June 19, 2025, 08:44:00 GMT
permalink Post: 11905837
Thank god someone has pointed out the absolute cobblers some people who claim to have some experience of this type (and other completely unrelated types) have been spouting. And if anyone else wants to erroneously compare the 757/767 low level EPR ALT CAP scenario , that keeps the TO thrust on, it doesn\x92t reduce it! This is truely one of the worst of these accidents threads I\x92ve read in a long time, I pity the mods.
June 19, 2025, 13:40:00 GMT
permalink Post: 11906028
Hidden
Has anybody the skill, knowledge, hands-on system familiarity or diagrammatic access to examine the
Ground/Air,
gear-handle,
gear doors
gear position lights
emergency extension,
Throttle lever position and
W.o.W. circuitry - in any sanguine detail?
What for? It could possibly reveal some abstract relationship flaw between microswitches, RadAlts, and/or even shock-strut extension or travelling gear or door position that allows for an effect dependent upon the high ambient temperature-dictated interrelationship?
Why ferret thusly? Many latent gremlins reside in complex circuitry. It is very hard to get away from the logical proposition that gear selection / travel (or possibly the earlier G/A transition) predicated the double flame-out and RAT deployment. The 787 was always ever described as an electric airplane and I see that as a harbinger - not of doom, but of inspiration.
I personally have never trusted electro-mechanical devices such as micro-switches... or for that matter, solenoid-operated relays. Or travelling further afield, those fiendish devices called circuit-breakers (thermal or otherwise). And a description of an RCD as a "safety switch" sends a shiver up my spine. They are really just a potential annoyance and an ongoing expense. As I have found again and again, their reliability and test functions are no guarantee of serviceability. A ceiling fire cured me of that fantasy.
You might also reflect deeply upon the following observation:
From the outset, this electric airplane had electrical issues. The Lithium Ion battery fires were never really resolved. They just re-housed it in a very stout titanium box - one that can only breathe a fiery breath overboard I believe... as if it was a slice of thorium always threatening to turn into lethal plutonium. The 787 designers convinced the regulator that their electric airplane could only become an industry steed if it had the power of such a battery. Unsure whether there's since been any ongoing issues (or if there had been, would it become a "known" event - now that this malignant potency has been robustly "contained"?). So what happens when a fire breaks out inside that titanium box and all its volts are discharged overboard? Are any battery-powered holding relays released at that point? i.e. is there a damning catch? Pandora's stout box may prove to be a gift-horse.
Ground/Air,
gear-handle,
gear doors
gear position lights
emergency extension,
Throttle lever position and
W.o.W. circuitry - in any sanguine detail?
What for? It could possibly reveal some abstract relationship flaw between microswitches, RadAlts, and/or even shock-strut extension or travelling gear or door position that allows for an effect dependent upon the high ambient temperature-dictated interrelationship?
Why ferret thusly? Many latent gremlins reside in complex circuitry. It is very hard to get away from the logical proposition that gear selection / travel (or possibly the earlier G/A transition) predicated the double flame-out and RAT deployment. The 787 was always ever described as an electric airplane and I see that as a harbinger - not of doom, but of inspiration.
I personally have never trusted electro-mechanical devices such as micro-switches... or for that matter, solenoid-operated relays. Or travelling further afield, those fiendish devices called circuit-breakers (thermal or otherwise). And a description of an RCD as a "safety switch" sends a shiver up my spine. They are really just a potential annoyance and an ongoing expense. As I have found again and again, their reliability and test functions are no guarantee of serviceability. A ceiling fire cured me of that fantasy.
You might also reflect deeply upon the following observation:
From the outset, this electric airplane had electrical issues. The Lithium Ion battery fires were never really resolved. They just re-housed it in a very stout titanium box - one that can only breathe a fiery breath overboard I believe... as if it was a slice of thorium always threatening to turn into lethal plutonium. The 787 designers convinced the regulator that their electric airplane could only become an industry steed if it had the power of such a battery. Unsure whether there's since been any ongoing issues (or if there had been, would it become a "known" event - now that this malignant potency has been robustly "contained"?). So what happens when a fire breaks out inside that titanium box and all its volts are discharged overboard? Are any battery-powered holding relays released at that point? i.e. is there a damning catch? Pandora's stout box may prove to be a gift-horse.
Last edited by bbofh; 19th June 2025 at 15:42 .
June 19, 2025, 13:59:00 GMT
permalink Post: 11906042
OK, enough quick, consecutive, posts from me for now. Off to do required chores.
June 19, 2025, 14:08:00 GMT
permalink Post: 11906052
Dunno, the discussion around the switch as a failure point looks spurious to me. With that used to support the idea that a possible engine shutdown was due to the master fuel valve closing.
I don\x92t really buy that, since we don\x92t know at this stage whether the engines did in fact fully shutdown, or were commanded to spool down to idle, or other lower thrust setting, both of which would produce the same result. Thoughts ?.
I don\x92t really buy that, since we don\x92t know at this stage whether the engines did in fact fully shutdown, or were commanded to spool down to idle, or other lower thrust setting, both of which would produce the same result. Thoughts ?.
