The Switch That Won’t Stay Put, Boeing, DGCA, and the Erosion of Aviation’s Most Sacred Covenant
On June 12, 2025, an Air India Boeing 787-8 Dreamliner operating flight 171 from Ahmedabad to London Gatwick crashed under circumstances that remain, eight months later, officially unexplained. The final report of the investigation is still “several months” away. The victims’ families await answers. The travelling public, which had been assured that the Dreamliner was one of the most advanced and safest aircraft ever built, awaits reassurance. The aviation industry, which has built its reputation on the relentless, methodical pursuit of the root causes of every accident, awaits the closure that only a thorough, transparent investigation can provide.
What we have instead of answers is another incident. On February 1, 2026, a different Air India Dreamliner, preparing for departure from London Heathrow to Bengaluru, experienced the same anomaly that is believed to have contributed to the Ahmedabad crash: involuntary movement of a fuel control switch from the ‘Run’ to the ‘Cutoff’ position. The crew, after three attempts, managed to reseat the switch. The flight continued without further incident. The aircraft was inspected, cleared, and returned to service. The Directorate General of Civil Aviation, India’s aviation regulator, issued a detailed “Rejoinder” defending its handling of the incident and directing Air India to circulate Boeing’s recommended operating procedures to its crew members.
And the underlying question—why do these switches move when they should remain stationary? —remains unanswered.
The accompanying editorial, published in the immediate aftermath of the February 1 incident, captures the frustration and unease that this recurring anomaly has generated among safety professionals, pilots, and the travelling public. Its title—”No shortcuts in aviation safety”—is not merely a statement of principle; it is an indictment of practice. The editorial charges that the DGCA, by defaulting to the assumption of pilot error, is taking precisely the kind of shortcut that compromises the foundational safety architecture of commercial aviation. It warns that “assuming pilot error before thoroughly probing each unusual incident in aviation is an error that must not be allowed to creep in because that would undermine safety, which is the manufacturers’ responsibility first.” And it insists, with evident exasperation, that “it should not take a year of probing to know how those switches moved on the ill-fated aircraft out of Ahmedabad.”
The editorial is not merely a critique of regulatory procedure; it is a cry of alarm from those who understand that the aviation industry’s extraordinary safety record is not a gift of providence but the product of a deliberately cultivated culture of relentless, unsentimental inquiry. Every accident is investigated until its root causes are identified and remediated. Every incident is treated as a potential precursor to an accident. Every assumption—including the assumption that the manufacturer’s design is sound and the pilot’s actions are suspect—is subjected to rigorous, evidence-based scrutiny.
That culture is now, the editorial suggests, under threat. The default assumption of pilot error, the deference to the manufacturer’s authority, the acceptance of procedural fixes (circulating recommended procedures) in lieu of design modifications, and the glacial pace of the accident investigation all point to a systemic failure of the safety imagination. The switch that moved on February 1 is not merely a technical problem awaiting an engineering solution; it is a symptom of a deeper malaise—an erosion of the vigilance and humility that have made commercial aviation the safest form of transportation in human history.
The Recurrence Problem: From Incident to Pattern
The February 1 incident is not an isolated event. It is the latest data point in a pattern that extends back at least to 2018, when the U.S. Federal Aviation Administration issued Safety Alert for Operators SAIB NM-18-33, warning that certain fuel control switches on Boeing 787s “could malfunction in this exact manner, increasing the risk of accidental engine shutdown.” It includes the June 2025 Ahmedabad crash, whose precise relationship to the fuel switch anomaly remains under investigation but whose temporal and technical proximity cannot be ignored. It includes, presumably, other incidents that have not been publicly reported or that were resolved by crew action without generating formal notifications.
The recurrence of a known, documented, safety-alerted anomaly is, in aviation terms, a profound failure. It means that the corrective actions taken after the 2018 alert were insufficient. It means that the investigation of the 2025 crash, eight months in and with no end in sight, has not yet identified the root cause or mandated the design changes necessary to prevent recurrence. It means that the procedures on which airlines and regulators are relying—circulating Boeing’s recommended operating procedures, reminding crews to check that switches are fully latched—are palliatives, not cures.
The editorial’s demand for urgency is not impatience; it is professional necessity. In aviation safety, the interval between an incident and its investigation is not merely a period of information gathering; it is a period of continuing risk. Every day that passes without a definitive determination of the fuel switch anomaly’s root cause is a day during which another 787, carrying another 290 passengers, could experience the same malfunction. The crew that successfully reseated the switch on February 1 may not be as fortunate next time. The circumstances that prevented the Ahmedabad crash from becoming a greater catastrophe may not align again.
