Report on the Accident of Air India Flight 171, Boeing 787-8 (VT-ANB), Ahmedabad, India, on June 12, 2025

Report on the Accident of Air India Flight 171, Boeing 787-8 (VT-ANB), Ahmedabad, India, on June 12, 2025

(As of July 14, 2025)

Report Number: AAIB/AI-171/2025/PRELIM-ANALYSIS Issuing Authority: Senior Aviation Accident Investigator

Executive Summary

This report details the ongoing investigation into the accident involving Air India Flight 171 (AI171), a Boeing 787-8 aircraft with registration VT-ANB. On June 12, 2025, the aircraft crashed into a residential area shortly after taking off from Sardar Vallabhbhai Patel International Airport (VAAH) in Ahmedabad, India, while en route to London Gatwick Airport (EGKK), United Kingdom. The accident resulted in the deaths of all 241 persons on board, with the exception of a single passenger, and an additional 19 fatalities on the ground.   

The preliminary investigation conducted by India's Aircraft Accident Investigation Bureau (AAIB), with assistance from the U.S. National Transportation Safety Board (NTSB), has established that the proximate cause of the accident was a catastrophic loss of thrust from both General Electric GEnx-1B engines. This loss of thrust was initiated by the transition of both engine fuel control switches from the 'RUN' position to the 'CUTOFF' position approximately three seconds after the aircraft became airborne.   

Analysis of the recovered flight recorders provides the central and most critical evidence for this investigation. The flight data recorder (FDR) confirmed the timing and sequence of the fuel control switch movements and the subsequent engine shutdowns. The cockpit voice recorder (CVR) captured a crucial exchange in the moments following the event, in which one pilot asked the other why the fuel had been cut off, and the second pilot responded that he had not performed the action. This dialogue indicates a profound and immediate breakdown in the crew's shared situational awareness at the most critical phase of flight.   

This report synthesizes all factual information available as of July 14, 2025, based on the AAIB's preliminary findings and other verified data. The analysis herein explores all credible causal and contributory pathways, focusing on three primary areas of investigation:

Human Performance: A detailed examination of flight crew actions, including the potential for inadvertent control activation, cognitive errors under high workload and stress, the role of the startle effect, and a critical assessment of Crew Resource Management (CRM) effectiveness.

Aircraft Systems and Design: An analysis of the Boeing 787-8 flight deck, specifically the design, ergonomics, and safety features of the fuel control switch assembly. This includes an evaluation of potential mechanical or electronic malfunctions, in light of a 2018 Federal Aviation Administration (FAA) safety bulletin that highlighted a relevant vulnerability.   

Organizational and Regulatory Factors: An assessment of the operator's maintenance practices and the broader regulatory framework concerning mandatory versus advisory safety information.

The investigation has formally ruled out bird strike or sabotage as causal factors. It has also addressed and debunked a widely circulated but fabricated report that incorrectly attributed the accident to a pilot's seat malfunction.   

While the final report from the AAIB is pending further detailed analysis, this document provides a comprehensive examination of the available evidence. It aims to identify the key safety issues and underlying factors that culminated in this tragedy, offering conclusions and safety recommendations intended to prevent a recurrence and enhance the safety of the global aviation system.

1.0 Factual Information

This section presents the established facts of the accident as determined by the preliminary investigation conducted by the Aircraft Accident Investigation Bureau (AAIB) of India and corroborated by participating international bodies. The information is presented objectively and without analysis, in accordance with the standards and recommended practices of the International Civil Aviation Organization (ICAO) Annex 13.   

1.1 History of the Flight

Air India Flight 171 (AI171) was a scheduled international passenger flight operating from Sardar Vallabhbhai Patel International Airport (VAAH) in Ahmedabad, India, to London Gatwick Airport (EGKK) in the United Kingdom.   

On June 12, 2025, the flight crew completed pre-flight preparations and the aircraft was pushed back from the gate at 13:13 India Standard Time (IST), which corresponds to 07:43 Coordinated Universal Time (UTC). The aircraft taxied to Runway 23 and performed a backtrack procedure to utilize the full available length of the runway for takeoff.   

The aircraft was cleared for takeoff at 13:37:33 IST (08:07:33 UTC). The takeoff roll commenced at 08:07:37 UTC. The flight data recorder (FDR) indicated a normal acceleration, with the aircraft reaching its takeoff decision speed (   

V1​) of 153 knots indicated airspeed (IAS) at 08:08:33 UTC, followed by its rotation speed (Vr​) of 155 knots IAS at 08:08:35 UTC.   

