Dream liner down in India on air port (5 Viewers)

[Komet]

The big question in my opinion is after the query why did you switch to cut-off, there was a full 10 seconds before the fuel switches were selected back. 10 seconds is an eternity in this scenario.

As soon as those switches were noticed in cut-off immediately select them back to on and that action alone would initiate an automatic restart which could have saved the day.

As it was the engines were in the process of restarting but time was no longer there.

 

[Retattack]

The big question in my opinion is after the query why did you switch to cut-off, there was a full 10 seconds before the fuel switches were selected back. 10 seconds is an eternity in this scenario.

As soon as those switches were noticed in cut-off immediately select them back to on and that action alone would initiate an automatic restart which could have saved the day.

As it was the engines were in the process of restarting but time was no longer there.

I suspect the other pilot didn't notice right away (which is the main reason I posited the Captain as the one who moved the switches). Loss of thrust would be apparent immediately, but you'd have to look around a bit to figure out the switches were in the wrong position. The exact timing and verbiage on the CVR transcript would definitely shed some light on this.

BTW, there is some confusion above on fuel pumps vs fuel boost pumps: boost pumps are in the fuel system, an engine fuel pump is in the engine (and controlled by the FADEC, which is enabled by the fuel control switches). Here's what the latter looks like:

View: https://www.youtube.com/watch?v=uYX7b-ekGMc

 

[Thumpalumpacus]

Your last para is half right - these switches open and close shut off valves in the Fuel Control Unit (FCU) on the engine itself and have nothing to do with the fuel pumps which are inside the fuel tanks in the wings and elsewhere.

These are the absolute last valve in each engines fuel system and block the fuel outlet of the FCU so that the engine dies of fuel starvation, rendering the throttle irrelevant.

I appreciate the correction and additional info. Thanks.

 

[MiTasol]

I suspect the other pilot didn't notice right away (which is the main reason I posited the Captain as the one who moved the switches). Loss of thrust would be apparent immediately, but you'd have to look around a bit to figure out the switches were in the wrong position. The exact timing and verbiage on the CVR transcript would definitely shed some light on this.

BTW, there is some confusion above on fuel pumps vs fuel boost pumps: boost pumps are in the fuel system, an engine fuel pump is in the engine (and controlled by the FADEC, which is enabled by the fuel control switches). Here's what the latter looks like:

View: https://www.youtube.com/watch?v=uYX7b-ekGMc

FADEC is another name for FCU - both manage the fuel flow from the EDP to the engine. On FADEC engines this is done electronically and on other engines mechanically. Mechanical units can only control fuel using a small number of inputs whereas FADEC monitors dozens so is far more efficient and reduces fuel consumption just like electronic fuel injection on cars does compared to cars with carbs. It may help to think of FADEC as electronic fuel injection and mechanical FCUs as carburettors. How the FADEC controls the output from the EDP varies depending on which of the many FADEC systems are fitted.

FADEC also controls other functions of an engine, the second most important on some engines being bleeding "cool" air from the compressor and running it through channel(s) around turbine(s) to shrink the outer case in order to maintain the optimal gap between the turbine blades and the turbine housing. On some engines it varies compressor blade angles and on most it records all the history of the engine so that maintenance staff can determine if an engine has been over-sped or over-temped. On large engines, outside of emergency decents, these are rare occurrences but on helicopters and propeller engines overspeeds often occur when the pilot goes outside of the operating parameters - often at ATC request. Over-temps do still occur but are very rare on FADEC engines.

One big difference which applies in this case is that the FADEC will not supply fuel to the engine below the minimum start compressor RPM regardless of where the fuel switch is. This prevents hot starts and overheating the turbines. Overheated turbine blades stretch and rub on the turbine case which causes engine fires and engine failures. Unless the APU was running turning on the fuel and ignition would not cause the engines to restart as, without the starter running, the compressor section will not reach minimum start rpm.

 

[Retattack]

One big difference which applies in this case is that the FADEC will not supply fuel to the engine below the minimum start compressor RPM regardless of where the fuel switch is. This prevents hot starts and overheating the turbines. Overheated turbine blades stretch and rub on the turbine case which causes engine fires and engine failures. Unless the APU was running turning on the fuel and ignition would not cause the engines to restart as, without the starter running, the compressor section will not reach minimum start rpm.

Restarts are tricky. If the engines are working properly, you can get the required compressor speed by air pressure (~270 Knots, obviously not an option in this case) or by using the APU/starter combination. My experience is on a 767, where the APU is started manually. But the 787 is apparently smarter, and the APU starts automatically when needed for a relight. In this case, per the report, it was starting, but hadn't completed the cycle by impact.

