Page Links: First 1 2 Next Last Index Page
JustusW
June 13, 2025, 16:31:00 GMT permalink Post: 11900677 |
Correct, but if they retract flaps while the engines are producing takeoff thrust and they are somehow losing altitude they definitely should speed up.
There are strong reasons to doubt the flaps had anything to do with the accident, I agree with the following sentiment completely: I was taught (only as familiarization for my job as ATC) that during takeoff the pilot flying should have their hand on the throttle levers. Is that generally correct? If yes, will changes to throttle settings always be reflected in the actual physical position of the throttle levers or are there situations where the actual commanded throttle could differ from the physical lever position? The interaction with the TCMA in particular is of interest to me. Regards, Justus Subjects: None |
JustusW
June 16, 2025, 09:42:00 GMT permalink Post: 11903330 |
Im a layman who knows nothing and am just a PPL and am fascinated by the technicals.So does the computer store the recommended flap setting given all the information entered and then decide whether the actual setting used is appropriate and spits out a warning of checklist complete?what would happen if use of the full runway was entered into the computer, but actually they entered at an intersection, surely the info would be wrong ?...
In addition the valid settings for takeoff flaps simply begin at 5\xb0, so anything less isn't even offered. The corresponding alarms will thus always trigger if you don't have at least 5\xb0 flaps set upon setting takeoff thrust, possibly requiring a higher setting depending on the calculated takeoff configuration. As mentioned before in this thread the loading of the accident aircraft should have been far below its maximums, so a 5\xb0 flaps takeoff is quite ordinary, and the aircraft left the runway well short of its end. Also the aircraft used the entire runway after backtracking along it since there are no taxiways going that far. This information has been corrected by FR24 a while ago and stems from the incomplete GPS positional data that is inherent in ADS-B tracking, especially on the ground. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): ADSB FlightRadar24 |
JustusW
June 16, 2025, 09:42:00 GMT permalink Post: 11903756 |
Im a layman who knows nothing and am just a PPL and am fascinated by the technicals.So does the computer store the recommended flap setting given all the information entered and then decide whether the actual setting used is appropriate and spits out a warning of checklist complete?what would happen if use of the full runway was entered into the computer, but actually they entered at an intersection, surely the info would be wrong ?...
In addition the valid settings for takeoff flaps simply begin at 5\xb0, so anything less isn't even offered. The corresponding alarms will thus always trigger if you don't have at least 5\xb0 flaps set upon setting takeoff thrust, possibly requiring a higher setting depending on the calculated takeoff configuration. As mentioned before in this thread the loading of the accident aircraft should have been far below its maximums, so a 5\xb0 flaps takeoff is quite ordinary, and the aircraft left the runway well short of its end. Also the aircraft used the entire runway after backtracking along it since there are no taxiways going that far. This information has been corrected by FR24 a while ago and stems from the incomplete GPS positional data that is inherent in ADS-B tracking, especially on the ground. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): ADSB FlightRadar24 |
JustusW
June 20, 2025, 17:45:00 GMT permalink Post: 11907155 |
1/Would the recorders lose access to aircraft data streams when engine power is lost, at least temporarely making the cockpit area mic recorded by battery power on the front recorder the only source of information ?
