It will take more than a single camera. A single camera with a view of both pilots would have to be placed behind, and centered on the throttle quadrant. A jumpseater would obstruct that view. And if a pilot was intent on committing evil, what’s to prevent them from coloring over the lens with a sharpie most of us carry, or hanging your coat/hat/tie in such a way that it obstructs the view? Cameras may have a roll in crashes caused by pilot error, but have their own limitations when crashes are caused by pilot evil.
Yes, automation will continue to progress as time goes on, but at least one Pilot will be on the flight deck for the foreseeable future. Sensor technology for things such as weather is still lacking for fully autonomous flight. Current weather radar, while very good, still involves Pilot interpretation looking out the window and experience. Would a completely autonomous aircraft have made the decision to land in the Hudson River? The bottom line is, you can build more logic in to the Start Switches, to prevent accidental or deliberate manipulation at inappropriate times, but there are literally hundreds of ways to bring an airliner down if one of the Pilots decides to do it.
So ill informed. Those drones do not have human beings on board! Do you have any idea how many of those drones you talk about crash? Neither do I, because no humans are on board, so no one really cares? What makes an aircraft remotely flown by a human any safer than one flown by a human/humans on board? The answer is nothing! The reason the drones are flown remotely, by a Pilot, is to prevent them from losing the Pilot in the event the aircraft gets shot down.
Verification procedures have been in place before moving fuel control switches for eighty years. You don’t seem to understand that safe operation aircraft, and countless other vehicles and systems, require trained, competent professionals. You’re attitude is no different than the Karens who insist on firearms designed for protection of law abiding citizens be unloaded, locked in a safe, and left at home by officers going on patrol.
I can see that you really have no idea what you are talking about. If you had ever flown an airliner with these switches, you would realize that these switches, as designed, are simple and very reliable. The ONLY way these switches can be moved to CUTOFF, is by a deliberate act. Adding layers of software logic would just reduce the reliability and then we would be facing the possibility of Hal, turning OFF the fuel supply at an inappropriate time. I for one am a fan of the KISS method of Keep It Simple Stupid. So go ahead, build your software logic in to this simple switch and the next suicidal Pilot will come up another one of the thousand ways to bring down an airliner if he so chooses!
Yes. We need to know if the fuel switches were turned off. If the pilot who turned them off, tries to pull the circuit breaker, the video will show that, too.
You and I are on the same page! Clearly, you have been in this industry for awhile. Thanks for input, not just some armchair QB
Has there been definitive published statement from Boeing, saying that HAL did not/ could not shut these two engines down?
The suicide/ mass murder narrative carries as much water as the simplicity or reliability of these switches or some other technical issue having lead to this accident.
The Indian Commercial Pilots’ Association (ICPA) said it was “deeply disturbed by speculative narratives … particularly the reckless and unfounded insinuation of pilot suicide”.
Indeed you are. I imagine the FO was on your side, until those last few seconds of his life where he thought : “damn, remote control would have stopped this maniac from flipping these switches and we would all just have lived happily ever after”. You dis my comment but go on yourself in a another comment that “at least one pilot will be on the flight deck”…make up your mind will ya… or do you think pax would accept a pilot as a single point of failure ? Anyway, hope you don’t mind other opinions too much.
Kudos to Russ for raising this, it’s sparked one of the best technical discussions I’ve seen here in a while.
I took a rough count of the 25 or so people who’ve commented:
- About 36% believe this wasn’t a mechanical failure, but the system should’ve had basic safeguards, like a warning light, an aural chime, or logic to block both engines from being shut down during takeoff.
- Around 32% are against adding more automation, saying it’s unnecessary or risks taking too much control away from pilots.
- The remaining 32% are in the middle, commenting on related issues like cockpit video, pilot mental health, or simply waiting for more facts.
What really stands out is that the most technically sharp voices, like jjbaker, FirstAutoLander, and Larry_S, all say the same thing: the system should not have allowed both engines to shut down without some kind of check or resistance.
The 787 has a strong safety record, one of the best for widebody jets. That’s why this incident stands out. The plane didn’t break, but it also didn’t step in when it should have. Not calling it a failure. But it’s a missing layer of protection, and that’s something worth fixing.
Who would have imagined? Apparently, the ergonomists didn’t.
