NB: The investigative report below is self-explanatory; and we owe the reporter a debt of gratitude. As for the government and industry executives, all I can say is this: what you are doing is beyond corruption, beyond criminality – it is evil disregard of human life. Please stop. So many lives have been destroyed, so much tragedy has been inflicted on passengers and their families. Just because of your manic obsession with cutting costs and maximising profit. Please stop.

“The industry is designing systems with the goal of protecting the engines or saving money,” the former senior analyst at Boeing told me… But that same cost-cutting can lead to a computer disobeying the pilot, even in an emergency…. This design philosophy of protecting the engines at all costs, is a world apart from older jets—in which pilots had full control of their planes and could even burn their engines if needed, to keep the aircraft flying… In the past decade, aviation crash investigations have followed a striking pattern. It is always easier to blame the pilot, particularly one from the Global South, than the opaque engineering of Boeing.

Rachel Chitra

{ONE}

MUKTI ARJUNSINH VANSADIYA’S PARENTS were a study in contrast on the morning of 12 June 2025. Her mother, 60-year-old Divya Vansadiya, was bubbling over with excitement—“like a child,” Mukti told me. Divya and her husband, Arjunsinh, were due to fly to London that afternoon to meet Mukti’s elder sister. Mukti had wanted it to be a special experience for them and had carefully chosen the flight they were on. “I wanted them to have that Dreamliner experience,” she said. The Boeing 787 is a modern wide-body aircraft with a massive cabin and nine-seat rows, something that would have felt “grand, comfortable and memorable.” Arjunsinh, a farmer from the rural outskirts of Surat who had never flown before, was nervous, apprehensive. Mukti sat him down to reassure him. “Airlines have one of the best safety records,” she remembers telling him. “It is not like roads where you have accidents every day, papa.”

Her parents’ flight, Air India 171, was one of the shortest in aviation history: 32 seconds in total, from take-off to crash. Alongside the couple, 239 passengers and crew died, with another 19 on the ground when the plane crashed into a hostel block of BJ Medical College, less than two kilometres from Ahmedabad’s airport. As I spoke to Mukti, she kept thumbing a photo of her mother in her twenties. “Isn’t she beautiful?” Mukti asked. “Why did this happen?” That is a question that haunts Mukti and hundreds of other families about AI171—the second deadliest aviation disaster in Indian history.

The aviation establishment seemed to coalesce early on an answer. Two days before the Aircraft Accident Investigation Bureau, an agency overseen by India’s ministry of civil aviation, was due to submit its preliminary report, the Wall Street Journal ran an exclusive. It was titled “Air India Probe Puts Early Focus on Pilots’ Actions and Plane’s Fuel Switches.” Citing “people familiar with U.S. officials’ early assessments,” the article said that the preliminary investigation suggested the pilot had manually cut off the switches sending fuel to the engine. But the report had an unusual way of establishing this. On 12 July, the day of the deadline, the AAIB released its report at 1 am—no press conference, no technical briefing, no investigators taking questions. Just a 15-page unsigned, undated, document not directly blaming the pilot but suggesting, with cherry-picked data, that he had cut the fuel to the engines.

The report comes to this conclusion with remarkable economy. In just 15 pages, it refers to “fuel,” “fuel control switches,” “fuel cut-off” or fuel-related behaviour at least nineteen times. The central takeaway of the report, though, lies in one line: “In the cockpit voice recording, one of the pilots is heard asking the other why did he cutoff. The other pilot responded that he did not do so.” The sentence never says “fuel.” It never says “engine.” It never says “switch.” It does not even make clear which of the two pilots was speaking. No other recordings were made public. But, because the line appears immediately after a section that states that the engine fuel cutoff switches transitioned from RUN to CUTOFF, the reader mentally supplies the missing noun.

Several aviation engineers I spoke to said that the rest of the report is shoddy, missing crucial details that such reports usually highlight. Joe Jacobsen, the deputy director of the Foundation for Aviation Safety, told me that the data the report omitted were precisely the bits needed to determine whether the aircraft itself was in distress before the cockpit conversation.

“It doesn’t even cover the basics,” Jacobsen said. “There is no meaningful presentation of engine spool-down sequencing, no engine N1/N2 progression tables, no reconstruction of electrical-bus behaviour, no timing for when the RAT began supplying electrical power, what triggered it—just the hydraulic power timestamp. And no explanation of why independent systems like the aft EAFR failed.” The Enhanced Airborne Flight Recorder, conventionally called the black box, records every input and output of an aircraft’s system and is designed to be nearly impregnable. The Boeing 787 has two. The forward EAFR, which faced the full brunt of impact and the fire from over fifty thousand kilograms of fuel, managed to yield 49 hours of data, while the aft EAFR, found on the rooftop of a building near a largely intact tail section of the plane, showing no visible fire damage, had its housing and connectors burnt, and yielded nothing. The report also mentions that the plane’s distress beacon did not activate during the impact. “It’s built to withstand high G force and high temperatures,” Sharath Panicker, an Air India pilot, told me. “How did it not survive in AI 171?” But the report did not raise a question about this.

The report was taken at face value by most international media. “Air India crash report shows pilot confusion over engine switch movement,” Reuters reported, while the BBC noted, “Air India crash: Pilot cut off fuel to engines – no fault with plane” It was the one issue on which there was seeming consensus from the New York Times to The Sun. Right-wing outlets only differed with more dramatic headlines, such as GB News’s “Air India pilot ‘deliberately cut off fuel while staying eerily calm’ before crash that killed 260 people.” Many of the aviation world’s niche outlets, such as Simply Flying, also toed the pilot-error line.

Indian outlets were not far behind. NDTV interviewed a former pilot who had worked with SilkAir—then a part of the Singapore Airlines group, which holds a 25.1 percent stake in Air India. The pilot said it was “definitely a case of deliberate manual selection to move it to ‘off.’” The Federation of Indian Pilots, which has a history of fighting cases over the safety and working conditions of its six thousand members, has since issued legal notices to the former SilkAir pilot, as well as to Reuters and the Wall Street Journal.

Within the AAIB itself, there was less certainty about the cause of the crash. I spoke to a subject-matter expert at the AAIB, who wished to remain anonymous. (Days after the crash, the civil-aviation ministry had issued an unofficial gag order on its officials speaking to the media, even banning journalists from entering the ministry building.) They told me that the independence of the investigation had been compromised very early by the companies leading the aviation industry.

“The preliminary report was a negotiated deal between Air India, Tata, GE and Boeing—GE to a lesser extent,” the expert said. “But the slew of emails being exchanged in the days running up to the 12 July 2025 deadline was primarily between the airline and the manufacturer. The Indian and US regulators were on standby.” Tata owns a majority stake in Air India and General Electric manufactured the crashed flight’s engine. The companies, the expert added, were negotiating which parts of the findings should be released until moments before publication. “The document was released a little past midnight, and I suspect it largely had to do with Boeing’s desire to influence public perception by targeting Western audiences first.”

What followed was months of scrutiny into the personal life of AI171’s pilot-in-command, Sumeet Sabharwal, rather than the mechanics of the crashed aircraft. Several of his colleagues told me that AAIB investigators had asked whether he suffered from depression, diabetes, high blood pressure or substance abuse. His ex-wife, from whom he had been divorced for more than a decade, was allegedly asked whether she would support claims that he had mental-health issues. She refused. “Good on her,” a batchmate of Sumeet from flying school told me. “They were using any and all means to get dirt on him.” AAIB investigators also questioned Sumeet’s nephew, a commercial pilot. The Federation of Indian Pilots then sent a legal notice to the AAIB, arguing that he had no connection to the crash.

I met Sumeet’s 92-year-old father, Pushkaraj Sabharwal, in his neatly furnished Mumbai flat. He was no stranger to air crash investigations, having worked in the Directorate General of Civil Aviation for three decades before serving as its deputy director of training and licensing. He recalled taking his son to work as a child. Ten-year-old Sumeet became fascinated by aircraft, spending ceaseless hours watching them take off and land. “He was a good pilot,” Pushkaraj said.