2/The recorders only draw 20W, why is it the front with reserves only for 10 minutes? Can you even buy a battery that small giving 28VDC? Why is such a limited solution selected? ( For reference, This battery gives about 9 times that: <url removed> ) Regarding the recording feature, there's three types of microphone commonly used nowadays: Condenser and Ribbon type are somewhat fragile and require power to record audio while Dynamic type is basically a reverse speaker and is considered rugged. There's an off chance that a Piezzo microphone would be used here as they are basically indestructible but usually reserved for recording while in contact with a large sound transducer. My guess based on that is that we're looking at a dynamic microphone with a run of the mill preamp. Depending on the actual electric setup this would yield a handful of different possible installations: 1) The "Cockpit Area Microphone" (hereby christened CAM because I like abbreviations) is a self contained unit consisting of a Microphone, a preamp and AD converter. This would mean while provided power the digital recording could be passed to either EAFR. 2) The CAM is a self contained unit consisting of a Microphone and a preamp. This would mean while provided power it could send an analog audio signal to the forward EAFR no problem, but would potentially struggle generating enough of a signal to be picked up by the rear EAFR. 3) The CAM is just a Microphone. This would mean it requires either no or very little power (even Condenser Mics usually require only Milliwatts) but the signal would be very hard to send over long distances and would require the EAFR to have a preamp. In general it is audio engineering 101 to place a preamp as close to the source as possible to avoid noise. Thus I would rule out 3. It has both ups and downs to convert the analog signal to a digital signal, and there is a possibility they'd do both. In either case I am confused from an audio engineering standpoint why the rear EAFR would not pickup audio from the CAM if the forward EAFR does. Unless the rear EAFR is fed (audio) data only via BUS, which would be an interesting choice. Also keep in mind that historically the CVR was also located in the tail section and very much received an analog signal over the entire distance. There's really no technical reason this wouldn't be possible, I routinely use far longer cables when running audio signals at concerts and those can't use compression because it would dumpster sound quality. So, yeah, I don't understand why there would be a mismatch between the recordings of either EAFR, unless there was something else preventing all signal transmission towards the rear EAFR. The CVR in the rear has been a thing for 80 years now. Regards, Justus Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Air Worthiness Directives CVR Cockpit Area Audio EAFR |
JustusW
June 21, 2025, 17:04:00 GMT permalink Post: 11907907 |
When we say "Software" we mean things like this:
if ( happy == true ) {
print("I'm happy!" } In case of the Safran FADEC 3 this is not actually what we're dealing with. It uses something called an FPGA (Field Programmable Gate Array) which is a very different beast to what we are used to dealing with. In a normal computer we simply translate code like above into something less human readable but instead interpretable by a microchip or the like. This "machine code" is then run sequentially and does whatever it is meant to do (hopefully). If we were to expand our little happy check above with another condition then our computer would sequentially check these conditions. This opens up a lot of hoopla about timing, especially when interacting with the real world. Let's say you want to track N1 and N2 in an engine. You'd have to make a measurement, that value would have to go through an AD converter, which writes it to some (likely volatile) storage, where it is then accessed by some sort of (C)PU, transferred to yet another piece of volatile memory and then used in the computation. This takes time because you can't do those things within the same clock cycle. Unsurprisingly this is rather inconvenient when dealing with the real world and especially when dealing with volatile physical processes that need monitoring. Like a modern turbine engine. Enter the FPGA. While it is programmable what that actually means is that (at a very high level) you can build a thing called a truth table, that means a definitive mathematical mapping of input states to output states. Unlike our sequential CPU driven system an FPGA will be able to perform its entire logic every time it is asked to do so. We don't have to wait for our happy check to perform any other check. This is very useful for our Turbine Engine, because now we can verify that N2 is smaller than X without delaying our check that the Throttle Control Lever setting is within acceptable distance to N1 and N2, while also creating the appropriate output for all the different bypasses and bleed valves in a modern engine, and so on. The Safran FADEC 3 does this "up to 70 times per second" as per the vendor. In order to be manageable the actual FADEC consists of multiple different pieces, many of which are FPGAs. At least two are used for so called "input conditioning". This is where we deal with converting messy real world values from sensors subject to real physics into nice and clean numbers. Here our values from the Throttle Control Levers come in, the signal from our N1 and N2 sensors, WOW signal, and on, and on, and on. This is then changed into logic level signals provided to a different set of FPGAs. Lacking an actual schematic I suspect that this is what sometimes is referred to as "channels". The channel could consist of both a signal conditioning stage and then a logic stage or (more likely) redundant signal conditioning stages feed separately into separate FPGA "channels" are evaluated and then the end result is likely put into yet another FPGA for control output generation. Why is this important? Because it is basically impossible for a "bug" to exist in this system. These systems are the epitome of a dumb computer. They do _precisely_ what they are meant to do. The TCMA is simply a set of conditions evaluated just like any other condition in those FPGAs. If there is an "error" then it is in the requirements that lead to the truth table used by these devices but never in the truth table itself. In fact these types of computation device are used precisely because of that very property. So when people say "the FADEC software" (ie TCMA) has "failed" or "has a bug" what they're really saying is:
The conditions that were experienced in the real world by the system were incorrectly assessed in the system requirements and lead to an undesired output state when taking into account the real world result we would have preferred.
