2 + 2 Does Not Compute, But 1 of 4 AND 1 of 4 Does
On 12 June 2025 a Boeing 787-8 Dreamliner crashed shortly after takeoff from Ahmedabad Airport, India. The crash resulted in the tragic loss of 260 lives. The plane was destroyed, along with a number of buildings. There was only one surviving passenger.
Why investigate when you can blame the pilot or pilots?
Throughout the whole history of civil aviation there have been far more instances of defects in the plane causing a crash than pilot malice. There are but very few instances of a pilot deliberately causing a crash.
Here is a question in the form of a puzzle. There are two pilots in a plane's cockpit and two fuel cutoff switches which can only be moved by human hands. We know that the fuel was cut off. How was the fuel cut off?
Many people will jump to the conclusion that 2 pilots plus 2 switches equals deliberate human action. The typical reader of science 2.0 however will reply in the manner of Isaac Asimov's Multivac computer: "Insufficient data for a meaningful response.". The preliminary report from India's Aircraft Accident Investigation Bureau does not compute: there is insufficient data for a meaningful discussion of how the accident might have been caused.
There are many more ways that the plane could have crashed due to a fault. These possibilities will always be investigated by the competent before investigating the possibility of pilot error or malice.
Figure 3 from the AAIB Preliminary Report1
The report, for reasons known only to its authors, fails to mention the five per engine fuel cutoff switches / relays. Only one of the five is under the control of the pilots. Indeed, the AI 171 pilots may not even have known that these relays exist if it was no part of their training. As was the case with the 737 MAX MCAS2 problem.
"It is hard to imagine a text more likely to sow confusion and encourage speculation than the partial summary of the fate of the Boeing 787 in Ahmedabad" The Times, India3.
When 2 + 2 Does Not Compute.
Immediately following news of the crash there was speculation across social media as to its cause. There was an unfortunate element of racism in many comments, with people overly ready to blame pilots, maintenance, managers and others based solely on the fact that they were Indian. Judging by comments left on YouTube, the majority in the court of public opinion seek to blame the pilots. After all, those switches don't move themselves. But the other fuel cutoff switches, actually relays, are not mentioned in the interim report. Were these relays deliberately hidden from view? Or were the investigators incompetent?
A Honeywell toggle switch4 of the type (4TL837-3D) used in the 787-8 for fuel cutoff.
The fact that the pilots had been condemned in the court of public opinion made the task of the authors of the interim accident report so much easier. The report does not blame any person or any thing. It merely states, in effect: "Look at these two switches which can only be moved by human hands". Also: "Look at these two humans". There are many gaps in the report, leaving too many things to the reader's imagination. But the report does not directly blame the pilots. As a matter of plausible deniability the authors made sure to not directly blame the pilots. But through classic misdirection such as is used by magicians they made sure that the public would infer that the report blames the pilots. Absent the exercise of due diligence almost anyone relying on the report would blame the pilots. And many newspapers, Youtubers, media influencers and commenters did. But not those for whom nullius in verbam is a thing.
Due diligence is not a hard task, or a big ask, in this age of the internet. Information about almost anything is "out there". Seek and ye shall find. There is more than sufficient information on the web for the Air India pilots to be exonerated in the court of public opinion.
"SINCE human beings fulfilled the dream of flying in the sky, researchers have always endeavored to make aircraft more energy efficient, environmental friendly, reliable and safer as well as less heavy and maintenance cost. More Electric Aircraft (MEA) could be a promising answer."
QIN LIU, TIAN LIANG, ZHEN HUANG,VENKATA DINAVAHI, IEEE5
There is an old saying: "A little knowledge is a dangerous thing.". People with knowledge of how planes generally work may not know about how MEA specifically works and may thus look at this accident from the limited perspective of their own knowledge and experience. That way lies error. MEA - More Electric Aircraft - is a method of improving performance of aircraft in terms of fuel economy and weight saving. MEA replaces metal rods and cables with sensors and electronically controlled actuators. Digital MEA replaces heavy analog (current carrying) actuator power cables with lighter digital signal carrying cables. Digital signals from sensors - which includes pilot controls - operate relays (whether mechanical or solid state) which feed power to actuators.