June 19, 2025, 14:08:00 GMT
permalink Post: 11906053
I have read most of the thread (old and new). As a lawyer working in forensic investigations, I am constantly involved in problem-solving. My field of work also includes complex investigations related to insolvencies, which almost always require an analysis of the causes behind a specific, established outcome. In doing so, I naturally also have to deal with probabilities. However, it often turns out that the most likely or plausible explanation does not reflect what actually happened.
Many of the considerations I’ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.
With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought—and it was nothing more than that—was that their activation becomes more probable if it can occur accidentally. That’s how I came across SAIB: NM-18-33.
Another user then brought up an iPhone. That notion would, of course, be dramatic—but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the “Off” position. Due to the buttons on top of the switches, which provide some resistance, it’s even possible that the object both pulled and pushed them.
But all of this is speculation. The investigation report will bring clarity.
Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety—especially considering that the FCS are protected laterally by metal plates.
Many of the considerations I’ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.
With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought—and it was nothing more than that—was that their activation becomes more probable if it can occur accidentally. That’s how I came across SAIB: NM-18-33.
Another user then brought up an iPhone. That notion would, of course, be dramatic—but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the “Off” position. Due to the buttons on top of the switches, which provide some resistance, it’s even possible that the object both pulled and pushed them.
But all of this is speculation. The investigation report will bring clarity.
Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety—especially considering that the FCS are protected laterally by metal plates.
June 19, 2025, 14:36:00 GMT
permalink Post: 11906073
I have read most of the thread (old and new). As a lawyer working in forensic investigations, I am constantly involved in problem-solving. My field of work also includes complex investigations related to insolvencies, which almost always require an analysis of the causes behind a specific, established outcome. In doing so, I naturally also have to deal with probabilities. However, it often turns out that the most likely or plausible explanation does not reflect what actually happened.
Many of the considerations I\x92ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.
With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought\x97and it was nothing more than that\x97was that their activation becomes more probable if it can occur accidentally. That\x92s how I came across SAIB: NM-18-33.
Another user then brought up an iPhone. That notion would, of course, be dramatic\x97but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the \x93Off\x94 position. Due to the buttons on top of the switches, which provide some resistance, it\x92s even possible that the object both pulled and pushed them.
But all of this is speculation. The investigation report will bring clarity.
Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety\x97especially considering that the FCS are protected laterally by metal plates.
Many of the considerations I\x92ve read fail because the simultaneous failure of both engines is extremely unlikely, leading to a constant search for higher-order causes. It was suggested that an incorrect altitude setting led to an early thrust reduction. However, this would not explain the deployment of the RAT (Ram Air Turbine), especially since the thrust could have been readjusted. FADEC and TCAM are highly redundant systems, and TCAM failure is unlikely due to WOW (Weight on Wheels) logic, making a simultaneous engine failure after VR equally improbable.
With that said, and with regard to my question concerning the AD that relates to the fuel control switches (FCS), my thought\x97and it was nothing more than that\x97was that their activation becomes more probable if it can occur accidentally. That\x92s how I came across SAIB: NM-18-33.
Another user then brought up an iPhone. That notion would, of course, be dramatic\x97but how unlikely is it really that after approximately 10,000 actuations between December 2013 and June 2025, the two FCS no longer lock perfectly? Considering all of this, I find it quite conceivable that the A/T slightly reduced thrust in the first seconds after VR (e.g., if an incorrect target altitude had been entered) and that an object lying between the thrust levers and the FCS could have pushed the FCS into the \x93Off\x94 position. Due to the buttons on top of the switches, which provide some resistance, it\x92s even possible that the object both pulled and pushed them.
But all of this is speculation. The investigation report will bring clarity.
Even if my theory is not confirmed, I still believe that the positioning and mechanism of the FCS are suboptimal. Switches of such critical importance should be better protected, and movements in the area in front of the switches (like reducing thrust) should not follow the same direction as shutting off the fuel supply. A different switching direction alone would provide more safety\x97especially considering that the FCS are protected laterally by metal plates.
June 19, 2025, 14:51:00 GMT
permalink Post: 11906087
OK, I promised some
informed speculation
when I got back, so here goes:
Disclaimer: never worked the 787, so my detailed knowledge is a bit lacking.
First off, this is perplexing - especially if the RAT was deployed. There is no 'simple' explanation that I can come up with.
GEnx-1B engines have been exceptionally reliable, and the GE carbon composite fan blades are very robust and resistant to bird strike damage (about 15 years after the GE90 entry into service, I remember a GE boast that no GE90 (carbon composite) fan blades had needed to be scrapped due to damage (birdstrike, FOD, etc. - now that was roughly another 15 years ago, so is probably no longer true, but it shows just how robust the carbon composite blades are - far better than the more conventional titanium fan blades).
Not saying it wasn't somehow birdstrike related, just that is very unlikely (then again, all the other explanations I can come up with are also very unlikely
).
Using improper temp when calculating TO performance - after some near misses, Boeing added logic that cross-compares multiple total temp probes - aircraft TAT (I think the 787 uses a single, dual element probe for aircraft TAT, but stand to be corrected) and the temp measured by the engine inlet probes - and puts up a message if they disagree by more than a few degree tolerance - so very, very unlikely.