The aircraft lifted off the runway at 08:08:39 UTC, as confirmed by the air/ground sensors transitioning to 'air' mode. The flight continued to accelerate, reaching a maximum recorded IAS of 180 knots at approximately 08:08:42 UTC, while at an altitude of approximately 625 feet above mean sea level.   

Immediately following the attainment of maximum airspeed, the FDR recorded a critical sequence of events. At approximately 08:08:42 UTC, the fuel control switch for Engine 1 transitioned from the 'RUN' position to the 'CUTOFF' position. Approximately one second later, the fuel control switch for Engine 2 also transitioned to 'CUTOFF'. This action immediately cut the fuel supply to both engines, and their primary rotation speed parameters (N1 and N2) began to decrease from takeoff power settings.   

With the loss of power from both engine-driven generators, the aircraft's Ram Air Turbine (RAT)—an emergency electrical power source—was observed deploying on airport closed-circuit television (CCTV) footage. Throughout this sequence, the aircraft's landing gear remained in the down position.   

At 08:09:05 UTC, a crew member transmitted a distress call, "MAYDAY, MAYDAY, MAYDAY". Air Traffic Control (ATC) attempted to acknowledge the call but received no further transmissions from the aircraft.   

The aircraft, having been airborne for a total of approximately 32 seconds, was unable to sustain flight. It maintained a wings-level, 8-degree nose-up attitude but lost altitude rapidly. At approximately 08:09:08 UTC, the aircraft impacted the hostel block of B. J. Medical College, located near the airport perimeter.   

Table 1: Timeline of Key Events

The following table provides an integrated timeline of the critical 35-second period from the start of the takeoff roll to the final impact, correlating data from the Flight Data Recorder (FDR), Cockpit Voice Recorder (CVR), and external observations.

Eksportuj do Arkuszy

Sources:   

1.2 Injuries to Persons

The accident resulted in a total of 260 fatalities and numerous injuries.

Eksportuj do Arkuszy

Sources:   

Note: The single onboard survivor was a passenger. Ground casualty figures are based on the latest available official reports. The former Chief Minister of Gujarat, Vijay Rupani, was among the passengers confirmed deceased through DNA identification.   

1.3 Damage to Aircraft

The aircraft was destroyed by impact forces and a severe post-crash fire. The wreckage was distributed across a wide debris field spanning over 1,000 feet. The aircraft's empennage, including the vertical and horizontal stabilizers, came to rest partially intact on top of a multi-storey building at the crash site.   

1.4 Other Damage

The crash caused catastrophic damage to the residential area of the Civil Hospital campus in Ahmedabad. The primary structures impacted were the doctors' quarters and the students' hostel buildings of the B. J. Medical College. The impact and subsequent fire resulted in the collapse of sections of these buildings.   

1.5 Personnel Information

The flight crew was composed of a Captain and a First Officer. The Captain served as the Pilot Monitoring (PM) for the flight, and the First Officer served as the Pilot Flying (PF).   

Table 2: Flight Crew Information

Eksportuj do Arkuszy

Sources:   

Note: Some initial reports cited lower flight hour totals for both crew members. The figures presented here are from more detailed subsequent reporting and are considered more accurate for the purposes of this analysis. Both pilots were fully licensed and certified for the operation.

1.6 Aircraft Information

Aircraft Type: Boeing 787-8 Dreamliner   

Registration: VT-ANB   

Operator: Air India   

Engines: Two General Electric (GE) GEnx-1B turbofan engines   

Airworthiness: The aircraft possessed a valid Certificate of Airworthiness at the time of the accident. A review of the aircraft's technical log revealed no open defects related to the fuel control system, engines, or associated electronics. The aircraft's total weight at takeoff was within certified limits, and it was loaded with 54,200 kg of fuel. Fuel samples taken from the refueling bowsers and from the aircraft wreckage were analyzed and found to be satisfactory and free of contamination.   

1.7 Meteorological Information

Weather conditions at Sardar Vallabhbhai Patel International Airport at the time of the accident were conducive to flight operations and were not considered a factor in the accident.

METAR: The official METAR (Meteorological Aerodrome Report) for VAAH around the time of the accident was consistent with the following: VAAH 120800Z 23006KT 6000 NSC 43/28 Q1005 NOSIG.   

Decoded: Observation for VAAH on the 12th day of the month at 08:00 UTC. Wind from 230 degrees at 6 knots. Visibility 6,000 meters (6 km). No Significant Cloud. Temperature 43°C, Dew Point 28°C. Altimeter setting 1005 hectopascals. No significant change expected in the next two hours.

Conditions: The conditions were characterized by light surface winds, good visibility, and high ambient temperature, which is typical for Ahmedabad in June. There was no precipitation, turbulence, or wind shear reported or forecast.   

