On 1 June 2009, the Airbus A330-200 airliner serving the flight crashed into the Atlantic Ocean, killing all 216 passengers and 12 aircrew. An updated, English Language final report on the crash by Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile was published on July 27. A PDF is downloadable here. It runs to 200-plus pages
Like most pilots, I have a practical interest in plane crashes whether they involve general or commercial aviation. It’s a facet of risk management. As an engineer who once worked in aerospace (Garrett AiResearch, Transco Products), I maintain a professional interest, even though control systems have evolved a long way since I had any contact with them.
What follows is my shortened version of some of the findings presented in the report. I’m not an accident investigator. I may have omitted critical points. The analysis includes a bulleted sequence of events. Here’s a condensed version, with my comments and elisions, of the discussion of what happened on the flight deck. It begins by saying the plane and crew met all the paperwork requirements. Then:
· The meteorological situation was not exceptional for time of year and location.
· There were powerful cumulonimbus clusters on the route; some could have been the center of notable turbulence.
· An additional meteorological analysis showed the presence of strong condensation towards AF 447’s flight level, probably associated with convection phenomena. . . [but] The precise composition of the cloud masses above 30,000 feet is little known, in particular with regard to the super-cooled water/ice crystal divide, especially with regard to the size of the ice crystals.
· Other planes in the area did alter their routes to avoid cloud masses.
· At the time of the autopilot disconnection, the captain was taking a rest.
Then, trouble started happening:
· There was an inconsistency between the speeds measured. This is assumed to be because the pitot probes were blocked by ice crystals.
· First the autopilot, then the autothrust systems disconnected while the plane was flying at the upper limit of a slightly turbulent cloud layer.
· Other systems detected an inconsistency in the measured airspeeds, resulting in the flight control law being reconfigured to “alternate 2B.” (This is where it gets hairy. “Flight Control Law” refers to the response parameters of the fly-by-wire control system – what the control surfaces do in response to manual control inputs. There is a detailed description of this starting on page 186 of the report.)
· When the autopilot disconnected, it generated a warning to the pilots in the cockpit. (The report says that it “surprised them.”)
· Although having identified and called out the loss of the airspeed indications, neither of the two copilots called the “Unreliable IAS” procedure. (IAS = Indicated Airspeed, a fundamental flight parameter derived from pitot and static pressure. This may be the most critical point – I can’t say for sure, because this copy of the report doesn’t have the appendices, one of which, Appendix 6, contains the procedure – but I don’t think it says to hold the pitch control “nose up” all the way to the ground. Relative to the IAS procedure, the report says that the copilots, while familiar with the procedure, had not had any hands-on experience with executing it or any other manual control procedures) at high altitude, in a real Airbus.)
Meanwhile, the report goes on:
· The Flight Directors (which tell the pilots how to fly manually did not disconnect, but they gave a lot of intermittent displays.
· In less than one minute after autopilot disconnection, the plane exited its flight envelope following inappropriate pilot inputs. (I assume that means “no lift.” The wings had stalled or were about to.)
· The Captain came back into the cockpit about 1 min 30 after the autopilot disconnected. I can’t decipher whether the stall had occurred at this point. What the bulleted list says next is that, “The approach to stall was characterized by the triggering of the warning then the appearance of buffet. That’s strictly an aural warning, because the primary flight display had gone wonky. The aural stall warning sounded continuously for 54 seconds, but on the cockpit audio tape, neither of the pilots made any reference to the stall warning or to the buffeting. (But they were in turbulence anyway.)
· A short time after the stall warning came on, the pilot flying (whoever it was at this point selected take-off/go-around thrust, and made a nose-up input.
Now, skipping ahead . . . .
· Angle of attack allows the stall warning to be triggered; but if the angle of attack values become invalid, the warning stops. And . . . By design, when the measured speed values are lower than 60 kt, the measured angle of attack values are invalidated. And . . . The plane’s angle of attack is not directly displayed to the pilots.
There’s more, but the bulleted items related to the flight deck end this way, “The last recorded values were a pitch attitude of 16.2 degrees nose-up, roll of 5.3 degrees to the left and a vertical speed of -10,912 ft/min.”
That’s enough of my editing. The opening paragraphs of the section of the report titled “Causes of the Accident,” read like this:
“The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information that resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.
“The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with airplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF [Pilot Flying]. The destabilization that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM [Electronic Centralized Aircraft Monitoring] messages, which did not help with the diagnosis. The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information.
“In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioral hypotheses in classifying the loss of airspeed information as “major” were not validated in the context of this accident. Confirmation of this classification thus supposes additional work on operational feedback that would enable improvements, where required, in crew training, the ergonomics of information supplied to them and the design of procedures.
“The airplane went into a sustained stall, signaled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery maneuver. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training, and the process of recurrent training does not generate the expected behavior in any acceptable reliable way.”