Air France Flight AF447 Crash Investigation Report

Air France Flight AF447 Crash Investigation Report History of Flight On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP opera...

Air France Flight AF447 Crash Investigation Report

History of Flight

On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP operated by Air France was programmed to perform scheduled flight AF 447 between Rio de Janeiro Galeão and Paris Charles de Gaulle. Twelve crew members (3 flight crew, 9 cabin crew) and 216 passengers were on board. The departure was planned for 22 h 00 min.

At around 22h 10 min, the crew was cleared to start up engines and leave the stand.Takeoff took place at 22 h 29. The Captain was Pilot Not Flying (PNF); one of the copilots was Pilot Flying (PF).

At the start of the Cockpit Voice Recorder (CVR) recording, shortly after midnight, the aeroplane was in cruise at flight level 350. Autopilot 2 and auto-thrust were engaged. Auto fuel transfer in the “trim tank” was carried out during the climb. The flight was calm.

At 1 h 35 min, the aeroplane arrived at INTOL point and the crew left the Recife frequency to change to HF communication with the Atlántico Oceanic control centre. A SELCAL test was successfully carried out, but attempts to establish an ADS-C connection with DAKAR Oceanic failed.

Shortly afterwards, the co-pilot modified the scale on his Navigation Display (ND)from 320 NM to 160 NM and noted “...a thing straight ahead”. The Captain confirmed and the crew again discussed the fact that the high temperature meant that they could not climb to flight level 370.

At 1 h 45, the aeroplane entered a slightly turbulent zone, just before SALPU point.

Note: At about 0 h 30 the crew had received information from the OCC about the presence of a convective zone linked to the inter-tropical convergence zone (ITCZ) between SALPU and TASIL.

The crew dimmed the lighting in the cockpit and switched on the lights “to see”. The co-pilot noted that they were “entering the cloud layer” and that it would have been good to be able to climb. A few minutes later, the turbulence increased slightly in strength.

Shortly after 1 h 52, the turbulence stopped. The co-pilot again drew the Captain’s attention to the REC MAX value, which had then reached flight level (FL) 375. A short time later, the Captain woke the second co-pilot and said “[...] he’s going to take my place”.

At around 2 h 00, after leaving his seat, the Captain attended the briefing between the two co-pilots, during which the PF (seated on the right) said specifically that “well the little bit of turbulence that you just saw we should find the same ahead we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast” and that “the logon with DAKAR failed”. Then the Captain left the cockpit.

The aeroplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82. The pitch attitude was about 2.5 degrees. The weight and balance of the aeroplane were around 205 tonnes and 29%.

The two copilots again discussed the temperature and the REC MAX. The turbulence increased slightly. At 2 h 06, the PF called the cabin crew, telling them that “in two minutes we ought to be in an area where it will start moving about a bit more than now you’ll have to watch out there” and he added “I’ll call you when we’re out of it”.

At around 2 h 08, the PNF proposed “go to the left a bit [...]”. The HDG mode was activated and the selected heading decreased by about 12 degrees in relation to the route. The PNF changed the gain adjustment on his weather radar to maximum, after noticing that it was in calibrated mode. The crew decided to reduce the speed to about Mach 0.8 and engine de-icing was turned on.

At 2 h 10 min 05, the autopilot then the auto-thrust disconnected and the PF said

“I have the controls”. The aeroplane began to roll to the right and the PF made

a nose-up and left input. The stall warning triggered briefly twice in a row. The recorded parameters showed a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS). The flight control law reconfigured from normal to alternate. The Flight Directors (FD) were not disconnected by the crew, but the crossbars disappeared.

Note: Only the speeds displayed on the left side and on the ISIS are recorded on the FDR; the speed displayed on the right side is not recorded.

Pitot Tubes Positions

At 2 h 10 min 16, the PNF said “we’ve lost the speeds ” then “alternate law protections”. The PF made rapid and high amplitude roll control inputs, more or less from stop to stop. He also made a nose-up input that increased the aeroplane’s pitch attitude up to 11° in ten seconds.

Between 2 h 10 min 18 and 2 h 10 min 25, the PNF read out the ECAM messages in a disorganized manner. He mentioned the loss of autothrust and the reconfiguration to alternate law. The thrust lock function was de-activated. The PNF called out and turned on the wing anti-icing.

The PNF said that the aeroplane was climbing and asked the PF several times to

descend. The latter then made several nose-down inputs that resulted in a reduction in the pitch attitude and the vertical speed. The aeroplane was then at about 37,000 ft and continued to climb.

At about 2 h 10 min 36, the speed displayed on the left side became valid again and was then 223 kt; the ISIS speed was still erroneous. The aeroplane had lost about 50 kt since the autopilot disconnection and the beginning of the climb. The speed displayed on the left side was incorrect for 29 seconds.