N1 power setting is somewhat less prone to measurement and power setting errors than EPR (N1 is a much simpler measurement than Rolls EPR) - although even with EPR, problems on both engines at the same time is almost unheard of.
The Auto Thrust (autothrottle) function 'falls asleep' at 60 knots - and doesn't unlock until one of several things happens - 250 knots, a set altitude AGL is exceeded (I'm thinking 3,000 ft. but the memory is fuzzy), thrust levers are moved more than a couple of degrees, or the mode select is changed (memory says that last one is inhibited below 400 ft. AGL). So an Auto Thrust malfunction is also extremely unlikely. Further, a premature thrust lever retard would not explain a RAT deployment.
TO does seem to be very late in the takeoff role - even with a big derate, you still must accelerate fast enough to reach V1 with enough runway to stop - so there is still considerable margin if both engines are operating normally. That makes me wonder if they had the correct TO power setting - but I'm at a loss to explain how they could have fouled that up with all the protections that the 787 puts on that.
If one engine did fail after V1, it's conceivable that they shut down the wrong engine - but since this happened literally seconds after takeoff, it begs the question why they would be in a big hurry to shut down the engine. Short of an engine fire, there is nothing about an engine failure that requires quick action to shut it down - no evidence of an engine fire, and even with an engine fire, you normally have minutes to take action - not seconds.
The one thing I keep thinking about is someone placing both fuel switches to cutoff immediately after TO. Yes, it's happened before (twice - 767s in the early 1980s), but the root causes of that mistake are understood and have been corrected. Hard to explain how it could happen ( unless, God forbid, it was intentional ).
Disclaimer: never worked the 787, so my detailed knowledge is a bit lacking.
First off, this is perplexing - especially if the RAT was deployed. There is no 'simple' explanation that I can come up with.
GEnx-1B engines have been exceptionally reliable, and the GE carbon composite fan blades are very robust and resistant to bird strike damage (about 15 years after the GE90 entry into service, I remember a GE boast that no GE90 (carbon composite) fan blades had needed to be scrapped due to damage (birdstrike, FOD, etc. - now that was roughly another 15 years ago, so is probably no longer true, but it shows just how robust the carbon composite blades are - far better than the more conventional titanium fan blades).
Not saying it wasn't somehow birdstrike related, just that is very unlikely (then again, all the other explanations I can come up with are also very unlikely
).
Using improper temp when calculating TO performance - after some near misses, Boeing added logic that cross-compares multiple total temp probes - aircraft TAT (I think the 787 uses a single, dual element probe for aircraft TAT, but stand to be corrected) and the temp measured by the engine inlet probes - and puts up a message if they disagree by more than a few degree tolerance - so very, very unlikely.
N1 power setting is somewhat less prone to measurement and power setting errors than EPR (N1 is a much simpler measurement than Rolls EPR) - although even with EPR, problems on both engines at the same time is almost unheard of.
The Auto Thrust (autothrottle) function 'falls asleep' at 60 knots - and doesn't unlock until one of several things happens - 250 knots, a set altitude AGL is exceeded (I'm thinking 3,000 ft. but the memory is fuzzy), thrust levers are moved more than a couple of degrees, or the mode select is changed (memory says that last one is inhibited below 400 ft. AGL). So an Auto Thrust malfunction is also extremely unlikely. Further, a premature thrust lever retard would not explain a RAT deployment.
TO does seem to be very late in the takeoff role - even with a big derate, you still must accelerate fast enough to reach V1 with enough runway to stop - so there is still considerable margin if both engines are operating normally. That makes me wonder if they had the correct TO power setting - but I'm at a loss to explain how they could have fouled that up with all the protections that the 787 puts on that.
If one engine did fail after V1, it's conceivable that they shut down the wrong engine - but since this happened literally seconds after takeoff, it begs the question why they would be in a big hurry to shut down the engine. Short of an engine fire, there is nothing about an engine failure that requires quick action to shut it down - no evidence of an engine fire, and even with an engine fire, you normally have minutes to take action - not seconds.
The one thing I keep thinking about is someone placing both fuel switches to cutoff immediately after TO. Yes, it's happened before (twice - 767s in the early 1980s), but the root causes of that mistake are understood and have been corrected. Hard to explain how it could happen ( unless, God forbid, it was intentional ).
June 19, 2025, 17:43:00 GMT
permalink Post: 11906222
Had a play with this scenario in the sim today and learnt a few things:
1) Incorrect performance data... It has to be a VERY significant perf shortfall and depending on the startle factor versus reaction time is still in my view a possibility.
2) Low altitude capture. The HUD is very compelling and there is no visualisation of power demanded versus power set in the symbology. The speed tape has a 10 second speed trend arrow and the FPV has avery sensitive inertial speed trend arrow. Again recovery was possible but by this time the guys were ready for it.
3) I remain agnostic about the RAT deployment. However, aside from punching out the RAT on the overhead panel there was only one method we could find to deploy the RAT in this very short timescale.