A bit of a mouth full, granted, but an important mouth full. This simply wouldn't be someone missing a semicolon somewhere in a thousand lines of code.
Regards, Justus Last edited by T28B; 21st June 2025 at 17:25 . Reason: Formatting making this easier to read for the layman. Nice post. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Air Worthiness Directives FADEC |
JustusW
June 21, 2025, 20:40:00 GMT permalink Post: 11908040 |
Sadly I'm unable to post links or I would have done so in my original post.
![]()
I ask because when I look for info about FADECs generally and FADEC 3 more specifically, I find this kind of documentation (notice the mention of FADECs in the lower left corner):
... which is part of a larger Powerpoint presentation by Ansys, explaining that these products are developed with SCADE development workbench, generating either Ada or C code, and that the resulting code runs under a microkernel realtime operating system:
Now, obviously enough, a CPU can be embedded in an application-specific FPGA, but it would still execute machine code. And from my experience in other embedded systems development, current CISC or RISC CPUs have more than enough computation power to implement command and control on a modern turbofan.
But maybe I should explain how I've arrived at the post above. I've basically spent the past few days on and off scavenging anything I could find on the 787 FADEC specifically. It was mentioned in this thread or the old one that the 787 uses the Safran FADEC 3, so my primary jumping off point was the Safran website and the information available on it. That plus a couple of press releases namely by Actel about their flash-based ProASIC3 and ProASICPLUS FPGAs was the evidence I used to arrive at my conclusions above. I can't for the life of me find the quote about the dual signal conditioning FPGAs anymore, but they are in there as far as I can tell. Overall information on the actual inner workings of these things are so sparse that outside of a few patents (keyword: configurable CPU) I was hard pressed to find anything at all to be honest. This all not being helped by me now finding references to my own post, thus having created my very own Woozle. Hooray.
Whilst you\x92re right to highlight the type of software in a FADEC, it should also be recalled that after the dual uncommanded engine shutdown event on the Baltic CS300, the FAA mandated updated FADEC software for all of a family of P&W engines. FADEC s/w can contain what we\x92d call bugs (whether they\x92re mistakes of coding or mistakes of logic in the design assumptions).
"it is basically impossible for a "bug" to exist in this system." This is not my experience.There are a lot of bugs in hardware and FPGAs. The guys doing this are real experts and bugs are less common than in software. But they do exist and they can be difficult to reproduce and subtle to diagnose. For someone new to FPGA it can be very intimidating because everything is parallel. It requires a different way of thinking. You can execute 1000 instructions simultaneously.Then various tricks to speed things up or reduce glitches add complexity. For example you may want to count in gray code or one hot instead of binary. Writing bug free FPGA code is very challenging. We cannot assume the FPGA code is free of bugs.
Now, in normal "everyday" usecases I'd fully agree with you, but in case of the FADEC we're talking about an FPGA with logic condition tables where every line is likely to have its own separate binder of engineering notes, discussions and recommendations. It is there where any "error" or "bug" is most likely to reside by a considerable margin.
Now, I am sure that the state of the art has moved on a lot since I was heavily involved in this sort of engineering but I can say that when my colleagues were prototyping ASICs (which are application specific devices that are not programmable like an FPGA) using FPGAs because it can be reprogrammed to cure bugs found in the code that created it I am absolutely sure that it is possible for a latent bug to exist in what has been built despite extensive testing being carried out. I well remember sitting down with an FPGA designer and a software engineer and showing them a situation where one of my radio devices was not being commanded to transmit, they refused to believe me until we captured their output signals in the failed state and I was thus able to prove to them that it was their logic and code that was failing and that my radio system was fully working except it couldn't possibly transmit when its enable line was inactive.