1.8 Wreckage and Impact Information

The examination of the wreckage provided key information regarding the state of the aircraft's controls at the time of impact.

Flight Deck Controls: The preliminary report from the AAIB noted that post-crash, the thrust levers were found in the idle position. The flap lever and landing gear lever were found in their respective standard takeoff positions. The fuel control switches were found in the 'RUN' position, which, when correlated with the FDR data, indicates they were moved from 'CUTOFF' back to 'RUN' by the crew during the accident sequence in an attempt to relight the engines.   

1.9 Flight Recorders

The aircraft was equipped with two L3Harris Technologies Enhanced Airborne Flight Recorders (EAFRs), which combine the functions of a Cockpit Voice Recorder (CVR) and a Flight Data Recorder (FDR) into a single crash-survivable unit.

Recovery and Data Extraction: The forward EAFR was recovered from the wreckage in good condition. The aft EAFR sustained substantial damage and its data could not be recovered through conventional means. On June 24, 2025, the Crash Protected Memory (CPM) module was retrieved from the forward EAFR and its data was successfully downloaded at the AAIB laboratory in New Delhi using a specialized 'Golden Chassis' unit.   

Data Recovered: The download yielded approximately 49 hours of flight data, covering six flights including the accident flight. Two hours of high-quality cockpit audio were also recovered, which captured the entirety of the accident sequence.   

Key CVR Transcript Excerpt: The AAIB's preliminary report released a single, verbatim excerpt from the CVR that is central to the investigation. Following the engine shutdown, the recording captured the following exchange between the two pilots:

"One of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so."   

This exchange occurred in the seconds immediately following the recorded movement of the fuel control switches.

1.10 Aircraft Maintenance Records

A review of the maintenance history for VT-ANB revealed several pertinent items related to the systems under investigation.

Throttle Control Module (TCM): The TCM is the assembly on the center pedestal that houses the thrust levers and the fuel control switches. Maintenance records confirm that the TCM on the accident aircraft was replaced twice during its service life: once in 2019 and again in 2023. These replacements were scheduled maintenance actions performed in accordance with Boeing's Maintenance Planning Document (MPD), which mandates replacement every 24,000 flight hours, and were not prompted by any reported defect or malfunction of the fuel control switches.   

FAA Special Airworthiness Information Bulletin (SAIB) NM-18-33: In December 2018, the U.S. Federal Aviation Administration issued this SAIB concerning several Boeing models, including the 787. The bulletin highlighted a "potential for disengagement of the fuel control switch locking feature". The SAIB explained that if the locking feature—a mechanism requiring the pilot to lift the switch before moving it—were to become disengaged, the switch could be moved directly between 'RUN' and 'CUTOFF', exposing it to the risk of "inadvertent operation" that could result in an "unintended in-flight engine shutdown".   

Operator Compliance with SAIB: The SAIB recommended a one-time inspection of the switch locking feature. Air India confirmed to the AAIB that these inspections were not performed on its 787 fleet, including VT-ANB, on the basis that the SAIB was an advisory document and not a mandatory Airworthiness Directive (AD).   

FAA/GE Engine Control Unit Bulletin (2021): A separate technical alert, Service Bulletin FAA-2021-0273-0013, was issued jointly by the FAA and engine manufacturer General Electric in 2021. This bulletin recommended the replacement of the "MN4 microprocessor on the ECU" (Electronic Control Unit) for the GEnx engine. The bulletin stated this was to address a condition related to thermal cycle fatigue in the microprocessor's solder ball connections, which could lead to intermittent electrical connections and potential engine control faults. The applicability and status of this bulletin with respect to the accident aircraft's engines remain under review by the investigation.   

2.0 Analysis

This section of the report transitions from the presentation of factual information to the analysis of that information. The objective is to determine how and why the accident occurred by systematically evaluating the evidence related to human performance, aircraft systems, and organizational factors. The analysis is guided by the central, established fact of the accident sequence: the uncommanded and near-simultaneous shutdown of both engines during the most critical phase of flight, initiated by the movement of the fuel control switches to the 'CUTOFF' position.

2.1 Introduction to the Analysis

The core analytical challenge of the AI171 accident is to reconcile the physical evidence from the Flight Data Recorder (FDR) with the verbal evidence from the Cockpit Voice Recorder (CVR). The FDR definitively shows that both fuel control switches were moved from 'RUN' to 'CUTOFF' three seconds after liftoff, an action that is fundamentally contrary to every established procedure, training protocol, and principle of airmanship for the takeoff phase. The CVR, in turn, captures the pilots' immediate and mutual denial of having performed this catastrophic action.   