Pushkaraj told me how crash investigations of the past had been conducted. “One must look into the life cycle of the engine, its maintenance chain,” he said. “Even minor things like the tensile strength of wiring, as, over years, wires can turn brittle and break. Then you’d have short-circuiting, electrical failures.” Aviation is an exceptionally safe endeavour. The number of fatalities per kilometre travelled has seen a steep plunge since the 1970s, with aviation deaths now almost a statistical blip, an anomaly. This level of safety was carefully built over decades of work by the industry—with rigorous regulatory oversight, flights operated by highly trained professionals, who undergo continuous evaluation, and jets whose critical systems are not just duplicate, but often triplicate or quadruplicate—if one component fails there are always other fail safes. Together, these create what civil aviation professionals call the “Swiss cheese model,” where a catastrophic failure can only occur if multiple holes in multiple defensive layers all align simultaneously. And thus, in a crash, every little piece of information, every string of data through each millisecond, needs to be methodically dissected. Simple explanations do a disservice to the safety of flying as a whole.

This was why, Pushkaraj said, he had approached the Supreme Court, asking for an independent judicial committee to oversee the AAIB’s investigation. (A similar inquiry had been conducted after a 2010 crash in Mangalore had killed 158 people.) The nonagenarian was in court to clear his son’s name. The past year had wounded him deeply. “I seem to have given thirty years of my life to an institution that, today, is busy painting my son as a murderer,” he told me.

At the end of August last year, Pushkaraj recalled, two AAIB officials visited his home with a huge entourage of Air India officials, saying they wanted to offer condolences. After that, the airline officials were sent downstairs to wait. An AAIB official told him, “We’ve come to understand why he did it.” Pushkaraj asked what his son had done. “We have come to know he has cut off the fuel of the plane,” they told him. “We have evidence.” Pushkaraj asked them to produce evidence or leave.

WHILE MEETING EVERYONE in Sumeet’s life, the AAIB did not question the only real witness to the disaster for nearly a year. The lone survivor to walk out was the 38-year-old British citizen Ramesh Viswashkumar. Speaking to the press shortly after the disaster, Ramesh mentioned hearing a loud boom in the back followed by green and white flickering lights. This was critical information that would point to a failure in the plane itself, but his testimony was recorded by the AAIB only in April 2026, after it was facing heat from lawyers in the Supreme Court. By then, Pushkaraj’s case had been joined by the Federation of Indian Pilots and by Amit Singh, a senior pilot who also runs the Safety Matters Foundation, an aviation safety NGO. Referring to the FIP’s membership, the senior advocate Prashant Bhushan told the chief justice, “My lord, as many as six thousand pilots in the country are saying these planes, the 787s, have had a history of serious electrical defects. The Air India 171 crash took 260 lives. We want these planes grounded.” A decade and a half earlier, Bhushan had fought a case against Air India’s acquisition of these same aircraft.

This case is dragging out slowly. After the AAIB did not respond within its initial deadline, the Supreme Court even offered that the bureau could submit its reply in a sealed cover. Since then, hearings have repeatedly been deferred, with the solicitor general—appearing for the Indian government, the ministry of civil aviation and the AAIB—seeking adjournments.

Meanwhile, as the petitioners place more and more data points from the investigation into the crash into the court record, it has become increasingly clear that what occurred on AI171—known in the aviation world by its the registration number VT-ANB—was a series of holes in the plane’s safety architecture that were the direct result of acts of omission and commission by both Boeing and Air India in order to cut costs. I spoke to nearly thirty pilots, engineers and analysts about the evidence presented and other documents I had received from whistleblowers at Boeing, Air India and the AAIB. Together, the picture they painted was of a disaster that was years in the making. Faults on the plane were visible years before. These compounded on the days leading to the crash and reached a tipping point on that fateful runway.

The experts pointed to a specific chain of events that brought the plane down. The Caravan has copies of the Airplane Health Management records of VT-ANB—real-time digital dossiers of maintenance analytics that Boeing’s planes send to the manufacturer and operator. VT-ANB’s AHM records show that on its previous flight, from Delhi to Ahmedabad, both the stabiliser’s position sensor and electrical motor control unit had faulted. These are part of the system that helps control the aircraft’s nose position during flight, the motor moving the horizontal wing on the tail of the plane, and the sensors telling the aircraft computers its exact position. Together, they help keep the aircraft stable during climb, cruise and descent.

The AHM records also demonstrate that all three of the plane’s Flight Control Modules—the aircraft’s “muscle” computers, which take commands from the main flight control computers and physically execute them by moving control surfaces such as the stabiliser, elevators and ailerons—were independently flagging conflict in the stabiliser data. When the entire FCM triplex goes into disagreement on a safety-critical surface such as the horizontal stabiliser, you are no longer looking at a nuisance sensor error. It points to a potential single point of failure in the airplane’s pitch control architecture. Regardless, the AHM records show the stabiliser’s motor and sensor were replaced in Ahmedabad before 12.10 pm, when the maintenance crew released the plane for flight on 12 June.

But fifteen minutes before take-off, at 1.23 pm, the FCMs themselves started faulting. These faults were all being communicated to Air India and Boeing via the plane’s satellite link, called the Aircraft Communications Addressing and Reporting System. An FCM is a highly critical component, and such a fault is called a NO-GO fault, requiring the aircraft to not be cleared for flight. VT-ANB’s ACARS codes, copies of which The Caravan has, clearly show that six NO-GO faults existed on the plane, and it was still given clearance to take off.

The codes, according to several engineers I spoke to, suggested that the plane suffered a massive electrical failure shortly into take-off. This was likely because of a failing inverter in the back of the plane, which caused a sustained electrical arc that ran through the 787’s highly centralised wiring. “The flight computers were already vulnerable to a reboot, given the faults pre-take-off,” a senior Air India engineer told me. “Just think of it like your home computer that will reboot itself automatically if it crashes. And so, these computers just needed a short power glitch to reset them, and instead what they got was a high-voltage inverter arcing. So yes, it would’ve made the flight computers reboot.” The reboot led to flight computers briefly entering “ground-mode,” which, several Air India engineers told me, led FADEC—Full Authority Digital Engine Control, the engine’s computer—to cut off fuel to the engines.

After their failure, the pilots did attempt to relight the engines. The evidence around this pokes major holes in the theory that the captain cut fuel to the engine. The AAIB report, oddly, did not mention exactly when the Ram Air Turbine—a stowed emergency wind turbine that deploys into the airstream during a total loss of power—deployed. It instead included a CCTV image implying the RAT deployed “during the initial climb immediately after lift-off.” Months later, the FIP released imagery that showed the RAT already deployed while the aircraft was still on the runway, suggesting something was already wrong with the plane before take-off.

The AAIB states that the RAT hydraulic pump began supplying power only after both engines’ N2 values—the rotational speed of an engine core—passed below the minimum idle speed at 1.38.47 pm. This would imply that the RAT powered the crew’s relight attempt at the mid-point of the 32-second flight. But RAT can only aid the relight if the aircraft is flying at a minimum of 300 knots, and VT-ANB achieved only 180 knots. Another source of power is the auxiliary power unit, a starter generator at the back of the plane. But this would be unlikely as well, since the report says that the APU’s inlet door was opened only at 1.38.54 pm.

The only other source of power for the aircraft to attempt a relight is the permanent magnet alternator generator, which relies on the smaller fan in each engine that remains spinning for a short while after engine cut-off. “But it can succeed if it is producing at full voltage—that is, five to eight seconds after the engine goes down,” an Air India engineer who worked on 787s, including VT-ANB, told me. “It certainly could not have happened ten to fourteen seconds later, as the AAIB implies.” The bureau’s timeline for the engine relight, they said, was “electrically impossible.”

