AF447: the wake-up call

The French air accident investigator, the BEA, has released the final report on the 1 June 2009 AF447 accident.

Shortly after two o’clock in the morning Air France flight 447 from Rio to Paris, an Airbus A330, was cruising at FL350 (35,000ft approx) with autopilot engaged. The two pilots were discussing a heading change to avoid one of the cumulonimbus clouds ahead, visible on the weather radar. Such clouds are always present in the inter-tropical convergence zone, which the aircraft was passing though as it approached the equator.

Because of the atmospheric conditions in the vicinity of the clouds, turbulence increased a little, and ice crystals temporarily blocked the pitot tubes that provide airspeed readings to the pilots. The flight management computer, confused by the disparity in airspeed data it was receiving, disconnected the autopilot as it was designed to do, warning the pilots that they were in control through a raucous audio signal that the crews call the “cavalry charge”. 
The copilot, who was flying, reacted by making a control input that raised the nose of the aircraft dramatically, especially considering that its height was already close to the maximum at which the aircraft could fly safely at that weight. The aircraft zoomed upward at 7,000ft/min rate of climb, speed rapidly decreasing, and less than a minute later a stall warning sounded. That was the first of many stall warnings, but the crew acted as if they did not believe them, continuing to climb and thus lose more speed.
As the aircraft slowed and lost the lift from its wings, it started descending and entered a deep stall.  It was eventually falling vertically at more than 3km per minute with the crew still holding its nose high. The BEA says in its report: “The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre.”
During the press briefing associated with the report’s release today, the BEA said that the crew interpreted the unfamiliar stall buffeting and the high level of unfamiliar aerodynamic noise as indicating an overspeed condition, whereas it was the opposite.
This is what the BEA had to say about why the pilots appeared unable to cope: “The investigation brought to light weaknesses in the two copilots: the inappropriate
inputs by the PF (pilot flying) on the flight controls at high altitude were not noted by the PNF (pilot not flying) through an absence of effective monitoring of the flight path. 
“The stall warning and the buffeting were not identified either. This was probably due to a lack of specific training, although their training was in accordance with regulatory requirements. Manual aeroplane handling cannot be improvised and requires precision and measured inputs on the flight controls. There are other possible situations leading to autopilot disconnection
for which only specific and regular training can provide the skills necessary to ensure the safety of the flight.
“Examination of their last training records and check rides made it clear that the copilots had not been trained for manual aeroplane handling of approach to stall and stall recovery at high altitude.”
The BEA made a series of recommendations, but the ones most directly related to the circumstances of this accident were that Airbus should provide the pilots with a direct angle of attack readout, and that training should be widened to take into account manual flying at the edges of the flight envelope, particularly handling the high altitude stalling that AF447 encountered. To make this training effective, the BEA wants simulators to be improved to represent – more accurately than they now do – handling characteristics at the edges of the flight envelope.

9 Responses to AF447: the wake-up call

  1. Mark 6 July, 2012 at 2:01 am #

    Stall is one essential link leading to this accident. In addition, the Flight Directors were misleading and the pilots may not have been able to see each other’s sidesticks. Also, the cascade of warnings, about one every ten seconds, needs to be made intelligible. Most chilling to me was “l’équipage progressivement déstructuré” (p. 205) the crew’s CRM and basic airmanship coming undone. Pilots are taught to fly the plane, always, but here they couldn’t.

  2. Mauro 7 July, 2012 at 12:23 pm #

    I cannot find reference to two items… the fact that the pilot monitoring could have no clue as to what the sidestick inputs of the pilot flying were ! Also, the captain coming onto the flight deck after the event started also could not see what the sidestick inputs were. Ergonomics may have been a big factor in the crew not being able to disentangle themselves from the situation.

  3. Mark 7 July, 2012 at 6:47 pm #

    Re the sidesticks: » Il est à noter que les actions appliquées par un pilote sur un mini-manche ne sont pas facilement observables par l’autre et que les conditions de vol de nuit en IMC rendent plus difficile la surveillance des attitudes…. « (p. 180)

    Agreed with your point about the captain probably not being able to see sidestick inputs; ergonomics are critical. So is training: Air France may have done what was required, but it looks like it wasn’t enough.

