July 01, 2025, 12:39:00 GMT
permalink Post: 11914246
On the 767, 757 and A330 anytime you are in single generator operations the aircraft is load shedding. The 787 with a totally different electrical system might function differently.
July 01, 2025, 12:55:00 GMT
permalink Post: 11914255
I believe that particular bug is fixed, though it's always possible there's other issues causing a total AC loss.
Not really relevant to what you quoted though, as the scenario in question requires:
The aircraft has two engines and should be able to climb out on one, plus it dropped like a rock . 'Significantly degraded' thrust isn't really compatible with what we saw. You'd also expect the engines to recover pretty quickly as it leveled off.
The limitations at high altitude are primarily air/volatiles degassing out of the fuel. That's not going to be much of an issue at sea level, even if the engines are a bit higher up during rotation.
APU is a nice-to-have; it's on the MEL. If you lose all four generators, it's because of some major carnage in the electrical software/hardware and chances of putting the APU on line even if it's operating are very slim.
Not really relevant to what you quoted though, as the scenario in question requires:
-
Engines running on centre tank fuel during takeoff
while the aircraft is operating normally
- We don't know for certain if this is the case. It seems to be but it's not something that happens on other families.
- Then, total AC failure stopping fuel boost pumps.
- Engines suction feed from contaminated/full-of-water wing tanks.
The aircraft has two engines and should be able to climb out on one, plus it dropped like a rock . 'Significantly degraded' thrust isn't really compatible with what we saw. You'd also expect the engines to recover pretty quickly as it leveled off.
The limitations at high altitude are primarily air/volatiles degassing out of the fuel. That's not going to be much of an issue at sea level, even if the engines are a bit higher up during rotation.
APU is a nice-to-have; it's on the MEL. If you lose all four generators, it's because of some major carnage in the electrical software/hardware and chances of putting the APU on line even if it's operating are very slim.
- The specific 248-day integer overflow was patched, and before the fix was rolled out, the AD required this system to by power cycled every 120 days to prevent overflow
- The PCU software still has the functional requirement to be able to command all AC GCUs to enter failsafe mode, this means that while the initial bug was fixed, the ability for this particular software system to command the same result is still a functional part of the architecture - presumably for safety management of the AC system
- This was not the first or last "software overflow error" issue in Boeing or even in the 787
I do agree that the engine driven pumps should be able to provide fuel alone, the whole point of these pumps is to keep the plane flying within some limitations, high altitude is one of those limitations, I propose that there may be others based on the following:
- Some more knowledgable people here have proposed or countered vapour lock, fuel contamination and automatic fuel cut-off theories to various degrees - even if these are not enough on their own, loss of electrical during rotation at high temperature could combine with these in a way we have not yet considered
- Thrust is nonlinear, and while I'm not qualified to say how much loss of fuel flow or loss of thrust would be critical in this scenario we do know that it was a hot takeoff with significant weight and gear remaining down - I know others here have run sims but I don't think anyone has focused on specific thrust / fuel flow params
- While electric fuel pumps might not be physically necessary for takeoff, my final point is: why are they required for takeoff? Is it not to mitigate cavitation, fuel sloshing at rotation, or any other kind of problem that might be relevant here?
July 01, 2025, 12:59:00 GMT
permalink Post: 11914257
Remember the 787 uses electrics for engine start, wing anti-ice, centre hydraulics, and cabin air compressors. There's some big electrical loads.
Centre tank boost pumps are probably comparatively small, but if you can conclusively say x is not required during ground engine start , why power it?
July 01, 2025, 13:36:00 GMT
permalink Post: 11914278
Thrust is non-linear and complex. Reaction engines (i.e. fans, props) are generally most efficient at minimum power - lowest excess velocity. Turbine engines are generally most efficient at high power. These cancel out somewhere in the middle. With two engines at low power, you also don't have the drag from the dead engine or the drag from the rudder countering yaw.
Cavitating destroys pumps rapidly - someone upthread said replacing the fuel pump immediately is SOP if it has suction fed. Expect end of life in tens of hours rather than tens of thousands.