The engines could only have relit between 1.38.45 pm and 1.38.50 pm, and not between 1.38.52 pm and 1.38.56 pm, which the AAIB report concludes they did. The AAIB notes that the first engine, “core deceleration stopped, reversed and started to progress to recovery” while “Engine 2 was able to relight.” That behaviour is not instantaneous. The engineer told me it requires a relight sequence lasting several seconds. During those seconds, engine computers must have authority to command ignition and fuel introduction—which means the fuel switches had to be in RUN mode. “The AAIB’s own data would imply the pilots’ hands were nowhere near the fuel switches,” they said.

+++

WHAT IS ASTOUNDING is that the pilot-error narrative has not shifted despite several concerning incidents on 787 Dreamliners since 12 June 2025. Just four days after the AI171 crash, AI315 returned to Hong Kong shortly after take-off, as the pilot suspected a technical issue mid-air. The next month, LATAM Airlines 603 suffered electric problems leading to an uncommanded RAT deployment shortly after take-off. Then, in October, AI117 from Amritsar to Birmingham had an uncommanded RAT deployment minutes before landing. Three months earlier, United Airlines 108 had declared Mayday, after an in-flight engine shutdown shortly after take-off, but was able to safely land. Also in October, AI154 diverted to Dubai en route from Vienna to Delhi after reportedly experiencing autopilot failures.

In November, a Tokyo-bound 787 aborted its take-off. The Tokyo flight had faults in its backstage processors and fault-monitoring system—its general processor modules and central monitoring computing function—as well as in a hydraulic pump. By the end of 2025, the directorate general of civil aviation issued Air India a show-cause notice for allowing a plane to take off despite knowing it had faults. These incidents create precisely the pattern that, aviation safety experts say, should have triggered deeper scrutiny of Air India’s Boeing 787 operations.

Despite not admitting fault, the civil-aviation industry seems to be taking protective measures. Britain has already started scrapping the 787s it purchased in 2013—the year VT-ANB was made. Significantly, Air India grounded three Boeing 787s after the AI171 crash and has not informed the public what issues these planes are facing. The first of these, VT-ANA, was grounded between August and October at Joramco, one of West Asia’s largest independent wide-body heavy-maintenance facilities, located in Amman, Jordan. The aviation-safety expert Mark Martin told me that the Dreamliner being parked in Jordan has serious implications, as Air India sends planes there for only long-duration structural inspections, heavy checks and modification work. A second Dreamliner, VT-ANE, was at Etihad Engineering’s wide-body Maintenance Repair and Overhaul complex, which specialises in composite structural repair and heavy checks, between July and September. The third has been parked in India at Tata’s Mumbai MRO since July, undergoing extended troubleshooting for recurring technical issues.

Air India refused to publicly comment on why these planes were grounded. “All three of these Dreamliners entered service around 2012–13,” a flight engineer at the Mumbai MRO told me. “Typically, the first heavy structural check cycle on a 787 should occur in the twelfth year, and for none of these planes was a check due. Air India is clustering multiple multi-month heavy checks now in 2025, right after AI171. This really doesn’t seem to be normal, staggered fleet-maintenance behaviour.” The engineer told me that, for such long periods of downtime, “airlines would be losing money hand over fist.”

Sam Thomas, the president of the India chapter of the Airline Pilots’ Association, granted that nothing could be said with certainty. “There’s also the possibility that these maintenance checks could be routine, because even if there’s a scheduled check, airlines can get a waiver to do it later,” he told me. But for a long-haul subfleet, he said, having three Dreamliners tied up at heavy MRO bases and two more offline at Boeing’s factory in Victorville, California, is unusual. Despite the groundings, Air India’s former CEO, Campbell Wilson, still maintained in October that “there was nothing wrong with the aircraft’s operations or practices that required changing.” Worryingly little is known about what retrofitting is occurring at the Victorville factory. “Boeing did not allow FAA officials in November to inspect these planes at its Victorville factory,” a senior analyst at Boeing, who wished to remain anonymous, told me, referring to the US Federal Aviation Administration.

Since the civil-aviation world is so deeply intertwined in commercial relationships, it seems unlikely that that very much accountability can be expected in this process. The Tata group, which owns a majority stake in Air India, should have had tough questions for Boeing, but is tied to every step of Boeing’s production chain. It manufactures floor beams and aerostructures for the 787, while the joint venture Tata–Boeing Aerospace, in Hyderabad, manufactures fuselages for Boeing’s AH-64 Apache attack helicopters. In the West, after a crash like this, it is often the insurer that pushes for a thorough investigation, as they have the most to lose financially. Air India has a syndicate of direct insurers led by Tata AIG General Insurance. “In such a tightly intertwined ecosystem of governments, airlines and aerospace giants, it becomes dangerously easy for a pilot’s reputation to be sacrificed so that business and a strategic relationship worth billions of dollars can continue,” the senior editor S Raghotham told me.

{TWO}

DESPITE THE POMP of its arrival at Chennai International Airport, in September 2012, with coconut-breaking, pujas and a water cannon salute, Air India’s first 787 Dreamliner landed with the weight of 92 giddy passengers and a nearly decade-old political scandal. The airline, still owned by the union government at the time, had ordered 27 Boeing 787s as part of a much larger aircraft purchase in 2005 and 2006: 68 Boeing aircraft for Air India, and 43 Airbus aircraft for Indian Airlines, a combined 111-plane order that cost Rs 67,000 crore for purchase and leasing. From its earliest days, questions shadowed the acquisition.

Critics argued that the order, the brainchild of the minister of civil aviation at the time, Praful Patel, was not matched by route expansion, revenue planning or the financial strength of the national carrier. Specifications for seats and configuration were changed at the last minute to favour Boeing, which led to an outraged response from Airbus—which often sells cheaper planes than its primary rival, Boeing—and calls for investigations into the deal. Air India, which had recorded comfortable profits in 2003, 2004 and 2005, began moving quickly into the red. The comptroller and auditor general said that the debt-funded acquisition had “contributed predominantly” to Air India’s massive debt, which stood at Rs 38,423 crore by March 2010.

Patel’s other initiative was as much to blame. The 2007 merger between Air India and Indian Airlines proved especially damaging, creating deep organisational dysfunction, labour disputes and mounting debt. By the late 2010s, Air India was surviving largely through repeated taxpayer-funded bailouts. Despite employing experienced pilots and engineers, it struggled with ageing infrastructure, procurement controversies, maintenance delays and a reputation for poor service reliability.

By 2014, the Central Bureau of Investigation was investigating the Boeing order, prompted by a 2012 case in the Supreme Court by the Centre for Public Interest Litigation, represented by Prashant Bhushan. By 2017 this had grown to four cases. The CBI filed its case closure report in one of the leasing cases, finding no wrongdoing, after the Ajit Pawar faction of the Nationalist Congress Party, of which Patel was part, aligned with the Bharatiya Janata Party’s alliance in Maharashtra. Air India continued to struggle financially until its 2022 acquisition by the Tata group, which had founded the company before its nationalisation, in 1953. The conglomerate’s attempts to turn Air India around, however, have been mixed, with the airline still posting record losses despite expanding its fleet significantly and refitting its creaky interiors.

Dreamliners had not even entered production at the time of Patel’s landmark deal and, over the next half decade, were subject to delays. Boeing’s flagship aircraft was already battling technical and certification troubles globally and had suffered repeated setbacks—from design and production problems to concerns around its heavily electrical architecture and lithium-ion battery systems. VT-ANB belonged to this earliest generation of Dreamliners inducted into Air India.

“Over the years, we’ve seen some very dangerous EWIS”—electrical wire interconnection system—“practices across multiple Boeing programmes,” Ed Pierson, the executive director of the Foundation for Aviation Safety, told me. “Fatigued employees, skipped installation plans, poor electrical bonding and grounding, improperly installed wire bundles, unqualified staff performing electrical work, rushed functional systems testing, and the removal of long standing quality inspections—all of this can create latent defects in a variety of aircraft systems which can be extremely difficult to troubleshoot. These flaws often produce those frustrating ‘No Fault Found’ or ‘Cannot Duplicate’ maintenance reports.” These were airborne fault warnings and pilot complaints that engineers were unable to reproduce during ground testing, often because intermittent electrical or software glitches can temporarily disappear before troubleshooting begins. “In the military, we used to call them gremlins,” Pierson said.

