What Flipped the Fuel Switch of AI171? Inside the Air India B787 Dreamliner Crash Investigation

Weeks after the tragic crash of Air India Flight AI171, which killed 241 passengers and crew and 19 on the ground, investigators have centered their focus on a single component: the aircraft’s fuel control switches.

India’s Aircraft Accident Investigation Bureau (AAIB) initially pointed to the uncommanded movement of both engine fuel switches from RUN to CUTOFF shortly after takeoff—resulting in a simultaneous dual engine shutdown and fatal descent. These switches (Part No. 4TL837-3D) had been flagged in a 2018 FAA Special Airworthiness Information Bulletin (SAIB) for possible locking mechanism disengagement.

But the US Federal Aviation Administration (FAA) has declared the switches safe—issuing a Continued Airworthiness Notification on July 11 and signaling confidence in Boeing’s design. This development raises a critical question:

Are investigators chasing the wrong culprit—and possibly overlooking a deeper, systemic failure?

The Crew: Experienced and Composed

The flight was under the command of Captain Sumeet Sabharwal, 56, who had logged more than 15,600 total flight hours, including 8,600 on the Boeing 787. He was supported by First Officer Clive Kunder, 32, who had 3,400 total hours, including 1,100 on the same aircraft type.

Both pilots were medically cleared, well-rested, and current on all training protocols. The cockpit voice recorder (CVR)captured their shock after the engines shut down seconds into the flight:

“Why did you cutoff?”
“I didn’t.”

What followed was a textbook response—restart attempts, system resets, and a MAYDAY call. Their actions suggest high situational awareness and strict adherence to protocol. This crew was prepared and capable. The system around them wasn’t.

Scenario 1: FADEC or TCMA Logic Error

The Boeing 787’s Full Authority Digital Engine Control (FADEC) system, paired with its Throttle Control Module Assembly (TCMA), governs engine performance, including thrust control and fuel regulation.

A sensor fault, software anomaly, or signal misinterpretation could have led FADEC to mistakenly trigger fuel cutoff—despite no command from the flight crew. A 2019 incident involving an ANA Boeing 787 supports this possibility, where FADEC misinterpreted thrust due to incorrect WOW (weight-on-wheels) logic during takeoff.

Could Flight AI171 have experienced a similar software-driven failure?

Scenario 2: Electrical Cascade and RAT Deployment

The Dreamliner features an advanced, integrated electrical power system that manages energy distribution across avionics, engines, and flight controls.

A cascading electrical failure could have resulted in:

• Automatic deployment of the Ram Air Turbine (RAT)—indicating total engine or power loss
• Disruption in the engine relight process
• Simultaneous communication breakdown across FADEC and fuel control systems

This scenario supports the theory that the switch movement was a consequence, not a cause—a result of an upstream power system fault.

Scenario 3: Human-Machine Interface Design Flaw

Fuel control switches are generally guarded and spring-loaded to prevent accidental activation. However, investigators will also examine cockpit ergonomics:

• Are the switches placed close to frequently used levers like flaps or landing gear?
• Do they provide sufficient tactile feedback or resistance?
• Could inadvertent contact have occurred during early climbout?

Evidence weighs against this theory. The switches require lift-and-pull motion, and the one-second gap between the two switch movements does not align with accidental simultaneous contact. More importantly, CVR transcripts confirm no deliberate crew action.

Is the Investigation Misfocused?

Investigators may be experiencing what experts call “component bias”—focusing on the part that moved rather than the system that caused it to move. The fuel switch was a known concern due to the 2018 FAA SAIB, making it an easy early narrative anchor.

But if the switch performed as designed, and no mechanical failure is found, then the real vulnerability may lie within:

• FADEC’s decision logic
• Boeing’s dual-engine shutdown architecture
• Electrical signal integrity or power isolation systems

Boeing’s July 11 Multi-Operator Message and the FAA’s Continued Airworthiness Notification confirm that no unsafe condition has been identified in the switches themselves.

Governance Oversight: Systemic Complexity vs. Regulatory Scope

While the FAA has expressed confidence in the integrity of the fuel control switches, that assurance primarily covers component-level certification. It does not necessarily address emergent failures from the interaction of complex software, hardware, and electrical systems—especially under edge-case scenarios.

Many of these interactions fall outside traditional regulatory frameworks, which are still evolving to handle software-dependent aviation systems. If system behavior isn’t stress-tested under extreme but plausible failure modes, regulatory clearance may create a false sense of security.

The Air India crash may ultimately expose a blind spot in global aviation governance: that digital complexity is now outpacing regulatory capacity—and that certification systems, though rigorous, are still catching up.

Unanswered Questions

• Did FADEC or another system send erroneous shutdown signals?
• Were power anomalies recorded prior to the event?
• Was the switch movement a symptom of a deeper fault?
• Are current B787 systems vulnerable to simultaneous engine shutdown under specific conditions?
• Is the 2018 SAIB still relevant—or has it served to distract investigators?

Dig Deeper or Risk Missing the Real Threat

Air India Flight AI171 was operated by a capable and alert crew under normal conditions. The disaster unfolded in less than 90 seconds—leaving little room for human intervention and little doubt that the system, not the crew, failed.

If the investigation stops at the fuel switch, it risks addressing the symptom, not the cause. The real danger may lie within the aircraft’s digital logic, signal architecture, or power distribution system—hidden from sight, but devastating in impact.

The fuel switch moved to cutoff, but the real failure may have occurred upstream—in the software, power systems, or logic architecture that governs it.

The switch flipped. But the real question is—what flipped the switch?

Until that’s answered, the risk isn’t resolved—it’s just misunderstood.

Disclaimer:

This article is based on preliminary investigation reports, public records, and independent research. Team TICE is not an aviation authority or certified investigative body. The analysis presented here is journalistic in nature and intended for public interest reporting. For corrections, clarifications, or additional inputs, please contact us at editorial@tice.news.