Some aircraft have switched to using jet/venturi pumps powered by returned fuel, like the A220. The electric boost pumps there are mainly for redundancy and are shut down in cruise; only one in each wing tank. Some A320s replace the centre override pumps with venturi transfer pumps.
Cavitating destroys pumps rapidly - someone upthread said replacing the fuel pump immediately is SOP if it has suction fed. Expect end of life in tens of hours rather than tens of thousands.
Some aircraft have switched to using jet/venturi pumps powered by returned fuel, like the A220. The electric boost pumps there are mainly for redundancy and are shut down in cruise; only one in each wing tank. Some A320s replace the centre override pumps with venturi transfer pumps.
My question is then: what is the minimum loss of thrust in both engines (perhaps more relevantly expressed as a % in fuel flow reduction from expected) that could produce the profile we saw. I appreciate this is a figure with many variables including timing and rate of loss.
The reason I think this question is relevant is because we pretty much have 2 prevailing theories at this point:
- A failure, or reduction of thrust (below idle, indicated by loss of AC generators), that somehow impacted both engines, within 20s of rotation (explaining the RAT and gear orientation)
- Somehow a loss of all AC power, leading somehow to a reduction of thrust or failure of engines (both engines impacted identically is assumed in this scenario since all AC is lost), and was of course below the minimum thrust needed to fly with gear down at this weight and temperature
July 01, 2025, 13:57:00 GMT
permalink Post: 11914288
July 12, 2025, 00:34:00 GMT
permalink Post: 11920038
Moving both switches to OFF within
01
sec has to be done by two hands, unnatural body movement would be noticed by PF and questioned immediately.
Your laptop, phone can record a video without LED light on. A fact that an aircraft must be restarted every 51 days tells me there is a memory leak somewhere.
Your laptop, phone can record a video without LED light on. A fact that an aircraft must be restarted every 51 days tells me there is a memory leak somewhere.
Last edited by Senior Pilot; 12th July 2025 at 03:47 . Reason: Edit error, report says 01 sec, not 0.1
July 12, 2025, 02:02:00 GMT
permalink Post: 11920093
Consider
this post
with a picture of the switches in question:
They must be lifted over the detent (if installed correctly) in each direction.
Far more than double pole - I think it's 4-8 ish. See the number of wires in the above picture. A previous post in one of the earlier thread indicated that it was essentially one pole per function - HPSOV, LPSOV, FADEC signal, generator etc. I'm not sure which one the EAFR reads. If it was a single contact failure, you would expect to see disagreement between the various systems controlled by the switch. I think that's very unlikely given both 'failed' in the same way near simultaneously and 'recovered' when switched.
For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.
Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.
They must be lifted over the detent (if installed correctly) in each direction.
For reference, it's pretty common for industrial emergency stop buttons to have 2-3 poles: redundant poles for the actual fault switching (legislative requirement above certain hazard levels), plus an additional pole for monitoring.
Depends on when they identified the SB and how obvious the lack of or incorrect fitting of detents is.
July 12, 2025, 10:43:00 GMT
permalink Post: 11920474
SLF: I have a small observation but I'm not sure what it means or if it has any relevance to the accident.
Previously I had assumed that the ADS-B data cut out at the same time as power was lost, so I imagined that whatever caused the fairly clear loss of thrust would have happened not too long before. But this report throws a bit of a wrench in my understanding of that.
According to the report, the fuel cutoff switches transition from RUN to CUTOFF at or very shortly after 08:08:42 UTC. Both engines' N2 values pass below minimum idle speed and the RAT begins supplying hydraulic power at about 08:08:47. Does this not imply that the generators have already been lost? With the APU also being off (the APU inlet door is noted to start opening at 08:08:54), I would have expected ADS-B data to cut out at or before 08:08:47. But curiously FlightRadar24 at least claims to have received data frames from the aircraft until 08:08:51.640970, almost five seconds later and almost ten seconds after the transition to CUTOFF (though the last frame containing coordinates comes at 08:08:50.871005).
Could anyone with relevant experience confirm how long it would take for AC power to be lost in this situation? Also, is it usual/unusual for a preliminary report like this to mention if/when the flight recorder switched to its independent power supply? I imagine it would definitely be in the final report, but I'd hoped it would be easily observable enough to be in this one.