In the Boeing 787 series almost everything is digitally controlled through electronics and computers. Each engine is controlled by an EEC, an Electronic Engine Controller, sometimes called an ECU, Engine Control Unit. The 787 engines are controlled by a type of EEC called a FADEC. This is a Full Authority Digital Engine Controller. Full Authority means exactly what it says: this computer is autonomous. It has full control over the fuel supply to the engine.
FAA6: "... the system provides no reversion to manual control."
The TCMA has full authority over fuel cutoff
In addition to the FADEC there is a TCMA - Thrust Control Malfunction Accomodation system. The TCMA has full authority over fuel cutoff. That is worth repeating again. The TCMA has full authority over fuel cutoff.
Yes, there are also two toggle switches below the throttle levers, so the pilots have complete authority to shut off the fuel. But because of the TCMA system they do not have final authority to leave the fuel supply on. The TCMA system has two command modes: fuel on and fuel off. Unlike most switches such as household light switches, which simply open a circuit, the TCMA system and pilot's switches are changeover switches. They are ON/ON switches. There is no OFF position. Changeover switches close a second circuit when they open the first circuit. The 787 fuel system has two control lines common to the fuel cutoff relays and the pilots' switches. There are thus five sets of switching contacts wired in parallel, each of which can cut off the fuel.
TCMA - Thrust Control Malfunction Accomodation system. Image from patent7.
In this TCMA diagram the toggle switch operated by the pilots is shown as switch 108. All of the other switches shown are relays. Items 130 on the paired relays 22 and 34 represent software control of the relays. Relays 22 and 34 lie within the dotted line 16 which represents the core TCMA module. The software is proprietory, it is a trade secret. As was Boeing's Maneuvering Characteristics Augmentation System - MCAS - software.
The fuel valve can not be opened by any means unless the fire relay is energised and in the run position. If fire is detected in the engine, or a fault other than loss of power causes the fire relay to drop out, it will send power to the cutoff coil 100.
Although electromechanical logic has long since been replaced by digital logic in most fields, there is still a need for electromechanical devices such as relays and contactors. These may have auxiliary contacts which signal the opening or closing of the main contacts. Either or both relay contact types can produce a fault condition.
A defect was discovered in the 787 fuel valves8 such that the fuel could not be shut off in the event of fire. The problem has been resolved by ensuring that the fuel valve actuators fail safe to a fuel off condition if an engine fire is detected.
In the 787, for each engine there is one pilot-operated fuel cutoff changeover switch which operates a changeover relay. This is one of four changeover relays which are wired in parallel so that any one of them can cut off the fuel. Because they are wired in parallel it makes no difference how many are set to 'fuel on': if any one switch is set to 'fuel off' then the fuel will be cut off regardless of other switch settings. Computer buffs will recognise this as classic OR logic. The fuel can be cut of by any one of five contact sets, whether by proper or improper action. There are two engines. Obviously the fuel to both can be cut off by the pilots. That's one condition. There are four relays for each engine. Any relay alone can cut off the fuel to one engine. Any 1 of 4 on LH engine and any 1 of 4 on the RH engine can cause fuel cutoff on both engines. There are 16 possible ways to shut down both engines.
There is only one way the pilots can cut off fuel to both engines and sixteen ways for the automated system to cut off both engines. Given the 16 to 1 ratio it should be obvious that the plane's automated systems are far more likely than the pilots to have cut off the fuel.
The odds based on OR logic apply only to this particular instance and to the electrical contact operations in this particular component of a very complex highly interconnected system. There is also the possibility of a wiring fault or a software logic causing relay operation. Many other sources of the erroneous operation of the fuel cutoff valve actuator are possible. The probability of twin fuel cutoff in flight happening again is a matter for engineers working with statisticians.
A system fault becomes even more likely when one considers that it has happened before. Here are some examples with brief descriptions.
2007 - Contactor failure9 - Boeing 777-222, N786UA
The accident occurred during engine start after pushback from the stand. After the right generator came online an electrical failure occurred in the right main bus. The failure resulted in severe internal arcing and short circuits inside the two main power contactors of the right main bus.Uncommanded 787 fuel cutoff at Osaka10.