1) Incorrect performance data... It has to be a VERY significant perf shortfall and depending on the startle factor versus reaction time is still in my view a possibility.
2) Low altitude capture. The HUD is very compelling and there is no visualisation of power demanded versus power set in the symbology. The speed tape has a 10 second speed trend arrow and the FPV has avery sensitive inertial speed trend arrow. Again recovery was possible but by this time the guys were ready for it.
3) I remain agnostic about the RAT deployment. However, aside from punching out the RAT on the overhead panel there was only one method we could find to deploy the RAT in this very short timescale.
June 19, 2025, 18:02:00 GMT
permalink Post: 11906235
Had a play with this scenario in the sim today and learnt a few things:
1) Incorrect performance data... It has to be a VERY significant perf shortfall and depending on the startle factor versus reaction time is still in my view a possibility.
2) Low altitude capture. The HUD is very compelling and there is no visualisation of power demanded versus power set in the symbology. The speed tape has a 10 second speed trend arrow and the FPV has avery sensitive inertial speed trend arrow. Again recovery was possible but by this time the guys were ready for it.
3) I remain agnostic about the RAT deployment. However, aside from punching out the RAT on the overhead panel there was only one method we could find to deploy the RAT in this very short timescale.
1) Incorrect performance data... It has to be a VERY significant perf shortfall and depending on the startle factor versus reaction time is still in my view a possibility.
2) Low altitude capture. The HUD is very compelling and there is no visualisation of power demanded versus power set in the symbology. The speed tape has a 10 second speed trend arrow and the FPV has avery sensitive inertial speed trend arrow. Again recovery was possible but by this time the guys were ready for it.
3) I remain agnostic about the RAT deployment. However, aside from punching out the RAT on the overhead panel there was only one method we could find to deploy the RAT in this very short timescale.
regarding point 1).
how significant, would you care to expand ?
June 19, 2025, 18:05:00 GMT
permalink Post: 11906239
Fuel valves and TCMA software updates?
Commanded engine cutoff - the aisle stand fuel switch sends electrical signals to the spar valve and the "High Pressure Shutoff Valve" (HPSOV) in the Fuel Metering Unit, commanding them to open/close using aircraft power. The HPSOV is solenoid controlled, and near instantaneous. The solenoid is of a 'locking' type that needs to be powered both ways (for obvious reasons, you wouldn't want a loss of electrical power to shut down the engine). The fire handle does the same thing, via different electrical paths (i.e. separate wiring).
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
As I've noted previously, a complete loss of aircraft electrical power would not cause the engines to flameout (or even lose meaningful thrust) during takeoff. In the takeoff altitude envelope, 'suction feed' (I think Airbus calls it 'gravity feed') is more than sufficient to supply the engine driven fuel pumps. It's only when you get up to ~20k ft. that suction feed can become an issue - and this event happened near sea level.
Not matter what's happening on the aircraft side - pushing the thrust levers to the forward stop will give you (at least) rated takeoff power since the only thing required from the aircraft is fuel and thrust lever position (and the thrust lever position resolver is powered by the FADEC).
The TCMA logic is designed and scrubbed so as to be quite robust - flight test data of the engine response to throttle slams is reviewed to insure there is adequate margin between the TCMA limits and the actual engine responses to prevent improper TCMA activation. Again, never say never, but a whole lot would have had to go wrong in the TCMA logic for it to have activated on this flight.
Now, if I assume the speculation that the RAT deployed is correct, I keep coming up with two potential scenarios that could explain what's known regarding this accident:
1) TCMA activation shutdown the engines
or
2) The fuel cutoff switches were activated.
I literally can come up with no other plausible scenarios.
In all due respect to all the pilots on this forum, I really hope it wasn't TCMA. It wouldn't be the first time a mandated 'safety system' has caused an accident (it wouldn't just be Boeing and GE - TCMA was forced by the FAA and EASA to prevent a scenario that had never caused a fatal accident) - and there would be a lot embarrassing questions for all involved. But I personally know many of the people who created, validated, and certified the GEnx-1B TCMA logic - and can't imagine what they would be going through if they missed something (coincidentally, one of them was at my birthday party last weekend and inevitably we ended up talking about what we used to do at Boeing (he's also retired)). Worse, similar TCMA logic is on the GEnx-2B (747-8) - which I was personally responsible for certifying - as well as the GE90-115B and the 737 MAX Leap engine - the consequences of that logic causing this accident would be massive.
I seem to remember Fred Dibner talking about how railway cars brake by draining the piston not by pressurising it, so trains will stop when supply lines break.
The electrical system updates to 787s for ADs and SBs - do any of these include software updates? For example the integer overflow causing GCU failsafe rectified under AD 2018-20-15. If so, who is writing and implementing these software updates? The original engineers? Their apprentices who had years long handovers? Or have they been outsourced and offshored? When these updates occur, does the entire system get tested and ratified or just the bit the bug fix is meant to fix? Because I\x92ve seen new bugs introduced by bug fixes in areas seemingly nothing to do with the original problem.