At 2 h 10 min 47, the thrust controls were pulled back slightly to 2/3 of the IDLE CLB notch (85% of N1). Two seconds later, the pitch attitude came back to a little above 6°, the roll was controlled and the angle of attack was slightly less than 5°.

From 2 h 10 min 50, the PNF called the Captain several times. At 2h 10 min 51, the stall warning triggered again, in a continuous manner. The thrust levers were positioned in the TO/GA detent and the PF made nose-up inputs.

The recorded angle of attack, of around 6 degrees at the triggering of the stall

warning, continued to increase. The trimmable horizontal stabilizer (THS) began nose-up movement and moved from 3 to 13 degrees pitch-up in about 1 minute and remained in the latter position until the end of the flight. Around fifteen seconds later, the ADR3 being selected on the right side PFD, the speed on the PF side became valid again at the same time as that displayed on the ISIS. It was then at 185kt and the three displayed airspeeds were consistent. The PF continued to make nose-up inputs. The aeroplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and angle of attack were 16 degrees.

At 2 h 11 min 37, the PNF said “controls to the left”, took over priority without any call out and continued to handle the aeroplane. The PF almost immediately took back priority without any call out and continued piloting.

At around 2 h 11 min 42, the Captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped, after having sounded continuously for 54 seconds. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was about -10,000 ft/min. The aeroplane’s pitch attitude did not exceed 15 degrees and the engines’ N1’s were close to 100%. The aeroplane was subject to roll oscillations to the right that sometimes reached 40 degrees. The PF made an input on the side-stick to the left stop and nose-up, which lasted about 30 seconds.

At 2 h 12 min 02, the PF said, “I have no more displays”, and the PNF “we have no valid indications”. At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning triggered again.

At 2 h 13 min 32, the PF said, “[we’re going to arrive] at level one hundred”. About fifteen seconds later, simultaneous inputs by both pilots on the side-sticks were recorded and the PF said, “go ahead you have the controls”.
The angle of attack, when it was valid, always remained above 35 degrees.
From 2 h 14 min 17, the Ground Proximity Warning System (GPWS) “sink rate” and then “pull up” warnings sounded.
The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees.

No emergency message was transmitted by the crew. The wreckage was found at a depth of 3,900 metres on 2 April 2011 at about 6.5 NM on the radial 019 from the lastposition transmitted by the aeroplane.

Recovered General Electric CF6-80-E1A3

GE CF6-80-E1A3 Engine

Wing as seen from underwater vehicle

Landing Gear as seen from underwater vehicle

CONCLUSIONS

The crew possessed the licenses and ratings required to undertake the flight.

The aeroplane possessed a valid Certificate of Airworthiness, and had been maintained in accordance with the regulations.The aeroplane’s weight and balance were within operational limits.

The aeroplane had taken off from Rio de Janeiro without any known technical problems, except on one of the three radio management panels.

The composition of the crew was in accordance with the operator’s procedures.

The meteorological situation was not exceptional for the month of June in the inter-tropical convergence zone.

There were powerful cumulonimbus clusters on the route of AF 447. Some of them could have been the centre of some notable turbulence.

An additional meteorological analysis showed the presence of strong condensation towards AF 447’s flight level, probably associated with convection phenomena.

The precise composition of the cloud masses above 30,000 feet is little known,in particular with regard to the super-cooled water/ice crystal divide, especially with regard to the size of the latter.

Several aeroplanes that were flying before and after AF 447, at about the same altitude, altered their routes in order to avoid cloud masses.

The crew had identified some returns on the weather radar and made a heading change of 12° to the left of their route.

At the time of the autopilot disconnection, the Captain was taking a rest.

The departure of the Captain was done without leaving any specific instructions for crossing the ITCZ.

There was an implicit designation of a pilot as relief Captain.

There was an inconsistency between the speeds measured, likely following the blockage of the Pitot probes by ice crystals.

The AP then the A/THR disconnected while the aeroplane was flying at the upper limit of a slightly turbulent cloud layer.

The aeroplane systems detected an inconsistency in the measured airspeeds. The flight control law was reconfigured to alternate 2B.

No failure message on the ECAM clearly indicates the detection by the system of an inconsistency in measured airspeeds.

The pilots detected an anomaly through the autopilot disconnection warning that surprised them.
Although having identified and called out the loss of the airspeed indications, neither of the two copilots called the “Unreliable IAS” procedure.
The Flight Directors did not disconnect.

The crossbars disappeared and then re-appeared on several occasions, changing mode several times.

