Aviate, Navigate, Communicate is the golden rule that gives pilots a clear order of priorities during a flight emergency. After ensuring the aircraft’s stability, they consult an emergency checklist. This process begins with immediate, memorized actions, followed by the structured steps of a checklist for the specific emergency. This checklist acts as a crucial safety net, mitigating human errors that can arise from fatigue, stress, or distractions among the crew.
Under the International Civil Aviation Organization (ICAO) rules, the sole objective of the investigation of an Accident/Incident is the prevention of accidents and incidents, and not apportioning blame or liability. The purpose of the final report is to issue safety recommendations, and educate the global aviation community. Technical details must be disseminated in language appropriate to each stakeholder group, including safety investigators, civil aviation authorities, aircraft manufacturers, airlines, and pilots. These reports are also intended for the public, the media, and victims’ families to provide factual information and improve industry-wide safety. Is there an agency that is responsible for ensuring that recommendations are acted on, investigators and pilots educated, and airline checklists updated as needed?
The Aviate, Navigate, Communicate framework needs the addition of Educate, which ensures that critical insights gained from final reports are effectively implemented. To achieve ICAO’s safety objectives, it is essential that final report recommendations are diligently followed through, learnings shared across the global aviation community, and this vital feedback integrated back into the ANC process.
Dual engine failures are rare, but they do happen. On these rare occasions, there is a specific dual engine failure checklist that pilots are trained to follow. We look at dual engine failure incidents and accidents, final reports, pilot responses during emergencies, and see if we can identify a pattern that connects them all.
US Airways Flight 1549
On January 15, 2009, about 100 seconds after takeoff from New York City’s LaGuardia Airport, US Airways Flight 1549, an Airbus A320, engines were hit by a flock of Canada geese. The repeated thumps of geese smashing into the engines were followed by eerie silence as both engines shut down. Neither Captain Chesley “Sully” Sullenberger nor First Officer Jeffrey Skiles had initiated the shutdown. The pilots would land the plane in the Hudson River with zero fatalities.
The NTSB released a preliminary report on February 12, 2009, followed by multiple interim statements. The final report was adopted and publicly released on September 14, 2010, officially citing bird strikes and the crew’s actions.
The NTSB Aircraft Accident Final Report for Flight 1549 [1] is publicly available and provides insightful details on pilot actions when faced with a dual engine shutdown. The NTSB issued 35 safety recommendations targeting structural upgrades to engines, low-altitude dual engine failure checklists, and enhanced passenger cabin water survivability. In the final report’s 213 pages, there were a few paragraphs that did not get adequate scrutiny or the needed attention. These passages are key to our understanding of pilot action in the event of encountering a dual engine failure.
Page 55 describes the pilots’ attempt to relight the engines. From page 55,
FDR data indicated that both thrust levers were set to the idle position at 1528:01, about 50 seconds after the bird encounter. The N1 and N2 speeds for the left engine both decreased while the speeds for the right engine did not respond. About 30 seconds later, the right engine master switch was moved to the OFF position.⁹⁵
⁹⁵ The engine master switch position is not recorded by the FDR; however, the engine master switch position was derived indirectly by noting the position of the high-pressure fuel valve.
Multiple attempts were made to relight the engines, but all attempts failed despite the Auxiliary Power Unit (APU) being switched on. From the reading of the NTSB report and the footnotes, we will make five assertions.
Assertion 1 (Fuel Valve vs Fuel Switch) – The Flight Data Recorder (FDR) records the position of the fuel valve and not the position of the fuel control switch in the cockpit (Footnote 95, page 55 NTSB report [1]).
Assertion 2 (Cockpit-initiated vs FADEC-initiated) – The FDR data cannot distinguish between a fuel shutoff initiated by the Full Authority Digital Engine Control (FADEC) and a cockpit-initiated fuel shutoff. The only way to disambiguate is to check the Cockpit Voice Recorder (CVR) for corresponding fuel control switch movement clicks. If clicks are audible in the CVR, the fuel shutoff was initiated from the cockpit; otherwise, it was initiated by the FADEC.
Assertion 3 (Fuel Switch Position) – If the FADEC initiates a shutoff, the fuel valves will close, and the fuel control switch in the cockpit will remain in the ON (RUN on Boeing aircraft) position. An engine-restart attempt from the cockpit will require the switch to be moved to OFF (CUTOFF on Boeing aircraft) and then back to ON (RUN on Boeing aircraft).
Assertion 4 (APU-assisted Restart) – If the FADEC initiates a shutdown when it detects a damaged engine, the engine cannot be restarted from the cockpit by moving the fuel control switch to OFF (CUTOFF on Boeing aircraft) and then to ON (RUN on Boeing aircraft). The FADEC will ignore the restart command. This is usually the second step in a dual-engine failure checklist in the Quick Reference Handbook (QRH) for relighting an engine. The first step is to ensure that the Air-Driven Generator (RAT) and the Auxiliary Power Unit (APU) have been switched on.
