13 
In June 2009 an Airbus A330-200, Air France flight 447, crashed into the Atlantic Ocean tragically killing 228 people. Now, the final BEA report into the event reveals that the tragedy occurred because the crew ignored the warning alarms in the cabin.
While initial analysis of flight recordings pointed to crew error, subsequent evidence suggested that faulty pitot tubes might have been to blame. Now, the BEA report makes it clear that it was the flight crew at fault. From the report:
In the first minute after the autopilot disconnection, the failure of the attempt to understand the situation and the disruption of crew cooperation had a multiplying effect, inducing total loss of cognitive control of the situation… The combination of the [Airbus] warning system ergonomics, and the conditions under which [Air France] pilots are trained and exposed to stalls during their professional and recurrent training, did not result in reasonably reliable expected behavior patterns.
As New Scientist points out, at the heart of the tragedy is the simple fact that the stall alarms were ignored. From New Scientist’s coverage:
Despite a stall warning sounding continually, it was ignored and the pilot kept the plane’s nose pointing upward – while the plane was in fact plummeting toward the ocean. All the crew needed to do was push the nose down to regain lift – but they didn’t.
As a result, the report questions whether pilot training is currently sufficient. It goes on to suggest that, as a minimum, they need to be equipped with a more rigorous knowledge of the physics of flight at high altitude. You can read the BEA’s full recommendations here. [BEA via New Scientist]
Image by BriYYZ under Creative Commons license
It wasn’t just the alarms – a glance at the sodding instruments would have told them that they were nose-up and descending rapidly which tends to mean only one thing.
The instruments had malfunctioned and therefore they couldn’t trust the alarms. The title of the article is a bit unfair.
That was my point – it was their failure to look at their instruments that brought the plane down, not their attentiveness to the alarms.
I don’t understand this.
There’s no way any qualified pilot in the world would not understand this.
There must be something else going on – I’m not one for conspiracy theories but I bet a bunch are flying around the folks who lost family on this plane.
They stalled out (from high altitude?) because the pilots didn’t know what a stall was? BS!
Let me just reel that back in slightly. I missed that their airspeed indicators were broken. I suppose if all your instruments were frozen (including altimeter) you wouldn’t know you were stalling. But surely after a while they could see they had massively descended? Still don’t get it
But even then if you have a stall warning going on you would try moving the nose down to see if it was real. I cant believe that a trained pilot let this happen.
You’d be surprised how strong the impulse to pull back when bad things happen in a plane is.
Having spent enough time messing around in a pseudo-Airbus cockpit, and delving into the intricacies of how they work, I’m fairly sure that there will have been multiple warnings, even with the pitot probes inoperable.
I’m actually more surprised that the stall prevention didn’t kick in and punch the nose down for them!
The cockpit is integrated enough that it should be possible relatively easily to get GPS altitude and ground speed, which the pilots should be able to convert into an airspeed for their given altitude, or at the very least coupled with the attitude indicators, understand that they needed to level out and apply as much thrust as possible!
Three Mile Island showed that when multiple warning start blaring at operators they tend to ignore, rather than prioritise, them. In this case, I imagine the FBW relaxed its envelope restrictions due to the incomplete data picture it was receiving.
You are correct, the aircraft flight envelope would have switched from Normal Law to Alternate Law when the airspeed became unreliable as the result of a blocked pitot. Normal Law provides extra envelope protection and stops a stall by limiting the maximum angle of attack.
In Alternate Law, pitch attitude and bank angle protection ceases and therefore it will not stop you from stalling, however the stall warners will continue to sound if a the aircraft is stalled. In Alternate or Direct Law (an even less restrictive flight mode) the pilots still have all of the necessary indications to detect a stall and all (assuming the aircraft control surfaces and systems are undamaged) of the control authority to return to normal flight.
All of that aside, there are unreliable airspeed checklists that when followed would have averted the whole situation. Not quite sure what the crew were up to here?