In 2019 an All Nippon Airways (ANA) flight touched down on the runway at which point the Thrust Control Malfunction Accommodation System malfunctioned and cut the fuel to the engines.
FADEC Faults
1995 Boeing Chinook Loss11 - multiple FADEC faults during testing.
In 1994 a Boeing Chinook crashed on the Mull of Kintyre. The initial reaction of the powers that be was to blame the pilot. It later transpired that there had been many problems with the FADEC.
2015 Seville Airbus A400M crash12 - 3 of 4 engines shut off by FADECs
Three of the four engines experienced power frozen after lift-off and did not respond to the crew's attempts to control the power setting in the normal way.
2019 Diamond DA42 Twin Star13
Speyer, Germany. In March 2019 both engines on a DA42 Twin Star failed simultaneously as the pilot selected gear up. He was able to land immediately with no injuries. This was caused by a FADEC flaw which shut down both engines.
Flight Management Systems Faults
Boeing 737 MAX groundings2
Two similar crashes occured: Lion Air Flight 610 on October 29, 2018, and Ethiopian Airlines Flight 302 on March 10, 2019. It was only after the second accident that media focus shifted from pilot error to a plane malfunction. It was eventually shown that MCAS software, the Maneuvering Characteristics Augmentation System, could force a pitch down. This was not in the pilot manuals.
LATAM Airlines Flight 800
During the flight the plane lost height rapidly, causing injury to 50 people who were thrown around in the cabin. The DGAC preliminary report14 of March 11 2024, claimed that the captain's seat had involuntarily moved forward and that weather was not a factor.
According to the report a member of the cabin crew grabbed the pilots seat, broke the switch cover and activated the switch which moves the pilot's seat. This, according to the DGAC, caused the pilot to push the yoke forward.
A possibility not mentioned in the report is that a fault caused the nose of the plane to pitch down violently. causing the cabin crew to grip the seat very firmly to avoid being thrown around. If the switch cover was already defective, as found in other 787s, it could have flipped open and the cabin crew could have operated the switch unawares due to the instant of panic.
The DGAC has yet to issue a final report.
Qantas Flight 72 Uncommanded Pitch Down15
This was an Airbus A330 incident. 12 people suffered serious injuries, and 107 people suffered minor injuries. The fault was traced to a flight control primary computer (FCPC) and an air data inertial reference unit (ADIRU). A false angle of attack - AOA - indication led the computer to command a pitch down maneuver.
FADEC Design&Certification Details
These direct quotes from FAA Advisory Circular16 Date: 6/29/01 AC No: 33.28-1 define a FADEC and describe areas of exemption from regulation.
j. Full Authority Digital Engine Control (FADEC). FADEC is a control system in which the primary functions are provided electronically and the electronic unit has full-range authority over the engine power or thrust. FADEC systems have been certificated that employ either two identical channels to provide full-operational capability after failure of one channel or a single channel with a simplified electronic or hydromechanical back-up to provide an alternate operating mode. The “FADEC system” includes all the control elements identified in the instruction manual, including: sensors, wiring, mechanical, pneumatic, or hydromechanical components and other limiter or protection devices. If the control requires data from aircraft computers to operate, this data is considered part of the EEC or FADEC system, and the interface requirements for this data should be specified in the engine instruction manual. Mechanical components, such as the fuel pump, that do not interface with the EEC system are generally not included in the definition of FADEC system components.The quoted paragraphs and link to the FAA AC are provided for the purpose of further information and to promote discussion.
Paragraph 1 - 3 , page 1 - 3
...
l. Loss of Thrust Control (LOTC). ...
One engine inoperative (OEI) or automatic take-off thrust control system (ATTCS) ratings and implementations are exempted from an LOTC analysis, because the portion of time spent at these ratings is relatively small, and they are covered by aircraft level analyses.
