Modern jetliners just aren’t supposed to fall out of the sky. It’s simply not acceptable (it’s not acceptable when smaller aircraft do it, either, by the way). Decades of refinement, engineering, development and lessons learned have produced an extremely safe worldwide air transportation system. That’s one reason the disappearance of an Airbus A330 operating as Air France Flight 447 from over the Atlantic Ocean almost three years ago is serving as a wake-up call to operators and pilots alike.
288
The investigation into the flight’s loss isn’t complete, but we do know much more about what happened now that the all-important cockpit voice and flight data recorders have been recovered. The tale they tell has many chapters—about modern automation, old-fashioned complacency, cockpit resource management and pilot training. But the central question remains: How could a modern jetliner, in cruise flight, simply disappear?
What happened?
It was a few minutes past 0200 Coordinated Universal Time (UTC) on June 1, 2009. The Airbus A330 was in cruise flight over the equatorial Atlantic Ocean at FL350, on a scheduled flight from Rio de Janeiro, Brazil, to Paris, France. Because this is a long flight—the great-circle distance between the two airports is 4941 nm—the captain left the cockpit and retired to a crew rest area at 0202. Minding the store in the cockpit were two first officers.
The widebody twin was flying in the Intertropical Convergence Zone, an area known for intense thunderstorms. That night was no different; at 0208, after studying the onboard weather radar, the first officers adjusted the jet’s flightpath 12 degrees to the left, presumably to miss the worst of the storms. Other flights in the area were making larger diversions.
Shortly, the Airbus entered the storms. Two minutes earlier, the cockpit had alerted the cabin crew to prepare for some turbulence. The crew also reduced the jet’s speed, from 0.82 Mach to 0.80.
At 0210:05, the autopilot and auto-thrust disengaged. The pilot flying (PF) said, “I have the controls.” The airplane began to roll to the right and the PF made a nose-up and left input. The stall warning sounded twice. Recorded parameters show a sharp decrease in airspeed, from about 275 KIAS to 60, displayed on the left primary flight display (PFD), followed a few moments later in the speed displayed on the integrated standby instrument system (ISIS), which incorporates attitude, airspeed and altitude information. The aircraft’s flight control software went into alternate mode, removing various protections—like excessive pitch inputs.
Around 0210:16, the airplane’s pitch attitude increased beyond 10 degrees and it started to climb. The PF made nose-down and left/right roll control inputs. Vertical speed, which had reached as high as a 7000 fpm climb, decreased to 700 fpm. Roll varied between 12 degrees right and 10 degrees left. The speed displayed on the left side increased sharply to 215 KIAS. The airplane was then at an altitude of about 37,500 feet, with an angle of attack of around four degrees.
At 0210:51, the stall warning triggered again. Thrust levers were positioned in the takeoff/go-around detent and the PF maintained nose-up pitch inputs. The angle of attack, around six degrees at the triggering of the stall warning, continued to increase.
About 15 seconds later, airspeed displayed on the ISIS increased sharply toward 185 KIAS, making it consistent with the values displayed on the left-side PFD. The PF continued to make nose-up inputs. The airplane’s altitude topped out at about 38,000 feet, its pitch attitude and angle of attack being 16 degrees.
At around 0211:45, the captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped. Altitude had decreased to about 35,000 feet, the angle of attack exceeded 40 degrees and the jet was descending at about 10,000 fpm. The airplane’s pitch attitude never exceeded 15 degrees nose up, but roll oscillations continued, sometimes reaching a 40-degree bank. Engine speeds were close to 100 percent. The PF made control inputs to the left and nose-up stops, which lasted about 30 seconds.
At 0212:02, the PF said, “I have no more displays.” The pilot not flying (PNF) added, “We have no valid indications.” At that moment, the thrust levers had been placed in the idle detent and engine speed had dropped to around 55 percent. Some 15 seconds later, the PF made pitch-down inputs. As a result, the angle of attack decreased, the speeds became valid and the stall warning triggered again. This probably was the crew’s last opportunity to recover and save the aircraft. At 0213:32, the PF indicated the jet was descending through 10,000 feet.
Recordings stopped at 0214:28 when the Airbus hit the water. The last recorded values were a vertical speed of -10,912 fpm and a groundspeed of 107 knots. The jet’s pitch attitude was 16.2 degrees nose-up, with a roll angle of 5.3 degrees left. All 216 passengers and 12 crewmembers were fatally injured.
Details
What’s all that mean? According to the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA), the French agency responsible for investigating aviation accidents, beginning at 0210:05 UTC and “likely following the obstruction of the Pitot probes in an ice crystal environment, the speed indications became erroneous and the automatic systems disconnected. The airplane’s flight path was not brought under control by the two copilots, who were rejoined shortly after by the Captain. The airplane went into a stall that lasted until the impact with the sea,” which occurred at 0214:28.
The BEA’s Third Interim Report on AFR447—the most recent one—which summarized the agency’s findings as of July 29, 2011, concluded blocked pitot tubes caused the A330’s flight control system to note erroneous airspeed data was being received, and disengage the autopilot and autothrottle systems, as it was designed to do. All of a sudden the crew—who had been mostly worried about circumnavigating thunderstorms—were asked to take over the tasks of maintaining altitude, speed and heading. They had years of experience doing exactly that—the least-experienced copilot had been flying since 2000—but couldn’t pull it off. Why?
As this article was being prepared, the BEA had made 10 safety recommendations to various certification and regulatory authorities, including the FAA.
Additional recommendations are expected when the final report comes out, presently set for the first half of 2012. No one with even a casual familiarity with the AFR447 accident expects the BEA will not find major fault with the pilots.
Lessons
Pilots have been known to joke about their understanding of cockpit automation, with phrases like, “Now what’s it doing?” or, “Yeah, it does that.” All of a sudden, it’s not funny any longer.
Air France, in a July 29, 2011, press release, said, “It is important to understand whether the technical environment, systems and alarms hindered the crew’s understanding of the situation.” Further, “It should be noted that the misleading stopping and starting of the stall warning alarm, contradicting the actual state of the aircraft, greatly contributed to the crew’s difficulty in analyzing the situation.”
There’s no question a stall warning system programmed to cease operation because the associated airspeed value is impossibly low needs some attention. And it’s disturbing that airspeed indications may have differed between the two PFDs and the ISIS. These characteristics certainly could have added to confusion in the cockpit. But automation isn’t going away, in part because we humans simply can’t fly accurately enough to meet RVSM standards for example, or fly optimal profiles in terminal airspace.
Regardless, at the end of the day, a well-qualified three-person crew failed to comprehend a relatively simple pitot-tube blockage, stalled the airplane and watched, confused, for almost four minutes as it descended to the ocean at approximately 10,000 fpm. Say what you may about the Airbus design philosophy and highly automated cockpits, but the AFR447 crew utterly failed to fly the airplane when it counted most.
The saddest thing? The crew really didn’t have to do anything: If they simply had maintained heading and attitude, letting airspeed fend for itself for the short time it took for the iced-up pitot tubes to clear themselves, nothing would have happened.
Which is the moral of this story. Regardless of how much automation is available and how well it’s working, we still have to fly the airplane at all times. Even when at high-altitude cruise with the autopilot minding the store, we must remain engaged with what the airplane is doing so we can take over if needed. When, not if, something breaks, we must remember to fly the airplane, even if all we have to work with is a throttle, a stick and some backup instrumentation.
