Within four and a half minutes in the early hours of June 1, 2009, an Airbus A330-200 operating as Air France Flight 447 from Rio de Janeiro, Brazil, to Paris, departed from cruise flight at 35,000 ft and descended into the Atlantic Ocean, killing all 216 passengers and 12 crewmembers. Glimpses of what might have gone wrong emerged from several interim reports issued by the French Bureau d’Enquêtes et d’Analyses (BEA) during its long investigation of the accident. In July 2012, the bureau published a nearly 300-page final report providing a full picture of what likely happened during those critical moments.
According to the report, the trouble began when the A330’s pitot tubes were obstructed by ice crystals, causing the various air data sources to produce unreliable airspeed information. Reacting as designed, the electronic flight control system (EFCS) rejected the air data, disengaged the autopilot and autothrottle, and reverted to a lower control law that provides fewer protections against flight-envelope deviations. Startled by the unexpected and unfamiliar situation, and with turbulence making sidestick control inputs difficult, the pilot flying (PF) inadvertently commanded a steep nose-up pitch change while leveling the airplane’s wings. The flight crew — a copilot and a relief pilot filling in for the resting captain — recognized the loss of reliable airspeed data but did not conduct the associated checklist procedure. Confusion reigned on the flight deck, and crew coordination vanished. Without automatic angle-of-attack protection, the airplane entered a stall. The crew either believed that the stall warnings were spurious or mistook the airframe buffeting as a sign of an overspeed. No recovery action was taken, and the A330 remained in a stall as it descended to the sea.
Based on the findings of the investigation, the BEA made 41 recommendations to various organizations worldwide on topics including pilot training, equipment certification, air traffic control (ATC) and search and rescue (see, “Safety News August 2012”).1
Air France 447 had an augmented flight crew comprising a captain and two copilots. When the airplane departed from Rio de Janeiro at 2229 coordinated universal time (1929 local), the captain was in the left seat and serving as pilot not flying (PNF), and one of the copilots was flying from the right seat.
The captain, 58, had 10,988 flight hours, including 1,747 hours as pilot-in-command in type. The PF, 32, had 2,936 flight hours, including 807 hours in type. The other copilot was 37 and had 6,547 flight hours, with 4,479 hours in type.
About two hours after departing from Rio, the flight crew received information from the airline’s operations center about an area of convective activity developing along the route between the SALPU and TASIL navigation waypoints. Shortly thereafter, the PF remarked that the airplane was “entering the cloud layer,” and the light turbulence to which the flight had been exposed increased slightly.
The report said that statements captured by the cockpit voice recorder indicated that the PF became preoccupied with the conditions they might encounter as the flight progressed through the intertropical convergence zone (ITCZ). Several times, he expressed concern about the turbulence and the relatively warm outside air that limited the airplane’s performance and precluded a climb to Flight Level (FL) 370 (approximately 37,000 ft), to get above the clouds. He suggested that they request clearance from ATC to climb to FL 360, which is not a standard level for their direction of flight.
“Some anxiety was noticeable” in the PF’s statements, the report said. “The captain appeared very unresponsive to the concerns expressed by the PF about the ITCZ. He favored waiting and responding to any turbulence noted.” The report said that the captain had crossed the ITCZ many times and likely considered the present conditions as normal.
Preparing for a rest break at 0152, the captain woke the other copilot, who was in the crew rest facility, and summoned him to the cockpit. The copilot took the left seat vacated by the captain and was briefed by the PF about the flight conditions. The turbulence had subsided, but the PF said that they could expect more turbulence ahead and that they presently could not attempt to climb above the clouds. The PF also noted that they had not been able to establish a position-reporting data link with the Dakar Oceanic flight information region.
The captain did not contribute any information to the briefing before he left the cockpit at 0200 and went to the crew rest facility. He also did not specifically designate which copilot would serve as the “relief pilot” — that is, the captain’s replacement — although he implied that the copilot in the right seat (the PF) would fill that role. The report said that the decision was questionable considering the significantly higher experience level of the other copilot.
At this point, the A330 was nearing the ORARO waypoint, which is between SALPU and TASIL, and entering the ITCZ. Airspeed was 0.82 Mach, and the pitch attitude was 2.5 degrees nose-up. The turbulence increased again, and the PF advised the cabin crew that the turbulence soon would intensify. “You’ll have to watch out there,” he said. “I’ll call you when we’re out of it.”
At 0208, the PNF, who was examining the weather radar display, suggested that they “go to the left a bit.” The selected heading then was adjusted 12 degrees left. In addition, “the crew decided to reduce the speed to about Mach 0.80, and engine deicing was turned on,” the report said.
Exiting the Envelope
At 0210:05, the autopilot and autothrottle disengaged, and the PF announced, “I have the controls.” The PNF responded, “All right.”
The airplane, which already had been near its performance limits in high-altitude cruise, “exited its flight envelope” within a minute of autopilot disengagement, the report said. “Neither of the two crewmembers had the clarity of thought necessary to take the corrective actions. However, every passing second required a more purposeful corrective piloting input.”
The airspeed shown on the left primary flight display (PFD) decreased rapidly from about 275 kt to 60 kt. A few moments later, the airspeeds shown on the integrated standby instrument system and the right PFD also decreased.
The ice crystal icing that had blocked the A330’s pitot probes is a phenomenon that is not well understood, according to the report. “In the presence of ice crystals, there is no visible accretion of ice or frost on the outside, nor on the nose of the probe, since the crystals bounce off of these surfaces. However, the ice crystals can be ingested by the probe air intake. According to the flight conditions (altitude, temperature, Mach), if the concentration of crystals is greater than the capacity for deicing of the heating element and evacuation by the purge holes, the crystals accumulate in large numbers in the probe tube.” The resulting disruption of total pressure measurement produces unreliable airspeed information, causing reversion from normal to alternate flight control law.