FAA Advisory Circular Date: 6/29/01 AC No: 33.28-1
Paragraph 1 - 3 , page 1 - 3
The Physics Of Spinning Down And Spinning Up
Engine dynamics
"Since the mass flow rate through the fan and the area of the fan are much larger than the core, this contribution will have a greater effect on thrust. However, the velocity of the core is greater than the fan, but because the mass flow rate is smaller, again the fan has a larger contribution to the thrust."At the moment of fuel cutoff in TOGA (max thrust) the momentum in the turbofans is sufficient to continue delivering thrust for a significant number of seconds. Indeed, if an engine flames out at during the takeoff roll or initial climb it can continue to contribute a significant share of thrust for a short time. Unlike the case with propellor driven planes, a fuel off condition in one engine will not immediately cause the plane to yaw.
"The current high efficiency turbofan engines vary between 8 and 10 bypass ratio ..."
Andrew Dankanich, David Peters
Washington University in St. Louis17
Additionally, the huge rotating mass will have sufficient momentum to continue to provide some hydraulic and electrical power. Hydraulic power is by its nature analog: the pressure will decay. In other planes a voltage or frequency drift will trigger an almost immediate power loss signal. The 787 alternators are VFSG - Variable Frequency Starter Generators. These will continue to provide power down to some threshold level at which a power loss signal will be triggered.
Ram Air Turbine - RAT - Details&Dynamics
The preliminary report1 confirms that the RAT was deployed. This was first suggested on YouTube by Jeff Ofstroff @jeffostroff and then taken up by many other channels. In the airport surveillance video released to the public the distinctive sound of the RAT can be heard. Also, a blur appears where the RAT would appear if stowed.
The RAT Can Deploy Automatically if any one of these conditions is detected:
Both engines have failed
Loss of electrical power to both sets of flight instruments
Loss of all four EMPs and faults in the flight control system on approach
Loss of all four EMPs and single engine failure on takeoff or landing
Total loss of hydraulic power.
The airspeed must be above 100kph else the blades will stall producing no output. The RAT is prevented from deploying in this situation because it will merely increase drag.
The survivor reported a loud bang during the flight and reported hearing the engines rev up. The RAT is spring loaded and held by one or more latches. As a last ditch safety item, noise is not a consideration. The RAT deploys with a loud thump and when it spins up it sounds like a large piston engine&propeller spinning up.
Glider Dynamics
Once all thrust is lost from whatever reason, every plane becomes a glider. A true glider can gain height by seeking out a thermal, for example. A powered plane is too heavy to do this. But the pilots can execute a brief exchange of kinetic energy for potential energy. In other words there can be an exchange of speed for height in a zoom climb. The airport surveillance footage may show proof of a zoom climb attempt.
Every plane and glider is subject to the forces of thrust, drag, lift and weight
A plane will maintain constant speed if the thrust is equal to the drag, and will maintain constant altitude if the lift is equal to the weight. A twin high bypass turbofan plane will experience a gradual loss of thrust over quite a few seconds after fuel shutoff. The AI 171 pilots may have been trying to use this decaying thrust together with a zoom climb in a desperate bid to gain altitude. An expert analysis of the video in conjunction with the FDR is needed.
Conclusion
There is plenty of evidence that a systems failure is the most likely cause of the Air India 171 tragedy. No forensic evidence of pilot malice has been produced by anyone, only innuendo and selective presentation of facts. If the intention of the investigators is to claim malice then they will be glad of the help they are getting from the gutter press and from some people on social media. It is being reported that the captain's last words on leaving for the airport were: "How are you Mr Lokhande. Please, take care of papa." Innuendo, Implication.
The full quotation is: " ‘How are you Mr Lokhande. Please, take care of papa, and I will be back soon."
While this article was in progress, in India 112 pilots have reported sick. The official line is that they are experiencing mental health problems. It is notable that other nations are not experiencing the same problem.
Industry insiders report a growing distrust among pilots in official crash narratives, further fueling psychological distress.
According to several Air India (AI) flight deck personnel, there is ongoing discussion within cockpits about the legitimacy of the AAIB’s preliminary conclusions.
AVIATION A2Z18
If the evidence in this article is credible* then either the investigators know nothing about automated fuel cutoff, or else they are deliberately hiding the probability that automated fuel cutoff systems are to blame. For as long as people are ready to blame the pilots the air industry will keep making money. Meanwhile, as with the 737 MAX, how long before it happens again and the pilots are exonerated?