Oddly, GPS isn’t tied closely into flight control systems, as GPS is not considered a ‘reliable’ source of data. It’s not that it’s inaccurate, but the system is owned and operated by the US government, and they have the ability to disable it at any time. As such, flight control systems aren’t designed to rely on GPS at any time, and pilots aren’t trained to use it as a primary source of data.
However, a simple glance at their GPS readings would have certainly helped the pilots to diagnose their situation. I’d consider this to be basic fault-finding.
I’ve responded to a few of the other points below…
I know it’s not integrated in as a primary sensor, more to provide situational awareness, which could be rendered inaccurate at any moment, however in this instance I’d have taken all the information I could get. Hell, a even a cup of coffee on the flight deck would have given some indication as to what was happening!
Very true, and it’s apparent that the pilots weren’t taking appropriate steps to diagnose their situation. With the plane giving them multiple conflicting warnings, they may have questioned the reliability of any data that it presented to them. This is one problem with complex automation – the less the pilots understand the nuts & bolts, the less trust they place in the system when it goes wrong. This could be due to a lack of experience, training or even basic ability, and the report makes a number of suggestions for how training practices should be modified.
This is one of the main reasons I would dearly love to get out of engineering the damn things and actually into flying them (not that anyone will pay me to do that atm!) – it got to the point where I’d spent enough time on the sim and the integration rigs that I knew the interoperability of the flight systems better than the pilots flying the things themselves.
Hah! That’s interesting, I’ve been working as a software engineer for the past 10 years, and I’m currently training for an ATPL with the intent of joining an airline. It took years for me to get the cash together to do it, and I’ll still be in debt when I finish.
I wouldn’t be surprised if you knew the tech better than the pilots, the pilots can’t possibly be expected to be fully trained engineers as well as fully trained pilots, and there are many forms of engineering that go into an aircraft. Software, electrical, structural, aeronautical, etc, etc,. However, when I look at a few of these accident reports, I can’t help thinking that pilots should be trained a little more like engineers to avoid situations like this.
I dread to think of the cost – I know it’s a minimum of 150hrs just for a commercial license, let alone any turbine and multi-engine ratings!
Even on the pseudo-A320 cockpit I was working on, there were always enough sources of information if you think to use them, despite a complete and total failure of the air data system! I’m not a qualified pilot by any means, but I’d at least like to think that with a basic familiarisation of the Airbus FbW system and its control authority I’d have effected a better outcome than they did.
Frozen ATPL £80k, type rating another £20k. If you’re lucky, the airline helps out with the type rating.
And I think you’re right, you probably would have effected a better outcome than these pilots. Air France had already reported 30-odd incidents of temporary pitot icing on A330s and A340s before this accident, and those planes didn’t crash. This is the exception, so it seems these pilots made some serious errors.
OUCH! That’s the reason I haven’t done it yet!
They were at ~FL350, so well above usual icing zone, though I assume that this was more related to the humidity caused by the thunderstorm in the area than anything else.
It’s still just inconceivable that with what should have been the combined level of training and experience on that flight deck, not one of them concluded that with such a high descent rate and pitch-up attitude, regardless of the IAS readout, that they needed to push the nose down and the throttles fully forward.
Force jet-wash over the pitch control surfaces and you will regain enough control to direct the aircraft downwards to an extent where aerodynamic lift takes over, even if you’re pushing the design limits for the subsequent recovery manoeuvre.
I agree completely that high altitude stalls are a nightmare to recover from, but the only way to do so is by descending out of ‘coffin corner’, nose first!
True, I guess the pilots actually thought that the plane was travelling too fast, so they pulled the nose up. Bad call.
I haven’t seen what the altimeter was reading from the FDR data, but it’s tied into the same pitot-static system as the airspeed sensors, so it’s possible that the altimeter may have been giving them faulty readings as well, particularly if all of the pitot probes were iced.
Sounds unlikely? There’s a theory that the plane may have been flying through supercooled water, the same phenomenon that causes freezing rain. That would cause an extremely fast build-up of ice, particularly on protruding metal surfaces like the pitot probes. Here’s a demonstration:
http://www.youtube.com/watch?v=fSPzMva9_CE
Hmmmm, for some reason I can’t reply to your final post, so here will have to suffice!
