The Air India AI171 crash near Ahmedabad this past June has already rewritten how many pilots and maintainers think about low‑probability, high‑consequence cockpit events. The Aircraft Accident Investigation Bureau preliminary report shows both engine fuel control switches moved from RUN to CUTOFF within a second of each other during the initial climb. That sudden loss of fuel flow precipitated a catastrophic dual engine shutdown and the eventual loss of the airplane. Those facts are now on the record.

Operational reaction was immediate. Regulators and carriers began targeted inspections of the physical locking features and installations for the fuel control switches identified in earlier FAA guidance. India’s DGCA ordered operators to complete inspections aligned with FAA SAIB NM-18-33, and carriers around the world took a precautionary look at their 787 cockpits. But the AAIB preliminary report also notes the 2018 FAA guidance was advisory and not a mandatory airworthiness directive. That distinction matters.

This is where certification scrutiny belongs, not in hindsight alone but in sober, operational terms. The 787 type certificate reflects exhaustive design work and a certification basis that included special conditions for the airplane’s novel systems and structures. The type certificate data and special condition record show that the 787 certification process addressed many design challenges unique to the program. But certification is a process, not a one time stamp. It certifies a design against a set of requirements and known failure modes at a point in time. It cannot and should not be expected to anticipate every possible interaction of hardware, human use, maintenance practices, and operational variability across thousands of operator environments. Still, when an event exposes a failure pathway where simple human actions or lost situational awareness can defeat a primary system safeguard, that is a strong signal to review whether the certification assumptions about human factor mitigations and physical protections remain adequate today.

Two practical points emerge for pilots and operators. First, critical controls that directly stop engine thrust require protections that make inadvertent or ambiguous operation extremely unlikely. The fuel control switch on the 787 is intended to be gated so a deliberate action is required to move it. The FAA SAIB noted occasions where that locking feature had been disengaged during installation or modification on other Boeing models. When that advisory remained nonbinding, some operators did not implement the check. The result: a vulnerability existed, and it was not universally closed. That gap between advisory guidance and enforced action is not hypothetical. It matters in the real world where fatigue, distraction, or cockpit clutter can change the risk calculus.

Second, certification compliance must be followed by resilient continued airworthiness practices at operator level. SAIBs and service bulletins rely on operators to act. The regulatory toolbox also includes airworthiness directives, which are mandatory. The AAIB preliminary report notes no immediate recommendation for Boeing or GE at that stage, and it is correct to avoid premature blame. But from a systems point of view, if an advisory points to a potential mechanism that can defeat a safeguard, regulators and certification authorities should evaluate whether that mechanism should remain advisory or be elevated to a mandated corrective action. The difference between an advisory and an AD in terms of fleet risk reduction is not academic.

Should we ask for a formal reexamination of the 787 type certificate? Yes, with qualifications. A blanket attack on the 787 certification would be counterproductive. The correct approach is a focused review: 1) identify certification assumptions around human interactions with critical cockpit controls, 2) audit whether the design provided for fail safe means that are not subject to routine maintenance or inadvertent installation changes, and 3) verify that operational procedures, training syllabi, and maintenance practices across major operators actually implement mitigations contemplated during certification. That review can be led by type certification authorities for the 787, working with the AAIB investigation team and operators, and should be narrowly scoped to the systems implicated. The goal is not to retry certification from first principles but to confirm the certification envelope still protects the fleet when human and maintenance variability are considered.

From the flightdeck perspective there are immediate, practical steps operators and crews should adopt now. Update SOPs to include explicit verbal callouts and sterile cockpit discipline tied to any fuel system movement after thrust reduction or any time the fuel switch is handled. Ensure simulator training scenarios include rare but plausible sequences where a protected control is moved inadvertently and crews must recognize and recover without time to spare. Inspect cockpit ergonomics for items that can snag or confuse a pilot’s hand during high workload phases. Those measures do not require redesign. They require disciplined, operator‑level implementation. The industry response in the days after the preliminary report showed operators are capable of quick action when guidance is clear.

Longer term there are design and regulatory lessons. Certification authorities should revisit how they evaluate single human action failure modes that can defeat multiple layers of protection. That includes the interplay of mechanical locks, switch placement, software interlocks, and required crew action within time windows that may be measured in seconds during an emergency. When a safety assessment accepts that a pilot response will reliably avert catastrophe, that assumption must be validated through realistic human factors testing, not only analytic probability models. If the human factor assumptions are optimistic, the design must add passive protections that do not rely solely on perfect human performance. The type certificate record and special conditions already show awareness of human factors topics, but the AI171 event suggests a targeted reappraisal of those specific protections on the 787 is justified.

Finally, this is not just about hardware or paperwork. It is an organizational challenge. Regulators must ensure that advisory information with safety implications triggers timely, auditable corrective steps. Manufacturers must ensure that design features meant to be protective stay protective over the service life of the airplane and across maintenance cycles. Operators must treat nonmandatory guidance that affects critical protections as operationally important even when it is not yet mandated. The deadliest lessons are rarely novel. They trace back to the same root causes: unanticipated combinations of component, human, and organizational vulnerabilities. If the aviation community treats the AAIB findings as a trigger for targeted certification and operational reviews rather than a source of finger pointing, we will have honored the lives lost by making flying measurably safer.

Practical checklist for flight operations and oversight officers

  • Conduct immediate cockpit pedestal and switch lock inspections per SAIB NM-18-33 and document completion.
  • Issue clear SOP amendments and mandatory briefing items for any fuel system work or abnormal fuel control indications.
  • Add simulator training scenarios that force recognition and recovery from inadvertent fuel control movement in the takeoff and initial climb phase.
  • Certification authorities should open a scoped review of 787 human factor assumptions related to critical physical controls and consider whether an AD or equivalent is needed to remove the advisory gap.

The AAIB final report will provide the technical detail investigators need to determine whether this was an unintended mechanical pathway, a maintenance or installation lapse, an operational omission, or an extremely rare crew action sequence. Until that final report is published, avoid simple narratives of design failure or pilot culpability. But do not let uncertainty be an excuse for inaction. There are operational fixes and a focused certification review that can reduce the chance of recurrence. That is what pilots and passengers expect, and it is what the profession must deliver.