HO/AFP/Getty Images
We all know what happened to Air France Flight 447 but it still continues to beg the question even after all these years - how on earth did an incredibly modern state-of-the-art aircraft with advanced avionics and Fly-By-Wire (FBW) system - the likes of an Airbus A330 end up in the middle of the Atlantic Ocean? To this day - on a hot summer evening in 2020, almost 11 years after it went down, it still does not make sense, to me at least. Read on and find out what exactly or at least, what the contributing factors were that brought the multi-million dollar jet down and 228 lives with it.
Background
Air France Flight 447 was a regularly scheduled commercial flight between Rio De Janeiro-Galeão International Airport (GIG) to the French capital, Paris, through Paris-Charles de Gaulle Airport (CDG). On the 31st of May 2009, the flight was operated by a 4-year old Airbus A330-203, registration F-GZCP (MSN 660), carrying 216 passengers and 12 crew members with a total of 228 souls on board.
Crew
On the flightdeck that evening was a 3-member crew consisting of:
Captain Marc Dubois, 58, with a total of 10,988 flying hours of which 6,258 hours and 1,700 hours were as a captain and on the Airbus A330 respectively. He was the most experienced on the flightdeck.
First Officer David Robert, 37, with a total of 6,547 flying hours of which 4,479 were on the Airbus A330. He was the second most experienced on the flightdeck.
Junior First Officer Pierre-Cédric Bonin, 32, with a total of 2,936 flying hours, 807 of which were on the Airbus A330. He was the least experienced on the flightdeck and was the Pilot-Flying (PF) on this flight.
Bonin was in control of the Aircraft for most of the flight and was seated in the Right-Hand-Seat (RHS).
Routing
The routing for the 447's flight to Paris was the usual transatlantic route: climbing out of Rio and turning towards a north-easterly direction and exiting mainland Brazil before flying over the Atlantic Ocean near the North-Eastern Brazilian city of Natal and continuing north and reaching the southern coast of Spain before eventually descending into Paris.
Rough route for AF447 made by GreatCircleMap.com
Flight time was expected to be 11 hours from Rio to Paris with a cruising altitude of 35000 feet. AF447 departed Rio de Janeiro–Galeão International Airport at 7:29 PM Local Time (10:29 PM UTC) on the 31st of May 2009. The flight went down at 02:14 UTC, about 3 hours and 45 minutes after departure, just south of the waypoint TASIL in the middle of the Atlantic Ocean.
MEHDI FEDOUACH/AFP/GETTY IMAGES
Analysis: What Happened?
We will have a look at all the key issues encountered leading up to the crash sequence-by-sequence and how they played a part:
Weather
Instrumentation
Autopilot
Flight Crew's Reaction and Crew Resource Management (CRM)
Weather
It was pretty obvious that Air France 447 had to cross the equator at some point while heading north which would mean flying through an area called the Intertropical Convergence Zone (ITCZ). The ITCZ is situated near the earth's geographical equator and is an area that is popularly known for convective weather as a result of converging trade winds. Thunderstorms and similar disturbances are pretty common in this region.
The ITCZ seen as a band of clouds converging across by NASA's Earth Observatory
On the night of the 31st, there were several clusters of powerful cumulonimbus clouds directly on the route of AF447. Cumulonimbus clouds are basically storm clouds which can go up to 50,000 feet in height. Since ground school, you are always taught to avoid these types of cloud as they are potentially dangerous and can cause severe turbulence/winds/precipitation and hail that in turn can potentially damage the airframe of an aircraft. You are also taught to circumvent several degrees either to the left or right -whichever is feasible and stay clear of these storm clouds. However, on Air France 447, upon seeing the storm clouds up ahead on their weather radar while approaching the ITCZ, the flight crew elected to continue on their present heading and to fly through the storm clouds.
The flightpath taken by AF447 shows the aircraft going through an intense area of weather (Red): TEMSI CHART WITH INFRARED OVERLAY (BEA)
Many other aircraft within the vicinity decided to avoid the many Cumulonimbus clusters in the area by flying around. The captain then leaves the flightdeck for his rest and leaves first officers Robert and Bonin at the controls.