The Assumption Problem: Why “Pilot Error” Is Not a Neutral Hypothesis
The editorial’s most pointed criticism is directed at the DGCA’s apparent predisposition to attribute the fuel switch anomaly to crew action. The regulator’s “Rejoinder,” while technically detailed, is framed in terms that subtly shift responsibility from the machine to its operator. The switch “did not remain positively latched” when “light vertical pressure was applied.” The crew “physically verified” the switch’s position after the third attempt. The implication, never explicitly stated but unmistakably present, is that the crew must have touched the switch—perhaps inadvertently, perhaps incorrectly—and that the proper remedy is to remind pilots of the correct operating procedure.
This framing is not neutral; it is ideological. It proceeds from the assumption, which the editorial identifies as deeply problematic, that “the manufacturer is always right and that the pilots are the ones who are moving switches.” This assumption is not derived from evidence; it is a prejudice that precludes the collection of evidence that might contradict it. If the regulator has already decided that the switch moved because the pilot touched it, why would it investigate the possibility that the switch moved because of a design flaw, a manufacturing defect, a software glitch, or electromagnetic interference? Why would it mandate design changes when procedural reminders are cheaper and less disruptive? Why would it question Boeing’s engineering when Boeing’s reputation is, for the regulator, a source of reassurance rather than a subject of inquiry?
The editorial’s invocation of the Mumbai taxiway incident—in which the right wings of two aircraft brushed each other, clearly a case of pilot error—is not an admission that all incidents are caused by pilots. It is a rhetorical strategy designed to forestall the accusation that the editorial is anti-pilot or indifferent to human factors. Yes, pilots make mistakes. Yes, those mistakes must be investigated and remediated through training, procedure, and, where necessary, discipline. But the existence of pilot error as a causal category does not justify its presumption in every incident. The question is not whether pilots ever err; it is whether, in this specific incident, the evidence supports the conclusion that pilot error occurred. And that question cannot be answered by assuming the answer in advance.
The Manufacturer Problem: Boeing’s Recurring Credibility Deficit
The editorial does not name Boeing in its critique of the assumption that “the manufacturer is always right.” It does not need to. The context—the 787, the fuel control switches, the FAA safety alert, the Ahmedabad crash—makes the reference unmistakable. And the reference carries with it the accumulated weight of Boeing’s recent history: the 737 MAX, two fatal crashes, a 20-month fleet grounding, billions in losses, and a permanently damaged reputation for engineering excellence and safety leadership.
Boeing’s response to the February 1 incident has been characteristically cautious and circumspect. The company is “in contact with Air India” and “supporting their review of this matter.” It has not, however, acknowledged that the fuel switch anomaly represents a design vulnerability requiring engineering modification. It has not mandated fleet-wide inspections beyond those already conducted by Air India. It has not issued a new safety alert or service bulletin. It has not, in short, demonstrated the urgency and transparency that the recurrence of a known, documented, safety-alerted anomaly demands.
This reticence is understandable from a corporate perspective. Boeing is still litigating the 737 MAX cases. It is still defending itself against accusations that it prioritised speed and cost over safety. It is still seeking to convince regulators, airlines, and passengers that it has learned the lessons of its catastrophic failures. Any acknowledgment that another Boeing aircraft, another safety-critical system, another design vulnerability has escaped detection and remediation risks reopening wounds that the company desperately wants to heal.
But what is understandable from a corporate perspective is unacceptable from a safety perspective. Boeing possesses technical knowledge about the design, manufacture, and performance of its fuel control switches that no other entity can replicate. Its engineers have access to test data, production records, and field performance reports that are not available to Air India, the DGCA, or even the FAA. Its failure to share this knowledge transparently, to acknowledge potential design vulnerabilities, and to mandate aggressive corrective actions across its global fleet is not prudent risk management; it is obstruction of the investigative process.
The Regulatory Problem: DGCA Between Autonomy and Deference
The DGCA’s handling of the February 1 incident, and its broader posture toward the fuel switch anomaly, reflects a structural tension in India’s aviation regulatory architecture. The DGCA is, on paper, an autonomous regulatory authority charged with ensuring the safety of Indian civil aviation. In practice, it operates within a complex ecosystem of international norms, manufacturer relationships, and domestic political pressures that constrain its independence.
The DGCA is heavily dependent on the FAA and the European Union Aviation Safety Agency for certification and oversight of aircraft types. It lacks the technical capacity to independently evaluate Boeing’s design claims or to mandate modifications that the FAA has not also mandated. It is embedded in a global regulatory system that, despite reforms following the 737 MAX crashes, remains heavily deferential to manufacturers. Its officers are trained in the same assumptions—that pilots err, that manufacturers are reliable, that procedural fixes are adequate—that the editorial identifies as problematic.
Yet these structural constraints are not absolute. The DGCA retains significant authority over the operation of foreign-manufactured aircraft within Indian airspace. It can mandate additional inspections, require design modifications, or even ground aircraft types that it determines to pose unacceptable risks. It can demand that Boeing provide the field data necessary to evaluate the fuel switch anomaly. It can insist that the investigation of the Ahmedabad crash be completed and its findings implemented before it accepts Boeing’s assurances of safety.
