July 11, 2025, 23:25:00 GMT
permalink Post: 11919990
There is mention of fire damage or thermal damage to the centre pedestal, perhaps enough to identify the position of the switches but not to be able to determine their internal physical state relating to the detent mechanisms.
For myself, I have total confidence that the switches functioned as intended. Obviously they commanded the fuel valve as intended, and can be seen intact (other than the plastic caps), and in the run position, so it is safe to conclude that a mechanical/electrical fault of both independent switches at the same moment is unlikely in the extreme. The FDR data states that they were moved to "off" position, which caused the engine shutdown, then returned to "run", so they obviously were mechanically and electrically functional.
The automatic deployment of the RAT is an indicator of the airplane systems sensing an engine shutdown, as is the APU autostart. Pax 11A mentioned the green cabin lights, which, if I understand correctly is an indication of a complete electrical generation failure.The time of all these events can be plotted from recorded data, which I expect we'll see in a full report later. In the mean time, it all makes unfortunate sense.
July 12, 2025, 01:26:00 GMT
permalink Post: 11920068
I'm bewildered by the descriptions of the toggle switches. 'Lifting' is not the terminology I've lived with. The knob is pulled out so that the detents in the inner end of the knob can move over the sharp ridges on the switch body. A minor point, but what is not so minor is the inference that these detents and ridges are a safety design that is sometimes not installed. Surely, they must be talking about some further mechanism, or am I in the twilight zone? I cannot believe there's an aircraft with simple smooth action between off and on, an over-centre toggle . . . that will stop the engines!
The DC3 had fuel levers, the right two of six on the pedestal. We had to put our hand across the slots when selecting the mixture, so that our other hand wouldn't pull the lever to cut out. 60 years later there's a toggle that can be jogged to off?!
I'm not ready to accept the time-line. My FO's were not as highly trained and the aircraft much simpler, but I'd track what they were doing every second until I'd got comfortable airspace under me. Reaching out and stopping the engines? Asking why? What world are they living in?
WTFH!!!!!? followed by the switches being back on. I really don't think I was that much different to my colleagues - they'd darn soon react to fairly modest mistakes, let alone chopping the fuel.
I know the language and basic quotes are not necessarily as written, and trying to take into account the surreal predicament the 'other' pilot found himself in, but what I'm reading doesn't set the scene for an experienced skipper that's also a trainer being the one that's surprised by his colleagues action.
The DC3 had fuel levers, the right two of six on the pedestal. We had to put our hand across the slots when selecting the mixture, so that our other hand wouldn't pull the lever to cut out. 60 years later there's a toggle that can be jogged to off?!
I'm not ready to accept the time-line. My FO's were not as highly trained and the aircraft much simpler, but I'd track what they were doing every second until I'd got comfortable airspace under me. Reaching out and stopping the engines? Asking why? What world are they living in?
WTFH!!!!!? followed by the switches being back on. I really don't think I was that much different to my colleagues - they'd darn soon react to fairly modest mistakes, let alone chopping the fuel.
I know the language and basic quotes are not necessarily as written, and trying to take into account the surreal predicament the 'other' pilot found himself in, but what I'm reading doesn't set the scene for an experienced skipper that's also a trainer being the one that's surprised by his colleagues action.
July 12, 2025, 01:51:00 GMT
permalink Post: 11920086
Nothing in the report suggests that the engines began to run down before the fuel was selected to cutoff. The report states a sequence of events for power loss which
begins
with the switches MOVING or BEING MOVED to cutoff. The maximum airspeed was immediately before the switches were moved, so there had not been a power rundown prior to that:
July 12, 2025, 01:55:00 GMT
permalink Post: 11920088
I'm bewildered by the descriptions of the toggle switches. 'Lifting' is not the terminology I've lived with. The knob is pulled out so that the detents in the inner end of the knob can move over the sharp ridges on the switch body. A minor point, but what is not so minor is the inference that these detents and ridges are a safety design that is sometimes not installed. Surely, they must be talking about some further mechanism, or am I in the twilight zone? I cannot believe there's an aircraft with simple smooth action between off and on, an over-centre toggle . . . that will stop the engines!