Beyond idle curiosity I'm asking because the report also says the no. 1 engine's cutoff switch transitioned from CUTOFF to RUN at "about 08:08:52", which oddly coincides with the last ADS-B data frame at 08:08:51.640970, and that seems important somehow. Or more likely I'm just ignorant of some quirk of the 787's electrical system.
For reference FR24's CSV containing all ADS-B frames supposedly received from the aircraft can be found in their post here: https://www.flightradar24.com/blog/f...rom-ahmedabad/
Previously I had assumed that the ADS-B data cut out at the same time as power was lost, so I imagined that whatever caused the fairly clear loss of thrust would have happened not too long before. But this report throws a bit of a wrench in my understanding of that.
According to the report, the fuel cutoff switches transition from RUN to CUTOFF at or very shortly after 08:08:42 UTC. Both engines' N2 values pass below minimum idle speed and the RAT begins supplying hydraulic power at about 08:08:47. Does this not imply that the generators have already been lost? With the APU also being off (the APU inlet door is noted to start opening at 08:08:54), I would have expected ADS-B data to cut out at or before 08:08:47. But curiously FlightRadar24 at least claims to have received data frames from the aircraft until 08:08:51.640970, almost five seconds later and almost ten seconds after the transition to CUTOFF (though the last frame containing coordinates comes at 08:08:50.871005).
Could anyone with relevant experience confirm how long it would take for AC power to be lost in this situation? Also, is it usual/unusual for a preliminary report like this to mention if/when the flight recorder switched to its independent power supply? I imagine it would definitely be in the final report, but I'd hoped it would be easily observable enough to be in this one.
Beyond idle curiosity I'm asking because the report also says the no. 1 engine's cutoff switch transitioned from CUTOFF to RUN at "about 08:08:52", which oddly coincides with the last ADS-B data frame at 08:08:51.640970, and that seems important somehow. Or more likely I'm just ignorant of some quirk of the 787's electrical system.
For reference FR24's CSV containing all ADS-B frames supposedly received from the aircraft can be found in their post here: https://www.flightradar24.com/blog/f...rom-ahmedabad/
July 12, 2025, 11:02:00 GMT
permalink Post: 11920495
The accident aircraft was written up for a status message of ”STAB POS XDCR” on the previous flight, which is a message relating to implausible data from the stab trim switches. It was released from maintenance (according to the preliminary report) at 06:40UTC ahead of an 07:40UTC departure (the crash flight) with ”no fault found”.
On the 787-8, as all modern planes, switches are not cabled as dry closing contacts all the way from the switch poles to the affected end devices (FADECs in the case of fuel cutoff switches), but rather connect locally to an analogue/digital converter to encode the switch position data onto the digital comms bus ARINC629 which allows all aircraft systems to talk to one another.
Are the fuel cutoff switches, which are positioned adjacent to the stab trim switches, connected to the same ADC module which produced the error message on the previous flight, which maintenance was unable to resolve before the accident flight took off? I do not know, but it must be worthy of being looked into.
On the 787-8, as all modern planes, switches are not cabled as dry closing contacts all the way from the switch poles to the affected end devices (FADECs in the case of fuel cutoff switches), but rather connect locally to an analogue/digital converter to encode the switch position data onto the digital comms bus ARINC629 which allows all aircraft systems to talk to one another.
Are the fuel cutoff switches, which are positioned adjacent to the stab trim switches, connected to the same ADC module which produced the error message on the previous flight, which maintenance was unable to resolve before the accident flight took off? I do not know, but it must be worthy of being looked into.
I think they're called remote data concentrators - in many cases it is a conversion from a direct digital input to a bus signal; electronics would not call it an 'analog' input unless it was actually measuring a quantitative value.
Was the RAT deployed manually?
The report says,
As per the EAFR data both engines N2 values passed below minimum idle speed, and the RAT hydraulic pump began supplying hydraulic power at about 08:08:47 UTC.
This was 5 seconds after the fuel was cut off.
