We tend to treat the 737 MAX crashes, Air France 447, and the recent 787 takeoff crash in India as separate events. Different airframes, different systems, different failure modes. But they are not separate. They are three manifestations of the same underlying problem.
In all three cases, the aircraft remained physically controllable. What failed was the logic that mediated between the crew and the machine.
The 737 MAX crashes were caused by MCAS acting on a single faulty angle-of-attack sensor. It trimmed nose-down repeatedly, overriding pilot inputs. The system was not transparent, and it was not defeatable without trim cutout switches. There was no way to tell it to stop and give full authority back to the crew.
Air France 447 lost pitot input at cruise, which triggered a cascade of degraded control laws. The autopilot disconnected, protections dropped out, and the aircraft entered alternate law. The airplane still flew, but the logic no longer matched the crew’s understanding. The pilots were not prepared to fly with what remained. The result was confusion, delay, and loss of situational awareness until it was too late.
Now the 787. The aircraft used the entire 11,000-foot runway. It lifted off, but the RAT deployed immediately after rotation, which tells us that primary electrical or hydraulic power was lost. The gear never retracted. There was no fire, no asymmetry, no visible external cause. Based on what is known so far, the engines appear to have stayed on but failed to deliver full power. Whether due to configuration, logic error, or electrical fault, the airplane did not respond to what the pilots needed. They had no way to force it to respond.
Three aircraft. Three contexts. One common thread: the system failed, and it would not hand control back to the pilots.
This is not a bug in any single system. It is a design philosophy problem. These aircraft were built on the assumption that software is the final arbiter, that logic can anticipate and manage edge cases better than a human can. That assumption works right up until it does not. When data is wrong, when systems degrade, when multiple constraints compete, the software narrows instead of yielding. It preserves its own coherence, even as the aircraft falls out of the sky.
We need a change in how authority is handled. If an aircraft loses flight data, if RAT deploys, if the autopilot disconnects unexpectedly or the engines stop responding to thrust commands, the pilots should be able to press one button and take full command. Not filtered command, not suggested input. Direct, physical, complete authority.
That means raw flight controls. Full thrust. Gear and flap operation regardless of system state. Acknowledge the damage risk. Accept the bypass. Let the pilots fly.
This is not about removing automation. It is about making sure the system knows when to step aside. Human pilots rarely exceed their own limits in a crisis. Software does, because it cannot triage. It tries to preserve everything. And when it cannot, it collapses silently and does nothing.
If the crews of the MAX, AF447, or the 787 had been given a simple, guaranteed way to bypass the system and fly the aircraft directly, the outcomes may have been very different. What killed those aircraft was not mechanical failure. It was software that did not know when to get out of the way.
Question. How many of you have had automation get in the way of safely flying your plane? How many wish they could have bypassed it?
Totally agree.