That it has not done so, or has done so only partially and reluctantly, is the basis for the editorial’s criticism. The DGCA’s response to the February 1 incident has been procedurally correct but substantively inadequate. It has followed the established protocols: incident reported, investigation conducted, findings documented, corrective actions prescribed. What it has not done is question the protocols themselves—the assumptions, the deference, the acceptance of procedural fixes as substitutes for design modifications. It has treated the recurrence of a known anomaly as an administrative problem to be managed rather than a systemic failure to be rectified.
The Trust Problem: Passengers, Crew, and the Fragile Covenant
The editorial’s concluding sentence—”How trustworthy is an aircraft if unusual movement of the fuel switches takes place”—is not rhetorical. It is a question that every passenger boarding a Boeing 787 is now entitled to ask.
Commercial aviation operates on a foundation of trust. Passengers trust that the aircraft they board has been designed and manufactured to the highest standards of safety. They trust that the airline has maintained it diligently and operated it competently. They trust that the regulator has overseen this entire process with vigilance and integrity. They trust that when something goes wrong, it will be investigated thoroughly and the lessons learned will be implemented universally.
This trust is not blind faith; it is evidence-based confidence accumulated over decades of safe operations and, when accidents occur, transparent investigations and effective corrective actions. The aviation industry has earned this trust through its demonstrated commitment to the principle that safety is not a competitive advantage but a collective responsibility.
The fuel switch anomaly threatens this trust. Not because it is, in itself, a catastrophic failure—the February 1 incident demonstrates that crews can manage it and aircraft can operate safely despite it. But because it keeps recurring, because its root cause remains unidentified, because the responses to it have been procedural rather than engineering, and because the institutions responsible for aviation safety appear to be more concerned with managing reputation than with pursuing truth.
The editorial’s demand for urgency is not about the specific switch or the specific aircraft type. It is about the integrity of the entire safety architecture. A regulatory system that defaults to pilot error, a manufacturer that withholds data, and an investigative process that stretches to a year without producing conclusions are not failures of individual institutions; they are symptoms of a systemic malaise. And that malaise, if left untreated, will not remain confined to the fuel switches of Boeing 787s.
Conclusion: The Switch and the System
The fuel control switch on a Boeing 787 Dreamliner is a small component in a vast and sophisticated machine. Its movement from ‘Run’ to ‘Cutoff’ is a minor deviation in the normal operation of a highly reliable system. The February 1 incident resulted in no harm, no damage, no delay. The crew managed the anomaly, completed the flight, and reported the event for investigation.
Yet the editorial published in the wake of this incident is not a disproportionate response to a minor event. It is a measured, necessary intervention in a debate that the institutions responsible for aviation safety have been unwilling to join. It asks questions that the DGCA has not asked, demands transparency that Boeing has not provided, and insists on urgency that the investigative process has not demonstrated. It speaks for the passengers who cannot ask these questions themselves and for the crew members whose competence is implicitly impugned by the default assumption of pilot error.
The switch that moved on February 1 will, in all likelihood, be repaired or replaced. The aircraft will return to service, fly thousands of hours, and carry hundreds of thousands of passengers without further incident. The investigation of the Ahmedabad crash will eventually conclude, its findings will be published, and its recommendations will be implemented. The FAA will review Boeing’s design, mandate modifications if necessary, and issue new safety alerts if appropriate. The system will, in its methodical, incremental way, address the problem.
But the editorial’s warning is that the system’s methodical, incremental way may no longer be adequate. The recurrence of a known anomaly, eight months after a fatal accident, is not an event that can be addressed through procedural reminders and extended investigation timelines. It is a signal—a signal that the system is not learning as quickly as it must, that the assumptions on which it operates are not being questioned, and that the trust on which it depends is being eroded. The switch that moves is not the problem; it is the symptom. The problem is the system that allows the switch to keep moving, year after year, alert after alert, accident after accident, without ever answering the question that the editorial poses with such stark simplicity: why?
Q&A Section
Q1: What is the significance of the FAA’s 2018 Safety Alert (SAIB NM-18-33) in understanding the recurring fuel switch anomaly on Boeing 787s?
A1: The FAA’s 2018 Safety Alert is significant because it establishes that the risk of fuel control switches moving inadvertently from ‘Run’ to ‘Cutoff’ was known to regulators and manufacturers eight years before the February 2026 incident. The alert specifically warned that certain switches on Boeing 787s “could malfunction in this exact manner, increasing the risk of accidental engine shutdown.” The recurrence of the anomaly in 2025 and 2026 therefore represents a systemic failure of the safety architecture. It means that the corrective actions taken after the 2018 alert were insufficient; that the investigation of the June 2025 Ahmedabad crash, eight months in and with no end in sight, has not yet identified the root cause or mandated design changes; and that the procedures on which airlines and regulators are relying (circulating operating procedures, reminding crews to check latching) are palliatives, not cures. The recurrence of a known, documented, safety-alerted anomaly is, in aviation terms, a profound failure that demands not procedural reminders but engineering modifications and root cause analysis.