This paradox—an action that must have been performed by a human operator, yet which both human operators denied performing—precludes a simple explanation. It necessitates a multi-faceted analysis that moves beyond assigning blame to explore the complex interplay between the human, the machine, and the operational environment. This analysis will therefore proceed by examining three primary pillars of accident causation:

The Machine: The design and integrity of the Boeing 787's fuel control system.

The Human: The performance of the flight crew, evaluated through the lens of established human factors science.

The System: The broader organizational and regulatory context in which the crew and aircraft operated.

The analysis will deconstruct the rapid 32-second sequence from liftoff to impact to identify all plausible causal chains and contributing factors that could explain the initial switch movement and the crew's subsequent inability to recover the aircraft.

2.2 The Fuel Control Switch Event: A Technical Examination

The precipitating event of this accident was the transition of the two engine fuel control switches. Understanding the design and function of this system is therefore fundamental to the analysis.

2.2.1 Boeing 787 Fuel Control Switch Design and Philosophy

The fuel control switches on the Boeing 787-8 are located on the cockpit's center pedestal, directly aft of the thrust levers. This location places them within the primary workspace of the flight crew. The design incorporates several layers of protection intended to prevent inadvertent activation, reflecting their critical nature.   

First, the switches are recessed and protected by surrounding physical guards or brackets, making accidental contact from a dropped object or a sweeping hand motion less likely. Second, and more importantly, the switches employ a two-action "lift-then-move" mechanism. To transition a switch from 'RUN' to 'CUTOFF', an operator must deliberately pull the switch toggle upward against a spring-loaded lock before moving it aft into the 'CUTOFF' position. This design ensures that the action is intentional and requires a distinct, two-part physical motion, unlike a simple flick switch.   

This design is part of a broader "quiet/dark cockpit" philosophy employed in modern airliners like the Boeing 787. This philosophy dictates that when all systems are operating normally, there are no illuminated annunciator lights in the crew's primary field of view. A dark panel signifies a healthy aircraft. While this reduces visual clutter and cognitive load during normal operations, it places a heavy reliance on the crew's ability to promptly detect and interpret new annunciations when an abnormal condition arises. If a system's state were to change without a corresponding salient visual or aural alert, it could lead to a critical delay in crew awareness.   

2.2.2 The Significance of the Activation Sequence

The FDR data indicates that the two switches were moved to 'CUTOFF' sequentially, with a time gap of approximately one second between the two actions. This timing is highly significant and provides a crucial clue as to the nature of the event.   

A purely accidental physical event, such as a hand spasm or an object falling on the console, would be unlikely to produce such a rhythmically consistent, two-part action. Such an event would more plausibly result in a near-simultaneous activation of both switches or a more random, uncontrolled contact. Conversely, a deliberate act of sabotage by a pilot intending to crash the aircraft would likely be executed with rapid, decisive finality, though the timing could vary.

The recorded one-second interval—action one, pause, action two—is more characteristic of a learned and practiced motor program being executed. In aviation, pilots develop "muscle memory" for many sequential cockpit tasks, such as configuring flaps, retracting landing gear, or performing shutdown procedures on the ground. These sequences become semi-automatic. This suggests that the activation of the fuel switches may not have been a simple physical slip, but rather a cognitive slip or "capture error." In a moment of high stress, distraction, or startle during the takeoff phase, a pilot intending to perform one two-part sequential action may have erroneously executed the deeply ingrained, but contextually catastrophic, motor program for shutting down the engines. This possibility shifts the analytical focus away from simple clumsiness or malice and toward the more complex domains of human cognitive psychology, procedural design, and the human-machine interface.

2.3 Human Performance Analysis

With no evidence of a command-level electronic malfunction that could have moved the switches automatically, the investigation must presume that the action was performed by one of the pilots. The analysis therefore centers on why a highly trained pilot would perform such an action. The vehement denials of pilot suicide by pilot associations, coupled with the crew's attempt to relight the engines, make a deliberate act of self-harm an extremely low-probability scenario that is inconsistent with the available evidence. The analysis will therefore focus on more plausible scenarios rooted in established principles of human error. Research indicates that human factors are a primary cause in over 60% of aviation accidents, with cognitive processes such as attention, memory, and decision-making being inherently vulnerable under adverse conditions.   

2.3.1 Scenario 1: Inadvertent Action due to Slip, Lapse, or Startle

This scenario posits that the switch movement was unintentional, resulting from a cognitive or ergonomic failure.