Anyone professional pilot or engineer who knows the systems knows that your premise is inept. In fact, the system description, including EEC PMA power and spar valve power has already been posted here.
There is a lot of internet mob and AI generated nonsense being spewed to deflect blame.
Guess what? A pilot could have done the same exact thing on any Airbus.
Referencing #1, on any Boeing there are a plethora of lights and cautions for engine failure.
I’ve already described why this is the case, having to do with catastrophic failures. Some of you are making the case that ejection seats should require a key, passcode and safety pin removal before a pilot can pull the handle. There have been inadvertent seat actuations by maintenance personal and pilots sitting on deck, egressing from cockpits. So the logic is let’s remove the functionality of the seat because someone might get hurt.
There are lights in the fuel control switches to indicate which engine has detected a fire. It’s not hard, unless you have an incompetent, or yes, suicidal pilot.
A similar response occurred after the Germanwings suicide. European ATC wanted to be able to take over and fly airliners from the ground. When they were informed that they would now be accountable for failing to properly execute such a responsibility, they suddenly wanted no part of it.
This is not a failure of ergonomics. It’s a failure of pilots.
Yeah, a pilot could do this on an Airbus too. That is a poor excuse, it means more aircraft have the same flaw.
If the system lets both engines get shut off right after takeoff with no warning, no lockout, and no pushback, that’s a design problem. Full stop.
This isn’t about adding passwords to switches. It’s about not letting one bad move take down 260 people while the airplane just nods and goes along with it.
Blaming pilots skips over the point of cockpit design. Humans make mistakes. Sometimes worse. The system’s job is to prevent the ones that kill.
The 787’s a solid airplane. Doesn’t mean it can’t have a blind spot. This sure looks like one.
A failure of ergonomics.
Hi, first time responder to your comments. I usually always agree with your thoughtful and well informed position on thingsThe switches need to stay the way they are. In the small likelihood that there is a dual engine failure the most expedient way to restart is to “reboot” the system by turning off then immediately on. BTW there is a master warning and associated warning EICAS message indicating engine has Been shut down
1 Like
What exactly do we need video for? It is established fact that the fuel valves were placed off one after the other, then on. The CVR conversation confirms this. They wouldn’t be talking about the cutoffs if the engines randomly shut themselves off because of bad solder. What exactly would video add to this discussion? We’d know a little sooner which pilot moved them? What in the end does that solve? A pilot moved the switches when the switches are not to be moved.
Hate to break it to all of the armchair quarterbacks out there but as someone who plays in the arena there’s a certain amount of competence, skill, and motivation required in order to ride the ride. It is utterly impossible to design any machine so that no training is required, and it is absolutely reasonable to expect that the training program can and should identify anyone who cannot meet that most basic bar.
There is simply no way to design any machine that both allows for human intervention and also somehow can divine human intention. That machine will never exist.
You may then ask why not remove the human from the equation, but this ignores the failure rate of automation. Yes, Virginia, the failure rate. Who here has flown even 100 hours in an aircraft with automation without once having to disengage the automation because it was not doing precisely what was needed? Anyone? Bueller… Bueller….
This is the availability heuristic in action, folks. We all remember the times the automation works, but forgive and forget its constant failures. But yes, please tell me more about how airliners will get rid of the filthy, stupid, greasy, idiotic pilots in X amount of time. Maybe offer me a ride in your flying car while you’re at it.
The fact of the matter is people have strengths and weaknesses. Machines (yes machines, you can give them whatever nerdy cool kid name like automation, machine learning, AI, it’s all the same human made garbage) have strengths and weaknesses. Conveniently, humans tend to be strong in areas where machines are weak and equally conveniently, vice versa. Thus the optimal solution is and always has been finding the right balance between the two. All automation is brittle. All human is unreliable. The two together are how we got to 99.99999% reliability in countries like the US that take some degree of care in what humans they pick for the mix.
The fun part is when the first fully automated aircraft finds a way to make the first fully automated smoking hole in the ground, everyone will still find a way to blame people. Strange how that works…..
Tom, appreciate the kind reply. You are correct: in a real emergency, pilots need direct control, and the switches can stay. But this wasn’t a fire, surge, or damage scenario. It was both engines being shut down at full takeoff power, under 300 feet AGL, with no system challenge or pause. So I’ll explain my view after some research.
