Air India Crash

If the latches are broken they'll probably move like a normal toggle switch, so not a massive amount of force needed (probably about the same as a bunch of others).

...

They're not really like any other kind of toggle switch I've ever seen. The action and the way they are designed seems unique to Boeing.

You really need to see them from the side to understand how exactly they work.

Edit:


Here
 
Last edited:
They're not really like any other kind of toggle switch I've ever seen. The action and the way they are designed seems unique to Boeing.

You really need to see them from the side to understand how exactly they work.

Edit:


Here

I think they’re more common on older aircraft - Nimrod had them plastered all over the Flight Engineer’s panel for fuel pumps, fuel isolation valves, generators etc, and throughout the various stations for power on. Being a much more manual aircraft required that system protection. The pedestal fuel HP cocks were cable operated gated levers - engine starting was a multi-hand choreography that needed two people!

I’ve definitely seen at least one get stuck in the ‘unlocked’ position where the spring couldn’t pull it back in (corrosion on the inside I think) so it could just be flipped up and down. The only way this is happening to both of them at once is a manufacturing flaw that went unnoticed till something knocked them both down together, by accident or otherwise.
 
I think they’re more common on older aircraft - Nimrod had them plastered all over the Flight Engineer’s panel for fuel pumps, fuel isolation valves, generators etc, and throughout the various stations for power on. Being a much more manual aircraft required that system protection. The pedestal fuel HP cocks were cable operated gated levers - engine starting was a multi-hand choreography that needed two people!

I’ve definitely seen at least one get stuck in the ‘unlocked’ position where the spring couldn’t pull it back in (corrosion on the inside I think) so it could just be flipped up and down. The only way this is happening to both of them at once is a manufacturing flaw that went unnoticed till something knocked them both down together, by accident or otherwise.

Another Nimrod chap thought I was the only one……..lol
 
So under what emergency circumstance would it be more desirable to kill fuel to both engines at an unsafe altitude and 100% crash vs killing fuel to one engine and trying to fly on the second.

Seems like a massive fault in the systems logic to me.
 
So under what emergency circumstance would it be more desirable to kill fuel to both engines at an unsafe altitude and 100% crash vs killing fuel to one engine and trying to fly on the second.

Seems like a massive fault in the systems logic to me.
Surely there is no situation where you would cut fuel to both engines on purpose at that stage of take off.

Even if the thing was on fire you would have to let it go and hope you maintained enough thrust and gained enough altitude to then be able to do something about it not purposely cut all your thrust at the most critical moment.
 
So under what emergency circumstance would it be more desirable to kill fuel to both engines at an unsafe altitude and 100% crash vs killing fuel to one engine and trying to fly on the second.
There is none.

Seems like a massive fault in the systems logic to me.
The system logic didn't do this.
 
The system logic didn't do this.

The system allowed the pilots to kill the fuel flow to both engines just after takeoff?

And by system i mean the two mechanical switches which seemingly work independent to any other confirmation be it either mechanical or software.

Seems like a massive system oversight, would it not be simple enough upon requesting fuel flow cutoff to the second engine for an additional confirmation to be required?
 
Last edited:
Surely there is no situation where you would cut fuel to both engines on purpose at that stage of take off.

Even if the thing was on fire you would have to let it go and hope you maintained enough thrust and gained enough altitude to then be able to do something about it not purposely cut all your thrust at the most critical moment.
You wouldn't.

However there are multiple times a day when you would need to do it routinely, and several emergency situations where you would need to do it to an engine very quickly.

You can't "lock out" controls based on what might happen exceptionally rarely when you need to be able to activate/deactivate that control on a regular basis, or in an emergency reliably.

Every time you add another "safety" feature you have to balance the benefit of adding it, to the risk that it'll actually decrease safety by making it harder for a more common situation to be dealt with, and IIRC cutting the fuel to an engine due to fire or damage is much more common than someone potentially turning both off by mistake/on purpose during take off.

To give an idea of what would probably be required to lock it out during take off, you would need to have some sort of additional mechanically activated lock on the switches (so the pilots know immediately it's not letting them move the switch) or in software* that took an input from the altimeter or ground proximity radar to prevent the switches being turned off below a certain height, but also an override for that to allow the engines to be turned off when on the ground...
That's at least two more potential failure points, especially as problems with the altimeter and landing gear (you'd most likely have the "allow it to turn off below..." by using a sensor on the landing gear to check they were in contact with the ground), and that are more common affecting your ability to turn off the engine.
I'm fairly sure most pilots, and the emergency crew on the ground might not be happy with a safety system that has the potential to stop them quickly killing the engines and fuel pumps if they do a landing where the gear has failed and thus the "on ground" sensor is likely not reading correctly.



The system allowed the pilots to kill the fuel flow to both engines just after takeoff?

And by system i mean the two mechanical switches which seemingly work independent to any other confirmation be it either mechanical or software.

Seems like a massive system oversight, would it not be simple enough upon requesting fuel flow cutoff to the second engine for an additional confirmation to be required?
See above.

You can try and prevent mistakes/things happening, but you hit a point where you absolutely have to trust the pilots, and any additional system just creates more chances for something to go wrong in a more common scenario.
Would you prefer the pilots to not be able to kill an engine that is on fire** or after an emergency landing because they're not trusted to kill the fuel to it unless the sensors agree to it, or risk something that has so far only happened something like once - assuming it (and it's a big assumption until the full investigation is done) that the pilots turned off the fuel.

*Which now means the mechanical switches cannot be trusted and you've introduced a failure point that the pilots cannot easily check.

**Any fire onboard an aircraft is typically a bit of a nightmare scenario, you want it out immediately, or on the ground very fast.
 
I was watching something last night where they said the switches were only polled for position once a second (I think for the flight recorders data),

So potentially they were moved anything from >0.1 second to 1.9 seconds apart. which means they could have changed position effectively at the same time.

So are you saying that hypothetically someone could initiate an action to move both down simultaneously, but in doing so, one of the switches actually hits home to the off position a split second before the other whereby the data records this as one second apart when it was actually 0.1 seconds apart? I'm not sure I understand how it can be 1.9 seconds apart though. Let me run through a couple of examples:

EDIT:

Sorry @Werewolf I was having a moment. Yes, an event could occur at 0.1 seconds, get polled at 1 second, then the next one at 1.9 seconds and get polled at 2 seconds. The duration between events is recorded as 1 second despite the events being 1.8 seconds apart because the poll took place at 0, 1, 2 seconds.
 
Last edited:
Google PLC scan time, the AI generated text gives a decent description of why two inputs changing state at the same time can be recorded at completely different times.

In O&G controllers 5s scans are common for low priority signals, 1s is common for safety stuff.
 
Sorry @Werewolf I was having a moment. Yes, an event could occur at 0.1 seconds, get polled at 1 second, then the next one at 1.9 seconds and get polled at 2 seconds. The duration between events is recorded as 1 second despite the events being 1.8 seconds apart because the poll took place at 0, 1, 2 seconds.
 
The reason I was emphasizing the point above, was that many people may dismiss the idea of the switches accidentally being moved - through being knocked or vibrated - because they have been reported to be recorded as 1 second apart events. The reality is that could have been 0.2 seconds apart if each event was 0.1 seconds before, and then 0.1 seconds after, a 1 second poll event recording point. So effectively they could have both moved pretty much simultaneously. I think this means that all options should remain on the table with regard to locking failure and accidental movement still?
 
Last edited:
Back
Top Bottom