Exclusive: Not pilot error? Missing black box data, a clue to systems failure or FADEC collapse

The world’s deadliest aviation disaster of 2025 appears not to have been a pilot error. It may have been a sudden, cascading electrical collapse that beat the pilots to the controls. Weeks after the Aircraft Accident Investigation Bureau (AAIB) submitted its preliminary findings, the issue continues to get more puzzling.

From a charred flight data recorder that possibly stopped recording before impact, to a ram air turbine (RAT) deployment that suggests prior electrical collapse, and a thrust lever anomaly that mirrors a known Boeing FADEC glitch, evidence points toward a chilling possibility: that multiple failures may have sealed the fate of Air India 171.

The Federal has learned that Air India, apart from fuel switch checks, has conducted internal checks on Boeing 787 sensors and electricals, a fact it has not publicly disclosed.

Also read | Ahmedabad Air India crash: Minister backs ‘unbiased’ probe; pilots flag key data gaps

However, sources say these checks may or may not have a bearing on the AI 171 tragedy, given airlines have a responsibility to check every aspect of a plane post-crash.

Jarring anomalies

What are the most jarring anomalies? One can see that the plane's tail was intact and the nose was crushed, and saw fire damage.

And yet, the forward recorder, pulled from a crushed and fire-damaged nose, survived with cockpit recordings intact. On the other hand, the (tail) aft-flight data recorder, or enhanced airborne flight recorder (EAFR), located in the undamaged tail, was found charred, with data undownloadable.

Black boxes are designed to withstand 1,100°C flames and 3,400 g impacts. If a black box fails, especially in a structurally intact section, it’s not just an accident. It’s a red flag. (Black boxes are present in the tail and nose of planes.)

And it’s from the forward recorder that we know what Captain Sumeet Sabharwal and First Officer Clive Kunder may have said (again, the AAIB has not attributed the voices to either pilot). Meanwhile, the two experienced pilots, posthumously, face heavy scrutiny, wild speculation and accusations of suicide, sabotage, and even marital discord. A media trial and a social media lynching of two men who never got to tell their side.

Reading RAT timeline

So, why did the aft-flight recorder fail? The RAT’s timeline provides a clue — its deployment before the fuel switches were touched suggests a total electrical failure occurred early in flight.

And, experts say the aft-EAFR, which lacks an independent power supply, could have stopped recording well before impact. Its blackened appearance may point to something else entirely: a possible lithium-ion battery fire.

That raises a deeper fear—did a flaw that once grounded the entire 787 fleet quietly resurface?

Add to this the unexplained silence in the AAIB’s report around ACARS and SATCOM transmissions, systems that usually offer the last digital heartbeat of an aircraft, and the pattern sharpens. The pilots issued a Mayday over VHF (very high frequency). But AAIB gives us no ACARS data, no SATCOM pings.

Also read: Exclusive | AI-171 crash triggered by fuel switches or engine failure?

Larger question

Finally, the thrust levers themselves. Found in the idle position post-crash, yet recorded in the forward position until impact. The same discrepancy was seen in a 2019 ANA 787 incident, where a faulty sensor misled the FADEC into shutting down engines without pilot command.

Here is how one may read the situation: One recorder failed. The other shows no sign of human error. The plane lost power before the crew could react. And Boeing’s systems may have outpaced the humans onboard.

Twelve years ago, lithium battery fires forced the global grounding of the Dreamliner fleet. Today, with AI‑171, we have the silence of a system probably failing mid-air, with no one left to explain it.

Let’s unpick these issues, one pointer at a time.

Pointer I: RAT deployment — Clue to electrical collapse

13:38:39–40 – RAT theoretically had to have deployed (assumed timeline)

13:38:42 – Engine 1 fuel switch moved from RUN to CUTOFF

13:38:43 – Engine 2 fuel switch moved from RUN to CUTOFF

13:38:47 – The RAT starts pumping hydraulic power

13:38:52 – Engine 1 fuel switch returned to RUN

13:38:56 – Engine 2 fuel switch returned to RUN

The RAT is a backup emergency generator. It doesn’t get activated merely if the engines shut down. It deploys when the aircraft loses electrical power, typically from engine-driven generators. So, if the RAT comes out, it means the plane has already suffered a major electrical failure, not just an engine issue.