June 19, 2025, 18:47:00 GMT
permalink Post: 11906262
Has it been determined from the wreckage that the RAT was deployed at the time of impact?
June 19, 2025, 20:35:00 GMT
permalink Post: 11906349
slf/ppl here - with a respectable amount of experience in software delivery for real-time/embedded/safety critical systems. Software development in this area really is an engineering discipline and bears no resemblance to common practice in other areas. Couple that with the requirements for function duplication/triplication, harness separation et al then IMHO the chances of FADEC etc software errors are effectively zero.
I'm commenting to make that point but also to link the videos and the FR-24 dataset - (below with my deltas for height/time added)
Extract from FR24 csv dataset
As noted in both threads to date everything was normal until it wasn't - the two values for fpm above are subject to FR24 variance of +/- 25' so even these suggest a normal climb at this stage of flight ca 2,000fpm. FR24 Lat/Longs all follow the centre line.
On this data the climb stops at around 70' AGL and electrical failure around 2s later. Again, as noted in the threads, this aligns with when gear up might have been expected. If the climb stopped because of fuel shutoff then 2s for spool down to electrical failure isn't out of the question.
Looking at the two videos.
The CCTV video indicates a total flight time, from rotation, of about 32s, subjectively levelling off ~14s after rotation.
The rooftop video has a flight time ~14s suggesting the video starts ~18s after rotation.
The rooftop video evidences the RAT as deployed from the beginning - meaning it must have been deployed by at least 16s after rotation - which aligns with the ADS-B indicated electrical failure.
If the forward flight recorder really is being sent to the US for recovery then it's reasonable to assume that the rear recorder contains nothing after the electrical failure and they are hoping the forward recorder captured something from the cockpit in the final 16s.
I don't have any experience of flight deck CRM but I don't see how those timings allow problem identification/misidentification and subsequent action - ie it wasn't down to the crew.
However:
The maximum aircraft height in the CCTV video, as judged by wingspan, appears higher than 71' - though it is certainly less than a wingspan height at the beginning of the rooftop video.
I haven't seen, in the threads, any statement of what happens on the flight deck with a total electrical failure - is it a 4s blackout whilst the RAT deploys and systems restart? - or are there batteries that keep something alive?
I'm commenting to make that point but also to link the videos and the FR-24 dataset - (below with my deltas for height/time added)
Extract from FR24 csv dataset
As noted in both threads to date everything was normal until it wasn't - the two values for fpm above are subject to FR24 variance of +/- 25' so even these suggest a normal climb at this stage of flight ca 2,000fpm. FR24 Lat/Longs all follow the centre line.
On this data the climb stops at around 70' AGL and electrical failure around 2s later. Again, as noted in the threads, this aligns with when gear up might have been expected. If the climb stopped because of fuel shutoff then 2s for spool down to electrical failure isn't out of the question.
Looking at the two videos.
The CCTV video indicates a total flight time, from rotation, of about 32s, subjectively levelling off ~14s after rotation.
The rooftop video has a flight time ~14s suggesting the video starts ~18s after rotation.
The rooftop video evidences the RAT as deployed from the beginning - meaning it must have been deployed by at least 16s after rotation - which aligns with the ADS-B indicated electrical failure.
If the forward flight recorder really is being sent to the US for recovery then it's reasonable to assume that the rear recorder contains nothing after the electrical failure and they are hoping the forward recorder captured something from the cockpit in the final 16s.
I don't have any experience of flight deck CRM but I don't see how those timings allow problem identification/misidentification and subsequent action - ie it wasn't down to the crew.
However:
The maximum aircraft height in the CCTV video, as judged by wingspan, appears higher than 71' - though it is certainly less than a wingspan height at the beginning of the rooftop video.
I haven't seen, in the threads, any statement of what happens on the flight deck with a total electrical failure - is it a 4s blackout whilst the RAT deploys and systems restart? - or are there batteries that keep something alive?
June 19, 2025, 23:26:00 GMT
permalink Post: 11906480
Summary of main theories
DISCLAIMER: Poster (a) is one of the (apparently quite numerous) lawyers following this thread; (b) a long-time forum lurker and aviation enthusiast who loves studying FCOMs for fun (to each his own, I guess); (c) has followed and read this thread from the start.
What I cannot do is add new theories or uncover any new facts the actual experts have not already thought of. However, since summarizing and structuring information is one thing lawyers tend to regularly do (and sometimes even do well), here is my attempt at a useful contribution to this thread: an attempt to summarize the main theories discussed here since day one (which I think hasn't been done for quite some time) in the hope that a birds-eye view will be helpful to those who have not read everything since the beginning or might even trigger some new flash of inspiration for someone more knowledgable than me. I have focused on the cons since there does not seem to be enough evidence to come to any positive conclusion.
I shall try to be concise and to refrain from personal evaluations of my own. Of course, no disrespect whatsoever is intended towards all those who have contributed to this thread and to the individual theories, one or combinations of which may turn out to have led to this tragic outcome. That arguments can be made against every single theory that has been propagated seems to be the result of the highly improbable and unusual nature of this deplorable event and certainly not due to any lack of knowledge or reasoning skills in this forum.
