The copilot in the right seat (the pilot flying) seemed to have been preoccupied with the thought they needed to climb to avoid the weather causing their turbulence. When pitot icing caused all three sources of pitot information to be momentarily lost, the autopilot clicked off and he found himself hand-flying a large aircraft at high altitude, for perhaps the first time. Most aircraft do not handle well at high altitude, and a heavy aircraft is even less responsive. Control inputs need to be small, smooth, and deliberate. This pilot's inputs were large, abrupt, and erratic. Had he done nothing at all, the airspeed information would have returned and the autopilot could have been reengaged. It appears all he needed to do was maintain attitude for one minute. But it only took a minute to depart controlled flight.
[Extracted from BEA Report, ¶1.5] The captain was 58 years old with about 11,000 hours total time, over 6,000 hours as captain, and 1,747 in type, all as captain. He started with Air France as a flight attendant, earned several ratings as a non-airline pilot, mostly in light aircraft. He was hired by Air Inter airline in a Caravelle and then A300. He became PIC qualified for the first time in 1997, two days before Air France and Air Inter merged. A year later he became a captain with Air France on the Boeing 737-200. Three years later be became A320 rated. Three years after that he added an A330 rating, a year after that he failed a line training flight test. (This is his first failure noted in the accident report.) . He added at A340 rating in 2007.
[Langewiesche] The crew arrived in Rio three days before the accident and stayed at the Sofitel hotel on Copacabana Beach. At Air France, the layover there was considered to be especially desirable. [The] captain, Marc Dubois, 58, was traveling with an off-duty flight attendant and opera singer. In the French manner, the accident report made no mention of Dubois’s private life, but that omission then required a finding that fatigue played no role, when the captain’s inattention clearly did. Dubois had come up the hard way, flying many kinds of airplanes before hiring on with Air Inter, a domestic airline subsequently absorbed by Air France; he was a veteran pilot, with nearly 11,000 flight hours, more than half of them as captain. But, it became known, he had gotten only one hour of sleep the previous night. Rather than resting, he had spent the day touring Rio with his companion.
- Copilot in the left seat
[Extracted from BEA Report, ¶1.5] The copilot in the left seat was 37 years old with around 7,000 hours total time, almost 5,000 of that in type. He appears to have been an "ab initio" trainee hired directly by Air France just six years after earning his base license. He went directly into the A320 with Air France and later added at A340 and then the A330 type ratings.
- Copilot in the right seat
[Extracted from BEA Report, ¶1.5] The copilot in the right seat was 32 years old with about 3,000 hours total time, 800 in type. Three years after earning his private pilot's license, Air France hired him and a year later he was flying the A320. Three years later he added the A340 and then the A330 ratings.
[Langewiesche] Occupying the right seat was the junior co-pilot, Pierre-Cédric Bonin, 32, who had brought along his wife for the trip, leaving their two young sons at home. [ . . . ] Bonin, whose turn it was to be the Pilot Flying—making the takeoff and landing, and managing the automation in cruising flight. Bonin was a type known as a Company Baby: he had been trained nearly from scratch by Air France and placed directly into Airbuses at a time when he had only a few hundred flight hours under his belt. By now he had accumulated 2,936 hours, but they were of low quality, and his experience was minimal, because almost all of his flight time was in fly-by-wire Airbuses running on autopilot.
[BEA Report, ¶184.108.40.206.4] A Flight Safety report was made in 2006 by an airline internal commission following incidents and accidents, in particular the Air France accident at Toronto in August 2005. The commission studied events at the airline that had occurred between 1985 and 2006. Notable elements from the report identified:
- During the period in question, two-thirds of the events occurred on long-haul flights;
- The “situational awareness”, “decision-making” and “crew synergy” causal factors were inseparable and constituted by far the most significant contributing factor;
- Piloting abilities of long-haul and/or ab initio pilots are sometimes weak;
- A loss of common sense and general aeronautical knowledge were highly noticeable;
- Weaknesses in terms of representation and awareness of the situation during system failures (reality, seriousness, induced effects).
Photo: Speed Measurement System, (BEA, Figure 4)
Click photo for a larger image
[BEA Report, ¶1.6.6] Information on the airspeed measuring system
- The speed is deduced from the measurement of two pressures:
- Total pressure (Pt), by means of an instrument called a Pitot probe;
- Static pressure (Ps), by means of a static pressure sensor.
- The Airbus A330 has three Pitot probes and six static pressure sensors.
- These probes are fitted with drains allowing the removal of water, and with an electrical heating system designed to prevent them from icing up.