Vishwash Kumar Ramesh (40), the sole survivor, in interviews with media houses, said that within seconds after takeoff, the cabin lights began flickering green and white. This aligns with the RAT deployment timeline and a sudden electrical anomaly—long before the crew made any recorded input.

Also read: Pilots' body sends notice to WSJ, Reuters over Air India crash reports

A flight engineer said, "RAT will begin rotation within one second of deployment. Then hydraulic pressure starts to build immediately, and within 6-7 seconds it will be sufficient for minimal control authority (pumping power)."

But the fuel control switches were moved to cut-off by 13:38:42-43; that's 4-5 seconds after the RAT began deploying.

Timing inconsistency

The AAIB report is also silent on ACARS or SATCOM uplinks. While ACARS (Aircraft Communications Addressing and Reporting System) is a digital datalink system that transmits messages between aircraft and ground stations, SATCOM, (Satellite Communications) enables long-range voice and data transmission via satellites, especially over oceans or remote areas.

In most modern crashes, investigators disclose the last pings or maintenance messages transmitted by the aircraft’s data systems. But here, not a single such detail is shared.

Also read | Celebi, barred from Indian airports, has been under security lens for long

This omission is striking, especially in the wake of earlier aviation disasters, such as Malaysia Airlines Flight MH370, Air France 447, and even Jeju Air 2216, where the abrupt loss of ACARS or SATCOM data became key to understanding how electrical or systemic failures unfolded in flight.

Which raises the question, did a systems failure or electrical fault disable these transmissions?

Crucially, the crew of AI‑171 did transmit a Mayday via VHF voice. But, the absence of ACARS/SATCOM data despite active voice radio communications could again suggest an early electrical failure that knocked out specific systems, but not all at once.

What RAT deployment suggests

The RAT deployment suggests the aircraft had already lost both engine-driven electrical generators before the switches were touched. That’s not just a small detail. It raises serious questions about the sequence of system failures onboard AI‑171.

Was there an underlying electrical malfunction that began shutting down systems before the crew even had a chance to respond? Did FADEC (Full Authority Digital Engine Control) misinterpret a failure and begin initiating emergency shutdowns?

The Times of India was among the first to highlight a timing inconsistency, noting that the RAT began supplying hydraulic power at 13:38:47 IST, and questioning how the aircraft reached peak airspeed two seconds earlier, at 13:38:42. The implication was that the RAT’s deployment contradicted the thrust loss timeline. A fair point, but it could get overridden slightly by the possibility of wind speed and inertia (objects in motion).

Also read | What India, and the world, can learn from AI-171 Dreamliner crash report

But according to The Federal’s sources, including a senior Boeing 787 captain, this interpretation may miss a key point: RAT deployment isn’t triggered directly by engine failure, but by the loss of both engine-driven generators. That means the engines could still be running, even producing partial thrust, when the RAT deployed.

Now, this distinction shifts the focus away from airspeed versus RAT power-up, and toward a more telling possibility: that a cascading electrical fault began before any fuel switch movement.

Pointer II: Aft-EAFR failure despite intact tail

Here’s what else stands out in the AAIB’s preliminary report. The Auxiliary Power Unit (APU) was recovered intact inside its compartment after the tail section was brought down. The vertical stabiliser was separated from the aft fuselage and found near the crash site.

The report does not specify the extent of fire damage to these components. Yet, the AAIB report published photos of the aft-EAFR, located in that very section, and it was found charred and unreadable.

Also read: Ahmedabad Air India crash: US safety board cautions against 'premature' conclusions

Logically, this is improbable. The aft-EAFR is the most protected component in a modern aircraft, certified to survive 1,100°C fires and 3,400 g impacts. So why did it fail?

Mystery of destroyed aft-EAFR

The answer may lie in the power source design. The forward EAFR is backed by a Recorder Independent Power Supply (RIPS). But the aft EAFR depends solely on aircraft power. If the electrical collapse began before the crash, as the RAT timeline suggests, then the aft recorder may have been dead before the plane hit the ground.