  4. David Connolly 8 July, 2012 at 12:21 am #

    Plus ça change, plus c’est la même chose, Voilla ! on a rainy convective July 5 2012,LFPG 051600Z 04004KT 5000 RA BKN040 BKN053 18/16 Q1009 NOSIG. And as predictable, with so many vested interests, the BEA’s final report on AF447 says nothing on the elephants, hippos and rhinos in the room. That is, the anti-human A-318-80 drone pilot philosophy.
    To wit :
    1) First and foremost ,Autotrim in manual flight:
    To kill yourself should require a bit of biceps/triceps beef in general.
    2) The human solution would be an ergonomic thumb trigger, activation of which puts the controls from Normal to Alternate Law. And thereafter, that activation, keeps the human pilot connected to the ship. Being connected is also illustrated in the pilot’s seats. F/O Bonin’s seat had no belts remaining, F/O Robert in Captain Dubois’s seat only had the lap belt remaining. This shows that F/O Bonin was completely belted/connected with a 5 point harness from takeoff and F/O Robert less so with 3 points casual CRZ relief belting. Not a fault per se, I’ve done that too, but illustrative, none the less.
    When the tail slammed first into the South Atlantic Ocean, compressing all of the aft-CG occupants to instant death, they, the pilots, no longer crew, were ripped-extended upwards and shredded out of their seats to instant death, beyond our living comprehension. Captain Dubois was non-belted and partially seated and slammed upward upon impact to instant death through the crumpled-folded fuselage crown. He was one of the first clothed victims recovered from the ocean surface. Bombed AI182 of June 23 1985, killing 329 mass-murder victims, yielded naked victims from high altitude explosive destruction of flail injuries, unlike AF447, and like PA103 of Dec 21 1988, killing 270 mass-murder victims.
    The only eye catcher of the only Airbus cockpit auto-moving control are the stab trim wheel’s white stripes, not so compellingly visible on the visual field periphery on a moonless convective CB night of the ICTZ. So typically and incoherently European is Airbus, in its assumed FBW arrogance, like its Emissions Taxing Scam, rightly rejected by China’s CAAC on Feb 6 2012, without negotiation.
    My B-744 sim and plane rule is this. First, be seated, slotted(flight plan on clipboard in slot by my right FO ankle), QRH in the slot at 90 degrees to it. Then, be belted to 5 points, lighted , as in panel/dome, storm to override all lights as I wish, as PF and rested to be nested. That means my seat arm rests down, so that for manual flight I have an arm fulcrum and a hand/eye reference for belted and braced PFD accuracy, in effect, I strap on the ship to my back to be relaxed and I have the roasted seared sim scars to prove it. But my greatest learning experience is of previous assumptions. Still, if you never love, you never care, if you never care, you never learn and repeat previous assumptions to rote learned disaster. As I always remember of Dublin’s Parisian Samuel Beckett’s 1983 parody of Westward Ho, his Worstward Ho. “All of old. Nothing else ever. Ever tried. Ever failed. No matter. Try again. Fail again. Fail better”. Beckett died in Paris on December 22 1989. It is a pity that Air France nor the SNPL read his works.
    3) Asynchronous flight controls:
    Except the rudder pedals. This inconsistent Euro-fudge is like the ECB being issuer of a central Euro currency, with no central treasury backstop. What could go wrong in Eurotopia ?
    4) Having auto disconnect of A/P and A/T. On the B-744 and other Boeings, it is “recommended” to disconnect for unreliable airspeed, but it will not immediately abdicate, it is up to the pilot to adjudicate.
    5) The stall warning system, while not compelling, has a well demonstrated fatal flaw, best illustrated in the AF-447 Entrée of XL Airways Germany’s A-320 Flight GXL888T FERRY TRNG FLIGHT on US Thanksgiving, Nov 27 2008, but in fact, an acceptance and check flight for its return to Air New Zealand after its lease. It was painted in ANZ livery before and the pressurized water cleaning caused water ingress into the core AOA vane sensor’s drive gear. 2 out of 3 AOA sensors then froze at TOC@ FL320 and after low speed tests at the rather low altitude of 5000 feet and stall-aided by full auto-trim-and crash into the Mediterranean Sea off Perpignan. Of Course the French SNPL are like an accordion player in battle, a lot of noisy useless baggage. They think the stall warning is central, rather than peripheral to the demise of AF447, when AF447’s crew were in fact acting as individual de-facto test pilots, flying their side of the aircraft, in panic, unlike test pilots acting in calm crew coordinated formation. If your building is on fire, do you stop using available fire extinguisher, with visible flames even though the fire alarm has burned out ?, if you are in the pub and knowingly left your keys there, do you go into the street looking under a lamppost looking for what is impossible to find, in effect, using the lamppost for support rather than illumination ?The SNPL seems to think so for either scenario and no thanks given for that AF447 Entrée of 2008.
    6) Quoting from the BEA report of that crash that claimed 7 lives “When the real AOA increased, the blockage of AOA sensors 1&2 at similar values caused the rejection of ADR 3 anemometric values, EVEN THOUGH THESE WERE VALID. This rejection was performed by VOTE WITHOUT ANY CHECK THAT THE PARAMETERS WERE CONSISTANT WITH EACH OTHER. The crew was not aware of this rejection, except indirectly through the loss of CAT 3 DUAL approach capacity.”
    7) A latent design failure if ever there was one and an inconvenient truth, not addressed at all on the BEA’s AF447 report, nor the SNPL or Air France or Airbus. The latter three have serious vested interests of culpability avoidance bordering evasion. Plus ça change, plus c’est la même chose, Voilla encore !
    8) The RTO of a Virgin B-744 from London Heathrow on Dec 7 2006, illustrates,%20G-VHOT%2008-08.pdf Boeings have 2 AOA vanes and they do not vote, either alarm is valid. I vote early and often. AOA voting is a high cost luxury.
    9) Second opinion ?, a triple IRS weighted position is optimal in LNAV. In VNAV AOA, it is not. Think of a second medical opinion for an acute diagnosis. One would not seek a third lest it agree with the first, generally ?.
    10) Stalls must be acted out, NOT, voted out, that type of voting is a very high cost AOA luxury, a great illustration of the wrong time and place. Democracy is generally suspended in a war zone, as a stall, Wind Sheer /TCAS RA is. In the XL disaster, Normal Law was democratically voted out. Think-ironically-Germany 1933 for another similar democratic deficit perspective, voted in to vote out.
    11) The BEA’s AF447 AOA display recommendation is largely irrelevant, as if you are at such an AOA to be wondering about it, there is most likely an IAS deficit, evolving at a V/S to an altitude deficit pancake crash.
    12) Boeings are designed by geniuses for idiots, Airbus is the opposite-QED.
    13) Side Sticks or Mini-Manche in French are the opposite of Bull Wheel Boeing yokes, in that they have a bias for over-control in inverse proportion to their size. A man sized Boeing yoke has a natural ergonomic-human bias for under-control. This glaring fact is of course conspicuous by its absence in the BEA’s final report on AF447.
    14) The July 5 2012 BEA report may be final on AF447, but it will never be the last word on the crash of the century.
    15) Assumption makes an ass of u and me and is the mother of most disasters-QED AF447.