- The pneumatic measurements are converted into electrical signals by eight ADM’s and delivered to the calculators in that form.
- The CAS and Mach number are the main items of speed information used by the pilots and the systems to control the aeroplane. These parameters are elaborated by three computers, called ADIRU, each consisting of:
- An ADR module which calculates the aerodynamic parameters, specifically the CAS and the Mach;
- An IR module that provides the parameters delivered by the inertial units, such as ground speed and attitudes.
- There are therefore three speed information elaboration systems that function independently of each other. The probes known as “Captain” supply ADR 1, the “First Officer” probes supply ADR 2 and the “Standby” probes supply ADR 3.
- The standby instruments elaborate their speed and altitude information directly from the pneumatic inputs (“standby” probes), without this being processed by an ADM or ADR. The ISIS is a unique standby instrument integrating speed, altitude and attitude information. It uses the same static and total pressure sensors as ADR3.
- The autopilot, flight director and autothrust functions are ensured by two Flight Management Guidance and Envelope Computers (FMGEC), connected in particular to a Flight Control Unit (FCU). Each of these two computers can perform these three functions.
- In order to operate, and determine the FD’s cues, the FMGEC need to use the data from at least two ADR’s and two IR’s, which they must consider to be valid. The monitoring performed by the FMGEC on the ADR and IR parameters looks for deviations with respect to two other values. For example, if one of the parameters from an ADR deviates excessively from the values indicated for the same parameter by the two other ADR’s, then the first shall be considered as invalid and will not be used. If at least two ADR’s or two IR’s are invalid, the FMGEC can no longer determine the FD’s cues and the crossbars disappear. However, the FD’s are not disengaged; the corresponding lights on the FCU remain lit.
Photo: Pitot probe diagram, BEA Report, figure 8.
Click photo for a larger image
[BEA Report, ¶220.127.116.11]
- When highly specific climatic conditions are met, in particular with the presence of ice crystals in excessive quantities, the conditions for use of the probes can exceed the conditions for qualification and robustness. In this type of situation, a partial obstruction of the total pressure probes in icing conditions and at high altitude (above 30,000 feet) can occur. This results in a temporary and reversible deterioration of total pressure measurement.
- In the presence of ice crystals, there is no visible accretion of ice or frost on the outside, nor on the nose of the probe, since the crystals bounce off of these surfaces. However, the ice crystals can be ingested by the probe air intake. According to the flight conditions (altitude, temperature, Mach) if the concentration of crystals is greater than the capacity for de-icing of the heating element and evacuation by the purge holes, the crystals accumulate in large numbers in the probe tube.
- As a result, a physical barrier is created inside the probe that will disturb the measurement of total pressure, this then being able to approach that of the measured static pressure.
- As soon as the concentration of ice crystals is lower than the de-icing capacity of the probe, the physical barrier created by the accumulation of crystals disappears and measurement of the total pressure becomes correct again.
- Experience and follow-up of these phenomena in very severe conditions show that this loss of function is of limited duration, in general around 1 or 2 minutes.
Photo: Evolutions of recorded angles of attack and of the stall warning trigger threshold, BEA Report, figure 62.
Click photo for a larger image
[BEA Report, ¶18.104.22.168]
- From 2 h 10 min 05 onwards, the flight control law was alternate and the stall warning triggered and stopped several times until the end of the flight. Only the values for one Mach calculation were recorded, although the warning triggering threshold depends on all three.
- The activations of the warning picked up by the CVR were identified as occurring at between 2 h 10 min 10.4 and 11.3 and between 2 h 10 min 13 and 13.4. The short duration of activation did not make it possible to detect it from the “Stall warning” parameter, but the FWC 1’s “Master warning” parameters were triggered on one point at this time. However, this warning should have continued until about 2 h 10 min 15.5, and then have been triggered again between 2 h 10 min 17 and 19. The disabling of this warning was probably due to the fact that, between 13.4 and 15.5 and then between 17 and 19, and possibly at other times, the three Mach values were abnormally low (three Pitot probes iced up). The warning triggering threshold then suddenly increased to values of about 10°, much greater than the recorded angles of attack, which led to the warning stopping.
- Analysis of the parameters showed that the stall warning stopped concomitant with the invalidity of the three angles of attack, and was triggered again when at least one of them became valid again. In view of the extreme values of angle of attack experienced by the aircraft, the change to the threshold as a function of Mach was secondary.
[BEA Report, ¶22.214.171.124]
- A simulation of the aircraft behaviour was conducted based on the theoretical model and on the PF’s inputs (sidestick and thrust). The validity of the model is limited to the known flight envelope based on flight tests. Consequently, it was possible to conduct the simulation on the period from 2 h 10 min 00 s to 2 h 10 min 54 s.