Ergonomic Considerations and Physical Slip: The proximity of the fuel control switches to other controls used during the initial climb, such as the landing gear and flap levers, creates a potential for ergonomic confusion. While the "lift-then-move" design provides significant protection, it is conceivable that a pilot's hand, moving toward the gear or flap lever under high workload, could have misplaced and inadvertently performed the two-step action on the fuel switches instead. However, this would require a significant misplacement of the hand and a failure to notice the tactile difference between the controls.

Cognitive Slip (Capture Error): A more probable scenario involves a cognitive slip, as discussed in Section 2.2.2. A "capture error" occurs when a frequently performed action sequence "captures" a less frequent one due to shared initial steps or cues. The motor sequence for shutting down the engines is practiced repeatedly on the ground at the end of every flight. It is possible that a cue during the takeoff—a specific sound, a thought process, or a distraction—inappropriately triggered this well-practiced shutdown sequence instead of the intended takeoff/climb sequence.   

Startle Effect and Action Bias: The takeoff and initial climb is a period of high workload and sensory input. An unexpected event—even a minor one not significant enough to be recorded by the FDR, such as a loud bang, a perceived vibration, or a flash of light—could have induced a "startle response" in one of the pilots. Startle is an automatic reflex that can temporarily impair cognitive function and create a powerful "bias for action," where the individual acts before fully diagnosing the situation. The activation of the fuel switches could have been an inappropriate, pre-cognitive response to a startling event. The subsequent CVR exchange ("Why did you cutoff?" / "I did not do so") is highly consistent with this hypothesis. The pilot who performed the action, having done so non-consciously under the influence of startle, would have no immediate memory of the intention to do so and would therefore genuinely deny it. The other pilot, observing the consequences (engine parameters decreasing), would be left to question an action that seemingly had no agent.   

2.3.2 Scenario 2: Breakdown in Crew Resource Management (CRM)

Crew Resource Management (CRM) is the system by which flight crews use all available resources—people, procedures, and equipment—to ensure safe operations. It is built on the pillars of communication, situational awareness, and teamwork. The evidence from AI171 points to a catastrophic failure of CRM in the seconds surrounding the engine shutdown.   

The CVR exchange is not merely evidence of confusion; it is evidence of a complete and instantaneous failure of the core "monitoring and cross-checking" function that is the bedrock of multi-crew operations. In a properly functioning crew, actions are verbalized, monitored, and confirmed. The sequence should be: Intention -> Verbalization -> Action -> Monitoring -> Confirmation. The data from AI171 shows that this loop was entirely bypassed. There was no verbalization of an intent to move the switches. The action was taken, and the monitoring pilot only detected the consequence (loss of thrust) after the fact, leading to a questioning challenge rather than a preventative one.

This breakdown in shared situational awareness is stark. At the most critical moment of the flight, the two pilots possessed fundamentally different mental models of the aircraft's state and of each other's actions. The Pilot Flying (PF), the First Officer, was responsible for aircraft control, while the Pilot Monitoring (PM), the Captain, was responsible for monitoring systems and the PF's actions. The PM's question implies he observed the system state change and immediately attributed it to an action by the PF. The PF's denial reveals a total disconnect.

The significant experience gradient between the Captain (over 15,000 hours) and the First Officer (approximately 3,400 hours) is a relevant factor. While not inherently unsafe, a steep authority gradient can sometimes inhibit communication or lead to assumptions. In this case, it appears the critical failure was not a lack of assertiveness, but a fundamental breakdown in the procedural framework of monitoring that should transcend any experience gap.   

2.3.3 Scenario 3: Misapplication of Emergency Procedure

This scenario presents a compelling, albeit deeply concerning, explanation that unifies the FDR and CVR data. It posits that the crew's actions were not a random slip but were driven by the incorrect application of a memorized emergency procedure.

The "Dual Engine Failure/Stall" memory item checklist for the Boeing 787 reportedly contains the step: "FUEL CONTROL switches... both CUTOFF, then RUN". This procedure is designed for a high-altitude dual-engine flameout, where cycling the switches is part of the engine relight process. Attempting this procedure at very low altitude immediately after takeoff would be catastrophic, as there is insufficient time and altitude for the engines to spool back up, a process that can take between 30 and 45 seconds from a dead stop.   

The actions recorded on the AI171 FDR are paradoxically consistent with this checklist. The switches were moved to 'CUTOFF', and then, after a delay of 10 to 14 seconds, they were moved back to 'RUN', triggering an engine relight sequence that was ultimately unsuccessful for Engine 2 and came too late for Engine 1.   