The airplane had pitched about 2 degrees nose-down and had begun rolling right when the autopilot disengaged. “The PF made rapid and high-amplitude roll control inputs, more or less from stop to stop,” the report said. “He also made a nose-up input that increased the aeroplane’s pitch attitude up to 11 degrees in 10 seconds.” As a result, the airplane began to climb rapidly. The aural and visual stall warnings activated twice, briefly.
“The excessive nature of the PF’s inputs can be explained by the startle effect and the emotional shock at the autopilot disconnection,” the report said. “Although the PF’s initial excessive nose-up reaction may thus be fairly easily understood, the same is not true for the persistence of this input.”
The PNF was not immediately aware of the PF’s control inputs or that, because of the unreliable airspeed data, the EFCS control law had changed from normal, which would prevent the airplane from reaching stall angle-of-attack, to alternate, which would not prevent a stall. He reacted to the stall warnings by saying, “What was that?”
The PNF then noticed the airspeed anomalies, as well as the reversion to alternate control law. At 0210:16, he announced, “We’ve lost the speeds,” and added, “alternate law protections.” The PF also noticed the airspeed anomalies. “We haven’t got a good display of speed,” he said.
However, neither pilot called for the abnormal/emergency checklist that addresses unreliable airspeed indications. Among the checklist actions is disengagement of the flight directors, which can — and did in this case — present erroneous cues in the absence of consistent airspeed information.
The report said that the pilots did not focus on the problem involving the abnormal airspeed indications because they might have perceived “a much more complex overall problem than simply the loss of airspeed information.”
Several messages appeared on the electronic centralized aircraft monitor (ECAM), and the PNF read them out “in a disorganized manner,” the report said, also noting that none of the ECAM messages provided an “explicit indication that could allow a rapid and accurate diagnosis” of the situation.
At 0210:27, the PNF observed indications that the airplane was climbing and said, twice, “Go back down.” The PF acknowledged and made several nose-down sidestick inputs that reduced the pitch attitude and the vertical speed. However, the report said that, possibly due to an erroneous flight director prompt to increase the pitch attitude, the PF did not make control inputs sufficient to halt the climb.
At 0210:36, the airspeed information shown on the left PFD returned to normal; the indication was 223 kt. “The aeroplane had lost about 50 kt since the autopilot disconnection and the beginning of the climb,” the report said.
‘I Don’t Have Control’
The PNF was calling the captain to return to the cockpit at 0210:51, when the stall warnings activated again. Pre-stall buffeting began seconds later. “The crew never referred either to the stall warning or the buffet that they had likely felt,” the report said.
The PF applied takeoff/go-around thrust but continued to apply nose-up control inputs. This is how pilots typically are trained to react to stall indications at low altitude, the report said, noting, however, that “at this point, only descent … through a nose-down input on the sidestick would have made it possible to bring the aeroplane back within the flight envelope.”
The buffeting, aerodynamic noise and misleading flight director indications might have caused the PF to believe that an overspeed situation existed, the report said. He reduced thrust to idle and attempted to extend the speed brakes.
The EFCS autotrim system reacted to the PF’s continued back pressure on the sidestick by moving the horizontal stabilizer to its full airplane-nose-up position, where it remained until the end of the flight. “The PF continued to make nose-up inputs,” the report said. “The aeroplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and angle-of-attack were 16 degrees.”
At 0211:38, the PF told the PNF, “I don’t have control of the plane at all.” The PNF responded by announcing, “Controls to the left,” and pressing the pushbutton on his sidestick to transfer flight control priority from the PF’s sidestick to his sidestick.
“The PF almost immediately took back priority without any callout and continued piloting,” the report said. “The priority takeover by the PF could not be explained but bears witness to the de-structuring of the task sharing” between the pilots.
The captain likely noticed the airframe buffeting and the airplane’s high pitch attitude while returning to the cockpit at 0211:42. The continuous aural master warning and intermittent stall warning, the confusing instrument indications and the stress conveyed by the two copilots when they told him that they had lost control of the airplane likely made it difficult for the captain to grasp the situation, the report said. “Subsequently, his interventions showed that he had also not identified the stall.”
The airplane was descending through 35,000 ft at 10,000 fpm with a 40-degree angle-of-attack and with roll oscillations reaching 40 degrees. “Only an extremely purposeful crew with a good comprehension of the situation could have carried out a maneuver that would have made it possible to perhaps recover control of the aeroplane,” the report said.
At 0212:02, the PF said, “I have no more displays,” and the PNF said, “We have no valid indications.”
“At that moment, the thrust levers were in the ‘IDLE’ detent and the engines’ N1s [fan speeds] were at 55 percent,” the report said. “Around 15 seconds later, the PF made pitch-down inputs. In the following moments, the angle-of-attack decreased, the speeds became valid again and the stall warning triggered again.”
At 0214:17, the ground-proximity warning system began to generate “SINK RATE” and “PULL UP” warnings.
The flight data recorder ceased to function at 0214:28. “The last recorded values were a vertical speed of 10,913 fpm, a groundspeed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left, and a magnetic heading of 270 degrees,” the report said. “No emergency message was transmitted by the crew. The wreckage was found at a depth of 3,900 m [12,796 ft] on 2 April 2011.”
This article is based on the English translation of the BEA’s “Final Report on the Accident on 1st June 2009 to the Airbus A330-203, Registered F-CZCP, Operated by Air France, Flight AF 447, Rio de Janeiro–Paris.” The report is available in English and the original French at www.bea.aero.
- The recommendations will be discussed in the September issue of AeroSafety World.
Download the full article [PDF 456K]