In short, it appears it wasn’t destroyed by the crash. It was probably never alive when it mattered.

And this isn't the first time data was not recovered in a deadly aviation disaster. Recall the crash of the Jeju Air Flight 2216, a Boeing 737‑800, in December 2024. During a belly-landing that killed 179 of the 181 people on board, both FDR and CVR stopped recording about four minutes before impact due to electrical failure.

Experts say loss of data in aft-EAFR can only be due to loss of electrical power, an internal arc, thermal runaway, or electrical surge. But none of this will leave visible fire marks.

Watch | South Korea plane crash: 85 dead – What happened?

The AAIB report says: "The aft-EAFR was substantially damaged and could not be downloaded through conventional means....aft-EAFR had impact and thermal damages to the housing." This phrasing seems to attribute the failure of the aft EAFR to “impact and thermal damage.”

Dreamliner woes

This risks conflating two distinct issues: the cause of failure that led to data loss potentially electrical or systemic and the visible charring (which has no relevance to black box data; as the forward-EAFR was equally burnt and yet 49 hours of data was recovered from it).

AAIB in its report does not give the cause of charring, given the aft-EAFR was recovered from a structurally intact tail. Why should the charring concern us?

Because this particular Boeing 787-8 (VT-ANB), delivered to Air India in 2013, belongs to the same early Dreamliner fleet grounded globally that year after lithium-ion battery fires on ANA and JAL aircraft. In those incidents, the battery fires caused charring but did not affect flight recorders, and their tail sections were structurally intact.

Also read: AAIB slams 'irresponsible' media reports on Air India crash

The photograph of the aft-EAFR’s appearance could be drawing attention away from a potentially deeper systems failure: the possibility that an undetected electrical breakdown, potentially originating in FADEC logic or sensor misinterpretation, disabled the aft recorder well before impact.

And the possibility that the charring was caused by a lithium-ion battery fire, which would suggest that a 12-year-old systemic flaw, one serious enough to ground a global fleet of 787s, has quietly re-emerged.

Pointer III: Hidden discrepancy in FADEC logic?

A growing number of pilots and engineers have expressed frustration over Boeing’s opacity when it comes to FADEC logic, the automated brain that controls engine function. Unlike Airbus, which provides more transparent documentation on sensor-to-FADEC pathways, Boeing has historically guarded this information tightly.

So, even if the aft-EAFR had survived, there might still have been ambiguity on Boeing's pathway logic as to what sensors have what weightage for FADEC logic decisions. But now, with the aft-EAFR not having survived, the data wipeout gets more severe.

The Federal, in an exclusive report earlier, reported that a major European airline, in light of the AI‑171 incident, has begun reviewing all sensor inputs and FADEC-related electricals across its Boeing 787 fleet, not just the fuel control switches.

This distinction is critical. Because, if FADEC or a shorted relay triggered the shutdown electronically, the switches may have never moved at all.

Also read: Fuel cut in 1 sec? AI-171’s final minutes flag mechanical failure, not pilot error

This makes Air India’s fuel switch inspection—as to whether the lock/gate mechanism is working—a superfluous exercise; that may have been caused only by media outlets reporting on the US Federal Aviation Administration (FAA)’s 2018 advisory on the possibility of locking failure in fuel switches.

Pilots The Federal spoke to say the cockpit display would have flagged the issue clearly. On the Boeing 787, the EICAS (Engine Indicating and Crew Alerting System) displays key engine parameters like fan speeds (N1, N2), exhaust gas temperature (EGT), and fuel switch position, directly on screen.

If the FADEC received a signal, real or faulty — that the engine had failed or the fuel valve had been cut off — that would trigger an alert such as “FUEL CONTROL SWITCH – CUTOFF” or “ENG SHUTDOWN”. So, when the engines spooled down, the pilots possibly saw that indication on the screen and asked about the fuel switches—not because they physically moved them, but because the aircraft said they had. This is conjecture, but highly probably, according to sources The Federal spoke to.