It suggests to me that the RAT deployment was initiated while the engines were still above idle and generating electrical power. Obviously one of the pilots could have done it via depressing the switch, as it's a "dual engine failure/stall" memory item (see Air India Ahmedabad accident 12th June 2025 Part 2 ) that won't hurt anything.
Is there a way for the RAT to deploy while the engines are still above idle?
The report says,
As per the EAFR data both engines N2 values passed below minimum idle speed, and the RAT hydraulic pump began supplying hydraulic power at about 08:08:47 UTC.
This was 5 seconds after the fuel was cut off.
It suggests to me that the RAT deployment was initiated while the engines were still above idle and generating electrical power. Obviously one of the pilots could have done it via depressing the switch, as it's a "dual engine failure/stall" memory item (see Air India Ahmedabad accident 12th June 2025 Part 2 ) that won't hurt anything.
Is there a way for the RAT to deploy while the engines are still above idle?
That is a very good question IMHO.
July 13, 2025, 04:27:00 GMT
permalink Post: 11921012
I have only seen a diagram for I think the 737. I remember there being a listing of what each pole did, but I can no longer find the post.
My expectation/speculation, though, is this:
The EAFR gets its information on cutoff switch position from the FADECs via data buses, similar to almost all other engine data. We have N2 information in the report after the engines were switched off, so clearly there are no concerns about this data not being captured.
This means that the FADEC's data of where the switches are is almost certainly the EAFR's data.
There are other poles on the switches that do other things - I think it was opening/closing the LPSOV and enabling the generators. The fourth pole in the 'cutoff' position was IIRC not used because the generators don't get a disable signal, whereas the LPSOVs are powered open in the run position and powered closed in the cutoff position.
If the switches were physically operated and in good electromechanical condition (not counting the possibly faulty gates), we would expect all four poles to operate essentially simultaneously, with the four 'run' contacts opening and the four 'cutoff' contacts closing. Not only would the EAFR pick up that the FADECs were commanded off, but also that the LPSOV closes after a short delay, and the generators drop offline before N2 drops below idle.
When the switches are moved back to run, we would likewise see the position of each LPSOV return to open.
(this does not necessarily mean that a person intentionally operated them, but that the lever actually moved).
If there was a wiring fault, contamination, or internal switch failure, we would probably not see this. Instead, you might see the LPSOV remain open despite the engine shutting down, or perhaps the FADECs trying to keep the engine running while the LPSOV has closed and shut off fuel, or the two FADEC channels receiving different run/cutoff signals - and all of this would probably happen differently on each engine (if it affected both engines at all). There is no indication of this in the report.
These are not your basic light switch where the load is either powered or not powered. They're four switches ganged together and operated in unison, and each channel powers either thing A or thing B. If you have both or neither A & B powered (for longer than the ~50ms that the switch takes to move between positions), this is a fault that should be visible in the EAFR data in some/many cases. Think valves being displayed in orange as 'position unknown'.
If all run contacts opened, and all cutoff contacts closed, the switch moved from run to cutoff .
I don't know whether they analysed the EAFR data in this much detail yet, but coupled with a potential click sound on the CVR, I think there's going to be very very little doubt at the end of the investigation whether the switches physically moved or not, and I strongly expect they did.
July 13, 2025, 05:47:00 GMT
permalink Post: 11921037
My take is that removing the authority to crash the plane is something that's necessary for single pilot operations. That means crew can't disable both engines, or all generators, or all transponders (MH370), or put the plane into unrecoverable situations. That's a very very short summary.
Incidents like this (potentially) imply that it may be necessary for two-pilot operations too.
July 13, 2025, 07:18:00 GMT
permalink Post: 11921078
The Action Slip scenario
What is an action slip?
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
———
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flips both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side
(Captain's side)
of the cockpit l oses power to most instruments. With all 4 generators offline, the RAT deploys to provide emergency power.
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
———
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying—aviate!—and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
Edit: I got the roles mixed up; in a fixed scenario, either the Captain was the PF (and may have set the switches to cutoff), or flight control changed over at the power failure.