https://ad.easa.europa.eu/blob/NM-18...SIB_NM-18-33_1
Last edited by 13 others; 12th July 2025 at 02:46 . Reason: spelling
July 12, 2025, 02:02:00 GMT
permalink Post: 11920092
The Service Bulletin (link below) referenced on page 6 of the preliminary report describes just that...fuel control switches without detents or what the bulletin describes as a "locking feature" that can be "disengaged" and still allow the switch to function. It's somewhat of a glaring omission that the report did not state the status (detent or not) of the switches on this aircraft. Presumably if no-detend switches were found then an emergency AD would already have been issued.
https://ad.easa.europa.eu/blob/NM-18...SIB_NM-18-33_1
https://ad.easa.europa.eu/blob/NM-18...SIB_NM-18-33_1
July 12, 2025, 02:02:00 GMT
permalink Post: 11920093
Consider
this post
with a picture of the switches in question:
They must be lifted over the detent (if installed correctly) in each direction.
Far more than double pole - I think it's 4-8 ish. See the number of wires in the above picture. A previous post in one of the earlier thread indicated that it was essentially one pole per function - HPSOV, LPSOV, FADEC signal, generator etc. I'm not sure which one the EAFR reads. If it was a single contact failure, you would expect to see disagreement between the various systems controlled by the switch. I think that's very unlikely given both 'failed' in the same way near simultaneously and 'recovered' when switched.
For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.
Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.
They must be lifted over the detent (if installed correctly) in each direction.
For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.
Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.
July 12, 2025, 02:41:00 GMT
permalink Post: 11920114
July 12, 2025, 03:34:00 GMT
permalink Post: 11920144
Unless defective. I only encountered one in a 30 plus year career where my Captain shutdown at block in and did not like the feel and checked that the detent was worn. Wrote it up. But Boeing installed some that did not have a detent and the FAA issued a SAIB, referenced in the Air India mishap report, to check for these switches because they could inadvertently be positioned to off. Whether they meant human or other inadvertent action was not clear.
July 12, 2025, 03:56:00 GMT
permalink Post: 11920159
To those who still try to put the blame on the switches...
- If the switches were defective (wrong type without the detent was installed), this airplane has been in operation for 10+ years - somebody would have noticed.
- If the switches were defective due to wear, it's impossible that both would fail simultaneously at exactly the same time. Have you ever seen all FOUR wheel bearings in a car fail within one second of each other?
- If this was an electric issue (spilled coffee theory), there is no way that ALL electrical contact simultaneously shorted into the exact condition to cut off the fuel. We would see one or two contacts fail first and some kind of "command disagreement", but not a nearly instantaneous total failure. Maybe only if somebody spilled a glass of mercury over the switches ...
The only plausible explanation is that somebody moved them (for a reason unknown).
- If the switches were defective (wrong type without the detent was installed), this airplane has been in operation for 10+ years - somebody would have noticed.
- If the switches were defective due to wear, it's impossible that both would fail simultaneously at exactly the same time. Have you ever seen all FOUR wheel bearings in a car fail within one second of each other?
- If this was an electric issue (spilled coffee theory), there is no way that ALL electrical contact simultaneously shorted into the exact condition to cut off the fuel. We would see one or two contacts fail first and some kind of "command disagreement", but not a nearly instantaneous total failure. Maybe only if somebody spilled a glass of mercury over the switches ...
The only plausible explanation is that somebody moved them (for a reason unknown).
July 12, 2025, 07:08:00 GMT
permalink Post: 11920265
To those who still try to put the blame on the switches...
- If the switches were defective (wrong type without the detent was installed), this airplane has been in operation for 10+ years - somebody would have noticed.