I would therefore never state that an FPGA-based FADEC is infallible. The devil will be in the detail of the functions contained within the devices and how they interact with each other and how the original logical functions are described and specified and then coded and checked for logical errors before getting on to the actual physical reality of the FPGA manufacturer's design and development system that bolts on to the back of the source code. If the FPGA devices are being pushed anywhere near the edge of their performance envelope, just like an aircraft things can go wrong. If a design begins with a device that is only just large enough in terms of how many logic blocks and routing channels are available for the logic required it's almost a certainty that development will take it to this area of its performance and a lot of tweaking may be needed which means that even more testing will be needed to be reasonable sure that it does what it is supposed to. In the end I hope it was useful for understanding where the reluctance of apportioning blame to these systems originates and ​​​​at the same time talk about some pretty nifty tech that I know few Software Engineers will ever deal with in their entire career. I do still find the idea of a fault (with the understanding above of where that fault originates) in the FADEC a convincing possibility, it's merely the nature and location of that fault that I felt could benefit from some more specifics in regards to the nature of how they were most likely to actually happen. I would love to actually hear more about how the FADEC 3 is structured internally and which components it uses, but I suspect that those who know are under NDA. Regards, Justus Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Engine Failure (All) Engine Shutdown FAA FADEC |
JustusW
July 14, 2025, 19:04:00 GMT permalink Post: 11922436 |
Upfront: Sorry for my initial post on the topic, like some other people in this thread it obviously touches a nerve and was rightly removed for exceeding the rules of civil discussion.
This is my attempt to shed a bit of light on why I find pushing theories of suicide very objectionable at this point in time. https://www.boeing.com/content/dam/b...df/statsum.pdf gives us a nice statistic over the last 20 years and also has this little tidbit: "965 million departures since 1959. 63% of those departures were on Boeing airplanes. (609 million on Boeing airplanes)" For the last 20 years I'd eyeball an average of between 20-25 million departures per year. So 400-500 million flights in just 20 years. Maybe let that sink in for a moment. We have doubled the total number of flights in the 20 years since 2005. In that timeframe we have: Nov 2013, LAM 470, 33 fatalities, confirmed by CVR Mar 2015, Germanwings 9525, 150 fatalities, confirmed by CVR There are additionally these: Mar 2014, MH370, 239 fatalities, no final report, no information available Mar 2022, CES5735, 132 fatalities, no final report, media reports claiming pilot suicide, strong counter by the investigating agency: "CAAC has previously said speculation surrounding the crash had "gravely misled the public" and interfered with accident investigation work." Both confirmed cases in that time have a very clear pattern that does in no way resemble the Air India Crash. Even beyond that timeframe no confirmed pilot suicide involved any measures against discovery by the departed. There is speculation regarding Silk Air 185 because the CVR failed to record the relevant part of the accident, but it is firmly in the "debated" category. But we can ignore all of that. Even if we put any theoretically possible Pilot Suicide into the equation one fact remains: The actual likeliness of pilot suicide has not changed. There were 2 confirmed prior to 2005 and 2 after and 2 suspected prior to 2005 2 and after. And that is despite a higher sensitivity and a more stressful job as well as significantly increased environmental stress factors. Obviously we are talking about, statistically speaking, numbers too small for analysis, but all of this is actually well within expected parameters. The recent years have seen a focus on mental health in general in many countries worldwide, and mental healthcare availability is growing in most countries. And here the US is a great example as far as aviation goes: https://casten.house.gov/media/press...tion-committee With this bill whose merit can be assessed by the people supporting it: " The legislation is endorsed by the Pilot Mental Health Campaign, Air Line Pilots Association, Airlines for America, the National Air Traffic Controllers Association, National Flight Training Alliance, the National Business Aviation Association, and NetJets Association of Shared Aircraft Pilots (NJASAP)." Summing up I would like to point out that there are good indications that there are no mental health issues involved here. Taking the aforementioned accidents as reference the issues were usually quite obvious once any kind of scrutiny was placed on the individuals involved. The individuals also made little to no effort of concealment in all confirmed cases and while the absence of evidence can be interpreted as indicative of successful concealment it is not proof and cannot be treated as such. Especially when it is documented that the overwhelming majority of suicides do not involve any element of concealment, and the psychological mechanisms at work commonly preclude any thought about what happens after, as far as medical