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
———
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flips both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
———
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying—aviate!—and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
Edit: I got the roles mixed up; in a fixed scenario, either the Captain was the PF (and may have set the switches to cutoff), or flight control changed over at the power failure.
Last edited by Musician; 13th July 2025 at 08:03 .
July 13, 2025, 07:36:00 GMT
permalink Post: 11921087
What is an action slip?
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
\x97\x97\x97
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flicks both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side (Captain's side) of the cockpit loses power to most instruments. With all 4 generators offline, the RAT deploys to provide emergency power.
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
\x97\x97\x97
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying\x97aviate!\x97and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
\x97\x97\x97
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flicks both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side (Captain's side) of the cockpit loses power to most instruments. With all 4 generators offline, the RAT deploys to provide emergency power.
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
\x97\x97\x97
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying\x97aviate!\x97and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
July 13, 2025, 07:41:00 GMT
permalink Post: 11921093
What is an action slip?
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
———
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flicks both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side (Captain's side) of the cockpit loses power to most instruments. With all 4 generators offline, the RAT deploys to provide emergency power.
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
———
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying—aviate!—and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
There's a possible scenario we're discussing here that fits all of the available evidence. It proposes that one of the pilots operated the switches in an unconscious action called an "action slip". This is a rote action that we do without conscious thought when we're distracted: we mean to do something, and then we get our signals crossed and do something else. To learn more, search for "action slip" or "cerebellum" on this thread; I hope paulross adds the keyword to the next build of his excellent index at https://paulross.github.io/pprune-th...171/index.html .
How would this scenario play out?
We don't have enough evidence to pin down the exact sequence, so there are some assumptions here that I hope you find plausible. (And obviously it's not the only scenario that fits the evidence.) We especially do not know who did what and why, so that is all guesswork on my part. The times are taken from the preliminary report. The report places the verbal exchange among the pilots where I put it.
———
8:08:39 The 787 becomes airborne. The F/O is pilot flying (PF), with both hands on the yoke. The Captain is PNF (not flying).
8:08:42 The PNF unconsciously flicks both fuel switches to CUT OFF, one after the other. This is a rote action performed after each flight, or as training captain in the simulator.
The action cuts power to the engines; they stop delivering thrust almost immediately, and the turbines start slowing down.
The 787 systems disconnect the electrical generators in advance of them failing. The right side (Captain's side) of the cockpit loses power to most instruments. With all 4 generators offline, the RAT deploys to provide emergency power.
The PF feels the cessation of thrust. He looks at the display to see an ENGINES SHUT OFF message. He assumes the PNF shut them off, and asks him why he shut them off. This is the lowest "probe" level on the PACE assertiveness scale; see e.g. https://psychsafety.com/pace-graded-assertiveness/ or search for "probe alert" on pprune if you wish to know more. The highest level of assertiveness, E for "emergency", would have the F/O put the switches back himself immediately, but that would have required a high degree of confidence in the face of the older Captain that may have been difficult to achieve.
Since the action was unconscious, the PNF replies that he did not do that.
8:08:47 The RAT starts delivering hydraulic power, the engines decelerate past idle.
The PNF realizes that engine power is in fact cut. Eventually he checks the switches he thinks he did not touch, sees the engine 1 switch first and flips it back to RUN at 8:08:52. He then thinks to check the second switch and flips it up at 8:08:56.
The accident sequence ensues.
There's really not much the PNF can do at this point. At 8:09:05, he transmits a MAYDAY.
———
Obviously there are variations to this, for example it could have been the PF who put the fuel switches back. (In the above scenario, the PF is focused on flying—aviate!—and never turns his head to see the switches.) My goal was simply to set out a possible sequence, to see whether it feels plausible. Remember, as you see other scenarios put forth, that any issues a person could wrestle with would also be distracting. While both pilots would be very focused during the takeoff run, the moment the aircraft lifted off, the PNF could well have mentally relaxed a little, opening an opportunity for the action slip.
Thoughts?
Seeing that the gear remained down after liftoff, there was CVR confusion after the event, and there was an attempt to rectify the situation…. I’m now thinking aviation is witnessing its most bizarre action-slip it’s ever seen and we’ll learn that the human automatic system is capable of making the most inappropriate and illogical responses to a given situation. I suspect fatigue and the captains sim experience of flicking switches plays a part.