- If the switches were defective due to wear, it's impossible that both would fail simultaneously at exactly the same time. Have you ever seen all FOUR wheel bearings in a car fail within one second of each other?
- If this was an electric issue (spilled coffee theory), there is no way that ALL electrical contact simultaneously shorted into the exact condition to cut off the fuel. We would see one or two contacts fail first and some kind of "command disagreement", but not a nearly instantaneous total failure. Maybe only if somebody spilled a glass of mercury over the switches ...
The only plausible explanation is that somebody moved them (for a reason unknown).
- If the switches were defective (wrong type without the detent was installed), this airplane has been in operation for 10+ years - somebody would have noticed.
- If the switches were defective due to wear, it's impossible that both would fail simultaneously at exactly the same time. Have you ever seen all FOUR wheel bearings in a car fail within one second of each other?
- If this was an electric issue (spilled coffee theory), there is no way that ALL electrical contact simultaneously shorted into the exact condition to cut off the fuel. We would see one or two contacts fail first and some kind of "command disagreement", but not a nearly instantaneous total failure. Maybe only if somebody spilled a glass of mercury over the switches ...
The only plausible explanation is that somebody moved them (for a reason unknown).
Ditto for the idea of the physical detents failing, causing the switch lever to drop at the worst time. Not impossible, again, but both switches within a second of each other? Very low odds.
Am I correct in thinking that engine cutoff would in flight would trigger a warning on EICAS?
July 12, 2025, 08:18:00 GMT
permalink Post: 11920332
Spoken to a rated mate whom is current on 78s and he told me that inadvertent operation of a fuel shut off in flight has happened with a switch being knocked past its detent (lock) by the switch being caught by a crew bag.
July 12, 2025, 08:26:00 GMT
permalink Post: 11920339
Probably not during Takeoff I wouldn\x92t have thought.
July 12, 2025, 08:37:00 GMT
permalink Post: 11920352
I cannot imagine a situation where any pilot would be moving a crew bag within seconds of getting airborne.
July 12, 2025, 19:53:00 GMT
permalink Post: 11920787
I flew the 777. The 78 switches are of similar design. They must be positively lifted and then moved with a robust over center block preventing them from moving after being bumped by something or other. Nothing I can think of in the cockpit could hit them with enough force to break the over center lock. IIRC none of our fleet had the side guard. It takes a conscious act to move them. The stabilizer trim cutouts are completely different red guarded switches.
July 12, 2025, 20:28:00 GMT
permalink Post: 11920815
They don't have to be positively lifted if the detent rounded out due to wear or if the switch installed was one that the SAIB referenced with the locking feature disengaged. I can't discern a raised boss on the body of the left switch in Fig.13, page 10 of the AAIB report. I assume those switches have some internal over center locking mechanism also besides the spring on the lever that would not be needed if there was no detent. I do remember writing up a 767 switch a long time ago when the Captain noticed the detent was worn and he could shut down without lifting.
On the other hand pilots deciding to end their lives in a spectacular fashion is not inconceivable. In fact over the last 25 years it may be the single most numerous reason for a catastrophic loss of a transport category aircraft operated at a major airline.
July 12, 2025, 21:20:00 GMT
permalink Post: 11920840
I beg to differ: not from a pilot's point of view who didn't read the bulletin. Please see below about the recommended "tug".
Not a pilot, but electronics engineer here: I finally understood what's wrong with the "defective" switches: on such a switch, if you raise it up (to change its position) and you turn it slightly clockwise or counterclockwise before releasing it, it will operate normally, but the detents are now "crossing" the lock tab, and this one doesn't prevent a move-it-without-raising-it-first action anymore. As far as I can tell from the position of the switches, you have to extend your arm sideways and put some effort in your wrist to activate these switches: chances are that such a movement results in some amount of rotation.
Agreed, but this "test" won't tell you if the detents are aligned or misaligned with the lock tab.