    2 h 10 min 23 The THR LK mode is de-activated,
    the thrust levers remain on the CLB
    detent. The N1 starts to increase and reach
    around 104 % in 12 seconds.
    Their black colour contributing to its out of scan anonymity. A Boeing A/T’s conspicuous white thrust lever position is in phase with its thrust level delivered. So, for a theoretical similar alternate Boeing A/T mode, there would not be such a jump in thrust level, as there was on AF 447, with a demonstrated jump in N1 from previous CRZ to actual CLB detent.
    are not compelling messages in a cascading failure sweat to move static thrust levers aft to actual thrust PDQ. Further, in a de-structured human panic mode non-compelling “Stall Stall” with a cavalry charge audio assist, is actually not heard. A stick shaker is one the most compelling tactile-audio warning on a flightdeck.
    2 h 11 min 58
    La vitesse verticale est d’environ -15 300 ft/min.
    (F/O PF Bonin)J’ai un problème c’est
    que j’ai plus de vario là
    I have a problem it’s
    that I don’t have vertical
    speed indication – THIS V/S is off the IRS scale and on the FDR scale, as it is academic, as much as on a Boeing or Airbus
    (Captain Dubois)D’accord
    (F/O PF Bonin)J’ai plus aucune Indication
    I have no more displays
    2 h 11 min 58 The vertical speed is around -
    15,300 ft/min. THIS V/S is off the IRS scale and on the FDR scale, as it is academic, so the PFD’s V/S pointer was pegged at the bottom of the tape.
    2 h 12 min 04
    2 h 12 min 07
    The airbrakes are controlled and
    deployed. (F/O PF Bonin) J’ai l’impression qu’on a une vitesse de fou non qu’est-ce que vous en pensez ?
    I have the impression that we have some crazy speed no what do you think?
    2 h 12 min 07 FL 29736
    The angle of attack 2 is temporarily
    valid at 41°.
    The stall warning is triggered.
    (F/O PM/PNF Robert) Non surtout ne ne (les) sors pas
    No above all don’t extend (the)
    SV : “Stall, stall”
    02:12:14 (F/O PM/PNF Robert) Qu’est-ce que tu en penses? Qu’est-ce que tu en penses? Qu’est-ce qu’il faut faire?
    What do you think? What do you think? What should we do?
    02:12:15 (Captain Dubois) Alors, là, je ne sais pas!
    Well, I don’t know!
    2 h 12 min 59 (F/O PF Bonin)Je suis à fond à… avec du gauchissement
    I’m at the limit… with the roll
    (Captain Dubois) Le palonnier
    The rudder bar
    2 h 13 min 38
    (Captain Dubois) Doucement avec le palonnier là
    Careful with the rudder bar there ……This is the only reference Captain Dubois made to a control input, because he could obviously SEE some desperate rudder dancing and was probably cognisant of the demise of AA587, an A-300-600 on Nov 12 2001 in New York. His error was not immediately physically taking over when both operating crew stated they were out of control. “Crew Fail, Pilot Fly”, would be a good muscle memory call in future. F/O Bonin’s stick inputs, had he held a Boeing yoke would have been immediately evident, even in a blind panic, to F/O Robert, long before Captain Dubois rushed back to the bridge. Of course noe are so blind, as those that will not see.