Instrumentation
Flying through storm clouds would also mean low temperatures and ice would start to form on critical external sensors if not managed properly. In the case of Air France 447, ice began to form on the pitot tubes.
Pitot Tubes
Pitot tubes or probes are vital sensors to any modern aircraft. The term "Pitot" is derived from the name of the French engineer, Henri Pitot, who was known for inventing these devices. Pitot tubes in modern aviation are sensitive tubes on the fuselage that protrude out to measure the speed of the airflow against the aircraft or in other words, it is used to determine the speed the aircraft is flying at.
The pitot tube has a small hole at the tip of the tube that is used to measure what is called stagnation pressure when there is airflow against the probe in the opposite direction. This works alongside the static port, which is a separate hole, usually found at the side of a fuselage that obtains static pressure. The pitot tube also has small holes that samples static pressure. By determining the differences in both the stagnation pressure and static pressure, you will be able to find the dynamic pressure, which is used to calculate airspeed.
Stagnation pressure = static pressure + dynamic pressure (Bernoulli's equation)
Overview of a Pitot-Static system by the Federal Aviation Administration (FAA)
Pitot tube on a Cessna 172, picture by Ruthann on Flickr
Pitot probes (2 below) and the static ports (within the red box) with covers on an ATR72 (picture by me)
Back to what happened with AF447, the Airbus A330 has 3 Pitot Probes on the nose of the aircraft, one is on captain's side, one is a standby and the last is on the first officer's side.
PITOT PROBES ON AN AIRBUS A330 (BEA)
Ice has formed on all three pitot probes and in turn effectively, have blocked the probes from measuring and determining accurate airspeed values. As a result, unreliable airspeed values were being fed into the Flight Computers and were being displayed to the flight crew.
Autopilot
When the flight computers recognised that they were receiving airspeed values which were unreliable, Autopilot (A/P) immediately disconnects and hands controls back to the flight crew. About 3 seconds later, the Auto Thrust system (A/THR), responsible for managing thrust settings, disconnects as well. The flight control law is also degraded to alternate Law 2 (protections lost).
The Electronic Centralised Aircraft Monitor (ECAM), which provides critical information to the pilots and advises them on the subsequent steps to take after a failure, just after A/P and A/THR was disconnected (BEA)
Now, what you have to understand at this point is that automation simply cannot deal with unreliable values and act on them, that would be illogical and potentially dangerous. Instead, it hands back controls to the humans- the pilots, who have the best sense of judgement in such situations and can act on them rationally based on what they feel is necessary. This is why both the Autopilot and Auto thrust both tripped on AF447 when the flight computers detected there was an airspeed discrepancy across all three pitot probes. Modern aircraft are designed as such and regardless of how technologically advanced they may be nowadays, there is always a reason why there are pilots in the flightdeck.
Flight Control Laws (Airbus)
Airbus has implemented a set of flight control laws that govern how the aircraft should fly and what the flight envelope (limitations) when there are flight control computer failures or a lack of them. Those are: Normal Law, Alternate Law, Direct Law and the Mechanical back-up mode. With regards to AF447, one has to look at both the Normal Law and Alternate Law.
In normal law during flight mode, there are 5 key protections which are enabled:
Pitch Altitude Protection
Load factor limitations
High Speed Protection
High Angle of Attack or Alpha Protection
Bank Angle Protection
All the above protections effectively limit the control input and does not allow you to go over a certain pre-defined value.
Degradation to alternate law occurs when there are flight control computer failures or failures of similar nature or simply in the case of Air France Flight 447, the flight computers were receiving unreliable data and as such they cannot enforce normal law protections based on parameters which are inaccurate and unreliable.
In alternate law, some of the protections are removed and not enforced. There are 2 sub-laws in alternate, alternate law with protections (reduced) and alternate law without protections (ALTN LAW - PROT LOST)
In the alternate law without protections, which was what the computers on AF447 reverted to, all protections are removed except Load Factor Limitations.