Pointer IV: Could faulty sensors have triggered FADEC shutdown?

Let’s now turn to the 2019 incident involving an ANA Boeing 787, which offers a precedent. The aircraft had just landed at Osaka Itami Airport when both engines shut down automatically. According to news reports, this event happened during taxiing. Unlike AI-171, where it might have happened during a high-energy phase like takeoff.

Investigators traced the cause to a Throttle Lever Angle (TLA) resolver sensor. This sensor tells the FADEC where the pilot’s thrust levers are positioned. It’s essentially the eyes of the aircraft’s power-control logic.

In this case, the TLA inputs were misinterpreted. The system falsely believed the throttles had been pulled fully back, triggering FADEC to shut off fuel to both engines without pilot command. And FADEC believed it.

It didn’t matter that the pilot had done nothing; the system responded to what it believed was the truth, experts noted then. That event happened while taxiing, not during a high-energy phase like takeoff.

Glaring disconnect

Now let’s go back to AI‑171. The AAIB report says, "The thrust lever quadrant sustained significant thermal damage. Both thrust levers were found near the aft (idle) position. However, the EAFR data revealed that the thrust levers remained forward (takeoff thrust) until the impact."

Watch | Ahmedabad flight crash: Why Tata, DGCA are at fault

There appears to be a disconnect here. The AAIB confirms that thrust levers were found in the idle position post-crash, but flight data showed they remained fully forward until impact.

If a sensor was faulty, like in the ANA case, FADEC can initiate a protective shutdown by cutting fuel. And remember: AI‑171 was not taxiing. It was at takeoff thrust. A double-engine shutdown at that point is fatal.

Why this theory appears more logical than switch shut-off theory:

a) Engine 1 began recovering after its fuel switch was returned to RUN

b) Engine 2 also relit briefly, but its core speed dropped again

c) Exhaust gas temperature (EGT) rose in both engines during relight, suggesting combustion was occurring — this suggests fuel was flowing at least intermittently and the engines were not completely starved of fuel

d) And finally: The aft EAFR data is unavailable

That could be a huge blind spot. It means we don’t yet know if FADEC ordered the shutdown. But the ANA case suggests that it can happen. And if it can happen, it must be ruled out with certainty before placing the blame on the pilots.

Pointer V: What we know, what we don’t

What we don’t know:

a) When the engines actually began losing thrust; we only know when FDR recorded fuel valve shutoff

b) Whether the fuel switches physically moved, or if FADEC issued an electronic shutdown based on a faulty sensor or logic misfire

c) What triggered the loss of data in the aft-EAFR

d) What happened to aircraft’s ACARS and SATCOM data, despite VHF voice communications being active

e) What FADEC actually commanded in the critical moments, as that data is stored in aft-EAFR

What we do know:

a) The thrust levers were recorded as forward until impact, but physically found in the idle position

b) The RAT began supplying hydraulic power before the fuel valve cut off, suggesting both main engine-driven generators had already failed

c) The aft-EAFR failed in the absence of visible structural damage to the tail, while the forward recorder — in a more damaged section — survived and recorded 49 hours of data

d) The switches moved from RUN to CUTOFF within a second too quickly to be humanly possible (per experts)

e) The engines showed signs of combustion during relight attempts, confirming intermittent fuel flow and that the engines weren’t completely starved

f) Sensor faults have previously triggered unintended FADEC shutdowns, including in a known 2019 ANA incident involving a similar Boeing 787

More questions

This specific aircraft is part of the early 787 fleet grounded globally in 2013 after lithium-ion battery fires and the charring on the aft-EAFR raises the possibility that the same flaw may have resurfaced.

So, the questions multiply:

Was this a cascading failure?

A software misinterpretation?

A sensor glitch?

Or, tragically, all of the above?

Disclaimer: The AAIB has not yet released its final report on the AI-171 crash. All technical scenarios presented here are based on preliminary information and remain hypotheses based on inputs from experts. Airlines routinely conduct both scheduled and precautionary checks, especially following major incidents. Sources emphasised to The Federal that such checks are standard procedure and do not, by themselves, indicate any confirmed fault in the system.