According to the AAIB Preliminary Report (June 2025):
- Aircraft lifted off and climbed through 200–300 feet AGL at TOGA thrust, with gear and flaps still extended.
- At ~4 seconds, the right engine fuel switch was moved to CUTOFF.
- At ~5 seconds, the left switch followed.
- Both GEnx-1B70 engines flamed out.
- At ~15 seconds, both switches were returned to RUN, initiating relight.
- Per the 787 QRH, relight takes 15–30 seconds depending on conditions.
- The aircraft had ~15 seconds of altitude left, not enough to recover.
What failed:
- The system allowed a dual engine shutdown during TOGA thrust, at low altitude, with no interlock or resistance.
- No logic check flagged the combination of high thrust, low altitude, and no fire condition.
- The airplane followed a catastrophic command sequence with no pause or confirmation.
This isn’t about removing pilot authority. It’s about breaking the chain when one wrong move could cost 260 lives.
What fixes it:
Add a simple logic gate to block a second engine shutdown when all three of the following conditions are met:
- Thrust levers at or near TOGA, and
- Altitude below 800–1,000 feet AGL, and
- No confirmed fire or override switch activated
If the crew needs to shut both down, they still can, by pulling the power back or flipping a guarded override. But the aircraft should not follow both shutdown commands blindly at full power and low altitude.
Why power setting matters:
- This occurred at 90–100% N1 (TOGA).
- Cruise power is typically 60–70% N1—a 30–40% delta.
- That power margin provides a valid cue for logic to intervene.
- No one shuts down both engines at TOGA unless it’s a mistake or something far worse. Either way, the system should resist.
Why altitude matters:
- Below 800–1,000 feet AGL, there’s not enough time to relight or troubleshoot, especially with gear and flaps extended.
- Even a textbook restart takes too long at that altitude.
- Once those engines flamed out, the outcome is now history.
The 787 is one of the safest aircraft flying. But this wasn’t a hardware failure. It was and remains a logic gap.
And it’s one that can be fixed.
Writing about systemic errors/ faults is often very complicated, because the reader has to be capable of logical and critical thinking and most importantly, read and comprehend what the text says.
Its much easier to just ignore all the discovered facts and call people “Karen” for asking very simple questions. People who are not willing to accept the “Keep Holy Boeing Innocent” doctrine, are accused of being unqualified, called names and clueless.
But… where are we now?
As it stands, the questions regarding the SAIB/ Switches remain unanswered. If the mechanical blocking of these switches was dysfunctional, flipping them could have happened by accident and without awareness of the person doing it. I am not the only person, asking about this. (Click)
As it stands, no statement from anybody/ anywhere within Boeing, confirms, that there could not have been a technical/ electronic fault causing the shut-off valves to be moved to OFF.
As it stands, a flying computer accepted/ executed a dual engine fuel cut with no indication justifying that action during the most critical phase of the flight with factually 0 chance to recover the aircraft. Bark, huff and puff all you want… but explain WHY this was possible in easy to understand terms. Lawyers WILL ask this question, soon enough.
Russ shared his personal opinion about cameras in the cockpit. While I am capable to accept someone elses opinion on something, I do not share the sentiment. Nobody wants to be under constant surveillance. Yet, footage may reveal both pilots physical actions in HD and zoomable.
We began investigating accidents to locate and erase errors and systemic failure and learn from them. Human factors, Technical Factors, Maintenance, Systems, Crew, Weather… everything. The goal? Find out what happened and avoid a repeat.
Whichever way you turn it (and under all possible circumstances for cause) the current system failed its purpose. That may be harsh, but its true.
It takes 10 minutes to determine a list of configurations under which a dual engine shutoff is guaranteed to be catastrophic. Thats when I expect the plane to act up and complain/ refuse, just like it does in countless other situations.
Well, put one fuel switch on the captain’s side and one on the fo’s side.
Hmm – I thought the big question was not whether the switches actuated (they must have?) but whether it was accidental or intentional. Doubtful that video would definitively answer that question.
I am confused. If each switch had to be pulled and then moved to the cutoff position, how could they both be done at the same time, within a small fraction of a second? With two hands? That seems highly improbable.
Still need more information.