    02:13:40 ( F/O PM/PNF Robert) Remonte… remonte… remonte… remonte…
    Climb… climb… climb… climb…

    02:13:40 (F/O PF Bonin) Mais je suis à fond à cabrer depuis tout à l’heure!
    But I’ve had the stick back the whole time!

    At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself.

    02:13:42 (Captain Dubois) Non, non, non… Ne remonte pas… non, non.
    No, no, no… Don’t climb… no, no.
    I suspect that this utterance was a sudden desperate realization of the unbelievable fact of them being stalled and finished and yet still possibly disbelieving it as a bunkrest nightmare.

    02:13:43 (F/O PM/PNF Robert) Alors descends… Alors, donne-moi les commandes… À moi les commandes!
    Descend, then… Give me the controls… Give me the controls!

    Bonin yields the controls, and Robert finally puts the nose down. The plane begins to regain speed. But it is still descending at a precipitous angle. As they near 2000 feet, the aircraft’s EGPWS detects the fast-approaching surface and trigger a new alarm. There is no time left to build up speed by pushing the plane’s nose forward into a dive. At any rate, without warning his colleagues, Bonin once again takes back the controls and pulls his side stick all the way back, in an emotional reflex rather than rational attempt at survival. This would happen on any aircraft in that unique situation.

    02:14:23 ( F/O PM/PNF Robert) Putain, on va taper… C’est pas vrai!
    Damn it, we’re going to crash… This can’t be happening!

    02:14:25 (F/O PF Bonin) Mais qu’est-ce que se passe?
    But what’s happening?

    02:14:27 (Captain Dubois) 10-Dix degrès d’assiette…
    Ten degrees pitch…

    Exactly 1.4 seconds later, the cockpit voice recorder stops.
    Stopped upon the dreadful glowing Parisian dawn of June 1 2009, yet never forgotten in UTC perpetuity.

  5. paul 8 July, 2012 at 12:28 am #

    AF447 crew suffered from the same lack of training that resulted in Colgan 3407 in Buffalo and Turkish in AMS. They were taught to DO stalls, not recognize and recover from the inadvertent event, nor at practical altitudes – very high and very low. These accidents – and others – were survivable with proper training that is lacking, and easily accomplished with today’s technology.

  6. Trevor 9 July, 2012 at 12:59 am #

    The final French BEA report is a whitewash of the fact that the junior co-pilot flying, Bonin, panicked on hearing the stall horn and pulled the side-stick fully back until the plane crashed at terminal velocity (124 mph vertical), as if he was in a low-altitude take-off and go-around. The crew had never been trained to handle high-altitude stalls; the fatal stall was pilot-induced!

    Unlike other flights that night, these Bozos hadn’t re-routed to avoid the equatorial storms, and the weather radar had been set at the wrong range until it was too late. Captain’s fault. The captain then goes for a nap without designating command or replying to the junior pilot’s concerns about flying through the inter-tropical convergence zone. Only the co-pilot not flying subsequently notices the weather radar discrepancy and advises junior to ‘Go left a bit’.