But the engine doesn't wind down instantaneously, and if you "catch" it during deceleration, you can get a relight despite not having the required starter or enough airspeed. Again per the report, the left engine actually relit and was accelerating toward recovery (though still several seconds from developing useful thrust).

As per the EAFR, the Engine 1 fuel cutoff switch transitioned from CUTOFF to RUN at about 08:08:52 UTC. The APU Inlet Door began opening at about 08:08:54 UTC, consistent with the APU Auto Start logic. Thereafter at 08:08:56 UTC the Engine 2 fuel cutoff switch also transitions from CUTOFF to RUN. When fuel control switches are moved from CUTOFF to RUN while the aircraft is inflight, each engines full authority dual engine control (FADEC) automatically manages a relight and thrust recovery sequence of ignition and fuel introduction. The EGT was observed to be rising for both engines indicating relight. Engine 1's core deceleration stopped, reversed and started to progress to recovery. Engine 2 was able to relight but could not arrest core speed deceleration and re-introduced fuel repeatedly to increase core speed acceleration and recovery. The EAFR recording stopped at 08:09:11 UTC

For anyone interested, here is an excellent description of the fuel cutoff switches and functions, starting at ~15:00

View: https://www.youtube.com/watch?v=-ur234kwnhk

 

[MiTasol]

Thanks for that info on the restarts. I have been avoiding reading the initial report as I was away from home and my big easy to read screen when it came out but saw reports that it lacking detail and resulted in more questions than answers.

Looks like it is time for me to read it.

 

[AerialTorpedoDude69]

A former inspector general of the Department of Transportation (who is super critical of the FAA) just claimed that a 787 fuel control system has switched to cutoff on its own in 2019 on a Japan Airlines flight. This is the first that I've heard of this and it just shows how bad media are at reporting critical context for stories like this.

And get this: it's because the fuel control system is controlled by software. They are not hard wired?

According to the article, there can be a glitch in the software which can automatically cut fuel to the engines.

To understand this, we got in touch with the US aviation expert, Mary Schiavo. She rejected the claims of human error that a pilot downed the Ahmedabad to London flight by cutting off the fuel supply.
"There is no evidence of this," she told us, before adding, "The voices, words and sounds on CVRs must be carefully analysed. There is nothing here to suggest pilot suicide or murder. The full transcript of the CVR should be released ASAP to avoid harmful paraphrasing."

here's the most relevant section:

"The investigation revealed the plane software made the 787 think it was on the ground and the Thrust Control Malfunction Accommodation System cut the fuel to the engines," she told FinancialExpress.com, before adding, "The pilots never touched the fuel cutoff."

There was a safety notice issued on the fuel cutoff system as late as May of 2025:

https://www.caa.co.uk/publication/download/25076

 

[DerAdlerIstGelandet]

I doubt that. Here is why…

A software glitch will likely switch both off simultaneously, not one switch a time, a second apart. Same for switching them back on. The switches were switched on one at a time, and 4 seconds apart, indicating a pilot with one hand on the controls switching then back on with his one free hand.

 

[AerialTorpedoDude69]

I doubt that. Here is why…

A software glitch will likely switch both off simultaneously, not one switch a time, a second apart. Same for switching them back on. The switches were switched on one at a time, and 4 seconds apart, indicating a pilot with one hand on the controls switching then back on with his one free hand.

In the article it mentioned that the JAL flight had double-engine failure because of this software bug. The reason is that the software indicated that the aircraft had landed, which triggered an automated system to cut off fuel to the engines.

Software bugs also caused the 737-Max debacle.

 

[DerAdlerIstGelandet]

In the article it mentioned that the JAL flight had double-engine failure because of this software bug.

Software bugs also caused the 737-Max debacle.

Sure, again though, a dual-engine failure would occur simultaneously if it were caused by software issues, and they would not be turned back on, one at a time.

And remember, this was a 13 year old aircraft with 41,000 hours on it.

And no, I just look it up. The March 29, 2019 incident involving Flight 985, was in-fact not caused by a software issue. It was caused by fuel contamination caused by biocide residue used as a fuel treatment. The residue solidified and blocked the fuel flow.

The FAA Air Worthiness Directive (AD) from 2019 is unrelated to the Japan Airways incident you wrote about. Airlines are required to comply with the AD. Therefore in the last 6 years Air India should have done so, and likely did. If they did not, shame on them.