When you compare Normal and Alternate Law (without protections)...
You will notice that there is no High AoA protection in alternate law. This is key and crucial in understanding what happens later subsequently for AF447.
ANGLE OF ATTACK: angle between the nose of the aircraft and the oncoming relative wind:
Angle of Attack (AoA) By Motion Imagery Standards Board (MISB) - Extracted from File:MISB Standard 0601.pdfOriginally from http://www.gwg.nga.mil/misb//docs/standards/ST0601.8.pdf, Public Domain, https://commons.wikimedia.org/w/index.php?curid=39884466
Flight Crew's Reaction and Crew Resource Management (CRM)
Immediately after the autopilot disconnected, the pilot flying (PF), Bonin, instantly pulls back on the sidestick and puts the aircraft into a climb. Ideally, crew should have kept the aircraft at level flight to sort things out. A possible explanation on why he reacted like that could be attributed to the fact that the crew were receiving incorrect altimeter readings and speed indications as a result of the icing on the pitot tubes. Just before Bonin deflected his sidestick full aft, the altimeter showed altitude at 34900 feet and upon seeing this it could be possible that he thought there was a loss in altitude and pulled back to climb back to 35000 feet.
Primary Flight Display (PFD) showing the altitude as 34900 feet just before PF reacts and pulls on the sidestick (BEA)
He pulled back even further when the instruments were showing the aircraft lost about 400 feet in altitude.
Primary Flight Display (PFD) showing the altitude as 34670 feet (BEA)
But in reality, the aircraft was still at 35000 feet and it is just the instruments that are showing the crew the inaccurate altitude data. After a brief moment, the ice on pitot #1 (captain's side) begins to melt and starts sending correct data to the left PFD as well (unclear if Robert, who was in the left seat notices this or unsure of which set of data to trust).
With the sidestick still held back by the Pilot Flying, by now, the high angle-of-attack protection would have kicked in and prevented the aircraft from exceeding alpha max (high angle of attack), a limit in high AoA protection. But then again, like what was mentioned earlier, the flight computers degraded to Alternate Law (without protections), which meant that there was no angle-of-attack protection that would have effectively stopped the nose from going too high.
As a result, the aircraft was still climbing with a high angle of attack (no lower than 10 degrees AoA) and was quickly losing speed as it quickly approached stall and the aircraft, sensing this, alerted the crew by sounding stall warnings.
Stall
A stall occurs when the aircraft is not flying at a sufficient speed for the wings to generate enough lift for an aircraft since the airflow over the wing is disrupted as a result of a high angle of attack. The weight then acts on the aircraft and causes it to fall like any ordinary object.
A stall showing the disrupted airflow as a consequence of a high AoA (blue arrow: Relative Wind)By en:user:GRAHAMUK (original), Mysid (SVG) - Vectorized in Inkscape from File:Deep Stall.png., CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=6946912
At some point of time it appeared that the PF was trying to follow the Flight Director (FD).
Flight Director and unreliable airspeed
The flight director is a navigational aid that assists pilots in vertical and lateral navigation. It is represented by a horizontal and vertical lines "crosshairs"
The flight director (green lines) (A320dp.com)
In the case of AF447, it seemed like the pilot flying was trying to actively follow the flight director as the stall warnings were being sounded in the cockpit.
The Flight Director was commanding the First Officer to climb, though this was based on the unreliable data being fed in by the blocked pitot tube #3 (First Officer's side), which still had ice on the probe.
Flight director showing the PF the command to climb (BEA)
In the Quick Reference Handbook, the memory item for unreliable airspeed for the Airbus A330, you will notice that the first thing you should do is turn off the Flight Directors:
QRH of an Airbus A330F (virtavia.online)
The crew did manage to identify an airspeed anomaly, however, they still proceeded to trust the false data they were receiving and did not clearly believe they were indeed approaching a stall or were close to a stall.
