The purpose of an air accident report is to establish the most probable cause of the accident. An air accident report should make recommendations to avoid such an accident in the future and should avoid assigning blame. The AAIB Preliminary Report fails on both counts.
The AAIB report also fails to mention a key characteristic of the aircraft's high bypass turbofan engines: they continue to provide thrust for some time after the fuel is cut off.
Three Scenarios
There are three widely reported hypothetical statements about the probable cause of the Air India crash.
A - Pilot fault.
B - Maintenance fault.
C - Software fault.
A - Pilot fault.
From the day of the accident there was speculation about pilot error or malice. There is no evidence whatsoever to support such speculation. The AAIB Preliminary Report did nothing to negate pilot blame. Worse still, it seemed to support such speculation. The AAIB report states, in clear sequence: the maximum airspeed was reached; the fuel switches were transitioned to cutoff; the engine speed began to decline. This cannot be true. As will be shown with engineering facts and with science, the fuel must have been shut off before maximum airspeed was acheived.
B - Maintenance fault.
Some Youtube content creators and commenters claim that the probable cause was poor maintenance by Air India. Specifically, with no supporting evidence, the claim is made that remedial works to prevent water ingress into the electronics bay were not done; that water entered the EE bay at VR; that this triggered a lithium battery fault; that this triggered an electrical fault; that this caused the engines to shut down. This is purely speculative. Also, it is contradicted by credible evidence, See 4. Battery Fire Is Not A Probable Cause, below.
C - Software fault.
Of the three claims, this is the only hypothesis which is supported by credible evidence. The claim is made that the fuel was shut off in error by the FADEC / TCMA system while the aircraft was still on the runway. That is the basis of the following accident summary.
Air India Flight 171 Accident Summary - Key Findings
1. The pilots are blameless.
The pilots, as soon as they became aware that the engine fuel had been cut off, operated the fuel switches as they were trained to do in an attempt to relight the engines.
2. The most probable cause
The most probable cause of the accident was the erroneous shutting off of fuel by the automated systems before the aircraft rotated for lift off. A false detection of thrust control malfunction during takeoff probably caused the TCMA - Thrust Control Malfunction Accomodation system to trigger a dual engine shutdown. TCMA fuel shutoff can only happen on the runway: it is inhibited in the air.
There is undue focus on the fuel switches. There is no evidence of a fault ever occuring with switches of the specific type fitted to this aircraft. The throttles aka thrust levers however were changed twice. These levers send signals to the thrust control computer systems: the two FADECs and one TCMA system per engine. A fault in the thrust lever / software system can trigger engine shutdown on the ground. Shutdown is inhibited in the air.
3. Engine Thrust During Spooldown
High-bypass declining thrust profile.
(This image is for the purpose of illustration only. It shows the step-change in thrust as core thrust is lost, followed by a spooldown at a rate which increases as the rpm decreases.)
a) Unlike a propeller, the fan acts as a compressor, raising the temperature of the bypass air. The air is also raised in temperature somewhat as it cools the core. The heating of the air adds to the bypass thrust. Bypass ratio will vary with engine speed, core temperature, air density and ambient temperature.
b) The bypass ratio of a high bypass turbofan varies somewhat with airspeed and altitude. During takeoff the bypass ratio of the GenX is 9:1 reducing to 8.3:1 at the top of climb.
Source: GE aerospace.
c) At the instant of fuel cutoff there is a step change in thrust due to the virtually instantaneous loss of turbine thrust. At the moment of fuel cutoff during the takeoff roll the thrust of each engine will be reduced to a residual thrust of about 90%. Accordingly, the combined thrust of the two engines will undergo a step change to about 180% of single engine takeoff thrust.
d) The 787-8 is certified for takeoff on one engine at 100% thrust subject to decision speed V! having been reached. Clearly the combined residual thrust of 180% is more than adequate to lift the aircraft off the runway and begin the climbout.
e) The rate of spooldown and loss of residual thrust will vary with the thrust setting at fuel shutoff and the airspeed. In all cases the spooldown will be at a gradually increasing rate as the rotational inertia aka flywheel effect decreases, being opposed mainly by drag. The final stage will be windmilling speed, determined mainly by airspeed.