As a result of this, I think we’ll see a renewed interest in slowing down actions at all times…touch a control, look at it, pause, consciously think about what you are touching before you execute it. This needs to be habitual, especially on LH fleets where fatigue inevitably plays into the operation.
We’ll also be discouraging the “insta-pilot” trend of showing how slick you are (usually on A320) where your hands flick round the flight deck at lightning speed. Even in more benign scenarios like shutdown flows etc, this isn’t a good habit.
July 13, 2025, 13:01:00 GMT
permalink Post: 11921309
The fact is the moment the report was released all other previous theories were all but invalidated and deliberate action became 2nd or 1st most probable.
- Could a wiring fault / short circuit explain the cutoff without switch movement - someone posted the pinouts above, these are not single-pole switches, the wiring architecture is designed to mitigate such faults. If the switches didn't move but cutoff was acknowledged then they either self-resolved 10s later, or they were then cycled to cutoff and back to run. Improbable but possible, but the report doesn't support this and there is no precedent for it, even for a single switch not resulting in accident
- Could these be the previously mentioned switches without the locking mechanism - even if that were the case, nobody has presented a report in over half a decade that could align precedent with such a failure - where is the report of even 1 of these switches being bumped accidentally, or due to turbulence, or on landing impact? The probability that the first manifestation of these inadequate switches was this particular 1-by-1 sequence 3 seconds after takeoff, after several years, not at any other phase, it seems quite low
I do agree that at this point deliberate action is the most likely cause, followed by extreme psychological episode. Casual accidental movement if it was remotely probable would surely have been detected in decades of operation and mitigated with a redesign.
July 13, 2025, 14:45:00 GMT
permalink Post: 11921364
It would have been useful if more of the CVR data had been released so as to see the crew interaction. Also the language used on what was released seems to refer to a third person.
However, from an operator perspective. Captain PM, FO PF. PF selects TOGA and follows the thrust levers, Captain confirms Thrust Set and replaces FO hands on the Thrust Levers. 80Kt call by PM, acknowledged by PF. Aircraft calls V1, Captain should withdraw hands from Thrust Levers and calls Rotate at Vr. PM is looking for confirmation the aircraft is climbing and calls Positive Rate. PF confirms and calls Gear Up. At this point the PF will be looking through the HUD looking to follow the flight director, the PM would be checking LNAV had engaged and at 400\x92 checking THR REF and VNAV SPD. However, at this point a loss of thrust occurred. So how was this apparent to the PF who would have been looking out with both hands on the control wheel. Reduction in pitch? GPWS call-out? Decreasing N1 on the engine instruments? EICAS ENG SHUTDOWN? What did the PM see? Who called out the situation? Were any actions called for? At some point as the generators went off line all the FO instruments would have blanked. Did the Captain assume control? I don\x92t think I would have been thinking about the Fuel Cut-Off switches at that point, yet they were specifically mentioned which does mean the switches were moved and it wasn\x92t some internal fault.
Hopefully, as the CVR is further analysed some more information will come to light.
However, from an operator perspective. Captain PM, FO PF. PF selects TOGA and follows the thrust levers, Captain confirms Thrust Set and replaces FO hands on the Thrust Levers. 80Kt call by PM, acknowledged by PF. Aircraft calls V1, Captain should withdraw hands from Thrust Levers and calls Rotate at Vr. PM is looking for confirmation the aircraft is climbing and calls Positive Rate. PF confirms and calls Gear Up. At this point the PF will be looking through the HUD looking to follow the flight director, the PM would be checking LNAV had engaged and at 400\x92 checking THR REF and VNAV SPD. However, at this point a loss of thrust occurred. So how was this apparent to the PF who would have been looking out with both hands on the control wheel. Reduction in pitch? GPWS call-out? Decreasing N1 on the engine instruments? EICAS ENG SHUTDOWN? What did the PM see? Who called out the situation? Were any actions called for? At some point as the generators went off line all the FO instruments would have blanked. Did the Captain assume control? I don\x92t think I would have been thinking about the Fuel Cut-Off switches at that point, yet they were specifically mentioned which does mean the switches were moved and it wasn\x92t some internal fault.