On AF447, the crew were in a state of confusion and seem to can't really process what was happening, at that point of time, Bonin was still holding back on the sidestick, the aircraft had stalled and was falling out of the sky with a descent rate of more than 10,000 feet per minute. Angle-of-Attack was now more than 30 degrees. The captain returns to the cockpit and both the pilots tell him that they've "lost control of the aircraft" and they've "tried everything".
AF447 in a deep stall
This is where it could have been a turning point and the aircraft could have been recovered however, the captain too was not able to understand or process what was going on, and to be fair, it is far-fetched to expect someone to immediately be able to diagnose the issues in the midst of warnings going off and with a lot of information being displayed at the same time.
Dual Input
First Officer Robert, unaware of Bonin still pulling back on the sidestick tries to put the nose down by pushing full forward on the sidestick. A new warning "DUAL INPUT" is heard. In Airbus planes, unlike Boeing's traditional yoke system, the sidesticks are not mechanically linked and you would not know as your sidestick would not move if someone else is operating the other sidestick. The key thing is, if both sidesticks were operated at the same time, their deflections are algebraically added together; and for AF447, since both pilots were linearly operating the sidestick in 2 different directions, the elevator did not move and remained at neutral as Robert's nose down command and Bonin's nose up command cancelled each other out.
The sidestick positions reflected: PNF- Robert Full Forward (Left white box - Nose Down command) PF- Bonin Full Aft (Right white box - Nose Up command)
The crew probably did not notice the dual input warning or indication since their peripheral vision was narrow - they were mainly focused on the PFD and trying to keep the Aircraft level.
Descent and crash
At this point, Angle-of-Attack has reached way beyond 40 degrees. With the continued nose up inputs, the trimmable horizontal stabilizer (THS) responded with 13 degrees for Nose Up (NU). The pitch was about 16 degrees nose up.
Descent with a 40 degree AoA value and 13 degrees NU THS value (UNKNOWN SOURCE)
The aircraft descended at about 10,900 feet per minute while in a deep stall. At about 2,000 feet, the Ground Proximity Warning System (GPWS) detects the rapidly approaching ocean below and warnings start to blare in the cockpit: "PULL UP","SINK RATE". The aircraft crashed belly-first into the Atlantic at 02:14 UTC, 3 hours and 45 minutes after departure from Rio.
Crew Communication: A total failure as a system?
The cockpit voice recorders (CVR) reveals the state of disorientation and confusion on the flightdeck. Despite the stall warning having sounded a number of times, there was no mention of the word "stall" or anything that remotely suggests a stall in the CVR recordings. Both pilots in the flightdeck seem to be on a different page altogether. There was no co-ordination, let alone critical communication between the two pilots. When Robert was trying to push the nose of the aircraft down to recover from the stall, he was not aware of Bonin trying to pull the nose up at the same time, causing both of their inputs to cancel each other out. The customary phrase " I have controls" was never mentioned during this period of time -probably leading to more confusion on why the plane was not reacting to their inputs. Somehow they were not able to notice the "DUAL INPUT" warning being sounded and the warning light directly in front of them -probably as a result of narrowed peripheral vision as they were focused on trying to get the wings level instead . The cacophony of different warnings altogether could have startled the crew and hindered their ability to judge the situation rationally and react appropriately. This was a perfect example of poor Crew Resource Management (CRM).
Sidestick
An Airbus sidestick (Photo by me)
One of the potentially contributing factors to the crash was the design of the Airbus sidestick. The problem was that unlike Boeing-based yokes, they are not mechanically-linked, although they do offer some level of comfort and stability when handling the sidesticks. For the Boeing-based yokes, you could see the yoke in front of you move if someone is physically moving the yoke on their side.
Yoke-based control in the flight deck of a Boeing 787 (THE POINTS GUY)
For Airbus, if someone were to pull and move on their sidestick, the sidestick on your side will remain stationary since both sidesticks are not mechanically-linked. This was why Robert was not aware that Bonin held his sidestick full aft while Robert was trying to push the nose down.
Not blaming the design of the sidestick but its no secret they contributed one way or another to the confusion and the eventual crash.