Assertion 5 (Windmill Restart) – The dual-engine failure checklist in the QRH includes steps for a windmill restart. The windmill restart is an option only if the aircraft is flying at a high altitude. If the FADEC had initiated the shutdown on detecting engine damage, a windmill restart will also fail to relight the engine.
On January 17, 2019, ANA flight NH-985, a Boeing 787, suffered a dual engine shutdown while landing at Osaka Itami Airport. The pilots deployed thrust reversers after touchdown to slow the aircraft and shortly thereafter noticed that the engines had shut down. The aircraft rolled down the runway and came to a stop, but the pilots were unable to restart the engines, and the plane had to be towed.
The root cause was attributed to the Thrust Control Malfunction Accommodation (TCMA) system in the FADEC being activated as the reverse thrusters were deployed before the aircraft Weight on Wheels (WoW) sensors had transitioned to ground mode. Pilots were advised to delay deploying thrust reversers on landing.
The investigation focused on the reason for the engine shutdown; what was overlooked was the reason for the engine restart failure. Assertion 4 says that cockpit-initiated restarts will fail when the FADEC initiates an engine shutdown. The root cause of the failure to restart engines on US Airways 1549, an Airbus A320, and ANA NH-985, a Boeing 787, was the same. An engine marked as ‘compromised’ by FADEC cannot be restarted from the cockpit, and requires a manual engine reset.
Jeju Air Flight 2216
On December 29, 2024, Jeju Air Flight 2216, a Boeing 737-800, was approaching Muan International Airport, South Korea, when a bird strike occurred with both engines ingesting birds. The pilots issued a mayday alert, performed a go-around, and on the second landing attempt, the landing gear failed to deploy. The airplane belly-landed, overran the runway at high speed, crashing into a concrete structure. Only two cabin crew members who were seated at the rear of the plane survived.
South Korea’s Aviation and Railways Accident Investigation Board (ARAIB) released a preliminary report on January 27, 2025 [2]. In July 2025, South Korean media reported that the crew mistakenly turned off the relatively unscathed left engine rather than the badly damaged right engine. The preliminary assessment stated that after a severe bird strike critically damaged the right engine, the pilot may have mistakenly shut down the functioning left engine while following emergency procedures. Some experts opined that thrust reversers could have slowed down the plane on the runway. A government-commissioned report using computer simulations concluded that all passengers would have survived if the concrete structure beyond the runway had been constructed of frangible materials.
From the US Airways 1549 precedent, once the engines were shut down by FADEC, restarting any functioning engine from the cockpit was not an option (Assertion 4). With the engines shut down, the thrust reverser would not have worked to slow the plane on landing. The pilots were executing the ANC playbook. It was not the pilots at fault. It was the playbook.
China Eastern Flight MU5735
On March 21, 2022, Flight MU5735, a Boeing 737, from Kunming was cruising at 29,100 feet, and was about 100 miles from its destination in Guangzhou, when fuel to the engines was shut off, and it went into a steep dive. A minute and 52 seconds later, it crashed into a mountain in the remote Guangxi region. There were no survivors.
The Civil Aviation Authority of China (CAAC) published a preliminary report on April 20, 2022. It was followed by interim reports in 2023 and 2024. No further updates were provided, and CAAC has not published a final accident report. The CAAC stated that no faults were found in the aircraft’s systems, structures, or engines. In May 2026, NTSB released the FDR information [3] in response to a request for information filed by a Chinese citizen under the Freedom of Information Act. The CVR audio files were handed over to CAAC and not made public.
Flight MU5735 was at a high altitude when its engines shut off. US Airways 1549 and Jeju Air 2216 were at much lower altitudes. Pilot training methods for dual engine failures at low altitudes focus on minimizing altitude loss. At higher altitudes, pilot training methods recognize other recovery techniques, including windmilling.
On October 14, 2004, Pinnacle Airlines Flight 3701, a Bombardier CRJ200, crashed while attempting an emergency landing at Jefferson City Memorial Airport in Missouri. Flight 3701 was a repositioning flight with only two pilots on board. The pilots intentionally deviated from standard operating procedures and aggressively maneuvered the aircraft to 41,000 feet. At 41,000 feet, both engines flamed out. The pilots followed the high-altitude dual engine failure checklist to relight the engines.
Four APU-assisted engine restarts were attempted, but the N2 speed for both engines remained at zero throughout the restarts. The double engine failure checklist also required pilots to use the windmill restart procedure if the airplane were at an altitude between 21,000 feet and 13,000 feet. The windmill restart required the plane to dive, attain an airspeed of at least 300 knots and an N2 indication of 12%, before attempting the relight.