4. Battery Fire Is Not A Probable Cause.
a) The AAIB timings show that the engines were most probably shut down before rotation (speed VR), perhaps even as early as decision speed V1. Lithium battery fires may take minutes to reach high temperatures and up to 10 minutes to deflagrate according to FAA tests.
b) The official updated Boeing document: 787 Lithium-ion Battery Events, A Guide for Fire Fighters, describes the lithium batteries and locations in detail.
Lithium Battery Locations
The box containing the lithium-ion battery cells is secured inside a reinforced stainless steel enclosure capable of containing a lithium-ion battery event. Venting of vapor during a battery failure event may be visible from an exterior vent on the bottom of the airplane under the forward or aft Electrical and Electronic (E&E) bay.c) Suggestions that the high temerature of a lithium battery fire caused the damage to the aft AEFR are wrong according to Boeing's fire-fighting document.
Temperatures may reach as high as 338 degrees Celsius/640 degrees Fahrenheit.
APU Lithium Battery Box
d) The main and APU battery packs are each enclosed in a very rugged stainless steel box. The boxes are vented under the aircraft.
APU Battery Vent
e) Airport surveillance video shows no sign of smoke coming from the areas of the battery vents.
f) According to the data it is very unlikely that a lithium battery fire caused the accident, or even happened before the crash.
5. No malfunction evidence in video.
The widely published airport surveillance video shows no evidence of any other malfunction on the runway. What some perceive as smoke is, to a high degree of probability, dust lofted by wake turbulence.
6. Landing gear was not selected up.
Gear up was not selected after lift off. This indicates that the pilots were aware shortly after takeoff that the airspeed and rate of climb were abnormal. Gear up is usually selected when the rate of climb is seen to be positive a few seconds after liftoff
7. RAT deployment.
The RAT - Ram Air Turbine - has the following deployment characteristics.
a) Deployment is inhibited by the WOW - Weight On Wheels - sensors.
b) Deployment is inhibited below 100 knots.
c) The blades do not spin until clear of all possible airframe contact points.
d) It takes up to 7 seconds for hydraulic power to be available after RAT deploy signal.
e) It takes up to 10 seconds for electrical power to be available after deployment.
f) Output power of the RAT depends on airspeed and is nil at about 100 knots.
g) RAT hydraulic power is insufficient to raise the landing gear.
8. TCMA - Thrust Control Malfunction Accomodation
a) The TCMA - Thrust Control Malfunction Accomodation system operates on logic which can shut off fuel to the engines on the ground in the event of engine thrust / thrust selection mismatch or assymetric thrust.
b) The TCMA logic incorporates redundancy: the TCMA can shut off the spar valve: the FADEC, using the same software logic, can shut off the engine fuel valve.
c) The TCMA and the FADEC software share data about flight status such as air/ground transitions.
d) TCMA / FADEC fuel shutoff is inhibited in the air: it is intended to prevent runway over-run after landing and to prevent runway / taxiway excursion.
e) It appears to be the case that TCMA / FADEC fuel shutoff is not inhibited at any stage during takeoff.
f) TCMA and FADEC receive data about the selected thrust via the Throttle Lever Angle (TLA) resolver sensor. They also share relevant flight status data.
________________________________________________________________________
Recommendations
1. The precautionary principle suggests that immediate steps should be taken, where a TCMA system is employed, to ascertain if the software is capable of inhibiting fuel shutoff at any point during the takeoff roll.
2. Immediate steps should be taken to ensure inhibition of fuel shutoff at or after V1, or perhaps a few seconds before V1.
3. If doubt exists about the TCMA / FADEC software then, as a precaution, pilots should use full-rated thrust for takeoff as was instructed by the FAA in 2006.
This AD requires revising the Airplane Flight Manual to prohibit takeoffs at less than full-rated thrust. This AD is prompted by a report of two occurrences of engine thrust rollback (reduction) during takeoff. We are issuing this AD to prevent dual-engine thrust rollback, which could result in the airplane failing to lift off before reaching the end of the runway or failing to clear obstacles below the takeoff flight path.Special Mention
FAA AD effective October 16, 2006
Special mention must be made of the medical staff and students who fled the scene of the accident and then returned immediately to render aid to survivors.
Further Reading
Air India Flight 171 - Ask The experts
Air India Flight 171 - The Vital Seconds
Air India Flight 171 Accident - The Most Probable Cause
Air India Crash: Update #5 - It's Dust, Not Smoke
Air India Crash: Update #4 - Lessons From The Past
Comments