This suggests a plausible, though tragic, sequence of events:

Immediately after liftoff, the crew experienced an event that they perceived as a sudden, catastrophic dual-engine failure. This could have been a real, unrecorded anomaly or a powerful illusion caused by a startle effect.

Under extreme time pressure and stress, the crew may have latched onto the only memorized procedure they knew for that specific condition: the dual-engine failure checklist.

One pilot initiated the first step of the memory item: moving the fuel switches to 'CUTOFF'.

The other pilot, not yet on the same page or recognizing the contextual inappropriateness of the action, issued the challenge recorded on the CVR: "Why did you cutoff?"

Despite the confusion, the procedure was continued, with the switches being moved back to 'RUN' in a desperate attempt to relight the engines.

This hypothesis reframes the accident from an inexplicable, random error to a procedurally-driven mistake made under extreme duress. It shifts the focus of the investigation toward the design of emergency procedures, the effectiveness of pilot training for rare, time-critical events, and the psychology of decision-making under startle conditions.

2.4 Aircraft Systems and Maintenance Analysis

While human performance appears to be the most likely area of causation, the possibility of a technical failure contributing to or initiating the event cannot be dismissed. The investigation into the aircraft's systems centers on the integrity of the fuel control switches themselves.

2.4.1 Fuel Control Switch Integrity and SAIB NM-18-33

The most significant piece of technical evidence is the 2018 FAA Special Airworthiness Information Bulletin (SAIB) NM-18-33. This document represents a formal acknowledgment by the regulator of a specific vulnerability in the fuel control switch design. The SAIB explicitly warned that the switch's locking feature could become disengaged, which would permit the switch to be moved between 'RUN' and 'CUTOFF' without the required "lift-then-move" action. The bulletin further stated that this condition exposed the switch to "the potential of inadvertent operation," which could lead to an "unintended in-flight engine shutdown".   

The scenario described in the 2018 SAIB aligns precisely with a potential pathway to the AI171 accident. If the locking mechanism on the accident aircraft's switches was disengaged, the level of protection against an inadvertent slip would have been significantly reduced. A much less deliberate hand motion could have been sufficient to move the switches.

This leads to a fundamental contradiction at the heart of the technical investigation. Before the accident, the FAA identified a specific failure mode with a catastrophic potential outcome. However, because it was issued as an advisory SAIB and not a mandatory Airworthiness Directive (AD), operators like Air India were not required to perform the recommended inspections and could, and did, choose not to. After the accident, in July 2025, the FAA and Boeing privately communicated to airlines that they did not consider the switch design to represent an "unsafe condition" that would warrant an AD.   

This post-crash assertion is difficult to reconcile with the pre-crash warning and the facts of the accident. It implies either that the investigation has privately and definitively ruled out this failure mode, or that the regulator considers the risk of a 260-fatality accident to be "acceptable" within its risk management framework. This apparent discrepancy elevates the analysis from a question of simple component failure to a systemic question about how non-mandatory safety information is promulgated, valued, and acted upon by regulators and operators across the industry. It raises the critical issue of whether a known potential hazard with catastrophic consequences should ever be addressed with non-mandatory guidance.

2.4.2 Other Technical Considerations

The investigation is also reviewing other potential technical factors. The 2021 FAA/GE bulletin regarding a potential fault in the engine's Electronic Control Unit (ECU) microprocessor is being examined to determine if a cascading electronic failure could have contributed to the event. However, given the physical, mechanical nature of the fuel control switches, a scenario where an electronic fault directly caused their movement is considered less likely than a failure of the switch mechanism itself or a human-initiated action. The "more electric" architecture of the Boeing 787, with its highly integrated Common Core System (CCS), means that complex, unforeseen failure interactions are a possibility that must be thoroughly investigated, although no evidence currently points in this direction.   

2.5 Comparative Analysis: The LATAM Airlines Flight 800 Incident

To provide broader context to the investigation, it is useful to compare the AI171 accident with another recent, significant incident involving a Boeing 787 flight deck: LATAM Airlines Flight 800. This analysis also serves to formally address and debunk a viral hoax report that conflated the two events. The detailed debunking of this hoax, which falsely claimed a pilot's seat malfunction caused the AI171 crash by pulling the throttles to idle, is contained in Appendix C of this report.   

The real LATAM 800 incident occurred on March 11, 2024. A Boeing 787-9 experienced a sudden, severe, uncommanded pitch-down maneuver during cruise flight, causing injuries to 50 occupants. The preliminary investigation by Chilean authorities has focused on the "involuntary movement forward" of the captain's seat. The leading hypothesis is that a switch on the rear of the motorized pilot's seat was inadvertently activated, possibly by a cabin crew member serving a meal, which pushed the pilot and his seat forward into the control column, causing the aircraft to dive.   