On page 70 of the final report [4], in the section Conclusions, it is listed that –
The captain did not take the necessary steps to ensure that the first officer achieved the 300-knot or greater airspeed required for the windmill engine restart procedure and then did not demonstrate command authority by taking control of the airplane and accelerating it to at least 300 knots.
Despite their four auxiliary power unit-assisted engine restart attempts, the pilots were unable to restart the engines because their cores had locked. Without core rotation, recovery from the double engine failure was not possible.
The FADEC had initiated the engine shutdown. By Assertion 4, APU-assisted restart will not work when the shutdown is FADEC-initiated. By Assertion 5, the windmill engine restart procedure will also fail, not because the cores had locked, but because the FADEC had initiated the shutdown.
As a result of the investigation, the NTSB Safety Board issued the following recommendation to the FAA on November 20, 2006.
For airplanes equipped with CF34-1 or CF34-3 engines, require manufacturers to perform high power, high altitude sudden engine shutdowns; determine the minimum airspeed required to maintain sufficient core rotation; and demonstrate that all methods of in-flight restart can be accomplished when this airspeed is maintained. (A-06-70)
The recommendation does not specify the nature of the high altitude sudden engine shutdown to be tested. Flight 3701 engine shutdown was FADEC-initiated. In-flight restart testing involves cockpit-initiated engine shutdowns. Assertion 4 and Assertion 5 show that results from the restart testing of a cockpit-initiated engine shutdown cannot be applied to a FADEC-initiated shutdown. The test case recommended by the NTSB Safety Board does not reflect the reality of what happened.
The parallels between Pinnacle Airlines Flight 3701 and China Eastern Flight MU5735 make it possible to draw inferences. In the absence of CVR confirmation (Assertion 2), it cannot be determined whether the fuel shutoff was initiated by a pilot or because of an external event that caused FADEC to initiate the shutdown. The FDR data shows the aircraft going into a dive and increasing airspeed. This is exactly what the QRH recommends in its dual engine failure checklist for a windmill restart.
Based on the FDR data, the media claimed that the sequence of events is consistent with the aircraft being deliberately crashed. But is it? If your purpose is to deliberately crash the plane, why switch off the engines? Aren’t the odds better with the engines on? Assertion 2 states that FDR data alone cannot determine whether the fuel shutoff was initiated in the cockpit or by FADEC. MU5735 did pull out of its first dive, and climbed before the next dive sent it crashing. Without CVR data to confirm, the dive path is consistent with the pilots attempting a windmill restart.
Assertion 5 (Windmill Restart) states that a windmill restart is impossible following a FADEC-initiated engine shutdown. If Assertion 5 is validated, then pilot training and high-altitude dual engine failure checklists require urgent updates. The windmill restart option should be removed and the ANC process biased toward minimizing altitude loss.
Air India Flight AI 171
On June 12, 2025, Air India Flight AI 171, a Boeing 787-8 aircraft, suffered a dual-engine failure and crashed 32 seconds after take-off from Sardar Vallabhai Patel International Airport, Ahmedabad.
The Aircraft Accident Investigation Bureau (AAIB) of India released a preliminary report on July 11, 2025. On June 12, 2026, the AAIB released a statement that investigations were in their final stages and that the final report was expected in a few months.
The preliminary report confirmed that a dual engine failure had occurred and ruled out bird strikes. There were two lines in the report that the media latched onto, misquoted, and then quickly blamed the pilots.
The preliminary report noted that the two fuel cutoff switches transitioned from the RUN to CUTOFF position seconds after takeoff. The key word here is transitioned. By Assertion 1, the FDR records the fuel valve position. By Assertion 2, the FDR data cannot distinguish a cockpit-initiated fuel shut off from a FADEC-initiated fuel shut off. The report stated a fact. AAIB had no evidence that the fuel control switch had been physically moved.
The preliminary report also stated a conversation between the pilots using the words – why did he cutoff. The report did not explicitly state whether this was verbatim from the CVR. If we assume that this was verbatim, then it indicates confusion, not accusation; one pilot asking the other if he knew why the engine had cutoff?
The media, reporting on the AI 171 crash, changed ‘transitioned’ to ‘moved’ and ‘why did he cutoff’ to ‘why did you cutoff’ and ‘why did you cutoff the fuel’. If the fuel control switch was physically moved, then it had to be one of the pilots who initiated the action. We have contended [5] that the fuel control switches never moved and remained in the RUN position. Even the subsequent engine restart was initiated by FADEC, and the fuel control switch never physically moved in the cockpit during the 32 seconds after takeoff.