Pierson and his deputy, Joe Jacobsen, are both Boeing whistleblowers who spoke to the US Senate’s permanent subcommittee on investigations, laying out the disturbing maintenance chronology for VT-ANB. In their submission, they noted that VT-ANB suffered significant electrical system problems from almost its maiden years in service. As early as 2014, there were issues with the aircraft’s fire inerter, which prevents fuel tank explosions by continuously flooding the tanks with nitrogen-enriched air. This was replaced. In January 2022, VT-ANB experienced a major electrical fire in its P100 power distribution panel—one of the central nodes in the 787’s highly integrated electrical architecture—stranding it in Frankfurt. The incident was serious enough to require panel replacement, and raised questions about wiring integrity and short-circuiting. In January 2023, when the plane was in Delhi, there was a collapse of its generator and power distribution.

The Caravan has copies of internal correspondence between Boeing and Air India, which show that, in this case and in subsequent ones, Air India followed Boeing’s Fault Isolation Manual to the letter. It replaced components and performed wiring integrity checks, documenting every step. Boeing certified each repair as compliant, but these issues kept recurring. The P100 distribution panel alone had to be replaced twice. This is critical because, on VT-ANB’s last day, all three of these systems—the power distribution, the generator and the inverter powering the fire inerter—failed simultaneously. What the emails expose is not poor maintenance but a certification infrastructure that treats symptoms while ignoring architecture. Boeing’s responses consistently directed Air India towards component-level fixes.

The Foundation for Aviation Safety’s submission describes an anomaly in the landing gear, in April 2022, attributed to problems in the plane’s central electrical architecture, called the common core system. Instead of isolated, easy-to-blame mechanical snags, the pattern points to recurring issues in the aircraft’s core electrical and computing infrastructure—exactly the domains flagged as vulnerable by earlier US FAA directives, by John Barnett, a quality-control manager at Boeing South Carolina, and by independent cybersecurity analyses. Pierson told me that “Boeing and Air India should have treated VT-ANB as a high-risk outlier long before the crash” and that “the clustering of electrical and CCS issues should have triggered a deep dive into Boeing’s design and quality records.”

These past technical faults also raise troubling questions about the conduct of the AAIB investigation itself, because the preliminary report does not mention them anywhere. There are, fundamentally, only two possibilities. Either the technical history and prior electrical issues involving VT-ANB were new information to investigators, in which case this could be criminal concealment of relevant information by Boeing and Air India. Or, investigators already had access to this information before the preliminary report was released, in which case the AAIB would be culpable for not investigating technical issues, and instead pointing to Sumeet.

+++

FOR MUCH of the twentieth century, Boeing was regarded as the gold standard of aerospace engineering, building its reputation on conservative engineering, rigorous testing and an almost obsessive safety culture. Boeing engineers famously operated on the principle that aircraft should be designed with layers of redundancy and fail-safe protection, because lives depended on it. That culture produced some of aviation’s most celebrated aircraft: the B-17 Flying Fortress, the 707 that launched the jet age, the 747 jumbo jet that transformed global travel and, later, the 777, considered one of the safest and most technically refined aircraft ever built. Inside Boeing, engineers historically held enormous authority, and decisions were driven primarily by technical considerations rather than quarterly earnings.

Many aviation historians and former Boeing employees trace the company’s cultural shift to its 1997 merger with McDonnell Douglas. Critics argue that McDonnell Douglas’s management philosophy ultimately took over Boeing. The new leadership increasingly prioritised shareholder returns, production targets and cost discipline. Over time, veteran engineers lost influence to finance executives and programme managers. Production was aggressively outsourced, supply chains fragmented and pressure intensified to deliver aircraft faster and cheaper. The consequences soon became painfully visible, particularly in its 787 programme. The aircraft was launched as a technological leap—composite fuselage, electric bleed-less architecture, a globalised supply chain—but it quickly became synonymous with delays, improvisation and patch-up fixes.

The 787’s earliest production block, nicknamed the “terrible teens,” consisted of heavily overweight, out-of-tolerance airframes that sat for years in rework because they did not meet delivery standards. Barnett told the BBC he could see under-pressure workers were deliberately fitting sub-standard parts to aircraft on the production line, in some cases pulling them from scrap bins to avoid delays because the plant was strictly driven by schedule and cost. “Boeing quit listening to their employees. So, every time I’d raise my hand and say, ‘Hey, we got a problem here,’ they would attack the messenger and ignore the message,” he said. Barnett submitted all his findings under the FAA’s whistleblowers’ protection programme. Two days into his deposition, he was found dead by a gunshot wound. Law enforcement said that there was no foul play in the death, nonetheless it cast a chilling shadow over other employees considering speaking out.

Barnett documented metal shavings left near critical flight‑control wiring, warning that they could chafe through insulation and cause catastrophic failures. FAA spot checks later confirmed shavings where Boeing had assured regulators none existed, forcing retrofits before delivery. These were not isolated incidents. Barnett also described a wider culture inside Boeing’s 787 plant in North Charleston, South Carolina, in which traceability rules were bypassed, workers were under relentless production pressure, and management treated safety concerns as obstacles rather than warnings. The Dreamliner’s electrical system generated its own scandals. In 2013, lithium‑ion battery fires grounded the global fleet. Each time, Boeing and the FAA insisted that fixes were in place and that the 787 was safe to fly. Each time, internal whistleblowers painted a much darker picture of systemic shortcuts and unresolved risks.

In 2024, the Boeing engineer Sam Salehpour blew the whistle on flaws in the 787’s fuselage assembly process. He claimed that workers were forcing misaligned composite barrel sections together—at times, physically jumping on them—leaving tiny gaps that were not properly shimmed. Over time, he warned, those gaps could concentrate stress and lead to premature fatigue or structural failure long before the aircraft reached its intended lifespan. Salehpour said he faced retaliation after raising the issue internally, prompting the FAA to open a fresh investigation even as Boeing maintained that the in-service Dreamliner fleet remained safe. By the time AI171 crashed, a pattern was already visible in the public record: a manufacturer that appeared to treat each controversy as a reputational crisis to contain rather than as a deeper systemic problem to confront.

The most worrying aspect of the 787 programme was that nearly all of its faults were raised by whistleblowers rather than by the FAA, whose role it is to certify the process by which aircraft are made. It was only after two 737 MAX’s crashed in 2018 that the reason for the FAA’s failures became clear. Boeing had learnt how to work the regulator, rather than fear it. In a 2020 report, the US House of Representatives’ committee on transportation and infrastructure found that Boeing repeatedly pushed schedule and cost over safety, while the FAA delegated critical certification work back to the company itself. The software that crashed both Lion Air 610 and Ethiopian 302 was certified by the FAA though they had minimal understanding of it, while Boeing downplayed its training requirements.

“I just Jedi mind-tricked these fools,” a Boeing employee boasted in internal communication. “I should be given $1000 every time I take one of these calls. I save this company a sick amount of $$$$.” He had, he explained, convinced them that all airlines and regulators accept only computer-based training, “to make them feel stupid about trying to require any additional training requirements.” It was a glimpse into the culture congressional investigators later exposed: regulators were not always treated as independent checks but as obstacles to be managed, outflanked or, in Boeing’s own language, “Jedi mind-tricked.” The same report catalogued “undue pressures” on engineers, retaliation against those who raised safety concerns, and a revolving door between Boeing and FAA that eroded the independence of federal oversight.