If both switches are "defective" ones (remember, that doesn't mean they don't do their job, only that some specific action may put them in a state where protection against unwanted action is lost), the same action from the same pilot may well put both switches in the dangerous configuration.
By the way, I find that the "check" recommended in the bulletin for a switch suspected from being "defective" is incredibly misleading. It will possibly detect a switch where the cap has already been turned, resulting in a misalignment of the lock tab with the detents, but it won't detect a switch waiting for a turn to put it in the dangerous configuration. The "check" should be "pull on the cap to raise it, try to turn it clockwise or counterclockwise while raised: if it can be turned, it's defective".
On the contrary, according to the above scenario, anything interacting with the switches (which are close to each other) can move them unexpectedly (the "iPhone falling" case), and the CVR statement would reflect the surprise of a pilot who actually didn't do anything wrong.
May I add that I consider the probability of such a scenario as very very thin, but I wanted to emphasize the fact that we must keep our minds open, instead of jumping to conclusions too early.
Not a pilot, but electronics engineer here: I finally understood what's wrong with the "defective" switches: on such a switch, if you raise it up (to change its position) and you turn it slightly clockwise or counterclockwise before releasing it, it will operate normally, but the detents are now "crossing" the lock tab, and this one doesn't prevent a move-it-without-raising-it-first action anymore. As far as I can tell from the position of the switches, you have to extend your arm sideways and put some effort in your wrist to activate these switches: chances are that such a movement results in some amount of rotation.
It’s also the norm for everyone operating the switches to give them a tug to insure they are in the detents.
It’s simply inconceivable that both switches failed in exactly the same way at almost exactly the same time and no pilot who flew the aircraft in the last year or so noticed the issues.
By the way, I find that the "check" recommended in the bulletin for a switch suspected from being "defective" is incredibly misleading. It will possibly detect a switch where the cap has already been turned, resulting in a misalignment of the lock tab with the detents, but it won't detect a switch waiting for a turn to put it in the dangerous configuration. The "check" should be "pull on the cap to raise it, try to turn it clockwise or counterclockwise while raised: if it can be turned, it's defective".
Add to that the CVR statement and it’s beyond inconceivable.
May I add that I consider the probability of such a scenario as very very thin, but I wanted to emphasize the fact that we must keep our minds open, instead of jumping to conclusions too early.
July 12, 2025, 21:28:00 GMT
permalink Post: 11920846
if you raise it up (to change its position) and you turn it slightly clockwise or counterclockwise before releasing it, it will operate normally, but the detents are now "crossing" the lock tab, and this one doesn't prevent a move-it-without-raising-it-first action.
If there were a fault with the locking feature of one of the toggle barrels, this would now be evidence on the initial report, as those parts can be seen to have survived in the photo in the report.
July 12, 2025, 21:43:00 GMT
permalink Post: 11920859
I beg to differ: not from a pilot's point of view who didn't read the bulletin. Please see below about the recommended "tug".
Not a pilot, but electronics engineer here: I finally understood what's wrong with the "defective" switches: on such a switch, if you raise it up (to change its position) and you turn it slightly clockwise or counterclockwise before releasing it, it will operate normally, but the detents are now "crossing" the lock tab, and this one doesn't prevent a move-it-without-raising-it-first action anymore. As far as I can tell from the position of the switches, you have to extend your arm sideways and put some effort in your wrist to activate these switches: chances are that such a movement results in some amount of rotation.
Agreed, but this "test" won't tell you if the detents are aligned or misaligned with the lock tab.
If both switches are "defective" ones (remember, that doesn't mean they don't do their job, only that some specific action may put them in a state where protection against unwanted action is lost), the same action from the same pilot may well put both switches in the dangerous configuration.
