Air India Crash: Need for Revised AAIB Report
Raghu
CONSIDERABLE time has gone by since the Air Accidents Investigation Bureau (AAIB) released its Preliminary Report (PR) on July 12 into the crash of Air India flight AI-171 a month earlier. The flurry of speculative print, online and social media reports has thankfully subsided. Many of these earlier reports had been driven by conjecture, fuelled by unfortunate leaks from within the investigation team. AAIB’s Preliminary Report (PR), which should have quieted the speculation, regrettably fuelled it by its own partial narration of facts, flawed and even contradictory analysis, and innuendo hinting at pilot error, especially through manipulation of Fuel Control Switches (FCS). Sections of the media picked up on these both in India and abroad and went to the unseemly extent of suggesting deliberate pilot action, pilot suicide, mental issues, even providing lurid details of family problems.
At the same time, there were a few analyses, including by this writer in these columns and elsewhere, who questioned the AAIB report and inconsistencies in its analysis, as well as its preliminary findings, especially its focus on the fuel switches and the possible role of the pilots. These writings also offered plausible alternative explanations for the chain of events leading to the crash. Wittingly or otherwise, the fuel switches and pilot action narrative, without looking at other possible causation chains, has allowed the aircraft and the engine, along with Boeing and the engine manufacturer General Electric, to evade any scrutiny so far.
In recent weeks, there have been more such critical analyses by aviation experts, former pilots on the Boeing 787 or similar aircraft, systems analysts and other commentators. A remarkably consistent pattern is emerging from this scrutiny, based on the very information presented in the AAIB Report along with additional publicly available information. Put together, there is now a credible body of analysis and explanation running counter to that of the AAIB and the findings in its preliminary report. Of course, progress made or directions being taken by the AAIB investigations are not known, for which the unnecessary secrecy and absence of transparency of the AAIB, including failure to hold even a single press conference, are largely to blame. The reality is, however, that the alternative explanations being offered now are so strong and serious that they call for the AAIB to revisit its provisional findings and release an updated preliminary report.
This article presents the main points of an alternative explanation bringing together the common points from the analyses of several expert commentators and this writer. It is reiterated that this discussion is based entirely on the information provided in the AAIB Report, except for one or two instances which are explained. Complex technicalities are kept to a minimum for the sake of the average reader.
There are some major anomalies in the AAIB Report leading to erroneous conclusions, and alternative explanations for the chain of events must be looked for.
NOT FUEL SWITCHES
First, is the time of deployment of the Ram Air Turbine (RAT) and therefore the timing of consequent events following upon that. The RAT is a small generator with a propeller driven by the aircraft’s forward motion through the air, which is deployed below the aircraft fuselage in the event of an electrical failure or engine failure, and supplies emergency electricity for essential requirements, hydraulics, cabin lights and so on. Now, the AAIB Report gives a second-by-second timeline for key events leading to the crash, but strangely does not give any timeline for this significant event as must be available from the many recording systems, but only states that the RAT was seen deployed “immediately after take-off” in CCTV footage from the airport. Is this because of sloppy reporting, or because the timeline would not match the narrative of pilot action being built?
The anomaly is this. (All times are given in UTC, add 5:30 hrs for IST). Take off is noted at 08:08:39 UTC (hours: minutes: seconds), and the fuel switches are noted in the report as going from RUN to Cut-off at 08:08:42 +1 for the two switches. (From here on, only the seconds are noted for brevity). If this was the trigger for both the engines to shut down, that process should have taken a few seconds after which, sensing engine shut-down and loss of electricity, the RAT should have deployed, which again usually takes 5-6 seconds to deploy, start winding up speed until able to generate electricity, and then start supplying hydraulic power which is noted at 08:08:47. This is too short an interval from the fuel switches transitioning. In fact, working backwards from the RAT supplying hydraulic power at the 47s marker, that should mean RAT deployment at 39s i.e., at take-off itself! The report itself states that the RAT was seen deployed in CCTV footage “immediately after take-off,” (see photo) or around the 39s marker, much before the fuel switches were operated at 42/43s! Evidently, the shifting of the fuel switches from Run to Cut-off was NOT the cause of the engines shutting down, which had already happened!
ELECTRICAL FAILURE, BATTERY FIRE?
So, what had happened to trigger the RAT deployment? It was clearly not engine failure, since the aircraft was still climbing and reporting no loss of power, so it must have been electrical failure. A clue lies in the Enhanced Aircraft Flight Recorders (EAFRs) or flight and cockpit data recorders, one in the forward section and the other in the Aft or rear section of the aircraft.