Q2: What criticism does the editorial level at the DGCA’s handling of the February 1, 2026 incident, and what assumption does it identify as problematic?
A2: The editorial criticises the DGCA for its default assumption of pilot error and its apparent deference to the manufacturer’s authority. The regulator’s “Rejoinder,” while technically detailed, frames the incident in terms that subtly shift responsibility from the machine to its operator: the switch “did not remain positively latched” when “light vertical pressure was applied.” The implication is that the crew must have touched the switch, and the remedy is to remind pilots of correct procedures. The editorial identifies this as an ideological assumption—”that the manufacturer is always right and that the pilots are the ones who are moving switches”—that precludes the collection of evidence that might contradict it. If the regulator has already decided that the switch moved because the pilot touched it, why investigate design flaws, manufacturing defects, software glitches, or electromagnetic interference? Why mandate design changes when procedural reminders are cheaper? This assumption, the editorial argues, “is an error that must not be allowed to creep in because that would undermine safety, which is the manufacturers’ responsibility first.”
Q3: Why does the editorial describe the circulation of Boeing’s recommended operating procedures as an inadequate response to the recurring fuel switch anomaly?
A3: The editorial describes procedural remedies as inadequate because they address symptoms rather than causes. A procedure tells pilots what to do if a switch moves; it does not explain why the switch moved or prevent it from moving again. The February 1 incident demonstrates the insufficiency of this approach: Air India had already conducted “precautionary checks” across its 787 fleet after the June 2025 crash and “found no issues.” Yet the same anomaly recurred on a different aircraft, operated by the same airline, flown by pilots trained under the same procedures. This is not an isolated failure of implementation; it is evidence that the underlying design vulnerability remains uncorrected. The editorial insists that the appropriate response to a recurring safety-critical anomaly is not procedural reinforcement but engineering modification. The distinction is fundamental: procedures manage risk; design eliminates it. The continued reliance on procedural fixes for a problem that has persisted for eight years, survived an FAA safety alert, and contributed to a fatal accident reflects a systemic reluctance to question manufacturer authority and mandate design changes.
Q4: What is the “structural tension” in India’s aviation regulatory architecture that the editorial implicitly criticises?
A4: The structural tension is between the DGCA’s formal autonomy as India’s aviation regulator and its practical dependence on foreign regulatory authorities and manufacturers. The DGCA lacks the technical capacity to independently evaluate Boeing’s design claims or to mandate modifications that the FAA has not also mandated. It is embedded in a global regulatory system that, despite reforms following the 737 MAX crashes, remains heavily deferential to manufacturers. Its officers are trained in the same assumptions—that pilots err, that manufacturers are reliable, that procedural fixes are adequate—that the editorial identifies as problematic. Yet the editorial implicitly argues that these structural constraints are not absolute. The DGCA retains significant authority to mandate additional inspections, require design modifications, ground aircraft types, demand field data from Boeing, and insist on completion of the Ahmedabad crash investigation before accepting safety assurances. That it has not done so, or has done so only partially and reluctantly, reflects not merely structural constraints but a regulatory posture that prioritises procedural compliance over substantive safety inquiry. The tension is between what the DGCA can do and what it chooses to do.
Q5: What does the editorial mean when it warns that the fuel switch anomaly threatens the “integrity of the entire safety architecture” of commercial aviation?
A5:** This warning means that the recurrence of a known, documented, safety-alerted anomaly, eight months after a fatal accident, without root cause identification or design modification, is not an isolated technical problem but a symptom of systemic failure. The “safety architecture” consists of interdependent institutions and practices: manufacturers design aircraft; operators maintain and fly them; regulators certify and oversee them; investigators analyse accidents and incidents; and the entire system learns from failures and implements corrective actions. This architecture has produced an extraordinary safety record, but its integrity depends on each component functioning as intended. The fuel switch anomaly reveals multiple component failures: a manufacturer that withholds data and avoids design modifications; a regulator that defaults to pilot error and accepts procedural palliatives; an investigative process that stretches to a year without producing conclusions. Each failure individually is concerning; collectively, they suggest a system that is no longer learning as quickly as it must, questioning assumptions it should question, or prioritising safety over reputation. The editorial’s warning is that this systemic malaise, if untreated, will not remain confined to the fuel switches of Boeing 787s. The erosion of safety culture is contagious; the assumptions that enable one problem to persist will enable others. The switch is the symptom; the system is the disease.