In the past decade, aviation crash investigations have followed a striking pattern. It is always easier to blame the pilot, particularly one from the Global South, than the opaque engineering of Boeing. In October 2018, when Lion Air 610 crashed, killing all 189 people onboard, Boeing and parts of the West’s aviation establishment quickly pushed the narrative toward pilot error, poor training and Indonesian aviation standards. The life of the pilot, Bhavye Suneja, stopped being dissected and scrutinised five months later, when Ethiopian Airlines 302—the same Boeing 737 MAX model as LA610—crashed, killing 157 more people.

Rather than sending the black box to be studied in the United States, as is often done, Ethiopian investigators flew them to be studied by French experts. Their findings clearly showed that proprietary Boeing automation software to stabilise the plane had repeatedly forced the nose of the aircraft down because of faulty sensor data. The pilots had fought desperately to regain control, but Boeing’s software and lack of redundancies for sensor malfunctions had led to the disaster. After the crash, all 387 Boeing 737 MAXs were then grounded for more than a year, costing the airline $20 billion in fines, compensation and legal fees—and about three times that in cancelled orders. If Boeing has learnt anything since, it is that bad media perception of the cause of a crash can be a very costly affair.

Formally, the AAIB is the lead investigator in the AI171 crash. But, in practice, the analysis of the black box is not just a mechanical download. The data has to be decoded, matched to Boeing’s parameter maps, interpreted against the company’s system logic and then argued over by investigation groups. The AAIB used the US National Transportation Safety Board’s help to retrieve and analyse black-box data. Instead of ring-fencing the recorders from interested parties, as the Ethiopian government did, it has repeatedly relied on the US system for analysis and interpretation. That gives Boeing and US regulators enormous room to influence the frame: which data points matter, which anomalies are treated as noise, which failure paths are considered plausible, and which are ruled out.

This is not paranoia. In the 737 MAX crashes, Boeing’s design assumptions escaped proper FAA scrutiny and the US Congress later found deep failures at both Boeing and the FAA. In 2024, the NTSB itself sanctioned Boeing for violating investigation rules in the Alaska Airlines MAX 9 case by disclosing non-public information and speculating on cause. So, the issue is not whether Boeing can “change” black box data. The issue is whether Boeing and its regulator should be allowed so close to the interpretation of data in a crash where the company’s own aircraft architecture is under question.

Boeing and the US regulators have certainly been monitoring the AI171 investigation closely since the day of the crash. The AAIB’s preliminary report says, “A team led by the NTSB Accredited Representative comprising of representatives from Boeing, GE and FAA arrived at Ahmedabad on 15.06.2025 and participated in the Investigation.” However, a member of the management team at Lloyds—the British bank is part of Air India’s reinsurance syndicate—told me that Lloyds representatives, along with a “go-team” from Boeing and General Electric, had already visited the site two days earlier.

This is a question that came up in parliament too. Six months after the crash, Manish Tewari of the Congress party raised a series of pointed questions in the Lok Sabha, including “whether the Government would furnish the chain of custody, access protocols and current status of the Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) and the procedure followed during their transfer, examination and evaluation by domestic and foreign investigators.” He also asked whether the government intended to conduct an independent, time-bound review of the investigation process to eliminate conflicts of interest, uphold global aviation safety standards, restore public confidence and ensure transparency. The ministry of civil aviation simply replied that other states “may” participate and noted the rules under which the AAIB is allowed to investigate the crash. Tewari told me it was “effectively a non-answer … that sidestepped the core questions being asked.” Boeing, Air India and the AAIB did not respond to a detailed questionnaire from The Caravan.

HOURS BEFORE THE CRASH, Akash Vatsa was exasperated. He was flying in VT-ANB on its previous flight from Delhi to Ahmedabad, and nothing seemed to be working on the aircraft. “This AC is not working at all, as usual the TV screens are not working, neither this button to call the cabin crew—nothing is working, nothing, not even the light is working,” he said in a video he took as the plane waited for permission to take off from Delhi. “This is why Air India is considered one of the worst airlines in the world,” he added, panning around to show other passengers use the in-flight magazines to fan themselves in the gruelling June heat. When Vatsa uploaded the video after the crash, viewers mocked him, calling him a fussy traveller who did not understand how aircraft systems worked. Perhaps unknowingly, he was documenting the first public evidence of a deep electrical failure spreading through VT-ANB’s core.

On the 787, the in-flight entertainment, cabin-climate control and crew communication panels are not isolated luxuries—they share both power and data on the aircraft’s core network. The same core network connects dozens of flight-critical systems, including the pathways to the FADEC and the flight computers. Boeing describes the Dreamliner as offering “advanced aerodynamics, more efficient engines and more electric systems.” The common core system is one of its biggest selling points. The CCS is an integrated, modular network that ties together functions that earlier jets handled with more discrete, independent systems. The goal of the system was evidently to cut costs. A December 2013 technical bulletin by Boeing notes that the 787 “differs from the traditional aircraft system, where each individual system requires its own dedicated communications route … the 787 architecture reduces the amount of wiring, hardware and overall weight of the airplane.” This reduced weight means lower production costs for Boeing, and lower fuel costs for the 787’s operators.

But that integration comes at a cost. In 2019, the security firm IOActive warned that the 787’s core network architecture exhibited insufficient redundancy and inadequate segmentation, raising concerns that failures in one domain could propagate in ways the original certification had not fully anticipated. Boeing publicly responded to IOActive by arguing that its systems had sufficient redundancy. However, the company’s internal documents, copies of which are with The Caravan, show that Boeing was well aware that they were lying. An internal document, dated 3 December 2013, reads, “the failure of one component in the common core system can lead to the failure of multiple systems.”

Three days before the crash, according to the AAIB preliminary report, maintenance staff logged that the plane’s core network was degrading. But this was a serious issue that Air India could have easily underestimated. In its operations notes to airlines, Boeing minimised the damage an inoperative core network could do, only mentioning that it tied non-flight critical systems. Maintenance marked the core network as “medium-risk”—issues that the airline can take a few days to fix. However, the core network connected dozens of flight-critical systems alongside as many mundane functionalities, such as the plane’s air conditioning.

Alongside the degraded core network, the AAIB report notes, the aircraft was already reporting cabin- and cargo-related faults in the weeks prior to the crash, all signalling stress with the same electrical ancestry. I was informed about this by an Air India engineer who had serviced the plane a few months before the crash. They were wracked with guilt when I spoke to them, having self-isolated for a month, repeatedly watching images and videos of the crash on repeat. “It’s like background music, the crash,” the engineer said. “It’s always at the back of my mind, the rhythm to my day at the site. I kept thinking what I could have done differently.” But it was not any one part’s maintenance alone that caused the crash. “If Boeing or the airlines gave engineers more authority, leeway and time when it came to dealing with faults, it’s possible the root cause could have been identified,” they said.

The AAIB reports that it had marked the plane’s data network or core network as CAT C MEL, or a “medium risk” entity, and the fire-inerter fault as CAT A MEL, or “high risk.” The urgency to deal with each of these differs. Boeing assesses the operational risk of a component failure and proposes dispatch conditions and repair timelines, which are approved by regulators such as the FAA and the DGCA, which largely apes all of the FAA’s guidelines. In practice, airlines do not always wait until the final deadline to fix an issue, instead fixing them based on a range of factors such as the availability of spare parts, engineering manpower and aircraft routing. But “high-risk faults need to be fixed immediately, making it extremely odd that the AAIB says the airline had nine more days to fix the fire inerter. “What does the AAIB report mean by saying the MEL is valid for the next ten days?” CS Randhawa, the president of the Federation of Indian Pilots, asked me. “If it was invoked on June 10, it should have been fixed by June 11, as it’s high-risk. How did they give it so much time?”

After it was released from maintenance, fifteen minutes before take-off, the aircraft’s ACARS logs started streaming fault after fault. At 1.23 pm, six sets of NO-GO warnings were sent. The ACARS told everyone in the loop that AI171’s left and right bus power control units—the computers that act as traffic controllers for electrical power—had entered fault mode, unable to keep the left and right 115-volt AC buses, or electrical junction points, in sync. It gave this warning three times. The aircraft’s two main power highways were falling out of phase, a condition that can cause surges, flickers or even short-circuits across systems. Next, all three FCMs began reporting operational errors, before two general processor modules, which perform calculations and control power supply, faulted. Taken together, AI171 was not dealing with a single fault but a systemwide degradation. All the holes in the Swiss cheese were aligning. Even one NO-GO fault should have been enough to disallow the plane from being cleared for take-off. There were six.