The evidence so far, however, points to manually shutting them off.

 

[Retattack]

In the article it mentioned that the JAL flight had double-engine failure because of this software bug. The reason is that the software indicated that the aircraft had landed, which triggered an automated system to cut off fuel to the engines.

Software bugs also caused the 737-Max debacle.

I know Mary Schiavo said that in her interview (here's another, where she says basically the same thing):

View: https://www.youtube.com/watch?v=vqFgf7ezwv8

But . . . she's wrong. The engines "failed" after landing, when the weight was on wheels but the landing logic was incomplete, and the pilots selected reverse thrust very quickly:

Boeing did recently release a bulletin regarding the Thrust Control Malfunction Accommodation system (TCMA). The safety system is designed to prevent uncommanded high-thrust situations. In the bulletin, Boeing said that selecting full reverse too quickly upon landing before the aircraft has fully transitioned to ground mode could cause the system to activate.

Besides, this has nothing to do with the fuel cutoff switches, which are entirely manually operated. If the report is correct and the switches were moved, software cannot be responsible.

Somewhat similarly, that "fuel cutoff safety bulletin" is for a completely different set of valves (located in the engine struts):

 

[DerAdlerIstGelandet]

I know Mary Schiavo said that in her interview (here's another, where she says basically the same thing):

View: https://www.youtube.com/watch?v=vqFgf7ezwv8

But . . . she's wrong. The engines "failed" after landing, when the weight was on wheels but the landing logic was incomplete, and the pilots selected reverse thrust very quickly:



Besides, this has nothing to do with the fuel cutoff switches, which are entirely manually operated. If the report is correct and the switches were moved, software cannot be responsible.

Somewhat similarly, that "fuel cutoff safety bulletin" is for a completely different set of valves (located in the engine struts):

Great post!

 

[MiTasol]

A former inspector general of the Department of Transportation (who is super critical of the FAA) just claimed that a 787 fuel control system has switched to cutoff on its own in 2019 on a Japan Airlines flight. This is the first that I've heard of this and it just shows how bad media are at reporting critical context for stories like this.

And get this: it's because the fuel control system is controlled by software. They are not hard wired?

According to the article, there can be a glitch in the software which can automatically cut fuel to the engines.

here's the most relevant section:

There was a safety notice issued on the fuel cutoff system as late as May of 2025:

https://www.caa.co.uk/publication/download/25076

There is so much wrong with that post but I will only address the two most blatant errors. Others have addressed the other items.

That link you provide is a 2025 REMINDER that UKCAA issued SN–2015/005 in 2015 and that EASA issued AD's on those systems in 2015.

The EASA AD's compliance document was the related US FAA AD.

What this SN almost certainly means is that UKCAA, while auditing an operator or AMO, have found an organisation who was not tracking compliance with one of those ADs so put out a reminder to all operators and AMO's.

What is definitely far more pertinent here are the first two items below:

• That SN and the AD's it refers to have NOTHING to do with fuel cutoff switches, and
• that UKCAA is reminding operators and AMO's that the US FAA put out US Airworthiness Directive 2015-19-09 on the 787-8 and the Europeans mandated it for EASA member operators and AMO's.
• it does, however, introduce a new item into the cause of the Indian Airlines accident which will be one of the many scenarios the investigation team need to eliminate or validate.

Unlike some people, Accident Investigators do not leap to unfounded conclusions but slowly and methodically investigate all scenarios, including unlikely ones, until they reach a probable cause. As well as that, to quote DerAdlerIstGelandet A software glitch will likely switch both off simultaneously, not one switch a time, a second apart. This, again, the investigation team need to eliminate or validate, even though it has a probability close approaching zero.

I will also point out that I was trained by an International Civil Aviation Organisation (ICAO) instructor and was qualified to investigate air accidents and incidents in accordance with ICAO Annex 13 so I do have a rough idea on what I am talking about and refuse to make any positive statements about this or any other accident under investigation. That qualification expired on my retirement.

 

[AerialTorpedoDude69]

The safety advisory is not related, sorry for including it.

Also, apologies, it was All Nippon Airways (ANA) not JAL. Otherwise, every source that I've checked claimed it was software which engineers initially believed caused the dual engine failure. I couldn't find a source regarding fuel contamination. In fact, the source that R Retattack linked to specifically says it's believed to have been software which caused the problem:

Boeing 787 Suffers Rare Dual Engine Failure on Landing - The Points Guy

ANA flight NH985 suffered a dual engine failure when it touched down at Osaka Itami (ITM) on Jan. 17.

thepointsguy.com

I am having trouble finding any authoritative source on the issue with the ANA flight. I can't find a primary source which claims it was a software issue. There's a single paywalled article which claims that the cause is unknown. That is not reassuring.