DEAR MODS: If I have distorted anything or if, meaning well, should have achieved the opposite \x96 I guess you know where the delete button is\x85
Anyway, here goes:
A. Misconfiguration or wrong takeoff data
Widely refuted, since
Still brought up from time to time. However, widely disregarded due to
It should be pointed out that the question of "RAT in or out" was for a while the most contentious in this thread.
C. Low-altitude capture
Still argued, even if refuted by many since
Various possible reasons for this have been discussed:
I. Bird strike/FOD
Unclear which maintenance measures could possibly have been performed that would have resulted in simultaneous loss of both engines. No apparent relationships between malfunctions reported by previous passengers and essential systems.
IV. Large-scale electrical fault (e.g. due to water in E&E bay)
The engines will continue to run if electrical power is lost. FADECs are powered independently.
V. Shutdown of engines by TCMA
A parallel is drawn to the ANA incident. However, this would require not only a fault in the air/ground logic but also a sensed discrepancy between T/L position (not necessarily idle) and thrust output on both engines simultaneously.
VI. (Inadvertent) shutdown by flight crew
What I cannot do is add new theories or uncover any new facts the actual experts have not already thought of. However, since summarizing and structuring information is one thing lawyers tend to regularly do (and sometimes even do well), here is my attempt at a useful contribution to this thread: an attempt to summarize the main theories discussed here since day one (which I think hasn't been done for quite some time) in the hope that a birds-eye view will be helpful to those who have not read everything since the beginning or might even trigger some new flash of inspiration for someone more knowledgable than me. I have focused on the cons since there does not seem to be enough evidence to come to any positive conclusion.
I shall try to be concise and to refrain from personal evaluations of my own. Of course, no disrespect whatsoever is intended towards all those who have contributed to this thread and to the individual theories, one or combinations of which may turn out to have led to this tragic outcome. That arguments can be made against every single theory that has been propagated seems to be the result of the highly improbable and unusual nature of this deplorable event and certainly not due to any lack of knowledge or reasoning skills in this forum.
DEAR MODS: If I have distorted anything or if, meaning well, should have achieved the opposite \x96 I guess you know where the delete button is\x85
Anyway, here goes:
A. Misconfiguration or wrong takeoff data
Widely refuted, since
- rotation, takeoff and initial climb seem normal;
- likely extreme errors would have been required to have such tragic effect (the fuel tanks should have been only about half full, so not close to MTOW);
- there is strong evidence that at least some flaps were extended for takeoff (post-crash photo, perhaps also visible in video from behind)
Still brought up from time to time. However, widely disregarded due to
- the fact that with two working engines an inadvertent flap retraction should easily be recoverable, even with gear down;
- strong indications that hydraulic and electric power were lost (audible/visible indications of RAT extension, survivor statement, lack of engine noise, position of MLG bogies).
It should be pointed out that the question of "RAT in or out" was for a while the most contentious in this thread.
C. Low-altitude capture
Still argued, even if refuted by many since
- inconsistent with apparent loss of hydraulic/electric power;
- PF would have been flying manually (however, A/T reaction would have been unexpected for the PF);
- should have been recoverable (unless one assumes that the crew (a) remained unaware of the changed FMA annunciations although alerted by the unexpected FD commands; and (b) was so startled that an A/T thrust reduction was not noticed and corrected, even though the PF was apparently sufficiently alert not to follow the FD commands).
Various possible reasons for this have been discussed:
I. Bird strike/FOD
- Would have to have occurred simultaneously due to lack of rudder/aileron input indicating symmetric thrust.
- No remains/traces on runway, no visual indications (flocks of birds, flames, structural engine damage).
1. Loss of electric fuel pumps
Suction feed would have provided sufficient fuel pressure.
2. Fuel contamination
No other aircraft affected, no measures taken at airport. Simultaneous flameout due to contaminated fuel very unlikely.
3. Vapour lock
Unlikely to occur in this scenario. Even if (momentarily) no sufficient fuel pressure from the center tank, the engines would have been fed by the wing tanks.
III. Improper maintenance
Unclear which maintenance measures could possibly have been performed that would have resulted in simultaneous loss of both engines. No apparent relationships between malfunctions reported by previous passengers and essential systems.
IV. Large-scale electrical fault (e.g. due to water in E&E bay)
The engines will continue to run if electrical power is lost. FADECs are powered independently.
V. Shutdown of engines by TCMA
A parallel is drawn to the ANA incident. However, this would require not only a fault in the air/ground logic but also a sensed discrepancy between T/L position (not necessarily idle) and thrust output on both engines simultaneously.
VI. (Inadvertent) shutdown by flight crew
1. Spontaneous execution of memory items (fuel control switches OFF, then ON; deploy RAT) due to assumed engine malfunction
In contrast to mistakenly shutting down the wrong engine after having correctly diagnosed the problem as per SOP, this would require not only a simple error in execution but a counter-intuitive unilateral action immediately after takeoff against basic principles of SOP or CRM.
2. No indications whatsoever of an intentional shutdown for nefarious reasons
(Would also be inconsistent with the content of the alleged mayday call.)