How was an aircraft in such disrepair allowed to fly? Before a flight departs, multiple layers of clearance are involved. Engineers must certify that the aircraft is airworthy or legally dispatchable under the MELs. Pilots then review the aircraft technical log, onboard warnings, weather, fuel, flight controls and take-off performance before accepting the aircraft for flight. Finally, air traffic control issues the actual take-off clearance for the runway. But the faults on AI171 slipped through the cracks, because the fault-monitoring mechanism also likely stopped working at the same time as flight-critical issues were surfacing.

Three days earlier, the aircraft’s core network was marked as an active fault. Once it starts degrading, this core network can also impact the Airplane Condition Monitoring Function, the Central Maintenance Computing Function and the pilots’ Electronic Flight Bags—all of which report faults in the plane to the cockpit. An internal maintenance note of Boeing, a copy of which The Caravan has, itself notes that an inoperative core network could impair the ACARS transmission of faults to the cockpit tablets or EFBs. When maintenance signed off, it did not have NO-GO faults. When Sumeet and his co-pilot, Clive Kunder, checked in the cockpit, the NO-GO items likely never appeared.

Because of the architecture of the ACARS system, Air India’s operations centre in Gurugram and Boeing’s data monitoring hub in Belleville, Illinois, were getting second-by-second updates on the faults of VT-ANB. “Air India’s operations control centre, under their live maintenance control department, are in charge of giving the call backs to pilots of flights that they have found faults in,” S Sen, an Air India pilot, told me. “This can happen as we’re taxiing, when we’re at the holding point before take-off or even after we have taken off. Then they will ask us to circle around and land at the departure airport itself. I have worked with other airlines and they have the same system too, every operator does.” When I asked him if it is a frequent occurrence, he said it was not because most faults would be found at the maintenance stage itself, and the flight would not be cleared for take-off. “But in a carrier that has about eight hundred aircrafts, it would happen about once a month.” Other pilots I spoke to reported the same procedure of monitoring by the operator and call backs to the pilot.

Other companies involved in the plane’s architecture, such as the engine manufacturer, would often get live updates too. An engineer from Safran Electronics, which is the creator of the 787’s FADEC, told me that the aircraft “also had live Engine Health Monitoring from its engines going to GE. For instance, if they see an issue with the engine, the plane can be at the holding point and still be called back.” But Air India, General Electric and Boeing did nothing to stop AI171’s take-off. This means that even if Sumeet had a death wish—a narrative for which the AAIB, Boeing and Air India have not produced a shred of evidence—the crash would still be criminal negligence on the part of all three companies.

The aircraft was cleared for take-off at 1.25 pm. At 1.38 pm, it started to roll and lifted off. The sheer negligence on Air India’s part became clearer later. At 1.50 pm, a full eleven minutes after the crash, an operator from Air India’s Gurugram operation centre sent the crashed plane a message asking, “DEAR CAPT CFRM ALL OPS NORMAL.”

{THREE}

MARK MARTIN WAS 16 years old when his father was blamed for a crash. His father was a helicopter pilot in the Indian Air Force and was out on deputation with the DGCA, in 1987. The DGCA lacks manpower and expertise and often takes in pilots from the IAF and even commercial airlines. “For the DGCA, he was flying a Hiller UH12 near a remote village in Kerala,” Martin told me. “At five hundred feet, the engines suddenly went dead. Given how little time he had, he attempted landing at a relatively open spot and crashed into a hut nearby. Nobody was in it, and nobody got hurt except my father, who was injured from head to toe. I remember being in the hospital when I heard that the AAIB had said the crash was caused by my father.” He said AAIB officials had announced that, at that altitude, the right thing to do would have been to attempt a relight of the engine rather than attempting a landing.

By 2012, Martin was a pilot on business jets. He told me that year, the DGCA analysed several crashes and released a directive saying that, in such a situation, the pilot should not attempt a relight and should instead land. “I took a printout of that directive to my father’s grave and laid it there,” Martin told me. “I returned home after that, had three shots of whiskey in his honour and said, ‘Finally, we’re right. The bastards are wrong.’” The moment pushed him to be an airplane crash investigator.

Piloting has never been simple. It requires an enormous store of memorised procedure and error responses, most of which must be executed in high-stress environments, with little margin for error. A mistake can cost a lot of lives and a lot of money. On the face of it, being a pilot appears to be a flashy and well-paid job. But when things go wrong, the industry’s financial incentive is to blame the cockpit rather than the machine design. As the commercial pilot Balraj Bhullar put it, “In the aviation world, Rachel, if someone is alive, hang him. If someone is dead, blame him.” Whatever you prepare for, whatever fail-safes exist on a plane, there could always come a time when every single one of those Swiss cheese holes align. All you have is protocol and knowledge fighting a ghost in a machine.

“A clean take-off roll on a 787 should take only between forty and forty-two seconds,” Amit Singh, one of Pushkaraj’s co-petitioners, told me. AI171 took a full 62 seconds, nearly double the time it was actually airborne. Normally, as the plane’s nose begins rising at about three degrees per second, lift increases, drag rises sharply, and the aircraft naturally stops accelerating the way it did on the runway. But AI171 did the opposite. It shot up. This was a fact that Simon Hradecky, an electronics engineer and editor at Aviation Herald, kept returning to in our conversations. He pointed out that, according to the AAIB report, the aircraft had been accelerating at nearly four knots a second immediately after take-off, compared to 2.6 knots a second on the ground. It was a telltale fingerprint that something was holding the jet back on the ground.

The explanation for the loss of speed on the runway seemingly lies in an ACARS code the plane had beamed out at 1.38 pm, the minute it was about to take off. This code indicates that there was a problem with the locking sensors of the thrust reversers, the devices that tell the FADEC whether the engine’s rear doors are properly sealed for forward thrust. If the thrust reverser doors are not fully sealed, hot exhaust air could leak forward into the engine’s intake, disrupting smooth airflow and causing the engine to lose power or stall. To ward against this, the FADEC limits thrust.

Soon after the plane was airborne, a rapidly growing number of ACARS codes began beaming out strings of faults codes, indicating that major systems, including flight control computers, were going down, taking dozens of subsystems and sensors in their wake. Multiple engineers and pilots told me that so many different systems failing at once points to a cascading electrical failure.

Based on the information we currently have—from ACARS codes, leaked documents I accessed from Air India, the AAIB and Boeing, as well as the expertise of the nearly thirty pilots, aircraft engineers and Boeing analysts and subcontractors I spoke to—the aircraft suffered a massive electrical failure shortly into take-off. Two days before the crash, maintenance engineers had marked the fire inerter as a high-risk fault. Along the same electrical line, called R2, as the inerter lay several other components that were faulting, such as the cabin air compressor, whose faults were already visible from the fluctuating air-conditioning in the previous flight, and the stabiliser’s motor and sensors that had been replaced in Ahmedabad.

In the tail section of the plane, near the inerter and the compressor, is an aft zonal dryer, a small unit that removes moisture from the ventilation air around them. “The aft zonal dryer itself was removed in later 787s around 2018,” Mike Andrews, the lawyer representing the families of more than 120 victims, told me. “We don’t know what problems existed with it that it was replaced with other systems. But older models like VT-ANB still had the dryer. Water intrusion and water leaks into the front and aft electronic bays has been a repeated problem with 787s.”

