Report: Air France AF447 Crash Caused by Pilot Error

French investigation board BEA today released a third report about Air France flight AF447. The Airbus A330-203 registered F-GZCP crashed into the Atlantic Ocean on 31 May 2009. This report current interim report has been made possible by the complete readout of the Flight Data Recorder (FDR) and the Cockpit Voice Recorder (CVR), which were recovered at the beginning of May 2011 after several campaigns of sea searches. According to the report the crisis arose after a problem involving blocked pitot tubes (devices that measure a plane’s air speed), which led to the disconnection of the autopilot. The pilots failed to discuss repeated stall warnings and “had received no high altitude training” to deal with the situation. The pilots got conflicting air speed readings and after the stall, responded by pointing the nose upward, rather than downward, to recover. They failed to regain control of the aircraft and no announcement was made to the passengers before it crashed into the ocean.

Air France AF447 Flight Path

Air France AF447 Flight Path

The flight can be broken down into three phases:

Phase 1: from the beginning of the CVR recording until the disconnection of the autopilot
Shortly after midnight the airplane was in cruise at flight level 350. Autopilot 2 and autothrust were engaged. The flight was calm. The crew was in contact with Recife ATC centre. The Captain proposed that the copilot take a rest due to the length of his shift. The latter answered that he didn’t feel like sleeping. A 1 h 55, the Captain woke the second copilot and announced “[…] he’s going to take my place”. Between 1 h 59 min 32 and 2 h 01 min 46, the Captain attended the briefing between the two copilots, during which the PF said, in particular “the little bit of turbulence that you just saw […] we should find the same ahead […] we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast” and that “the logon with Dakar failed”. The Captain left the cockpit. The Captain’s departure occurred without clear operational instructions. There was no explicit task-sharing between the two copilots. Some minutes later the crew decided to reduce the speed to about Mach 0.8 because of slightly increased turbulence.

Phase 2: from the disconnection of the autopilot to the triggering of the stall warning
At 2 h 10 min 05, the autopilot then auto-thrust disengaged and the PF said “I have the controls”. The airplane began to roll to the right and the PF made a left nose-up input. The stall warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS). The AP disconnected while the airplane was flying at upper limit of a slightly turbulent cloud layer. There was an inconsistency between the measured speeds, likely as a result of the obstruction of the Pitot probes in an ice crystal environment. At the time of the autopilot disconnection, the Captain was still resting.

At 2 h 10 min 16, the PNF said “so, we’ve lost the speeds” then “alternate law protections […]”. The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb. Even though they identified and announced the loss of the speed indications, neither of the two copilots called the procedure “Unreliable IAS”. The copilots had received no high altitude training for the “Unreliable IAS” procedure and manual aircraft handling. No standard callouts regarding the differences in pitch attitude and vertical speed were made. There is no CRM training for a crew made up of two copilots in a situation with a relief Captain. The crew composition was in accordance with the operator’s procedures.

The PF made nose-down inputs alternately to the right and to the left. The climb speed, qui which had reached 7,000 ft/min, dropped to 700 ft/min and the roll varied between 12 degrees to the right and 10 degrees to the left. The speed indicated on the left side increased suddenly to 215 kt (Mach 0.68). The speed displayed on the left PFD remained invalid for 29 seconds. The airplane was then at an altitude of about 37,500 ft and the recorded angle of attack was around 4 degrees. From 2 h 10 min 50, the PNF tried several times to call the Captain back.

Air France AF447 ECAM Messages

Phase 3: from the triggering of the stall warning to the end of the flight
At 2 h 10 min 51, the stall warning triggered again. The PF applied TO/GA thrust and maintained his nose-up input. The recorded angle of attack, of the order of 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabiliser (THS) began moving and passed from 3 to 13 degrees nose-up in about 1 minute; it remained in this position until the end of the flight. The approach to stall was characterised by the triggering of the warning, then the appearance of buffet. In less than one minute after the disconnection of the autopilot, the airplane was outside its flight envelope following the manual inputs that were mainly nose-up. Until the airplane was outside its flight envelope, the airplane’s longitudinal movements were consistent with the position of the flight control surfaces. Neither of the pilots made any reference to the stall warning and neither of the pilots formally identified the stall situation. About fifteen seconds later, the speed displayed on the ISIS increased suddenly towards 185 kt. The invalidity of the speed displayed on the ISIS lasted 54 seconds. It was then consistent with the other speed displayed. The PF continued to make nose-up inputs. The airplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and its angle of attack were 16 degrees. At 2 h 11 min 42, about 1 min 30 after the autopilot disconnection, the Captain came back into the cockpit. In the following seconds, all of the recorded speeds became invalid and the stall warning stopped. By design, when the speed measurements were lower than 60 kts, the 3 angle of attack values became invalid. The angle of attack is the parameter that enables the stall warning to be triggered. If the angle of attack values become invalid, the stall warning stops.

