Transcription
There's been a lot of speculation about the cause of the accident. Once the relevant data from the flight data recorder and the cockpit video recorder is released, we should have a much clearer picture. Still, I believe there are already some important clues.
For context, I've been in aviation for 25 years, flying a dozen different aircraft types across four different airlines. I've served as a Czech airman and instructor and evaluator for airline pilots, and have published flight safety articles for more than two decades in publications like Flying and Twin Turbine magazines. I've also produced around 60 videos on this channel focused on aircraft accidents and flight safety.
Now, before we dive into what increasingly appears to be the cause of the crash, let's first review some of the more widely circulated theories. And I say some because there have been quite a few.
One early theory stemmed from video footage of the aircraft's takeoff, which some observers believed showed the wing flaps not being extended. Like all modern airliners, a Boeing 787 requires flap extension for takeoff. Flaps increase lift at lower speeds, allowing the aircraft to become airborne using less runway. Takeoff flap settings on the 787 typically range from 5 to 15° depending upon the conditions. Shorter runways usually call for more flaps, around 15°, to reduce the takeoff distance. Conversely, takeoffs over rising terrain may use a lower flap setting, which requires more runway but allows for a steeper initial climb. Amadabad's single runway is 355 meters or 11,499 ft long. This should provide ample length for most takeoff configurations. There's no official confirmation yet on the preferred flap setting for this particular takeoff. However, when runway length permits, pilots typically use a lower flap setting to optimize aircraft performance.
Although there doesn't appear to be significant terrain along the departure path, there are multiple buildings in the area. In order to take off, an airliner must be able to clear all obstacles by at least 35 ft in the event of an engine failure. To provide a safety margin for less than ideal aircraft performance or pilot technique, the required climb gradient includes about 1% of additional margin. In practice, this means that the further the aircraft is from the runway, the higher it should be above any obstacles. The most critical part of the climb occurs during what's known as the second segment, which begins once the landing gear is retracted and the aircraft is still in its takeoff flap setting. Retracting the gear is essential to meet the required climb gradient. If it remains extended, the added drag significantly reduces performance and climb capability. Keep that in mind. It will become important later. But for now, let's return to the topic of the flaps.
Although the flap position isn't clearly visible in the available video footage, that's not surprising. At settings of five or even 10°, flaps can be difficult to see in flight. Importantly, the Boeing 787 is equipped with a takeoff configuration warning system that gives an oral alert if the aircraft is not properly configured for takeoff, including if the flaps are not set. While flap-related accidents did occur in earlier decades, these types of incidents have become extremely rare since the introduction of such warning systems. In other words, the likelihood of the crew attempting to take off with no flaps was always low. Supporting that, there are now reports that the flap positions found in the wreckage were consistent with proper extension for takeoff. At this point, we can reasonably rule out flap configuration as a factor in the crash.
A second theory focused on possible fuel contamination. This idea gained traction after video footage suggested that the ram air turbine, or RAT, had automatically deployed prior to the crash. The RAT is an emergency backup that provides electrical power if all onboard generators fail. Twin-engine airliners like the 787 are equipped with at least three different generators, one on each engine and a third on the auxiliary power unit, or APU, a small turbine engine located in the tail of the aircraft. During normal flight, the two engine-driven generators supply power with the APU shut down unless an engine generator has failed. And if an engine generator has failed, it will take a minute or so to start up the APU and connect its generator to the electrical system. If both engine-driven generators fail, the RAT automatically deploys to provide essential electrical power. In this case, the aircraft's inability to climb or maintain altitude strongly suggests that both engines shut down in flight and notably appear to have done so in rapid succession.
For context, as it relates to a dual engine failure, the FAA reports that the failure rate of modern jet engines is less than one failure per 375,000 flight hours. The odds of two engines failing within an hour of each other due to unrelated mechanical issues is about 1 in 140 billion. The odds of them failing at the exact same time are essentially zero, effectively impossible without a common cause. It's worth noting that another figure sometimes cited for in-flight engine shutdowns is one per 50,000 flight hours. Using that number, the odds of two engines shutting down within an hour of each other would be around one in two and a half billion. However, that figure includes all in-flight shutdowns, not just those caused by mechanical failures. Many of these shutdowns occur when pilots follow procedures to shut down an engine due to warning signs such as low oil pressure or, in rare cases, they do so inadvertently. Some of these precautionary shutdowns may eventually be traced to mechanical issues, but many are not. In any case, the probability of a simultaneous dual engine failure remains essentially zero. And the odds of two independent engines failing within an hour of each other are still extraordinarily low, easily beyond 1 in 10 billion and possibly as rare as 1 in 100 billion.