Can MiTasol or DerAdlerIstGelandet provide a source please? I realize that this is a very sensitive topic and apologize for implying anything about Boeing's engineers, who are among the best in the world, if not the best aviation engineers in the world.

 

[Thumpalumpacus]

I doubt that. Here is why…

A software glitch will likely switch both off simultaneously, not one switch a time, a second apart. Same for switching them back on. The switches were switched on one at a time, and 4 seconds apart, indicating a pilot with one hand on the controls switching then back on with his one free hand.

The other thing is that one of the aircrew, still unknown which one, noticed the shutdown. Does the software have actuators that move the toggles? My understanding is that the MFD doesn't give warning for fuel cutoff, which implies that the aircrew asking noticed the switches actually moved. Have I got something wrong?

 

[DerAdlerIstGelandet]

I got my incidents mixed up. Confusing a JA with an ANA. The JA was caused by fuel contamination, the ANA was not caused by the fuel shutoff switches either (the ones shut off on AN171), but by the TCMA. The TCMA activated when the pilots activated the thrust reversers after landing. The TCMA system is designed to shut down engines during landing if it detects a potential risk in an uncommanded high-thrust situation. The incident involved the pilots deploying thrust reversers during landing, which triggered the TCMA system to shut down the engines.

 

[DerAdlerIstGelandet]

The other thing is that one of the aircrew, still unknown which one, noticed the shutdown. Does the software have actuators that move the toggles? My understanding is that the MFD doesn't give warning for fuel cutoff, which implies that the aircrew asking noticed the switches actually moved. Have I got something wrong?

I'm not sure, but the software in question is in fact unrelated to the switches.

The pilot in question is almost certainly the FO. He would have had both hands on the yoke. The Captain would have been monitoring and would have had both hamds free once he took his hands off the thrust levers.

 

[Thumpalumpacus]

I'm not sure, but the software in question is in fact unrelated to the switches.

The pilot in question is almost certainly the FO. He would have had both hands on the yoke. The Captain would have been monitoring and would have had both hamds free once he took his hands off the thrust levers.

Right, my understanding is that the captain is the more likely querent about the toggles.

I'd be really surprised if the software had actuators to move the switches, which implies that whoever asked the question noticed the toggles. That of course feeds into my question about how the glass-screen might display fuel cutoff. I'd hope that would be in big red letters. If not, then perhaps the software could have cut fuel, and the pilot noticed a warning on-screen, triggering the question, rather than noticing the toggles out of place.

I suspect that this is close to the heart of the investigation. Toggles out of place imply either malice or incompetence, whereas toggles in-place implies a deeper system defect, be it software or electrical. I don't know.

 

[MiTasol]

Otherwise, every source that I've checked claimed it was software which engineers initially believed caused the dual engine failure. I couldn't find a source regarding fuel contamination. In fact, the source that R Retattack linked to specifically says it's believed to have been software which caused the problem:

Believed by the press and other instant experts who have no ICAO Annex 13 or other relevant qualifications.

Boeing 787 Suffers Rare Dual Engine Failure on Landing - The Points Guy

ANA flight NH985 suffered a dual engine failure when it touched down at Osaka Itami (ITM) on Jan. 17.

thepointsguy.com

and believed by people who think that a tow truck can safely move an aircraft.

I am having trouble finding any authoritative source on the issue with the ANA flight. I can't find a primary source which claims it was a software issue. There's a single paywalled article which claims that the cause is unknown. That is not reassuring.

Can MiTasol or DerAdlerIstGelandet provide a source please?

JTSB do not consider this a serious incident probably meaning they determined that it could only occur on the ground.

Aviation magazine has an article but I no longer subscribe. This is what is available outside the paywall. Both these items, and especially the JTSB classifying it non serious, make the suggestion that the probable cause was the crew selecting the reversers before the full weight of the aircraft was on the wheels is most likely correct. That, and its opposite, have been known to cause incidents and accidents before now.

 

[fubar57]

No mechanical issue seen in fuel switches in deadly Air India crash, FAA admin says | CBC News

The head of the U.S. Federal Aviation Administration (FAA) said on Thursday the fatal crash last month of an Air India Boeing 787 jet does not appear to have been caused by a mechanical issue or inadvertent movement of the fuel control unit or switches.

www.cbc.ca