The altitude was then around 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was around -10 000 ft/min. The airplane’s pitch attitude did not exceed 15 degrees and the engine N1 was close to 100%. The airplane was subject to roll oscillations that sometimes reached 40 degrees. The PF made a nose-up left input on the sidestick to the stop that lasted around 30 seconds.
At 2 h 12 min 02, the PF said “I don’t have any more indications”, and the PNF said “we have no valid indications”. At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning was triggered again.
At 2 h 13 min 32, the PF said “we’re going to arrive at level one hundred”. About fifteen seconds later, simultaneous inputs by both pilots on the sidesticks were recorded and the PF said “go ahead you have the controls”. The angle of attack, when it was valid, always remained above 35 degrees.

Throughout the flight, the movements of the elevator and the THS were consistent with the pilot ’s inputs. The engines were working and always responded to the crew’s inputs. The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees.

No emergency message was sent by the crew. The wreckage was found 6.5 nautical miles north-north-east of the last position transmitted by the airplane.

Based on analysis of the flight recorders, French investigation board issued several new safety recommendations.

They recommend that the regulatory authorities re-examine the content of training and check programmes and in particular make mandatory the creation of regular specific exercises aimed at manual
airplane handling. Approach to and recovery from stall, including at high altitude.
In addition they recommend that the regulatory authorities define additional criteria for access to the role of relief Captain in order to ensure better task-sharing in case of relief crews.
The regulatory authorities should evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on board airplanes.
They also recommend that the regulatory authorities require that aircraft undertaking public transport flights with passengers be equipped with an image recorder that makes it possible to observe the whole of the instrument panel and that regulatory authorities make mandatory the triggering of data transmission to facilitate localisation when an emergency situation is detected on board. They recommend to study the possibility of making mandatory the activation of the Emergency Locator Transmitter (ELT) when an emergency situation is detected on board.

Source: BEA

2 Responses

  1. Nalliah Thayabharan says:

    The accident was caused by the co-pilot induced stalled glide condition and remained in that condition until impact. To recover from stall is to set engine to idle to reduce nose up side effect and try full nose down input. If no success roll the aircraft to above 60° bank angle and rudder input to lower the nose in a steep engaged turn. Pilots lack of familiarity and training along with system malfunction contributed to this terrible accident. Also the following contributed to the accident
    (1)the absence of proper immediate actions to correct the stalled glide
    (2) Insufficient and inappropriate situation awareness disabling the co-pilots and the captain to become aware of what was happening regarding the performance and behaviour of the aircraft
    (3)lack of effective communication between the co-pilots and the captain which limited the decision making processes, the ability to choose appropriate alternatives and establish priorities in the actions to counter the stalled glide
    During most of its long descent into the Atlantic Ocean, Airbus A330-203 was in a stalled glide. Far from a deep stall, this seems to have been a conventional stall in which the Airbus A330-203 displayed exemplary behavior. The aircraft responded to roll inputs, maintained the commanded pitch attitude, and neither departed nor spun. The only thing the Airbus A330-203 failed to do well was to make clear to its cockpit crew what was going on.Its pitch attitude was about 15 degrees nose up and its flight path was around 25 degrees downward, giving an angle of attack of 35 degrees or more. Its vertical speed was about 100 knots, and its true airspeed was about 250 knots. It remained in this unusual attitude not because it could not recover, but because the co-pilots did not comprehend in darkness, the actual attitude of the aircraft. The co-pilots held the nose up. If the co-pilots had pushed the stick forward, held it there, and manually retrimmed the stabilizer, the airplane would have recovered from the stall and flown normally.