I recently worked as a consultant on a dual engine failure involving a light piston aircraft. In that case, both engines failed simultaneously just after the gear was extended for landing. Fortunately, the pilot was able to crash land on a city street, and both he and his wife walked away unharmed. The root cause, as expected, was a single point of failure, a miswired backup battery system that failed to power the computers controlling both engines during an electrical transient to the normal electrical system. The key takeaway is this: Simultaneous engine failure is at the bottom of the crash cause probability chart, unless the failures are due to a shared cause.
One such cause of simultaneous engine failures can be bird ingestion. It has happened most recently in Jeju Air flight 2216, which went down after such an event, and of course there's the well-known 2009 miracle on the Hudson event. However, in the case of Air India 171, investigators have reportedly ruled out bird ingestion, likely because no bird remains or bird-related damage were found in either engine at the crash site. Airliners like the 787 are designed with extensive redundancy to prevent single points of failure from shutting down both engines. But there are two things that can't be fully duplicated: Exposure to birds and a single shared source of fuel.
This isn't to say that fuel contamination can't be isolated or managed. Each engine on the 787 is supplied by its own collector tank, which is replenished from the respective wing tanks and, at times, the center fuel tank. In past accidents, contaminated fuel has caused engine failures when clean residual fuel in the carburetors or collector tanks allowed the engines to start and taxi normally, only for the contamination to trigger a failure during the high fuel flow demands of takeoff and climb.
Now, a few key points. While fuel contamination has caused crashes before, the vast majority involved either piston-powered aircraft burning low-leaded AV gas or turbine-powered aircraft that were mistakenly fueled with avgas instead of Jet A kerosene fuel. That kind of error is virtually impossible with the 787. First, there isn't enough AV gas at a commercial airport to fuel a widebody aircraft. Second, airline fuelers only work with Jet A. They never touch AV gas. More importantly, there have been no reports of other aircraft at the same airport experiencing engine issues. And by now, it's almost certain that regulators have tested the airport's fuel sources and found no signs of contamination. At this point, contamination does not appear to be the cause.
That brings us to the topic of sabotage, a possibility that entered the conversation after the press inquired of regulators whether sabotage was being considered. The subtext likely relates to recent escalations and hostilities between India and Pakistan. Regulators responded that they are not ruling anything out, including sabotage, which is the appropriate stance during the early stages of an investigation. One scenario that's been floated is the intentional contamination of the aircraft's fuel. The problem with this theory is scale. A Boeing 787 carries around a quarter of a million pounds of fuel; to contaminate it enough to cause both engines to fail would require a massive amount of foreign material, something unlikely to go unnoticed by airport security. Another theory suggests the aircraft's FedEx computers, which control the engines, were sabotaged with a virus. But FedEx computers are not standard computers. They're not connected to the internet, they're not updated remotely, and they're highly specialized. Successfully tampering with them would require deep technical access and expertise, making this an implausible method of sabotage. If someone wanted to sabotage the aircraft, a physical device like a bomb would be far simpler. And finally, if this were an act of terrorism or sabotage, why has no one claimed responsibility? The entire point of such an act is to spread fear. Remaining silent undermines that purpose.
So, we arrive at what is, from a probabilistic standpoint, the most likely cause. Unfortunately, one that has been seen far too often in the past. There are strong indicators suggesting it played a role in this tragic accident. And it begins with a few early facts.
Around July 20th, days after the accident, the Directorate General of Civil Aviation, DGCA, instructed Air India to remove three company executives from their crew scheduling roles: a divisional vice president, a chief manager of crew scheduling, and a planning executive. While the stated reason was related to pilots exceeding allowable flight duty times on flights for May, the severity and timing of this action are noteworthy. At the time, the flight data and cockpit video recorders had reportedly not yet been downloaded, but it's plausible that some flight data was already available to investigators. Modern aircraft routinely transmit flight parameters such as thrust setting, air speed, altitude, and g-loading to both maintenance and flight operations teams. In many US airlines, for example, this data is accessible to pilots for post-flight debriefings. This is part of a formal program known as FOQA, flight operations quality assurance, which automatically flags and transmits a report to the airline when certain parameters are exceeded in flight. Air India flight 171 almost certainly triggered such a threshold, and this preliminary information may have raised early concerns about pilot performance.