On VT-ANB, an ACARS code shows that, fifteen minutes before take-off, the aft zonal dryer was likely failing. If the dryer was malfunctioning, there would be a buildup of moisture in the aft bay, with high condensation risk on the wiring and high-voltage inverters, raising the risk of short circuits or even an arc. In fact, that very day, another Air India 787, departing from Vienna, had been grounded by an Austrian engineer because its electronic bays got flooded with water. But unlike the flight in Vienna, VT-ANB’s fault-monitoring mechanism was also faulting, indicating that the severity of the rising temperatures in the aft electronics bay could have gone undetected. Additionally, the plane’s left and right bus power control units were already slipping out of phase, one of the NO-GO faults that the companies had overlooked.

If the BPCUs are also faulting, power quality can swing violently, and protection may not isolate the inverter when it should. As heat built up, it is likely the inverter reached its thermal and dielectric threshold limits—meaning, its cooling and insulation could no longer contain the voltage. “When that happens, the inverter will discharge through nearby wiring harnesses a sustained electrical arc—a plasma-level short that can melt metal and vaporise insulation,” a senior Air India flight engineer, who did not want to be named, told me. This explosive electric charge is likely the “loud boom in the back” that the sole survivor heard.

Take-off is always one of the most electrically demanding phases of flight—all four power channels, BPCUs and hydraulic pumps draw maximum load as the plane transitions from ground to airborne mode. It is in this phase that any latent faults or improper wiring can surface and cause unintended consequences.

The trigger for the electrical arc was probably the demand placed on the system when the landing gear was commanded up. On successful climb, Clive would have commanded the wheels “UP” a second before and Sumeet would have executed his command as the pilot monitoring. The gear would have started retracting, then stopped milliseconds later. The hydraulic right pump—which supplies pressurised fluid that powers critical aircraft systems such as flight controls, brakes, landing gear and steering—had already faulted before take-off. Sitting on R2, the electrical arc would have hit it too. The AAIB report only notes that the landing gear itself was physically down, but does not share black box data on whether it had stopped its retraction.

The flight engineer told me that the maintenance engineer on the previous flight had already warned about the possibility of this high-voltage inverter arcing, and on the crash flight it did—sending sharp voltage spikes surging back through the airplane’s 28-volt and 115-volt power buses, rippling through the core network. “This indicates a cascading electrical failure,” they told me. Four ACARS codes corroborate this, suggesting the arc passed through the R2 line, hitting the forward and aft electronics bays. These codes suggest that the arc cooked the wiring of the emergency distress beacon and crippled the auxiliary power unit—a starter generator for the plane’s massive turbofan engines in an emergency. The AAIB report documents the results to the components nearby. “The Emergency Locator Transmitter (ELT) was not activated during this event” … the (aft) EAFR had impact and thermal damages to the housing. The wires were protruding from the housing and the connectors were burnt.”

The most dangerous of these failures is the auxiliary power unit, because it meant that AI171’s emergency power source failed before its engines did, a possibility that Boeing had not designed to prevent. The AAIB report seems to argue against this possibility, stating, “the APU was inspected and found intact … APU inlet door began opening at 08:08:54 UTC”—that is, 15 seconds after liftoff. But the Air India engineer who had maintained the plane three months before, and had seen its electrical degradation, told me that the “APU inlet door opening was probably a result of the prior electrical disturbance on the plane; that same disturbance that resulted in the deployment of the RAT”—the ram air turbine, which is the plane’s other reserve of power.

The final effect of the electrical arc was likely the rebooting of all three of AI171’s flight-control computers. The possibility of something like this occurring was already flagged by the FAA as early as 2016. The FAA had found that if a 787’s flight-control modules are continuously powered for 22 days, all three would simultaneously reboot mid-air. To ward against this, it recommended a 21-day power recycle for the FCMs, and, similarly, a 51-day power recycle for the common core system to clear up any software corruption, stale data accumulation or latent logic faults building up. Air India did not respond when I asked whether such a recycle had been done on AI171.

But, even if a recycle had been done, the FCM almost certainly rebooted because of the electrical arc. The danger of such a reboot is that, for a few moments, the logic deep inside the computers would have silently flipped to its failsafe “ground mode,” before it started up, analysed and flipped back to “air mode.” Immediately, every flight parameter on the plane—weight-on-wheels, thrust reversers, flaps, spoilers, landing gear, stabiliser trim—would have gone to their fail-safe mode, which would be “on ground.”

“The spoilers”—the flat panels on the top surface of an aircraft’s wings—“will likely deploy if the plane goes to ground mode in air,” Singh told me. This makes sense when on ground, because drag is created and airflow disrupted, allowing the aircraft to slow down safely and stay on the runway. In the air, this can make the plane stall. The thrust reversers, already faulted, would go from “stowed” to “idle reverse.” This means the engines directing airflow backwards would redirect airflow in the opposite direction to have a gentle braking effect, like on a landing plane. Both the spoilers and thrust reversers would have led to an immediate loss of lift and forward thrust. As with the landing gear, the AAIB report only describes the final physical position of thrust reverser and does not mention the spoilers. “The digital capture for the very systems that determine ‘air’ versus ‘ground,’ for whether there was a stall, for whether the fly-by-wire automated jet went into manual mode—are all conspicuously absent from the report,” an engineer at Emerson Electric, a Boeing subcontractor, told me.

All of these errors would have hit the cockpit immediately after take-off. The amber coloured “master caution” light, the aircraft’s general warning alert for significant system problems would have suddenly lit up. Then, on the flight warning display, if the fault-monitoring system was working, the ACARS codes suggest amber messages would have started queuing faster than any human eye could read: “ELEC SYS,” “BUS ISLN,” “GEN OFF BUS,” “RAT DEPLOYED,” “SPOILERS,” “STAB TRIM.” And then the loss of flight-critical data: “AIR DATA SYS,” “ALT DISAGREE,” “MACH DISAGREE,” “CAS DISAGREE,” “CABIN ALT AUTO,” “PACK,” “ZONE TEMP,” “DATA COM,” “BAT DISCH.” Then whole sections of the cockpit display would have frozen on their last readings as the computing and power backbone feeding the warning display collapsed—a sudden, systemwide blackout, like a stroke cutting off blood flow to the brain. The cockpit lights would have flickered.

Two seconds later, Sumeet and Clive would have heard the sound that pilots reserve for their nightmares: the sound of the left engine spooling down and, before the plane could yaw with the asymmetric thrust, the right engine winding down as well.

WHAT DID THE FADEC really do in AI171’s last moments? According to Boeing’s training manual for the 787, the company, designed protection circuit and software logic called the thrust control malfunction accommodation to prevent dangerous thrust. In the critical take-off phase, when both engines are at full power and the aircraft is still on the ground, there is almost no room or time to correct an error, before the plane hits the airport perimeter wall, nearby buildings or planes. When it comes to the question of how much engine power to command, it is not the pilots but the FADEC that calls the shots. The FADEC continuously compares the pilot’s commanded thrust with the engine’s actual output, and calculates whether the thrust is accelerating or decelerating as expected. If the system detects that the thrust is contradictory to commands, then the TCMA informs the FADEC of a thrust control malfunction and automatically shuts off fuel to the engine.

As per the TCMA’s patent document and Boeing’s literature, five parameters need to all be true for a TCMA event: the aircraft is on the ground, its speed is less than 200 knots, the altitude is less than 17,500 feet, thrust levers or thrust reverser levers are in “idle,” and the engine fan speed is more than the TCMA threshold. At 1.38.44 pm, all these would have been seen as true. The airplane read “on ground,” airspeed was less than 200 knots, altitude was low and the fan speed was likely high, given take-off thrust. The preliminary report itself notes that “EAFR data revealed that the thrust levers remained forward (takeoff thrust) until the impact.” Additionally, the whole series of ACARS codes accessed and sent to Boeing were topped off with “EM12R0,” an indicator of airspeed data disagreement. The senior Air India engineer told me that on an average day, with eleven hundred Dreamliners in the sky, nearly eighty to a hundred can fly with this code meaning no harm, as it simply indicates that one of the channels for airspeed calculation disagreed with another. But, on AI171, it would have proved disastrous, since the FCM reboot would have sent the thrust reversers to idle—triggering TCMA and resulting in the fuel cutoff.