study of the issue is concerned. This does not mean it does not happen, cases of concealment attempts or even partial successes are well documented, but it is a lot less prevalent. In this case estimates range mostly from between 10% to 30% of all suicides being misreported as unintentional injury with massive variation depending on multiple factors like country, ethnicity, gender, sexual identity, etc. In final conclusion: Anyone can make mistakes. It is possible one or both of these pilots made a mistake. It is also possible that a combination of bad luck lead to an alignment of the holes. In my opinion the inability to receive urgently required medical support is as much a hole in the Swiss Cheese as the worst maintenance or design error imaginable. We know from the previous discussions in all threads on this Accident and the report itself that the pilots were flying their aircraft until they ran out of time and airspace. One cannot demand more from a human being, no matter what the final cause is ultimately determined to be. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): CVR Mental Health Parameters |
JustusW
July 15, 2025, 06:26:00 GMT permalink Post: 11922684 |
His mother died and he took some time off to grief. He later returned to flying status and was openly contemplating early retirement to spend time with his Dad. There is absolutely nothing indicating any sort of mental health issues. Post accident it is normal to pull medical records. There can be many reasons for this, be it toxicology coming back weird due to the fire or any of a myriad other reasons imaginable that require reference data. Also note that the PF was the FO not the Captain and that the report does not say which pilot said what. This was discussed multiple times already. The report does not mention it in any way shape or form. There is no reason to believe the report would leave out such a crucial detail. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Jump Seat Mental Health |
JustusW
July 15, 2025, 08:00:00 GMT permalink Post: 11922728 |
So everything beyond the bereavement leave is based on statements by one of the many "experts" opining publicly for clout or money based on rumors from people who have no way of knowing what they are talking about. The list of baseless false statements by those experts is getting a bit long. If there was reason to believe Pilot Suicide we would expect Law Enforcement to be involved and the homes of both pilots to have been searched. Either this was done completely evading public notice, which I find hard to believe in such a high profile case, or it was not done at all. I find the latter option the more believable of the two. There is no need to put any kind of emphasis on the "apparently" part. Obviously we are only looking in from the outside. But there is zero evidence for mental health issues and several indicators for this to not be the case. Taking time off to grief for a parent is a healthy and normal way to deal with a tragic life event like this. It shows that the Captain was both emotionally and financially stable enough to assess and prioritize his personal needs. Again: Human Error is quite obviously a leading theory right now based on the preliminary report. Ascribing any kind of intent not based on factual information is not a good idea. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Human Factors Mental Health Preliminary Report |
JustusW
July 15, 2025, 08:10:00 GMT permalink Post: 11922732 |
It\x92s not a simple mistake.[...]
I guess there might theoretically be a way to snag them with loose clothing (like having a very frayed sweater with holes in the sleeve putting one\x92s arm in a really strange place) somehow and while pulling to free it manage to pull them out and down but I\x92m going to put this in the asteroid hitting earth category. ![]() Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Action slip |
JustusW
July 15, 2025, 10:26:00 GMT permalink Post: 11922807 |
The fuel switch discrete doesn't really get used except for engine start - if it falsely indicates shutdown (on one or both channels), the FADEC won't do anything if the engine is already running. All this will set maintenance faults - and associated EICAS Status messages (L/R ENGINE CONTROL or ENGINE C1). I doubt that would be recorded on the DFDR - it would go to the QAR but that's unlikely to survive a crash. It would also be logged in the FADEC NVM - but again no guarantee that would survive either (although when the Lauda 767 crashed due to the thrust reverser deployment, the DFDR was destroyed but the FADEC NVMs both survived - much of what we know about that crash came from the FADEC NVM.)
Again, not familiar with the specifics of the 787, but on the 747-400/-8, one pole of the fuel switch feeds EICAS - which uses it in various message logic - and sends it out to any other aircraft systems that use it. There is "Digital Flight Data Acquisition Unit) DFDAU (pronounced Daff Du) that takes all the various system digital signals, sorts them and provides them to the DFDR and QAR. The 787 has something similar to the DFDAU but I don't recall what it's called. I would assume from your statement, that if a mismatch in the NC/NO signal on the switch was detected the FADEC would not direct the Fuel Cutoff Valves to close (as far as the types you are familiar with are concerned), is that correct? The report states:
[...] at about 08:08:42 UTC [...] the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off.