De mortuis nil nisi bonum dicendum est
___________________________________________________________________________
* I accept fault for any errors in this article and stand ready to be corrected. I am not paid by anyone to write here and I have no connection to any od the entities mentioned.
There is still much to be said about how the 787 works, and how this relates to the AI 171 tragedy. I may write a follow-up. If so it will be linked here.
Sources
1 - AAIB preliminary report
https://aaib.gov.in/What's%20New%20Assets/Preliminary%20Report%20VT-ANB.pdf
2 - Boeing 737 MAX groundings
https://en.wikipedia.org/wiki/737_MAX_groundings
3 - Air India crash report feeds rumours and wounds national pride
https://www.thetimes.com/world/asia/article/air-india-flight-crash-repor...
4 - Honeywell switches type TL
https://www.yic-electronics.com/datasheet/d6/TSI352-66CQY.pdf
5 - Modeling and Simulation of Variable Speed Variable Frequency Electrical Power System in More Electric Aircraft
https://www.researchgate.net/publication/316247581_Modeling_and_Simulation_of_Variable_Speed_Variable_Frequency_Electrical_Power_System_in_More_Electric_Aircraft
6 - FAA document on FADECs, with embedded URL to in-depth information.
https://www.faa.gov/sites/faa.gov/files/2022-01/Full%20Authority%20Digit...
trol%20%28FADEC%29.pdf
7 - TCMA patent
https://patents.google.com/patent/US6704630B2/en
8 - 2025 - Fuel Shutoff Valve – Mandatory Actions on Boeing Aircraft
https://www.caa.co.uk/publication/download/25076
https://www.federalregister.gov/documents/2015/09/29/2015-24145/airworth...
9 - Report on the accident to Boeing 777-222, registration N786UA at London Heathrow Airport on 26 February 2007
https://assets.publishing.service.gov.uk/media/542303bced915d1374000bbb/...
10 - 2019 All Nippon Airways (ANA) flight fuel cutoff
https://www.financialexpress.com/business/airlines-aviation/ai-171-crash-boeing-787-experienced-fuel-switch-cut-off-in-2019-too-says-us-aviation-expert-japan-pilots-never-touched-it/3917100/
11 - 1994 Mull of Kintyre Chinook crash
https://en.wikipedia.org/wiki/1994_Mull_of_Kintyre_Chinook_crash
https://www.computerweekly.com/news/1280096803/Chinook-ZD576-How-the-Fad...
12 - 2015 Seville Airbus A400M crash - 3 of 4 engines shut off by FADECs
https://en.wikipedia.org/wiki/2015_Seville_Airbus_A400M_crash
13 - 2019 - dual engine failure in a Diamond Twin Star
https://aviationconsumer.com/industry-news/fate-1-fadec-0/
14 - INFORME PRELIMINAR DEL SUCESO DE AVIACIÓN N°2052-24 DE FECHA 11 DE MARZO DE 2024
https://www.dgac.gob.cl/wp-content/uploads/2025/03/Informe-12-meses-suceso-2052-24-11-MAR-2024-CC-BGG.pdf
15 - Qantas Flight 72 Uncommanded Pitch Down.
https://en.wikipedia.org/wiki/Qantas_Flight_72
16 - FAA Advisory Circular Date: 6/29/01 AC No: 33.28-1
https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_33.28-1.pdf
17 - Turbofan Engine Bypass Ratio as a Function of Thrust and Fuel Flow
https://openscholarship.wustl.edu/cgi/viewcontent.cgi?article=1036&conte...
18 - Air India Pilots Call in Sick After Boeing 787 Crash, Here’s Why?
https://aviationa2z.com/index.php/2025/07/25/air-india-pilots-call-in-si...
Further reading
A reverse engineers perspective on the boeing 787 ...
https://www.ioactive.com/reverse-engineers-perspective-on-the-boeing-787-51-days-airworthiness-directive/
edit update links added
Air India Crash: Update #1
Air India Crash: Update #2 - The AAIB Report Revisited
Air India Crash: Update #3
Comments