Is there any valid reason why transponders can be switched off?
If not then all transponders should be armed and locked immediately so they cannot be switched off ever again!!
This has been discussed repeatedly during the last 24h but I'd like to summarize.
I have seen two reasons so far.
1. in case of equipment fire there has to be a means to cut electrical power to the equipment.
2. malfunction of the transponder sending out garbled signals that block the radar system and may create chaos for ATC.
Now, as the question is very likely to be addressed in the accident report,
how could these risks be mitigated?
Re (1), while I concur the fire risk is high priority, I think electronics design has made significant progress since the 777 was designed and certified in the early 90s. Power consumption is less, "design for safety" has improved, and it is becoming commonplace to design circuitry that monitors over-temperature and shuts down automatically. Just look at all effort done in electric cars nowadays. (Yes there have been some well publicized fires, but they mask the fact that in the vast majority of events the overtemp protection works. And a transponder draws far less power than an electric car.)
Re (2), unfortunately the type certification processes tend to hamper innovation and progress. But there are some potential relatively easy design fixes such as replacing "hard" power on/off switches with momentary reset buttons, such as e.g. in laptop computers.
Going one step furher one may have a networking between devices so that a shutdown or standby of the active transponder automatically turns on the redundant transponder, or at the very least sends a fault message on ACARS.
Considering the whole world's attention to this incident, it seems certifiers may come under some strong pressure to establish more tamper-proof datalinks in order to not let any more airliners vanish. The technology is already existing.