    Stinginess by Air France meant this plane’s old-design ‘pitot’ air-speed tubes had not been upgraded, so all 3 iced-up in the 35,000-foot storm, causing dis-engagement of the autopilot. Junior inexplicably pulls the plane up to its ceiling of 38,000 feet, then it plummets like a stone being manually pitched nose-up 10-14º in the rarified air.

    Chaos reigned: turbulence, popping ears, loss of data screens, warning horns. The pitot tubes came back online quite quickly, so the crew could have re-engaged the autopilot but the junior co-pilot flying was pulling the nose up for all he was worth. If he had only released the side-stick while still at altitude the situation would have ameliorated and lift been regained.

    Captain eventually returns but seems in a trance, doesn’t take the controls, or even notice that junior is pulling the side-stick back like a maniac as the stall warning horn sounds a total of 75 times.

    Senior co-pilot on the left fails to press over-ride button to disable junior’s non-interconnected side-stick; at times they are both making inputs, and Airbuses accept the electronic average as valid — oops — serious design flaw here!

    Under control of The Three Stooges, a crash became inevitable when they realised they didn’t have enough altitude to nose-down, power-up and regain lift. All in pitch black with no visual references. The plane was fully functional to the end. Lessons have been learned but Boeing’s dual-yoke stick system would have saved the day. Airbus is unlikely to relinquish its video-game side-sticks as blame ricochets between the plane-maker and Air France.

    As for the rogue-pilot of AF447, this was Pierre-Cedric Bonin, 32, who was left in control virtually throughout this sad episode. His wife was a passenger. Obsessed with climbing over the weather systems, he rose to 38,000 feet, contrary to weight and temperature stipulations, then continued to hold the nose high until it stalled — all the way down to the Atlantic. He was a total lunatic who flew contrary to everything he had been taught. The other two pilots, who failed to stop him, were not much better.

    Changes required :

    1) Linked Boeing-style yokes instead of video-game joysticks.

    2) A ‘high-stall’ emergency button, with cancel-to-autopilot, which maintains +5º pitch and 85% thrust.

    3) Angle-of-attack indicator and audible warning when out-of-envelope.

    4) Better co-ordination and use of ITCZ weather data.

    5) Testing of all pitots for resistance to supercooling and freezing.

    6) GPS backup as a ground-speed indicator.

  7. David Learmount 9 July, 2012 at 10:26 am #

    Trevor, how about this event for a parallel with AF447? The accident report said it was caused by, and I quote: “the crew’s mismanagement of the aircraft’s speed, altitude, headings and attitude through inconsistent flight control inputs leading to a loss of control”. The aircraft plunged into the sea at night after two prolonged bouts of stickshaker activity and eleven aural bank warnings. There was absolutely nothing wrong with the aeroplane.

    Which aeroplane, which accident? Ethiopian Airlines Boeing 737-800 on 25 January 2010, in the Mediterranean Sea at night less than 5min after departure from Beirut. The crew were not saved by, as you put it, “Boeing-style yokes instead of video-game joysticks”. Pilot disorientation is no respecter of aeroplane types or manufacturers.

  8. Trevor 9 July, 2012 at 12:51 pm #,_En_route,_south_west_of_Beirut_Lebanon,_2010_%28LOC_HF%29

    ET409 was, ostensibly, the result of over-worked pilots (no rest for 51 days), joint-low type experience, unfamiliarity with the airport and plain bad flying skills. The trim had been set incorrectly prior to takeoff making all other controls harder to work.

    There didn’t seem to be any resolution of the conflict between eyewitness reports of it being on fire and the investigation’s claim there was no evidence of a bomb. Lightning strike, perhaps? The weather was unsettled but not seriously bad. The ultimate reason for it spinning down into the Med remains something of a mystery but I don’t think side-sticks would have helped the situation.

  9. Trevor 10 July, 2012 at 7:50 pm #

    The aftermath of AF447 triggered tensions between Airbus, Air France and the French pilots’ union, with the latter childishly refusing to co-operate with the investigation. Each grouping has their own agenda, namely buck-passing of culpability in order to save money and reputations.

    Air France has fallen to rank as the most-lethal airline in Europe, with only Aeroflot faring worse. The Gallic mindset, translated into pilot error, has no doubt played a part in this poor performance. The appalling CRM (crew resources management) of AF447 has already become legion in flying classrooms worldwide. We owe them a debt of thanks in improving flight safety — so long as pilots remember their lesson and keep cool under stress.