While the specific mechanisms of the AI171 and LATAM 800 events are different—one involves fuel switches on the center console, the other involves seat movement switches on the seat back—they share a disturbing common theme. Both incidents highlight a potential systemic vulnerability in the highly integrated and complex flight deck of the Boeing 787: the proximity of critical controls to potential sources of inadvertent activation through plausible, if rare, human actions and movements.

In the case of AI171, the hypothesized agent is the flight crew's own hand movement within their primary workspace. In the case of LATAM 800, the hypothesized agent is a cabin crew member interacting with the flight deck environment. Together, these events form a pattern. They suggest that the aircraft's human-machine interface (HMI), while technologically advanced, may contain latent ergonomic hazards. They raise the question of whether the design adequately accounts for the full range of human interaction and potential for error within the confined and critical space of the cockpit. This shifts the analysis from the failure of a single component to a broader evaluation of Boeing's HMI design philosophy and its effectiveness in mitigating human error.   

3.0 Conclusions

Based on the factual information gathered and the comprehensive analysis conducted as of July 14, 2025, the investigation has reached the following conclusions. These conclusions are based on the AAIB's preliminary report and all available evidence; the final determination of cause is pending the completion of the full investigation.

3.1 Findings

The aircraft, Air India Flight 171 (VT-ANB), was certified, equipped, and maintained in accordance with existing regulations and was airworthy for the accident flight.

The flight crew was properly licensed and qualified for the flight in accordance with regulatory requirements.

The weather at the time of takeoff was not a factor in the accident.

There was no evidence of sabotage, bird strike, or pre-impact fire or explosion.

The takeoff roll, rotation, and initial liftoff were normal.

Approximately three seconds after liftoff, at an airspeed of 180 knots, the fuel control switches for both Engine 1 and Engine 2 were moved from the 'RUN' to the 'CUTOFF' position.

The movement of the switches was sequential, with a time gap of approximately one second between the two activations.

The movement of the switches to 'CUTOFF' resulted in the shutdown of both engines and a total loss of thrust.

The Cockpit Voice Recorder (CVR) captured an immediate exchange in which one pilot questioned the other about the fuel cutoff, and the other pilot denied having performed the action, indicating a complete breakdown of shared situational awareness.

The design of the fuel control switches incorporates a two-action "lift-then-move" safety mechanism to prevent inadvertent operation.

In December 2018, the U.S. FAA issued Special Airworthiness Information Bulletin (SAIB) NM-18-33, which warned that the locking feature of these switches could become disengaged, creating a risk of inadvertent operation and in-flight engine shutdown.

The operator, Air India, had not performed the optional inspections recommended in SAIB NM-18-33 on the accident aircraft, as the bulletin was not mandatory.

Approximately 10 to 14 seconds after the initial shutdown, the flight crew moved the fuel control switches back to the 'RUN' position in an attempt to relight the engines.

The engine relight attempt was unsuccessful in the time available due to the aircraft's low altitude and airspeed.

The actions of the flight crew (moving switches to CUTOFF, then back to RUN) are consistent with the misapplication of the "Dual Engine Failure/Stall" memory item checklist, a procedure intended for high-altitude recovery and not for the takeoff phase of flight.

The accident was not survivable due to the low altitude at which the loss of power occurred and the subsequent impact with terrain.

3.2 Probable Cause(s) (as of July 14, 2025)

The Aircraft Accident Investigation Bureau of India is continuing its investigation. Based on the evidence available to date, the probable cause of this accident was a loss of control and impact with terrain resulting from a total loss of engine thrust immediately after takeoff.

The loss of thrust was a direct consequence of the transition of both engine fuel control switches to the 'CUTOFF' position by a member of the flight crew.

Contributing to the accident were:

A severe breakdown in crew resource management and monitoring, which failed to prevent the initial erroneous action and inhibited a coordinated response.

The potential misapplication of an emergency procedure under conditions of extreme stress and startle, leading the crew to take an action that was catastrophic at low altitude.

Potential latent ergonomic vulnerabilities in the flight deck design, specifically concerning the protection of critical switches from inadvertent activation during a high-workload phase of flight.

A systemic failure in the aviation safety ecosystem's handling of risk, wherein a known vulnerability with catastrophic potential, identified in a manufacturer/regulator safety bulletin, was not addressed by a mandatory corrective action, leaving the final decision to operator discretion.

4.0 Safety Recommendations

As a result of this investigation, and to prevent the recurrence of a similar accident, the following safety recommendations are issued as of July 14, 2025.