We have maintained that a thermal runaway event in the Lithium-ion battery in the aft avionics bay created a catastrophic electrical failure, which caused the RAT to deploy [6,7]. The electrical failure powers down the network switches and Remote Data Connectors (RDC), resulting in the FADECs losing their connection to the Common Core System (CCS). This disconnection from the CCS, stops aircraft data from reaching the FADEC, and each engine’s FADEC, after a network timeout, initiates a shutdown [8]. It is only after the RAT restores power, and the network switches and the Remote Data Connectors (RDC) are rebooted, when the connection between FADEC and CCS is restored. Once the network connection is restored, and when the FADECs start receiving aircraft data, each FADEC initiates an engine restart.
Our five assertions can be easily validated and confirmed by the engine manufacturer. The above premise, on FADEC-initiated actions on detecting that the connection to CCS is down, can also be very easily tested by the engine manufacturer.
In an aircraft engine test lab, with the engine running, simulate a network-down scenario where the FADEC is disconnected from the CCS. Does the FADEC initiate a fuel cutoff and engine shutdown? What is the network timeout from when it first detects that the network is down and when it initiates the shutdown? Once the network is restored, does the FADEC initiate an engine-restart? What is the time delay from when the network is restored to FADEC issuing an engine-restart command? The answers to these questions will explain the sequence of events reported in the AI 171 preliminary report.
Aviate, Navigate, Communicate, Educate
A modern aircraft is highly complex, integrating avionics, pneumatic, electrical, mechanical, electronics, and software systems. In addition, they are designed with redundancy as a core philosophy. Redundancy is the existence of more than one independent means of accomplishing a function, each physically separated, ensuring fail-safe operations with no single point of failure.
An accident investigation is an elaborate and multi-disciplinary process. They are fact-finding, and not fault-finding activities. The primary goal is prevention; identifying exactly how and why it happened, so that systemic changes can be made to ensure it never happens again. The final report must not just identify the root cause, but recommend safeguards to prevent this from happening again. The report’s recommendations must not just target manufacturers but educate aircraft operators and inform best practices and update pilot checklists.
In the case of China Eastern, Jeju Air, and Air India, the media were quick to blame the pilots. The published data and reports show otherwise. Whether it was deliberate misdirection or gross media incompetence, it is for others to decide. In these three cases, the published data shows that pilots acted by the playbook, following standard operating procedures and emergency checklists, and did not deviate from regulated protocols.
While the Aviate, Navigate, Communicate steps all happen in the cockpit, the Educate step must happen after a final report is published. The feedback from any final report needs to be incorporated into the ANC process. This is an opportunity for AAIB to create a transparent accident report, backed by evidence-based science, using measured words, and recommend best practices that will restore confidence in the process, prevent similar accidents, regain flyer trust, foster industry-wide confidence, educate the public, and ensure safer skies.
References
[1] Loss of Thrust in Both Engines After Encountering a Flock of Birds and Subsequent Ditching on the Hudson River, US Airways Flight 1549, Airbus A320-214, N106US, Weehawken, New Jersey, January 15, 2009, Accident Report NTSB/AAR-10/03, available at https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf
[2] Preliminary Report of Jeju Air (HL8088, 7C2216). Available at https://araib.molit.go.kr/USR/BORD0201/m_34591/DTL.jsp?id=eaib0501&idx=262906&mode=view
[3] NTSB FOIA China Eastern MU5735. Available at https://securefoia.ntsb.gov/app/AddAttachment.aspx?docid=66&ispaldoc=F
[4] Crash of Pinnacle Airlines Flight 3701 Bombardier CL-600-2B19 N8396A Jefferson City, Missouri, October 14, 2004. Available at https://www.ntsb.gov/investigations/accidentreports/reports/aar0701.pdf
[5] Nothing but the Facts. Available at https://www.linkedin.com/pulse/nothing-facts-ranjit-john-iveic
[6] Hiding in Plane Sight. Available at https://www.linkedin.com/pulse/hiding-plane-sight-ranjit-john-qzvlc
[7] Eyes Wide Shut – Deliberate Misdirection or Gross Incompetence. Available at https://www.linkedin.com/pulse/eyes-wide-shut-deliberate-misdirection-gross-ranjit-john-fnu2c
[8] Ducks, Geese, and Planes. Available at https://www.linkedin.com/pulse/ducks-geese-planes-ranjit-john-qap5c
Credits
Header image credits: Edmund Seeger, 2008 Las Vegas N106US US Airways, CC BY-SA 2.0; USER dreamcatcher（Pascal Simon, B-1791 Boeing 737-89P(WM) China Eastern Airlines 20191207, CC BY-SA 3.0; Anton Homma, Boeing 737 Jeju Air at Fukuoka Airport, CC BY-SA 2.0; RyanZ225 PC (aka ZhangerAviation), Air India 787-8 (VT-ANB), CC BY-SA 4.0