By the way, I find that the "check" recommended in the bulletin for a switch suspected from being "defective" is incredibly misleading. It will possibly detect a switch where the cap has already been turned, resulting in a misalignment of the lock tab with the detents, but it won't detect a switch waiting for a turn to put it in the dangerous configuration. The "check" should be "pull on the cap to raise it, try to turn it clockwise or counterclockwise while raised: if it can be turned, it's defective".
On the contrary, according to the above scenario, anything interacting with the switches (which are close to each other) can move them unexpectedly (the "iPhone falling" case), and the CVR statement would reflect the surprise of a pilot who actually didn't do anything wrong.
May I add that I consider the probability of such a scenario as very very thin, but I wanted to emphasize the fact that we must keep our minds open, instead of jumping to conclusions too early.
Not a pilot, but electronics engineer here: I finally understood what's wrong with the "defective" switches: on such a switch, if you raise it up (to change its position) and you turn it slightly clockwise or counterclockwise before releasing it, it will operate normally, but the detents are now "crossing" the lock tab, and this one doesn't prevent a move-it-without-raising-it-first action anymore. As far as I can tell from the position of the switches, you have to extend your arm sideways and put some effort in your wrist to activate these switches: chances are that such a movement results in some amount of rotation.
Agreed, but this "test" won't tell you if the detents are aligned or misaligned with the lock tab.
If both switches are "defective" ones (remember, that doesn't mean they don't do their job, only that some specific action may put them in a state where protection against unwanted action is lost), the same action from the same pilot may well put both switches in the dangerous configuration.
By the way, I find that the "check" recommended in the bulletin for a switch suspected from being "defective" is incredibly misleading. It will possibly detect a switch where the cap has already been turned, resulting in a misalignment of the lock tab with the detents, but it won't detect a switch waiting for a turn to put it in the dangerous configuration. The "check" should be "pull on the cap to raise it, try to turn it clockwise or counterclockwise while raised: if it can be turned, it's defective".
On the contrary, according to the above scenario, anything interacting with the switches (which are close to each other) can move them unexpectedly (the "iPhone falling" case), and the CVR statement would reflect the surprise of a pilot who actually didn't do anything wrong.
May I add that I consider the probability of such a scenario as very very thin, but I wanted to emphasize the fact that we must keep our minds open, instead of jumping to conclusions too early.
July 12, 2025, 22:25:00 GMT
permalink Post: 11920886
1 second delay
Again, you can not conclude that from the report.
Different inputs are sampled at different rates. Some very basic info here:
It's highly likely switch positions are only sampled at 1Hz, and not at 100 Hz. For engine parameters you'll likely want a higher sample rate, as the whole engine could go from perfectly fine to exploded in less than a second.
If you had something like:
08:08:42.96 UTC: cut off switch 1
08:08:43.01 UTC: cut off switch 2
It would likely be recorded as:
08:08:42 UTC: cut off switch 1
08:08:43 UTC: cut off switch 2
Leading you to believe there was one second between these 2 actions, whereas it was actually only 50ms.
Different inputs are sampled at different rates. Some very basic info here:
It's highly likely switch positions are only sampled at 1Hz, and not at 100 Hz. For engine parameters you'll likely want a higher sample rate, as the whole engine could go from perfectly fine to exploded in less than a second.
If you had something like:
08:08:42.96 UTC: cut off switch 1
08:08:43.01 UTC: cut off switch 2
It would likely be recorded as:
08:08:42 UTC: cut off switch 1
08:08:43 UTC: cut off switch 2
Leading you to believe there was one second between these 2 actions, whereas it was actually only 50ms.
Last edited by AK1969; 13th July 2025 at 00:41 .
July 13, 2025, 00:08:00 GMT
permalink Post: 11920951
Switch locking mechanism
I was just looking into these Honeywell TL family switches for a different project. There are certain part numbers that have the locking mechanism - the ones that don't are clearly different. I didn't see anything to indicate that the locking feature was selectable or defeatable. I suspect the faulty 737 switches fron 2018 had an issue with the detent machining or maybe the loading spring - i.e. a bad batch.