an accidental touch of the wrong buttons.

Flying is very safe, but at the same time, you will never know how many near misses happen daily that don't become accidents.

This is speculation again since I don't really know, but my understanding of aviation engineering is that there would be two separate controllers for each engine connected to these two switches. At no point would they be connected to the _same_ control unit. The really short time (~1s) between the two being cutoff is the difficult thing to explain here.

Is it possible to rest the switch on the notch? Does the switch make contact if the switch is in the RUN position but the switch is not completely down?

That is, is it possible they flipped the switches over to RUN but did not seat the switches properly, and instead leaving them on top of the notch, with later vibration causing the switches to disengage?

Just trying to think of some semi-plausible non-active causes.

Report says the switches went to cutoff one second apart from each other. Can a human do the physical operation on two switches that quickly?

When your engine catches on fire/blows apart on takeoff you want to cut fuel as fast as possible.

Delay is probably worse - now you're further disassociating the effect of the action from the action itself, breaking the usual rule: if you change something, and don't like the effect, change it back.

Armchair safety/human factors engineering, gotta love HN.

Using that reasoning all airplane crashes have a lot in common too.

Doesn’t mean the ones where you cannot determine the reason and have to speculate don’t suck.

A rodent chewing on wires. Vibration-induced chafing. Tin whiskers causing an intermittent short. There are many possibilities, those came to mind first.

Not difficult, but can you close an investigation on that note without going over other possibilities?

What if there's another safety lesson to be learnt here?

To answer your question: because it is a very rare occurence.

OK, that makes a kind of sense, altitude would spoil the plan, if a suicidal pilot's only plan was to cut the engines.

See me obliquely referencing that with "flying into the side of a mountain".

My first instinct is that the suggestion is overfitted due to hinsight bias. This particular accident happened to involve these particular switches so let's add a warning to these switches. Duh!

Some problems that immediately come to mind:

- For which settings is there going to be a voice confirmation? Is their confirmation more important than all the other audio warnings?

- During emergency situations, when pilot workload is high, will these only add to that workload, making the emergency even worse?

- Will the pilots get so used to hearing these every day that their brains will simply tune them out as background noise?

Really though, if a pilot wishes to doom an aircraft, there's 1000 different ways they could do so. The solution to this problem likely lies in the pilot mental health management department, rather than the fuel cut off switch audio warning one.

> The time between the two switches being activated and then them being switched back on after being noticed strongly suggests that they were actually manipulated

How so? It is just as likely to be an intermitted electronic malfunction.

Not precisely the electrical malfunction, but dual engine shutdown has occurred, fortunately after landing:

https://www.aerosociety.com/news/ana-787-engine-shutdown/

intermittent state switching is absolutely a thing in (poorly designed/manufactured/tested/QC'd) electronics

All this rests on whether we have CVR audio of the pilot(s) manipulating the switches.

The other pilot likely flipped them back - but at that point, it was impossible to avoid crashing.

The rodents were remorseful and fixed the cables in the meantime. /s

Sometimes? If you have enough altitude to trade for speed then after the cutoff you could glide to a hypothetical miraculously-placed runway right in front of you, vs. having fire quickly consume the entire plane if you don't cutoff..

But they don't look protected or hard to switch?

Sure, but you can open the door, pull the handbrake, or turn the wheel so hard you lose control of the vehicle. These are all similarly preventable, but maybe not worth the risk of being unable to open the door, brake or steer if the safety mechanism fails closed, or if your situation is outside the foresight of its designer.

Also, you don't need multiple certifications and 1500 hours of experience to drive a car.

A friend did exactly that in a manual transmission, doing 100km/h.

She was mad and said she has to jam it hard ( going for 5th and missed), but it went into reverse. And the gearbox literally hit the road when she let out the clutch.

There’s no good reason to do that.

There may be a good reason to cut fuel to one engine shortly after takeoff.

You could have a system that prevents both switches being thrown, and only in the specific window after takeoff, but you’ve also now added two additional things that can fail.

You also can't reverse a plane while flying it...

This is a rather odd comparison. You can slam the brakes, yank the steering week, and do all sorts of things to intentionally make the car crash.

You can turn the ignition off. The reversers will not unlock on an airliner that's airborne either.

Remember the "surging" incidents where the driver insisted he was stepping on the brake but was actually stepping on the gas?

Now you created a fuel system cutoff control inhibition system which may malfunction in its own ways, e.g., refuse to cut off fuels from a burning engine because it thinks the plane is too low due to faulty altimeter reading.

> The danger of a burning engine is irrelevant if you are heading into terrain.

Not quite. When you hit the ground you do not want any fuel leaks or hot surfaces as much as possible. That is why for example engines are shutdown when doing an emergency belly landing, to try abd prevent the airplane from bursting into flames.

Sounds good, but I'm not sure I trust Boeing outsourced software developers to implement that absolutely correctly.

Exactly

Yeah that would have completed prevented this scenario /s

I'm not sure you want a creative AI flying a plane anyway.

If the switches have an unknown design flaw then it’s unknown how likely it is they’d both fail simultaneously

My understanding is these switches are used routinely during the shutdown procedure or did I get that wrong?

It's getting hugged by the world and they didn't use a CDN apparently.

What is the path of the wires from the switch onward? Do they go into a digital input of the flight computer, or do they directly feed the fuel control valves?

https://simpleflying.com/boeing-787-technical-features-guide...

" Advanced electric controls

The 787 entered service with an improved fly-by-wire flight control system. Rather than mechanical processes, the systems convert flight deck crew inputs into electrical signals. Still, there were additional advancements with the type."

No, lacking other evidence (e.g. CVR recording) it doesn't mean they have been moved. The wiring in between the switches and the engine+FDR could've also developed an intermittent fault.

The fact that your car's engine stops doesn't mean you turned the ignition switch off. Anyone who has had to troubleshoot a car with intermitent electrical faults knows that.

> If I’m wrong, I’ll hang up my hat and never cover live news again.

It easy to say that when you know there's likely no way to prove or disprove whether it as an accident or not. Unless a pilot left a note stating his future intentions, there's no way to determine their state of mind.

Not possible it's an "I bumped it" type of accident, maybe.

It's quite possible it's a "performed the wrong muscle memory at the worst possible moment" type of accident. This is unlikely, but anyone who thinks such a mistake is impossible doesn't know anything about human factors.

Unlikely just means "low probability." There are thousands of flights per day, so it's only a matter of time.

Also, it took 10 and 14 seconds to switch them back on. If it was an accidental switch, you would think it would have been quicker to switch them back.

I have a couple of those type of switches, though smaller, in my parts bin. They were from some piece of surplus equipment that got junked. Where I've seen them used is in a crowded control panel where they might just get bumped. The two red plastic levers to the left are another type of safety switch: The lever is spring loaded, and covers the handle of a toggle switch.

In my view it would be quite hard to move them by accident, and probably not possible to move at once.

It would be interesting to know if the plane has any other switches of the same type, that are routinely activated.

Happily not. If this were possible, it would open up a whole universe of problems.

What if he mistook the switch for a different switch?

Is this a switch that has a dedicated connection to the corresponding cutoff valve? Or does it go through some common digital bus that passes commands? If so, how well is this bus protected?

The report specifically says the FO was flying. The conversation is immaterial since the person who cut the fuel could have made either statement.