Ironically, the Aft EAFR in the more or less intact tail section (seen in many photos sticking out of a hostel building) was found completely damaged and no data could be recovered from it, whereas the forward EAFR, although located in the forward section that was totally smashed, was recovered and data could be downloaded from it. In all probability, the Lithium ion battery in the Aft EASR had undergone a runaway fire, which can melt even the hard metal casing, and triggered an electrical failure. The AAIB investigations should have noted this. Li-ion battery fires have been noted in Boeing Dreamliners, which were even grounded earlier before some modifications were carried out. On AI-171, the lone survivor reported flickering cabin lights, going to white and greenish, typical of RAT electrical supply, and the same aircraft landing in Ahmedabad on its incoming flight earlier had also reported electrical problems.
This would explain RAT deployment “immediately after take-off” or at 08:08:39 or 40, with the RAT turbine picking up speed, consistent with starting to supply hydraulic power at 08:08:47.
FADEC LOGIC
The AAIB Report barely discusses the Full Autonomy Digital Engine Control (FADEC) system which is key to understanding the operation of the Boeing 787 Dreamliner. The report mentions FADEC re-starting the engines when the fuel switches were manually moved from Cut-off to Run, but does not seem to believe FADEC could have performed any role earlier, that too autonomously of the pilots, which is actually its role.
To quickly recap, the Dreamliner is the most electric aircraft operating currently. All operations from the pilots are only electrical signals, along with signals from numerous sensors and control system elements throughout the engine and aircraft. The FADEC computer collates all these signals and takes decisions which are transmitted and converted into actions by actuators operated hydraulically. The FADEC system logic is designed around the principle of protecting the aircrafts integrity even by-passing pilot commands if required. The idea is pilots may panic, commit mistakes of judgment, whereas FADEC would take the optimal or correct decision as programmed.
In our case, FADEC would have received an electrical failure signal, which would also have meant no signals coming in about engine performance. FADEC “knows” that this could mean the aircraft has no electrics but the engine is ok, but cannot take the chance of an engine fire caused by fuel continuing to be supplied, so it must shut off fuel, by-passing the pilots. One may presume that this happens at 08:08:42-to-47 about when the AAIB Report says fuel switches had been moved, but which (as suggested in my earlier piece) could be sensor readings not switch indications. Pilots would have noted fuel supply being stopped and engine powering down, triggering the conversation between the pilots so sensationally recounted in the AAIB Report without being investigated further.
When new or unfamiliar incidents are encountered, software patches are prepared, flight-tested by test pilots and then loaded into the FADEC systems to update the logic so as to respond to the new situation if it occurs. Rare incidents are called “edge cases.” In this case, perhaps a new addition to the logic may be added instructing FADEC not to cut fuel supply when the aircraft is below a certain altitude.
There are several other finer points that also require discussion, such as the half-retracted position of the undercarriage or wheels, the throttle lever position in the cockpit which could have been because of the crash, the coming into action of the Auxiliary Power Unit (APU) which reinforces the anomalies in the AAIB Report and so on, but this would get very technical and may not be needed for the thrust of this article.
CONCLUSION
The above discussion has shown that the AAIB Preliminary Report has several significant errors and gaps, and hence has made serious mistakes and misjudgments in its findings, however provisional. The major conclusions of the report, even if not stated in those words, have been taken by the wider public and even in professional aviation circles as suggesting pilot error, and with no other plausible explanation being offered.
The aviation industry, safety professionals and the wider public do not know what is contained in the EASR data or what was found from the downloads. There is much data that would by now also be available from SATCOM or ACARS (Aircraft Communications Addressing and Reporting System) which record human or automated satellite communications between the aircraft, engines, cockpit, control tower and intermediate monitoring stations. Boeing, General Electric, NTSB, FAA and other agencies must have seen all this information by now. How much has AAIB seen and analysed? Unfortunately the public in India and also the UK which lost many citizens in the crash are unfortunately in the dark on all of this. All they have so far is speculation and a deeply unsatisfactory AAIB Preliminary Report.
The report is not expected to point blame, but to arrive at an understanding of the accident and suggest measures to improve safety of aircraft, airlines, passengers and other stakeholders. Towards that goal, in light of the above and other evidence and analysis now available, it is imperative that AAIB re-examine the evidence and release a revised or updated Interim Report at the earliest.