VII.
Malfunction/mishandling of the fuel cutoff switches (most recent)
1.
Wear or improper operation of the switches, so that they do not lock but can shift back into the OFF position.
Argued to be impossible due to robust switch design, preventing switch release in any other than a locked position.
Actuation of the switches by an item placed before them which was pushed onto the switches by retarding thrust levers seems equally unlikely due to force required to pull the switches out of the locked position.
Actuation of the switches by an item placed before them which was pushed onto the switches by retarding thrust levers seems equally unlikely due to force required to pull the switches out of the locked position.
2.
Spilled drink leading to short in the wiring
Hardly conceivable that before takeoff open liquid containers would be placed anywhere where they could spill onto the pedestal.
June 20, 2025, 00:03:00 GMT
permalink Post: 11906499
June 20, 2025, 00:28:00 GMT
permalink Post: 11906506
Therefore the crew could have manually deployed it... (there's a button for that). If I saw the engines winding down and couldn't be sure that they would stop at idle, I'd be inclined to deploy the RAT instead of waiting for airplane to do it.
Last edited by Tailspin Turtle; 20th June 2025 at 00:53 . Reason: Add a reason for manual deployment of the RAT
June 20, 2025, 00:38:00 GMT
permalink Post: 11906511
June 20, 2025, 01:07:00 GMT
permalink Post: 11906518
June 20, 2025, 01:11:00 GMT
permalink Post: 11906519
This incident is very perplexing to me. This is my first post on here and I am not a pilot. I have over a decade of experience in the RAAF as an engine fitter on Mirage and Hornet aircraft. Albeit a bit of time ago.
I have watched the video's and looked at the FR-24 data a hundred times. To me it looks like a normal rotation and at WoW everything starts to go wrong.
Airspeed starts dropping off immediately going by the FR-24 data. If reports are correct the pilot makes his Mayday call. FR-24 data stops.
In the video from the balcony I agree the RAT is out and operating but I can also hear the engines at idle or just above (maybe flight idle).
If the captain manually deployed the RAT this makes sense to me. In both video's I don't see any aircraft behavior that would suggest they are not flying the aircraft.
Is there an electrical fault at WoW that renders the cockpit dark and therefore manually deploying the RAT (possibly initiating APU start, inlet door is open at crash site) would make sense to restore cockpit power.
I can't understand any pilot shutting down both engines at 200ft AGL. He would surely know that his fight is over at that point.
I am not ruling out pilot error (configuration or otherwise) but my hat goes off to two pilots that I believe were trying to fly this aircraft until it hit the ground.
Sorry if my wording is a bit off but mine is military background not commercial.
I have watched the video's and looked at the FR-24 data a hundred times. To me it looks like a normal rotation and at WoW everything starts to go wrong.
Airspeed starts dropping off immediately going by the FR-24 data. If reports are correct the pilot makes his Mayday call. FR-24 data stops.
In the video from the balcony I agree the RAT is out and operating but I can also hear the engines at idle or just above (maybe flight idle).
If the captain manually deployed the RAT this makes sense to me. In both video's I don't see any aircraft behavior that would suggest they are not flying the aircraft.
Is there an electrical fault at WoW that renders the cockpit dark and therefore manually deploying the RAT (possibly initiating APU start, inlet door is open at crash site) would make sense to restore cockpit power.
I can't understand any pilot shutting down both engines at 200ft AGL. He would surely know that his fight is over at that point.
I am not ruling out pilot error (configuration or otherwise) but my hat goes off to two pilots that I believe were trying to fly this aircraft until it hit the ground.
Sorry if my wording is a bit off but mine is military background not commercial.
June 20, 2025, 04:57:00 GMT
permalink Post: 11906594
The Indian Express is carrying a story (
https://indianexpress.com/article/ci...lues-10077117/
) that includes the following:"Investigators probing the June 12
crash of Air India flight AI-171 from Ahmedabad to London Gatwick
are taking a close look at a February 2020 incident in Gatwick, involving an Airbus A321, in which both engines malfunctioned immediately after takeoff. It led to a Mayday call before the aircraft returned to Gatwick 11 minutes later after a turnaround." ...
..."it was \x93clear from visual observation and wreckage\x94 that the flight suffered a power failure." ...
..."The black boxes and the DVR have been recovered but the officer said that the devices were damaged and file extraction would \x93be a complicated process\x94." ...
... "We will check the technical logs to see if any of the engineering teams or pilots of the previous flight left comments on the performance of both engines"
Assuming there is some credence to the article, dual engine failure due to water contamination is the leading theory. It certainly fits much of the speculation in this thread. It may be that the flight data was not captured and much more reliance will be on forensic examination of the CCTV footage and the wreckage. Those waiting for the flight data to be published may be disappointed.
If the original CCTV footage was made available, together with a detailed survey map of the airport, it will be possible to accurately estimate the takeoff speed and altitude during all the critical periods. My guess is thrust was reduced or lost very early and perhaps before the aircraft left the tarmac. Then shortly after becoming airborne, power was lost resulting in the deployment of the RAT. It is doubtful that the pilots shut down the engines or the wrong engine. Likewise flap/slat misconfiguration is unlikely.