But the AAIB report fights shy of telling us when this fuel cutoff exactly happened. It notes that the aircraft “achieved the maximum recorded airspeed of 180 Knots IAS at about 8:08:42 UTC (1:38:42 IST) and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position.” But this explanation defies logic. Newton’s first law tells us that an object in motion will continue in motion unless acted upon by an external force, just like a car would not stop the minute you switch off the ignition but would coast along unless someone or something brakes it. “With both engines still at takeoff thrust at 1:38:42 pm the aircraft would accelerate further for about a second even if at that very point both fuel switches were selected to CUTOFF and the engines begin to run down,” Hradecky, the Aviation Herald editor, told me.

The preliminary report would make readers assume that there was a fuel cut off, then both engines went to minimum idle, then fuel switches were moved back to “RUN” and then relight attempts started. But the AAIB carefully stays away from giving precise timestamps for fuel cut-off and when the engines went below minimum idle, instead clubbing it with other events that have a timestamp.

The AAIB report also has a few puzzling lines. “When fuel control switches are moved from CUTOFF to RUN while the aircraft is inflight, each engine’s full authority dual engine control (FADEC) automatically manages a relight and thrust recovery sequence of ignition and fuel introduction,” it notes. But the report itself does not mention whether the FADEC did attempt a relight. “It does sound as if the AAIB report is referencing how the FADEC procedure should work rather than explaining exactly what did happen on 171,” Mike Andrews, the lawyer, told me. “This underscores the need for an independent evaluation of the actual FDR and any ACARS data to understand what was actually occurring with the automated systems.”

The truly horrifying thing I discovered in this investigation, though, is that the AAIB wrote those lines on the FADEC likely to mislead its readers that a relight had happened because the pilots recycled the fuel switches. Instead, the FADEC would have prevented a relight attempt, even if ordered by the cockpit, because the aviation industry increasingly values automation for these processes. FADEC could have also refused Clive’s desperate attempts to recycle switches at 1.38.52 pm and 1.38.56 pm, because it had nowhere to draw power from. “The industry is designing systems with the goal of protecting the engines or saving money,” the former senior analyst at Boeing told me. “It’s a good sell to airlines if you can tell them, ‘We can have your engines running for longer, reducing your maintenance costs.’” Engines are expensive. A single GE Aerospace engine for the Dreamliner typically costs between $25 million and $30 million. With two engines per aircraft, the upfront investment exceeds $60 million and roughly accounts for about a fifth of the value of the whole aircraft. But that same cost-cutting can lead to a computer disobeying the pilot, even in an emergency.

This design philosophy of protecting the engines at all costs, is a world apart from older jets—in which pilots had full control of their planes and could even burn their engines if needed, to keep the aircraft flying. Take the example of the United Airlines Flight 232 in 1989. One of its engines failed, it lost all hydraulics, and the aircraft became effectively unflyable by conventional means: no ailerons, no elevators, no rudder. The crew did something that in a modern FADEC-restricted environment would simply be impossible. They flew the jet entirely through asymmetric engine thrust—pushing one engine harder, pulling another back—manually modulating raw power to force the aircraft to turn, climb and descend. They knew this could overheat or overstress the engines, and potentially destroy them. But that was not the priority. Pilot authority overrode engine preservation. Nearly half the passengers survived. Similarly, on Polish Airlines Flight 16 in 2011, pilots used very aggressive thrust changes to stabilise pitch and keep aerodynamic control during approach. The objective was to save 231 lives, not to preserve turbofan hardware so it could have a longer maintenance cycle. The engines were sacrificed. Everyone lived.

With no altitude, no thrust, no starter power, 16 seconds after take-off, Sumeet and Clive would have known the plane could not be saved. They still did their best. One took over controls, while the other attempted a relight. They called out Mayday at 1.39.05 pm and likely never even received the “Pull up, Pull up” terrain warnings. Against the deafening silence of blacked-out systems, the only sounds they would have heard were passenger screams and the ATC’s responses, as the ground closed in on them.

“I WILL NEVER FORGET that day until I die,” Romin Vahora, a lab technician at the Ahmedabad Civil Hospital, told me. The hospital is housed in the same campus as BJ Medical College, which AI171 crashed into. Just hours earlier, he had been at the airport, seeing off his brother Parvez, his aunt Yasmin and Parvez’s three-year-old daughter, Zuveriya. He was on duty during the crash as bodies began piling into the hospital, and he was called to sign onto the panchnamas—witness documents—of the cadavers, all the time worrying if his family had survived.

He shuddered while recounting the sights he saw. He had seen a woman who had been six months pregnant, her stomach split open with the foetus visible. He kept searching through the bodies brought in and, at one point, he found a child with her head separated from her body. The child was about Zuveriya’s age. He went closer to look at the disembodied head. “It wasn’t her, and I felt such a flood of relief then,” Romin told me. “Then I felt so terrible for that relief. Even if it is not my niece, that was someone else’s child.”

When his family were identified, they were handed over to Romin in a sealed casket. “They refused to let me open my brother’s casket, so I argued with them,” he told me. “They told me, ‘We are stopping you because the body is not in a condition to be seen.’ So I said, ‘Whatever it is, that is my problem, not yours. I will open the body—do whatever you can.’” He opened it and found his brother’s body.

Others have not been as lucky. Sagar Patel, a British resident, told me that the loss of his mother, 62-year-old Hasumatiben Patel, hit him the hardest when he saw his two-year-old daughter wandering around the house, “searching and asking for her gran.” She had been the heart of the house, he said. Sagar had just finished performing the last rites for Hasumatiben when he read reports that British coroners had found parts of other people’s bodies in the remains returned to the families of some aircrash victims. “It derailed me,” Sagar said. “Who had I buried? What is my mother? Where is my mother?” He told me he got no closure for her death.

After the crash, Air India agreed to pay Rs 25 lakh each to the victims’ families, the minimum legal liability under the Montreal Convention. I had been following the story closely since the day of the crash, and the families I spoke to said that Air India representatives had asked them all to sign release forms, waiving their right to sue the company, in order to get the compensation. In December, the release forms mentioned that they could not sue Boeing, GE, GE Aerospace, Safran and Safran Electronics. Late that month, I reported that experts I spoke to suggested the flight control computers on the plane likely restarted because of the electrical arc. From the next month, the release form for the victims’ families seems to conspicuously state that the families could not even sue Honeywell, which manufactures the FCCs. Ajay Parmar, a 28-year-old gardener at the hospital, suffered thirty-percent burns on his hands, face and feet, and no longer has a job—by the time he returned after recovery, the college had hired another gardener. For many families like his, surviving precarious financial situations, there would not have been a second thought about signing the indemnity and collecting compensation.

Meanwhile, Air India has made its largest purchase of jets ever: a whopping 585 jets, 250 of which are from Boeing. It is a high-flying time for Indian aviation. With an overcrowded and underfunded railway system creaking from railway accidents, and the declining cost of flying over the past decade, more Indians are flying than ever before. “India is now one of the world’s fastest-growing aviation markets and is expected to have a fleet of more than two thousand aircrafts in the coming years, making it too important a market for Boeing and Airbus to ignore,” Raghotham told me. If so many more Indians will be flying, their safety can only be ensured if there is strict regulatory oversight and clear moves are made to disallow commercial interests from influencing investigations when something does go wrong.

Honest answers are the least the families of the victims deserve. Romin told me that, when he was scrambling around the charred bodies, searching for his relatives, he saw them bring in the body of Sumeet. The captain was still vaguely recognisable, and he had gone down holding onto the yoke of the plane, not letting go even when all hope had been lost. His body was brought to the hospital with him still holding onto it.

Rachel Chitra is an investigative and financial journalist who has worked with outlets including Reuters, Forbes and The Times of India. On the Air India crash, she’s published a four-part investigative series for The Federal and detailed analyses for Frontline.

Source: CARAVAN

+++++++++++++++