- The simulation demonstrated the following:
- From about 15 seconds before disconnection, the autopilot countered aerological disturbances whose intensity would be defined as “light” on the ICAO scale (variations in vertical acceleration of less than 0.5 g);
- When the autopilot disengaged, a concomitant lateral gust caused the aircraft to depart from its flight path with a roll to the right;
- The subsequent roll movements resulted from the inputs by the PF;
- The aircraft’s movements in the longitudinal axis were primarily due to the inputs by the PF, with the exception of small variations due to the aerology (variations in normal acceleration of about 0.2 g);
- The turbulence eased as from about 2 h 10 min 30 s;
- With no PF inputs, the aircraft would have gradually rolled further to the left but the variations in pitch attitude and altitude would have been small.
[BEA Report, ¶126.96.36.199]
- When the autopilot disconnected, the roll angle increased in two seconds from 0 to +8.4 degrees without any inputs on the sidesticks. The PF was immediately absorbed by dealing with roll, whose oscillations can be explained by:
- A large initial input on the sidestick under the effect of surprise;
- The continuation of the oscillations, in the time it took to adapt his piloting at high altitude, while subject to an unusual flight law in roll (direct law).
- In addition, the deviation in roll may have been caused by the risk of turbulence that had preoccupied the PF in the minutes leading up the autopilot disconnection.
- Following the autopilot disconnection, the PF very quickly applied nose-up sidestick inputs. The PF’s inputs may be classified as abrupt and excessive. The excessive amplitude of these inputs made them unsuitable and incompatible with the recommended aeroplane handling practices for high altitude flight. This nose-up input may initially have been a response to the perception of the aeroplane’s movements (in particular the reduction in pitch angle of 2° associated with the variation in load factor) just before the AP disconnection in turbulence. This response may have been associated with a desire to regain cruise level: the PF may have detected on his PFD the loss of altitude of about 300 ft and loss of vertical speed of the order of 600 ft/min in descent. The excessive nature of the PF’s inputs can be explained by the startle effect and the emotional shock at the autopilot disconnection, amplified by the lack of practical training for crews in flight at high altitude, together with unusual flight control laws.
- Although the PF’s initial excessive nose-up reaction may thus be fairly easily understood, the same is not true for the persistence of this input, which generated a significant vertical flight path deviation. The safety investigation has made it possible to exclude, with reasonable certainly, the explanation that the repeated nose-up inputs were caused by the PF’s unsuitable flying position (examination of the adjustment of his seat showed that it was adjusted in a way that was adapted to his morphology). Examination of the FDR parameters indicated that during the flight controls check undertaken while taxiing in Rio-de-Janeiro, the roll inputs did not induce a pitch component.
- Whether the PF’s nose-up inputs were deliberate or not, there was no verbal expression of this to the PNF. At no time did the PF indicate his intentions or objectives with respect to the control and stabilisation of the flight path. Although the PF’s various roll inputs indicate his intention to keep the wings horizontal, it is not possible to determine what the PF’s target was in the longitudinal axis.
Identification of the Situation
[BEA Report, ¶188.8.131.52]
- Once the first actions in response to the perceived anomaly is executed (returning to manual piloting following AP disconnection) and the flight path stabilisation ensured, the philosophy of both the manufacturer and the operator is for the crew to look for additional information necessary to understand the problem and take action.
- Identifying the loss of speed information could have prompted the crew to apply the “IAS douteuse” emergency manoeuvre, if they had considered that the safe conduct of the flight was “dangerously affected”, this condition being generally associated with avoiding a collision with the high ground or terrain. Training for this emergency manoeuvre in a flight phase at low altitude may reinforce this interpretation by crews. In addition, the study of events involving loss of speed indications in cruise tends to show that the emergency manoeuvre is never applied, so much so that the failure to perform this manoeuvre is not specific to the crew of AF 447.
- Neither was the non-ECAM emergency procedure “Vol avec IAS douteuse/ADR Check Proc” called out. A call for this procedure must be sufficiently practised for it to become an automatic response to awareness of an airspeed indication anomaly, regardless of any need to construct a more elaborate understanding of the problem.
- In the case of the accident, the crew did not associate the loss of displayed speeds and the associated procedure.
- The disabling of the THRUST LOCK function by the PF indicates that he was searching for information. The PF may therefore have been overloaded by the combination of his immediate and natural attempts to understand the situation that was added to the already demanding task of handling the aeroplane.