Hopefully, as the CVR is further analysed some more information will come to light.
July 13, 2025, 18:03:00 GMT
permalink Post: 11921494
It would have been useful if more of the CVR data had been released so as to see the crew interaction. Also the language used on what was released seems to refer to a third person.
However, from an operator perspective. Captain PM, FO PF. PF selects TOGA and follows the thrust levers, Captain confirms Thrust Set and replaces FO hands on the Thrust Levers. 80Kt call by PM, acknowledged by PF. Aircraft calls V1, Captain should withdraw hands from Thrust Levers and calls Rotate at Vr. PM is looking for confirmation the aircraft is climbing and calls Positive Rate. PF confirms and calls Gear Up. At this point the PF will be looking through the HUD looking to follow the flight director, the PM would be checking LNAV had engaged and at 400\x92 checking THR REF and VNAV SPD. However, at this point a loss of thrust occurred. So how was this apparent to the PF who would have been looking out with both hands on the control wheel. Reduction in pitch? GPWS call-out? Decreasing N1 on the engine instruments? EICAS ENG SHUTDOWN? What did the PM see? Who called out the situation? Were any actions called for? At some point as the generators went off line all the FO instruments would have blanked. Did the Captain assume control? I don\x92t think I would have been thinking about the Fuel Cut-Off switches at that point, yet they were specifically mentioned which does mean the switches were moved and it wasn\x92t some internal fault.
Hopefully, as the CVR is further analysed some more information will come to light.
However, from an operator perspective. Captain PM, FO PF. PF selects TOGA and follows the thrust levers, Captain confirms Thrust Set and replaces FO hands on the Thrust Levers. 80Kt call by PM, acknowledged by PF. Aircraft calls V1, Captain should withdraw hands from Thrust Levers and calls Rotate at Vr. PM is looking for confirmation the aircraft is climbing and calls Positive Rate. PF confirms and calls Gear Up. At this point the PF will be looking through the HUD looking to follow the flight director, the PM would be checking LNAV had engaged and at 400\x92 checking THR REF and VNAV SPD. However, at this point a loss of thrust occurred. So how was this apparent to the PF who would have been looking out with both hands on the control wheel. Reduction in pitch? GPWS call-out? Decreasing N1 on the engine instruments? EICAS ENG SHUTDOWN? What did the PM see? Who called out the situation? Were any actions called for? At some point as the generators went off line all the FO instruments would have blanked. Did the Captain assume control? I don\x92t think I would have been thinking about the Fuel Cut-Off switches at that point, yet they were specifically mentioned which does mean the switches were moved and it wasn\x92t some internal fault.
Hopefully, as the CVR is further analysed some more information will come to light.
Interestingly ENG 1 was cut off first\x85
July 13, 2025, 19:16:00 GMT
permalink Post: 11921552
I don\x92t know if it started to open or was registered open at 8 seconds.
July 14, 2025, 22:51:00 GMT
permalink Post: 11922563
Having seen it today, fuel control switch to cut off produces a L/R ENG SHUTDOWN EICAS message almost immmediately or ENG SHUTDOWN if both. No aural warning. Generators instantly off line therefore it is likely all FO instruments blanked. Definitely a startle event for the PF in this case.
July 16, 2025, 00:30:00 GMT
permalink Post: 11923360
Since the preliminary report neglected including when the RAT deployment occurred, I've tried to estimate it based on the picture they did include:
Baro altitude should be around 150ft; using the public cctv video, I estimate this picture was taken between 4-7 seconds after rotation. A wide range, but that was the best estimate I could come up with. Maybe someone else could narrow it down further.
Baro altitude should be around 150ft; using the public cctv video, I estimate this picture was taken between 4-7 seconds after rotation. A wide range, but that was the best estimate I could come up with. Maybe someone else could narrow it down further.
I'm equally impressed by how quickly No1 engine recovered. I think it's safe to say that this situation is not recoverable, but a truly impressive piece of engineering all the same.