The report then states:
As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC. [...] Thereafter at 08:08:56 UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN.
Subjects (links are to this post in the relevant subject page so that this post can be seen in context): DFDR Digital Flight Data Acquisition Unit EAFR EICAS FADEC Fuel (All) Fuel Cutoff Fuel Cutoff Switches Preliminary Report RUN/CUTOFF Timeline (Preliminary Report) |
JustusW
July 15, 2025, 10:41:00 GMT permalink Post: 11922820 |
The thrust lever quadrant sustained significant thermal damage. Both thrust levers were found near the aft (idle) position. However, the EAFR data revealed that the thrust levers remained forward (takeoff thrust) until the impact. Both fuel control switch were found in the \x93RUN\x94 position. (fig.13) The reverser levers were bent but were in the \x93stowed\x94 position.
Subjects (links are to this post in the relevant subject page so that this post can be seen in context): EAFR Preliminary Report |
JustusW
July 15, 2025, 10:55:00 GMT permalink Post: 11922831 |
With what we know now from the preliminary report that option seems to be a good candidate as the source of initiation for an action slip. Both the PF instead of calling Gear Up Action Slipping and operating the Cutoff Switches, or the PM instead of calling Positive Rate doing so would fit that scenario and timeline. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Action slip Fuel (All) Fuel Cutoff Fuel Cutoff Switches Gear Lever Preliminary Report V1 V2 |
JustusW
July 15, 2025, 16:08:00 GMT permalink Post: 11923051 |
This is the reason why a common rule of thumb is that to observe a signal at any given frequency you need to have at least twice that frequency in sampling rate. Unless someone with actual knowledge of the signal pathway comes along I would be very cautious with any time interval close to the likely sampling rate. A difference of 1 second may be a real world difference way less than that. I'm unaware what sort of debouncing is used in these systems, so can't comment on that. Subjects: None |
JustusW
July 15, 2025, 17:30:00 GMT permalink Post: 11923102 |
1994 RAM630, confirmed 1997 SilkAir 185, NTSB says confirmed, Indonesian NTSC says undetermined, private investigation blames a technical fault 1999 EgyptAir 990, confirmed 2013 LAM470, confirmed 2014 MAH370, no report, no evidence 2015 Germanwings 9525, confirmed 2022 China Eastern 5735, media reports of pilot suicide strongly rejected by investigating agency, no report. Excluding the last one because the investigating agency explicitly called reports of pilot suicide false we have 7 cases since the beginning of commercial aviation. 2+1 suspected cases since 2000. That's 1:300.000.000 to 1:200.000.000. Actually I erroneously included the last one in my previous posts. I don't think including a case where the investigating agency explicitly refuted claims of suicide is valid. Last edited by Senior Pilot; 15th July 2025 at 20:59 . Reason: Edit quote Subjects (links are to this post in the relevant subject page so that this post can be seen in context): NTSB |
JustusW
July 15, 2025, 17:49:00 GMT permalink Post: 11923123 |
The STAB cutout switches are located next to the Fuel cutoff switches. What did Air India\x92s on duty AME do as part of their troubleshooting? Were panels removed to gain access to the rear of the switches and wiring? What about wiring and data connections elsewhere? What may have been disconnected/disturbed as part of this process? It would not be the first time that an engineer had innocently done something that later caused an accident. And I haven't read anything about possible nefarious action by a (disgruntled?) engineer - but I've seen lots of accusations directed at the pilot(s)...
Wires or wiring is mentioned twice in the report:
The wiring from the TO/GA switches and autothrottle disconnect switches were visible, but heavily damaged.
The aft EAFR was located on the roof top of Building A on 13th June 2025. The EAFR had impact and thermal damages to the housing. The wires were protruding from the housing and the connectors were burnt.