The copilots had not undertaken any in-flight training, at high altitude, for the “vol avec IAS douteuse” procedure or on manual aeroplane handling.

The speed displayed on the left PFD was incorrect for 29 seconds, that of the speed on the ISIS for 54 seconds and the speed displayed on the right PFD for 61 seconds at most.

In less than one minute after autopilot disconnection, the aeroplane exited its flight envelope following inappropriate pilot inputs.

The Captain came back into the cockpit about 1 min 30 after the autopilot disconnection.

Throughout the flight, the movements of the flight control surfaces were consistent with the pilot’s inputs.

Up to the exit from the flight envelope, the aeroplane’s movements were consistent with the position of the flight control surfaces.

There is no regulatory CRM training for a crew made up of two copilots in a situation with a relief Captain.

The approach to stall was characterised by the triggering of the warning then the appearance of buffet.

In the absence of a display of the limit speeds on the speed tape on the PFD, the aural stall warning is not confirmed by any specific visual display.

The stall warning sounded continuously for 54 seconds.

Neither of the pilots made any reference to the stall warning or to buffet.

A short time after the triggering of the stall warning, the PF selected TO/GA thrust and made a nose-up input.

Neither of the pilots formally identified the stall situation.

The theoretical training undertaken by the copilots, as well as some documents, including the OSV note, associated the buffet phenomenon with the approach to stall as well as to overspeed. On the Airbus A330, the buffet phenomenon is only encountered on the approach to stall.

The angle of attack is the parameter that allows the stall warning to be triggered; if the angle of attack values become invalid, the warning stops.

By design, when the measured speed values are lower than 60 kt, the measured angle of attack values are invalidated.

Each time that the stall warning triggered, the angle of attack exceeded the value of its theoretical trigger threshold.

The aeroplane’s angle of attack is not directly displayed to the pilots. The engines functioned normally and always responded to the crew’s inputs.

The PNF called out imprecise flight path corrections. They were however essential and sufficient for short-term management of the situation.

The last recorded values were a pitch attitude of 16.2 degrees nose-up, roll of 5.3 degrees to the left and a vertical speed of -10,912 ft/min.

The Pitot probes installed on F-GZCP met requirements that were stricter than the certification standards.

Analysis of the events related to the loss of airspeed indications had led Airbus and Air France to replace C16195AA Pitot probes by the C16195BA model. The first aeroplane had been modified on 30 May 2009.

EASA had analyzed Pitot probe icing events; it had confirmed the severity of the failure and had decided not to make the probe change mandatory.

The flight was not transferred between the Brazilian and Senegalese control centres.

Between 8 h 22 and 9 h 09, the first emergency alert messages were sent by the Madrid and Brest control centres.

The crew was not able to use the ADS-C and CPDLC functions with DAKAR Oceanic. If the connection had been established, the loss of altitude would have generated an alert on the controller’s screen.

The first floating aeroplane parts were found 5 days after the accident.

The flight recorders were recovered 23 months after the accident.

Causes of the Accident

The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information tha resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.
The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF. The destabilisation that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM messages, which did not help with the diagnosis.
The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information.
In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioural hypotheses in classifying the loss of airspeed information as “major” were not validated in the context of this accident.
The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behaviour in any acceptable reliable way.
In its current form, recognizing the stall warning, even associated with buffet,
supposes that the crew accords a minimum level of “legitimacy” to it. This then
supposes sufficient previous experience of stalls, a minimum of cognitive availability and understanding of the situation, knowledge of the aeroplane (and its protection modes) and its flight physics. An examination of the current training for airline pilots does not, in general, provide convincing indications of the building and maintenance of the associated skills.
More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures. A crew can be faced with an unexpected situation leading to a momentary but profound loss of comprehension. If, in this case, the supposed capacity for initial mastery and then diagnosis is lost, the safety model is then in “common failure mode”.

During this event, the initial inability to master the flight path also made it impossible to understand the situation and to access the planned solution.

Thus, the accident resulted from the following succession of events:

Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;
Inappropriate control inputs that destabilized the flight path;
The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;
The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;
The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;
The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it

These events can be explained by a combination of the following factors: The feedback mechanisms on the part of all those involved that made it impossible:

To identify the repeated non-application of the loss of airspeed information procedure and to remedy this,

To ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences;

The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for ”Vol avec IAS douteuse”;

Task-sharing that was weakened by:

Incomprehension of the situation when the autopilot disconnection occurred,
Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;

The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;

The crew not taking into account the stall warning, which could have been due to:

A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,
The appearance at the beginning of the event of transient warnings that could be considered as spurious,
The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,
The possible confusion with an overspeed situation in which buffet is also considered as a symptom,
Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,
The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.

Download Full Investigation report here