..."it was \x93clear from visual observation and wreckage\x94 that the flight suffered a power failure." ...
..."The black boxes and the DVR have been recovered but the officer said that the devices were damaged and file extraction would \x93be a complicated process\x94." ...
... "We will check the technical logs to see if any of the engineering teams or pilots of the previous flight left comments on the performance of both engines"
Assuming there is some credence to the article, dual engine failure due to water contamination is the leading theory. It certainly fits much of the speculation in this thread. It may be that the flight data was not captured and much more reliance will be on forensic examination of the CCTV footage and the wreckage. Those waiting for the flight data to be published may be disappointed.
If the original CCTV footage was made available, together with a detailed survey map of the airport, it will be possible to accurately estimate the takeoff speed and altitude during all the critical periods. My guess is thrust was reduced or lost very early and perhaps before the aircraft left the tarmac. Then shortly after becoming airborne, power was lost resulting in the deployment of the RAT. It is doubtful that the pilots shut down the engines or the wrong engine. Likewise flap/slat misconfiguration is unlikely.
June 20, 2025, 05:30:00 GMT
permalink Post: 11906603
TCMA things, imagination and evidence
You may be surprised to know that TCMA doesn't require that, it just requires a differential between commanded and actual thrust.
It has never triggered during takeoff until now. Maybe it still hasn't been. We'll see. Given there is an actual example of a 787 in the wild shutting down both of it's engines when it shouldn't (ANA), I'm surprised how complacent people are that this couldn't be the cause..Software can always have weird corner failures that could never have been thought of or tested.
It has never triggered during takeoff until now. Maybe it still hasn't been. We'll see. Given there is an actual example of a 787 in the wild shutting down both of it's engines when it shouldn't (ANA), I'm surprised how complacent people are that this couldn't be the cause..Software can always have weird corner failures that could never have been thought of or tested.
Note that the thrust lever actuators are wired to the FADECs, and that the TCMA gets the T/L position from that. For TCMA to trigger, it has to determine that its FADEC (on that engine) failed to achieve a commanded reduction in thrust. So we're either looking at a weird, unprecedented edge case, or a FADEC failure, or both.
Just so I have this clear, are you saying that the implementation of the TCMA functionality involved
no
new components being added to the pre-existing FADEC? Are you saying, in effect, that the two switch relays described in the TCMA patent application, which relays and their configuration achieves the described two channel redundancy, were already there as components or are mere depictions of what the software does itself?
Originally Posted by
Lead Balloon
I am not suggesting you are wrong and, as I've said before, the descriptions and schematic in the patent application are just 'big hands / small maps' concepts. However, if TCMA functionality "is simply a bit of software in the FADECs", merely sending a 1 or 0 or other signal into a point in the pre-existing FADEC that already had control over fuel cutoff (with the TCMA software merely monitoring data busses, rather than direct sensor outputs, to work out thrust lever position and whether or not the aircraft is 'on the ground' for TCMA purposes) I for one would really like to know that for sure and get my head around the implications.
With a MCAS crash, it required a hardware problem with an AOA sensor, used as input to a correctly working MCAS, to cause the aircraft to behave erratically. With a correctly working TCMA, I believe it'd require two hardware problems to get TCMA to shut down the engine, as there'd have to be an implausible thrust lever reading, and a FADEC/engine failure to process it within the TCMA allowed range ("contour"?). On both engines, separately and simultaneously.
That leaves a software problem; it's not hard to imagine. The issue is, at this point it's just that: imagination. I could detail a possible software failure chain, but without examining the actual code, it's impossible to verify. We simply don't have the evidence.
I could just as well imagine a microwave gun frying the electronics on both engines. An escaped hamster under the floor peeing on important contacts. A timed device installed by a psychopathic mechanic. There's no evidence for that, either.
This process is a way to psychologically cope with the unexplained accident, but because it lacks evidence, it's not likely to identify the actual cause. We've run the evidence down to "most likely both engines failed or shut off close to rotation, and the cause for that is inside the aircraft". Since the take-off looked normal until that failure, we have no clues as to the cause hidden inside the aircraft. We need to rely on the official investigation to discover and analyse sufficient evidence. The post-crash fire is going to make that difficult.
"Both engines failed or shut off close to rotation" explains all of the evidence : it explains an unremarkable take-off roll, loss of lift, absence of pronounced yaw, loss of electrical power, loss of the ADS-B transponder, RAT deployment, the noise of the RAT banging into place and revving up, emergency signs lighting up, a possible mayday call reporting loss of thrust/power/lift, and a physically plausible glide from a little over 200 ft AAL to the crash site
It explains what we saw on the videos, what the witness reported, where the aircraft ended up, and the ensuing sudden catastrophe.
I don't believe we have evidence for anything else right now—I'd be happily corrected on that.
-----
Edit: the evidence of the crash photo with the open APU inlet door, and the main gear bogeys tilted forward, are also explained by the dual engine failure/shut off.
Last edited by Musician; 21st June 2025 at 06:48 . Reason: more evidence