![]() While severely burnt the switches are still solidly in place and anything that was lodged in the switch housing itself would likely still be there. And I guess it would also be unlikely for FOD to equally impact both switches. I think I just talked myself out of the FOD theory. I find option C to be at least a productive train of thought because it may provide methods of mitigation. That is after all what we're trying to achieve in discussing this kind of accident. I would expect or at least look positively on a suggestion to use the Embraer model for operating the cutoff valves. While it introduces a secondary element that may fail, requiring the Throttle Control Levers to be at idle just seems like a good idea. How is this handled by Airbus? Subjects (links are to this post in the relevant subject page so that this post can be seen in context): EAFR Fuel (All) Fuel Cutoff Fuel Cutoff Switches TOGA |
JustusW
July 15, 2025, 18:26:00 GMT permalink Post: 11923158 |
It's kind of amazing and terrifying that there is a set of switches that can cause this kind of accident with this kind of immediacy. Imagine having a button in your car directly next to your gear selector that will make the car suffer an immediate highspeed crash if touched under the wrong circumstances. I personally would not want that button there. Or if it had to be there I'd want there to be a few really good measures preventing anything that included "fiery death" and "me experiencing".
To address this directly, the critical flaw is what a statistician would call
"
a posteriori
analysis
".[...] The statistic you have simply can't be properly applied to the situation you are attempting to apply it to.
I have specifically examined the actual incidents of suspected and confirmed pilot suicide and contrasted their significant differences with the Air India accident. I have concluded based on those differences and the known data about behavior of people committing suicide that the Air India accident does not show even marginal overlap with any confirmed or suspected cases of pilot suicide and is inconsistent with our general understanding of the mental conditions leading to suicidal behavior. I have not, and will not make a statistical argument against this case being pilot suicide. I will however refute attempts at misrepresenting the statistical facts about pilot suicide. The only reason we are talking about pilot suicide is that this is now likely to be a case of human error and some people are apparently unwilling to entertain the thought of human fallibility even in the total absence of any indication of a mental health issue, let alone crisis. We know with absolutely certainty that people very rarely make lethal mistakes out of the blue that fly in the face of the entirety of their training and normal routine behavior. This should not be a hot take. Doubly so in the context of a Safety Culture that has majorly contributed to that very knowledge. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Human Factors Mental Health |
JustusW
July 16, 2025, 10:23:00 GMT permalink Post: 11923614 |
Attention, Wall of Text incoming. Take appropriate precautions and fasten your seatbelts!
I will say that in reading your earlier post, I came away thinking you were arguing for the unlikelihood of suicide in this case, at least in part because it is unlikely in the world of commercial aviation as a historical fact. If that's not the case, I apologize. But I will add I think other commentary here has fallen into this trap, as discussed in my referenced post.
There have been many accidents where unindicated or even counter indicated action was taken by one or more pilots involved. As discussed in the first and second thread extensively many pilots could report incidents where they observed someone retracting flaps instead of gear. There have been major fatal accidents with pilots shutting down healthy engines instead of surging or burning ones. There's good reason the 787 has extensive takeoff configuration warnings, because we have had accidents and incidents with unsafe configurations taken to takeoff, beyond and sometimes even into a crash. Humans make mistakes. It is the goal of Safety Culture to prevent those mistakes from causing harm.
But TL;DR - I'd posit that the rate of truly experienced mental health issues experienced in pilots is higher than whatever rate almost anyone is thinking.