[BEA Report, ¶184.108.40.206] Reactions of the crew to the stall warning
- Four seconds before the triggering of the STALL 2 warning, the flight director crossbars reappeared on the PFDs. The vertical mode engaged was V/S mode with a target value of +1,400 ft/min. The modes displayed on the FMA were never called out by the crew. The horizontal bar then indicated a slight nose-up order compared with the aeroplane symbol. The PF’s nose-up input caused the increase in the angle of attack and triggered the stall warning. At the instant when the STALL 2 warning was triggered, at 2 h 10 min 51, the aeroplane’s pitch attitude was 7 degrees, and increasing. A few seconds later, buffet started.
- The crew never referred either to the stall warning or the buffet that they had likely felt. This prompts the question of whether the two co-pilots were aware that the aeroplane was in a stall situation. In fact the situation, with a high workload and multiple visual prompts, corresponds to a threshold in terms of being able to take into account an unusual aural warning. In an aural environment that was already saturated by the C-chord warning, the possibility that the crew did not identify the stall warning cannot be ruled out.
- Even if the PF’s acceptance (or rejection) of a stall diagnosis was never verbalised, even though some of his actions could be considered to be consistent with those recommended in an approach to stall situation: setting the thrust levers to the TOGA detent, or his concern with keeping the wings horizontal. On the other hand, in the absence of airspeed information known to be reliable, it is possible that the PF thought that the aeroplane was in an overspeed situation,notably due to his interpretations of several clues:
- The aerodynamic noise,
- The buffeting, that he might have interpreted as being due to high speed,
- The speed trend arrow on the PFD, which at that time indicated acceleration.
- Some of the PF’s actions may be interpreted as indicative of a perception of a risk or of a diagnosis of overspeed. Firstly, the PF reduced the thrust during the seconds preceding the activation of the STALL 2 warning and the onset of buffet. Secondly, 51 s after the triggering of this warning, the PF said “I have the impression we have speed” then moved the thrust levers to the IDLE detent. He reformulated his impression a few seconds later, combined with an attempt to extend the speedbrakes.
- The application of maximum thrust was probably the consequence of the perception of the stall warning. However, the PF may have assimilated the triggering of the warning as a consequence of the reduction in thrust, which he had applied four seconds earlier; he should then have applied full thrust to return to the earlier situation.
- A few seconds later, the PF said “I’m in TOGA, right?”. Either he was unsure whether or not he had set the thrust controls to the TOGA detent, as he intended, or he did not understand why this action was ineffective in clearing the stall warning. This second case might therefore indicate that the PF had built an erroneous mental representation of the aeroplane’s flight model, and that he had hoped that he could resolve the situation by applying TOGA thrust at high altitude and a pitch attitude of twelve degrees, a strategy similar to that recommended at low altitudes. The fruitless result of his actions possibly heightened his mistrust of the warning.
- Finally, although the PNF had called out the reconfiguration to alternate law when reading the ECAM, and even though the indicators of the loss of protection should have been displayed on the PFD (SPD LIM and an amber cross in roll and yaw), it is possible that the PF was not fully aware of this reconfiguration and of what it implied. He may therefore have embraced the common belief that the aeroplane could not stall, and in this context a stall warning was inconsistent.
- The pitch attitude oscillations, in the seconds following the activation of the stall warning, reveal that the handling of the aeroplane was clearly very difficult and probably demanded the PF’s full attention. During this phase, the aeroplane symbol on the PFD was close to, but on average slightly above, the flight director horizontal bar.
- Moreover, the flight director displays could have prompted him to command a positive pitch angle, of about 12.5°. This value appears in the stall warning procedure for the take-off phase. It is possible that, even though he did not call it out, the PF had recalled this memorised value and then had clung to this reference without remembering that it was intended for a different flight phase. The conjunction of this remembered value and the flight director displays may have constituted one of the few (and maybe even the only) points of consistency in his general incomprehension of the situation.
Note: The “Vol avec IAS douteuse” procedure recommends disabling the FD, to prevent it from presenting cues that could potentially be irrelevant.
- When the Captain returned to the cockpit, the aeroplane was in a rapid descent, though at an altitude close to the cruise level it was at when he had left. Under these conditions, and not having experienced the complete sequence of events, it was very difficult for the Captain to make a diagnosis. He would have needed to question the co-pilots about the sequence of events, an approach that was blocked by the urgency of the situation and the stress conveyed by the PNF’s tone of voice.
- Subsequently, his interventions showed that he had also not identified the stall: the multiple starts and stops of the stall warning certainly contributed to make his analysis of the situation more confused. He then seemed to have based himself on the pitch attitude and thrust parameters to analyse the flight path.