To the Federal Aviation Administration (FAA) and other National Airworthiness Authorities (e.g., EASA):

SR-2025-01: Immediately review the criteria for the issuance of mandatory Airworthiness Directives (ADs) versus advisory Special Airworthiness Information Bulletins (SAIBs). This review should establish a clear threshold requiring mandatory action for any identified single-point or common-mode failure that carries a credible risk of a catastrophic outcome, such as a dual-engine shutdown.   

SR-2025-02: Mandate a comprehensive ergonomic and human factors review of the Boeing 787 flight deck, with a specific focus on the design, location, and protection of all switches critical to flight safety (including, but not limited to, the fuel control switches and pilot seat movement controls). This review must assess the risk of inadvertent activation under all foreseeable operational scenarios, including high workload and crew interaction.   

To The Boeing Company:

SR-2025-03: Develop and make available a modification for the Boeing 787 fuel control switch assembly. This modification should provide enhanced physical protection beyond the current design and/or incorporate a time-delayed software logic gate to prevent in-flight activation of both switches to 'CUTOFF' below a specified safe altitude, except in case of a confirmed engine fire.   

SR-2025-04: Review and amend the "Dual Engine Failure/Stall" checklist and associated training materials for the Boeing 787. The procedure must be bifurcated to provide clear, distinct, and unambiguous memory items for high-altitude versus low-altitude (e.g., below 1,000 feet AGL) scenarios, with a strong emphasis on the inadvisability of cycling the fuel switches during takeoff or initial climb.   

To Air India and all Operators of Boeing 787 Aircraft:

SR-2025-05: Immediately implement a policy for the mandatory review and risk assessment of all non-mandatory safety bulletins (e.g., SAIBs, Service Letters) issued by manufacturers and regulators, with a documented process for justifying decisions on implementation.   

SR-2025-06: Incorporate specific, high-fidelity simulator training scenarios into recurrent pilot training programs that focus on managing the startle effect and responding to unexpected, catastrophic failures during the takeoff and initial climb phases. These scenarios should be designed to test and reinforce correct procedural application under extreme time pressure.   

To all Pilot Training and Air Carrier Training Organizations:

SR-2025-07: Enhance Crew Resource Management (CRM) training to include specific modules on managing steep authority/experience gradients within the flight crew. Training should emphasize techniques for maintaining effective communication, challenge-and-response protocols, and collaborative decision-making during high-stress, time-critical events, ensuring that procedural adherence does not break down under pressure.   

Appendices

Appendix A: Cockpit Voice Recorder Transcript (Relevant Excerpt)

The following is a partial transcript of the key communications recorded by the CVR in the final moments of the flight, correlated with UTC time from the FDR. The transcript begins just after the aircraft has lifted off. (CAM = Cockpit Area Microphone, RDO = Radio Transmission, CPT = Captain, FO = First Officer).

Eksportuj do Arkuszy

Sources:   

Appendix B: Key Flight Data Recorder Parameters

A full analysis of the FDR data is ongoing. However, a graphical representation of the key parameters during the 32-second flight duration would plot the following against a common timeline (Time in UTC seconds from 08:08:39):

Indicated Airspeed (IAS) in Knots: Showing a rise to 180 knots, followed by a rapid decay.

Altitude (Radio Altimeter) in Feet AGL: Showing a brief climb to approximately 200 feet, followed by a continuous descent to zero.

Engine 1 and Engine 2 N1 (%) (Fan Speed): Showing both engines at takeoff thrust (e.g., ~95-100%) until 08:08:42, followed by a rapid, near-simultaneous decrease toward zero, a brief partial recovery in Engine 1, and then continued decay.

Fuel Control Switch Position (Discrete): A binary plot showing both switches in the 'RUN' position until 08:08:42, transitioning to 'CUTOFF', and then returning to 'RUN' at 08:08:56 (Engine 1) and 08:09:00 (Engine 2).

This visual representation confirms the sequence of events: a normal takeoff, followed by a sudden, commanded dual-engine shutdown, a brief and failed recovery attempt, and an inevitable aerodynamic stall and impact.

Appendix C: Analysis and Debunking of Hoax "Seat Malfunction" Report

Shortly after the accident, a fraudulent document purporting to be a preliminary report from the AAIB circulated online. This document falsely attributed the crash to a pilot's seat malfunction. This appendix formally debunks the claims of that hoax report by contrasting them with verified facts from the official investigation and details from a separate, unrelated incident involving LATAM Airlines Flight 800, from which the hoax drew inspiration.

The dissemination of such misinformation is a serious disservice to the investigation and the families of the victims. All stakeholders should rely exclusively on information from official investigative bodies.