    Air France complained that the copilots did not have enough time to analyze the situation. Gravitational stalled glide does not allow timeouts, to thoroughly discuss the situation to find out what went wrong. The co-pilots – 37 year old David Robert and 32 year old Pierre-Cédric Bonin missed the cardinal rule that first they must fly the airplane, and after start analyzing the situation, since a falling airplane is not going to wait for them. If they did not understand the instruments, then instead of pondering on it they should have come to the quick conclusion that they did not understand those instruments, and apply the unreliable airspeed procedure clearly prescribed for that situation, which is a blind, given thrust and pitch setting for the given configuration, and let the airplane fly itself, and only after get to analyzing what went wrong, and by the time they finished, the root-cause (pitot icing) would have probably cured itself. It was the safe solution to the problem, but not applied.
    The Airbus A330 performed exactly as it was designed and described when the stall warning cut out at the end of valid values, except the co-pilots did not know it. Unfortunately, it happens too often with catastrophic results that pilots are not familiar with the systems of their own airplane, such as in the case of American Airlines 587 over Queens, which was clearly the airline’s fault.
    Air France also argued that the stall warning system in the A330 is too “confusing”. Every modern airplane is quite a confusing piece of machinery. It is full of buttons, levers, all kinds of red, yellow, green lights with buzzers, and a host of other indicators and controls inside, which can look very confusing indeed, but it is the pilot’s duty to reign on them, or not to be pilot.
    Airbus A330-203 is a new generation, highly automated piece of equipment with drastically simplified controls, displays, and instrumentation compared to older models. Still, pilots with the same human capabilities as the ones on Air France flight 447 could very well stay in full control in those planes, and many times acted heroically saving situations much graver than where the plight of Air France flight 447 started, such as United Airlines flight UA232 at Sioux City, or Air Canada flight AC143, the Gimli Glider. If those pilots could perform well in those older, much more complicated aircraft in tougher situations, then there is no excuse for the co-pilots of AF flight 447 to be confused in a generally much simpler and easier-to-fly aircraft.
    The Airbus A320 is a digital fly-by-wire aircraft as the flight control surfaces are moved by electrical and hydraulic actuators controlled by a digital computer. The computer interprets pilot commands via input from a side-stick, making adjustments on its own to keep the plane stable and on course, which is particularly useful after engine failure by allowing the pilots to concentrate on engine restart and landing planning. Some say the Airbus A330 is a “video-game” airplane due to its side-stick control, which does not match up in real hard situations. But who can say that after the successful ditching of US Airways flight 1549 on the Hudson River? It was an Airbus A320 with the same side-stick control, and it matched up with the hardest situation very well with an experienced 57 year old Captain Chesley Sullenberger at the command. The Airbus A330 is not a video-game airplane, it is the airlines that make it a video-game by cutting corners, taking advantage of its superior automated capabilities thinking that it flies by itself, and no training and no knowledge of even the basics of the principles of flying is required in them for their pilots, as was demonstrated by the co-pilots of flight 447, who seemed to be incapable to react even on a basic level to the phenomenon of the aerodynamic stall. The co-pilots had not applied the unreliable airspeed procedure. The co-pilots apparently did not notice that the plane had reached its maximum permissible altitude. The co-pilots did not read out the available data like vertical velocity, altitude, etc. The stall warning sounded continuously for 54 seconds. The absence of any training, at high altitude, in manual airplane handling and in the procedure for ”Vol avec IAS douteuse” (Flight with questionable Indicated Airspeed) caused this terrible accident. Evidently, it might not be what Airbus had on its mind designing the aircraft. They might have meant the best of the both, an airplane with superior controls, matched with seasoned pilots with superior education in the principles of flying and the handling of hard situations, best of the best, as airlines are prone to boast of their flying personnel, to represent quality improvement in flying safety by this pairing. Now, if this piece of equipment falls in the hands of the airlines who use it as a video game to save training costs, telling only their pilots that “if the red light on the right side blinks, just pull the stick back as hard as you can, and let the system do the rest”, they can get away with it as long as everything is normal, the airplane is good enough for that, but in unforeseeable situations, such as the flight 447 en-route to Paris on that night, without any independent knowledge of flying in general, the video-gaming with the aircraft may ultimately come to a fatal end.
    However, beyond the reasoning and explanations there is still some eeriness about the crash, taking in consideration that Air France flight 447’s pilots just sat there in daze squeezing the control stick, barely being able to do more than commenting on how the airplane was falling out of the sky until crashing into the Atlantic Ocean, the arrival of the 58-year-old flight captain Marc Dubois in the cockpit not making much a difference either. The question might arise whether weren’t the pilots in a mentally incapacitating state of shock and disbelief? Whether do or can Air France test pilots of how well they can keep their mental stability under the duress of a catastrophic situation? None of it seems to be the fault of the Airbus A330, which needs only good, trained pilots to give superior performance for the good of the flying public. Very similarly 3 decades ago Captain Madan Kukar’s mistaken perception of the Air India Flight 855 situation resulted in causing the Boeing 747-237 to rapidly lose altitude and the airplane hit the Arabian Sea at 35 degree nose-down angle.
    Practicing recovery from “Loss of Control” situations and improve flight crew training for high altitude stalls (simulator training usually has low altitude stalls which are significantly different due to energy status of the aircraft) should become the mandatory part of recurrent training.

  1. December 31, 2014

    […] Related: Air France AF447 Crash Report […]

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>