I think the reports were of a cruise alt of FL350, climbing to FL380 during the manoeuvres. Unless as you suggest the static ports on the pitot probes were blocked as well, though even in that instance the system should have been reporting roughly the correct altitude, and zero IAS, so nothing on the displays should have indicated an overspeed.
In this instance I’d like to see companies coating the metallic portions of the pitot probes with this stuff.
I can’t find the video they used to have online which showed the pouring of water on an already cooled Al plate. The uncoated half experienced rapid ice buildup, the coated half had just few droplets which themselves would have been swept away into the airflow with little effort.
OK, a few things:
1) The pilots ignored the alarms because they didn’t know which warnings to trust. Due to incorrect sensor readings, the plane was feeding them multiple conflicting warnings – overspeed as well as the stick shaker (stall) warning.
2) The automatic stall protection that typifies the Airbus flight control philosophy was not operational in this case. The computer realised that it was receiving conflicting airspeed readings from the pitot-static system. In this situation, the computer can’t make flight control decisions that overrule the pilot (as the information on which it bases those decisions is faulty), so it shifted from its normal flight control law to one where the pilot has more authority.
3) The crash occurred during a moonless night, so the pilots could not see anything out of the windows. There were no visual cues to indicate altitude, attitude or horizon, and the instruments that provide two of those were giving them faulty readings.
The moonless night is a common factor in similar crashes where faulty airspeed/altitude readings were partly responsible, namely Birgenair Flight 301 and Aeroperú Flight 603 (both in 1996).
The reason I’m pointing this out isn’t to absolve the pilots of all blame, but merely to point out that they weren’t complete idiots. There were good reasons for their errors, and to err is human.
However, no plane should ever be brought down by iced pitot probes. They should have realised where the fault lay and taken appropriate action. In the event that airspeed readings cannot be trusted, the plane should be placed at a certain attitude and throttle level to ensure that a straight an level flight is maintained until the issue can be resolved. These pilots failed to properly diagnose their situation.
Just like Fuhishima the individuals involved failed because of a lack of clearly deffined roles and responsibilities. Ask yourself if your business does this. It wont because the leaders want total overiding power because of their incentive plans, so they dont bother to give anyone else any responsibilities. This crash is totaly the result of greed.
Not had a chance to read the report properly, but from memory there are usually at least 2 independent power sources for pitot heating across multiple bus-bars, so what happened?!
Procedural error meaning they were never turned on, or hardware failure?
They were probably being heated, it’s unlikely that the pilots simply forgot. Airbus had already issued a mandatory service bulletin (followed by an EASA airworthiness directive) which required the old Thales probes to be replaced with new Goodrich ones. Apparently the Thales probes were prone to icing at cruise altitude. The heaters were simply overwhelmed by fast ice build-up and they took a few minutes to melt through the ice so the probes. This caused a few minutes where airspeed readings were lost.
This plane was scheduled to receive this replacement during routine maintenance, but it hadn’t happened at the time of the crash.
Sorry, posted that before I finished cleaning up the wording, and I can’t edit. Correction:
“The heaters were simply overwhelmed by fast ice build-up and they took a few minutes to melt through the ice. This caused a few minutes of in-operability during which airspeed readings were lost.”
Hmmmm, for some reason I can’t reply to your final post above, so here will have to suffice!
I think the reports were of a cruise alt of FL350, climbing to FL380 during the manoeuvres. Unless as you suggest the static ports on the pitot probes were blocked as well, though even in that instance the system should have been reporting roughly the correct altitude, and zero IAS, so nothing on the displays should have indicated an overspeed.
In this instance I’d like to see companies coating the metallic portions of the pitot probes with this stuff.
I can’t find the video they used to have online which showed the pouring of water on an already cooled Al plate. The uncoated half experienced rapid ice buildup, the coated half had just few droplets which themselves would have been swept away into the airflow with little effort.