The Swiss Cheese Model and AF447
The Swiss Cheese Model By Davidmack - Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=31679759
The Swiss Cheese Model of any accident attributes that even with a (infinite) number of layered defences, if all the flaws (holes) align an accident is bound to occur. This is a perfect example of what happened with Air France Flight 447. From weather: deciding to fly through a storm cloud, instrumentation: Pitot Tubes which were easily prone to Icing , crew: crew's reaction and judgement of the situation and communication and poor CRM were all the fatal flaws which were aligned and it eventually led to the crash.
Conclusion
The pitot tubes used on F-GZCP were actually outdated and were prone to water ingress. As per Airbus's recommendation, Air France was actually in the midst of replacing the pitot probes and in fact F-GZCP was scheduled to have its pitot tubes replaced after its arrival in Paris. After the crash, Airbus issued Mandatory Service Bulletins requiring all Airbus A330/A340s to have at least two Goodrich P/N 0851 HL installed. The Goodrich Pitot probes are reportedly able to withstand high-altitude icing better as compared to its predecessors.
This article was not written to blame any party or hold any individual responsible. It is a mere analysis of what happened based on official findings of the investigations.
The crash was a chain-linked unfortunate series of events (Weather, Instrumentation, Autopilot, Flight Crew's Reaction and CRM) that contributed one way or another.
May all 228 souls on board rest in peace..
References
This analysis would not have been possible without the content and images to help you visualize and understand. All credits go to the following sources:
Images:
Header image A330 Tail: HO/AFP/Getty Images
AF447 Route: MEHDI FEDOUACH/AFP/GETTY IMAGES
ITCZ band of Clouds: https://earthobservatory.nasa.gov/images/703/the-intertropical-convergence-zone
AF447 Route + Weather: https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
Pitot Static System: http://www.faa.gov/pilots/training/handbook/
Pitot Tube on a Cessna 172: https://www.flickr.com/photos/ruthann/1561804536
Pitot Tubes on an Airbus A330: https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
ECAM Messages: Screencapture from https://www.youtube.com/watch?v=n-hbWO0gL6g, original video from BEA
Angle of Attack diagram: https://gwg.nga.mil/misb//docs/standards/ST0601.8.pdf
PFDs: Screencapture from https://www.youtube.com/watch?v=n-hbWO0gL6g, original video from BEA
Stall Diagram: By en:user:GRAHAMUK (original), Mysid (SVG) - Vectorized in Inkscape from File:Deep Stall.png., CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=6946912
Flight Director: http://www.a320dp.com/A320_DP/flight-instruments/sys-8.3.13.html
Flight Director on AF447: Screencapture from https://www.youtube.com/watch?v=n-hbWO0gL6g, original video from BEA
Unreliable Airspeed memory item, from 330F qrh: http://virtavia.online/wp-content/uploads/wpforo/attachments/1/937-A330F-QRH.pdf
AF447 animation (deep stall): Screencapturefrom https://www.youtube.com/watch?v=BR5kFOHVnUU
AF447 Sidestick positions and animation: Screencapturefrom https://www.youtube.com/watch?v=BR5kFOHVnUU
Angles during Descent: Unknown source
Boeing 787 Dream)liner flight deck: https://thepointsguy.com/guide/a-look-inside-the-boeing-787-dreamliner-flight-deck/
Swiss Cheese Model: By Davidmack - Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=31679759
Content:
Air France Documentary: https://www.youtube.com/watch?v=XAom93qwoN0
Final Report AF447 (BEA):https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
Air France 447 Deep Stall and thunderstorms: https://www.youtube.com/watch?v=ZrtfUZRk5h4
Pitot Tubes: https://en.wikipedia.org/wiki/Pitot-static_systemand https://www.scientificamerican.com/article/what-is-a-pitot-tube/
AF447 Animation: https://www.youtube.com/watch?v=n-hbWO0gL6g(BEA animation)
Airbus Flight Control Laws: https://www.youtube.com/watch?v=bg29_8UvftQand https://www.youtube.com/watch?v=HYBQ4KHRgVs
Swiss Cheese Model: https://en.wikipedia.org/wiki/Swiss_cheese_model