Around 12% of people globally have a mental health issue at any given time - even being incredibly conservative, the rate in pilots is clearly going to be at least in single whole figure percentages (which is far from rare). Obviously the majority of these issues are not going to be those with severe outcomes, but some will. And almost all mental health issues tend to affect cognitive ability to at least some level. Slowness in action and fatigue are diagnostic criteria for many of the most common mental health conditions for example. Currently 12.6% of pilots meet the medical threshold for depression, with a slight but below average difference between males (12.8%) and females (11.4%), with 4.1% of all pilots experiencing recent suicidal thoughts. https://ehjournal.biomedcentral.com/...940-016-0200-6 It should be noted that the utilized test (PHQ-9) is considered insufficient to assess suicide risk. Depending on scoring these values could be about average, or significantly below average. Based on their wording I would expect the latter, because their methodology does not specify severity.*1 Results of 0-4 points suggest no intervention necessary, 5-9 (classified as mild) simply suggest retaking the test after a few weeks. Research shows that for the general public Major Depressive Episodes have a prevalence of ~5-10%, with the prevalence of minor depression being less studied but significantly higher than major depression. There is also significant symptomatic overlap of mild depression with stress related conditions such as "Burnout" (if you know, please don't, this conversation is already complex enough without bringing that in). Considering the prevalence of stress in the industry I am actually surprised the numbers here are not higher. The lesser delta between males and females could be indicative of just such an issue, meaning that based on the data available the number of pilots actually suffering from depression could be less than even the comparably low number reported here. The actual suicide risk is usually orders of magnitude below even that but not easily covered in this data context due to the test used. Cognitive impact is highly variable depending on the individual, actual symptoms and severity. It would be wrong to assess that 12.6% of pilots are a risk factor from this data. Quite the opposite, in fact. After the Germanwings crash the topic was discussed and has reached the awareness threshold for many. Mild cases usually require little to no intervention beyond raising awareness and helping the brain fix its chemistry through positive reinforcement. This can be as simple as taking PTO, reducing work hours, or focusing on social or physical activities. In the past 10 years these kinds of low impact measures have been made more readily available, most notably during the Covid-19 pandemic and the resulting turmoil. Further political activity has lead to some positive action as well. I already mentioned the recent success of the Pilot Mental Health Campaign getting legislation through Congress for improvements of the outdated FAA guidelines on mental health in an earlier post. Similar efforts are underway globally, be that internal review within regulatory bodies, or political movements.
As a critical care physician (with AVMED background), these last few years we seeing unprecedented rates of self-reported stress, anxiety, depression, and deliberate self-harm. This is being experienced in most western countries (perhaps globally, but I have less direct knowledge of non-western countries). It is absolutely off the scale. In my 35 year career, I have never seen anything like the last 4 years.
Sadly, I am confident this phenomenon will result in more incidents like Germanwings, MH370 and this. This is certainly a challenge for healthcare everywhere, but I do not consider the data available to be majorly applicable in the context of aviation over the already very current research closer to the industry and GA. The positive impact of what has been done and is being done is highly likely to outperform whatever global mechanism is at work here. It's certainly a very important field of study, but based on the data I would still consider the industry and regulators as a global whole to be on a positive path. We can certainly discuss this topic further, but I would not currently see it as likely to be causal in this particular case. Overall I am still not convinced we are looking at an individuals mental health crisis in this case. I have already detailed the massive differences to all known or suspected cases of pilot suicide at least twice. There is no evidence of mental health issues for the Captain or the FO. There is certainly a strong indication for a human factors cause to this accident. And as mentioned above I find the idea of improving the safety of the Fuel Cutoff Switches a worthwhile topic to discuss. No single action, and I see these two switches as a single action just as much as operating both thrust levers, should be able to cause a major accident. I find it perfectly reasonable to require the Throttle Levers be at idle for the Cutoff Switches to work, and in case of an incorrect setting some sort of alert would be appropriate. *EDIT* *1: I missed this in my original readthrough, the cutoff is sensibly set to 10, starting with moderate depression. I'd have to look into the classification scheme but from memory both mild and moderate depression fall into the same category as relevant for the following statements. Last edited by JustusW; 16th July 2025 at 10:37 . Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Action slip FAA Fuel (All) Fuel Cutoff Fuel Cutoff Switches Human Factors Mental Health Muscle Memory Preliminary Report RUN/CUTOFF |
JustusW
July 16, 2025, 10:43:00 GMT permalink Post: 11923626 |
"There is a reasonable explanation: One of the pilots set both switches to cutoff." There is no known evidence for the claim of intent. There are documented instances of pilots making fatal mistakes out of the blue. Human Error is by far the more likely explanation. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Fuel (All) Fuel Cutoff Switches Human Factors |
JustusW
July 16, 2025, 17:14:00 GMT permalink Post: 11923864 |
A preliminary report can only contain what is certain. The attribution you want is unlikely to be available yet. Subjects (links are to this post in the relevant subject page so that this post can be seen in context): Fuel (All) Fuel Cutoff Switches Pilot "Why did you cut off" Preliminary Report |