Further reinforcing this possibility is a recent series of simulator sessions involving Air India pilots and full-motion Boeing 787 simulators. These simulations can serve multiple purposes, such as testing how specific aircraft systems respond in defined scenarios. However, the most likely reason is to evaluate how trained company pilots would react to a similar situation. The goal is to assess whether pilot actions were consistent with procedures and whether gaps in training or a culture of non-compliance may have contributed to errors in judgment or technique. Simulator testing was also done after the miracle on the Hudson to see whether the crew could have made it back to LaGuardia after losing both engines to bird strikes. Technically, it was possible, but only if the pilot started turning back immediately. The NTSB, in response to this, added a 35-second delay to reflect the time it took the actual crew to process what had happened and begin maneuvering. With that delay added, no simulator crew was able to make it to the runway. This vindicated Captain Sullenberger's decision to land in the Hudson. These kinds of simulations are typically run after investigators have downloaded flight data from the recorders. That way, they can program the simulator to match the exact conditions of the flight. Note that Air India has stated that simulator tests were produced by company instructor pilots independently of the investigation.
This might explain why early reports suggest that the pilots attempted to climb with the gear extended and retracted the flaps at 50 ft above the ground. Given the fact that all evidence points to the flaps being extended throughout the flight, demonstration that the flaps could be retracted at 50 feet does not appear to have any bearing on the investigation. Reports say the simulator showed the aircraft could still climb and clear the obstacles even with the gear down. There is no mention as to whether this was conducted during a single engine failure or with both engines operable. The difference between the two scenarios would be significant.
Now, there'd be no reason to run that scenario if both engines had simply failed at the same time without any crew action. If that had happened, the gear and flap position wouldn't matter. There wouldn't have been enough altitude or power to recover. But there is a reason to run the simulation if the crew initially experienced a single engine failure and accidentally shut down the wrong engine. Now, there's no confirmation of this, but it's a scenario that has tragically played out before. In 2015, a TransAsia ATR72 crashed after the crew mistakenly shut down the working engine. 15 people out of 58 on board survived. In 1989, a British Midland 737 went down for the same reason: The crew shut down the wrong engine, not realizing the one that failed hadn't fully quit. 47 of the 126 passengers on board died. Most of the rest were seriously injured. And in 2021, Trans Air flight A10, a cargo jet, crashed off Honolulu after a similar misidentification of the failed engine. There are other examples as well, but there's one detail that stands out.
In surveillance video of the takeoff, there's a noticeable plume, either dust or smoke, coming from the left engine's exhaust. The quality of the footage isn't good enough to say exactly what it is, but it's unlikely to be just runway dust. This airport sees frequent jet traffic, and any loose debris near the runway would be blown clear by routine operations. So this could be early visual evidence of an engine abnormality during takeoff. In that situation, standard procedure is basic and clear. First, fly the airplane. The crew's priority is to climb to a safe altitude, usually around 1,000 ft, while retracting the landing gear. Once the aircraft is stable, they can begin troubleshooting. Accelerate, retract the flaps, and if needed, shut down the affected engine. The shutdown process usually happens in two or three deliberate steps. Step one: Identify the malfunctioning engine and verify it with the other pilot. Then bring the thrust lever to idle. This step is reversible. If a mistake is made, you can simply push the lever forward again and regain thrust. Step two: If both pilots agree, move the start/stop switch to stop. This shuts down the engine, and at that point it's not coming back without a full restart procedure, which likely isn't an option at low altitude. Step three only happens if there are signs of a fire or serious damage. The crew would pull the fire handles, which cuts off fuel and hydraulic shut-off valves at the firewall to prevent flammable liquids from being delivered to a hot, damaged engine.
Now, here's a concern. Reports suggest the shutdown happened almost immediately after takeoff. That could be a red flag. It might mean that the crew reacted instinctively by memory without going through the proper verification steps, and that would go against how airline crews are trained to handle these emergencies. If the simulator tests conducted after the crash were designed to explore this scenario, early indications are that other crews did not immediately shut down an engine. Instead, they followed standard procedures: climb first, stabilize, then identify and verify the correct engine before taking any action.
At this stage, that's the most likely explanation. If new information comes out, that assessment may change. Until then, God bless the victims, God bless their families, and thank you for watching.