This crash would not have happened with a more experienced set of pilots, no doubt about it. But that isn't to say we need to blame the pilots here. They were, in many ways, ordinary pilots. And therein lies the problem.

— James Albright

image

Updated:

2025-10-06

"To put it briefly, automation has made it more and more unlikely that ordinary airline pilots will ever have to face a raw crisis in flight—but also more and more unlikely that they will be able to cope with such a crisis if one arises."

— William Langewiesche

image

BEA Report, figure 6.

This is a case of two pilots unable to recognize a problem for what it was as it was unfolding, and of a third pilot who couldn't solve the problem in the limited time he had. I agree with Mr. Langewiesche, automation has made flying easier but it has also made pilots less able to deal with the unexpected.

The days of pilots who are well schooled at dealing with all manner of things going wrong are coming to an end. That generation of pilots has long ago started retiring and pretty soon they will all be footnotes in history. You cannot train this kind of thing in a simulator, where the absent risk of real injury and death cannot be simulated. But I think pilots can train themselves to remain calm in stressful situations. We can also train pilots to realize when things are not as they should be, and how to return a situation uncertain into a situation recognizable.

I think many modern aircraft accidents could have been saved had they been flown by pilots from generations before all this automation. As damning as that may sound, modern aviation is safer than it has ever been because automation has removed much of the guess work, because aircraft are better designed, because we know how to better maintain them, and, yes, because our pilots are better in many ways. So how can I stand by my statement that many modern aircraft accidents could have been saved by earlier generations of pilots? Because these pilots were practiced with dealing with things coming apart at the seams, and they have a few bag of tricks for saving the day. I'll provide those techniques in a bit, but first we need to dive into what happened with Air France 447 to illustrate just how quickly things can go from perfectly normal to catastrophic. In this case, less than five minutes.

  • Date: 1 June 2009
  • Time: 0014
  • Type: Airbus A330-203
  • Operator: Air France
  • Registration: F-GZCP
  • Fatalities: 12 of 12 crew, 228 of 228 passengers
  • Aircraft fate: Destroyed
  • Phase: En route
  • Airport (departure): Rio de Janeiro-Galeao International Airport, Brazil (SBGL)
  • Airport (arrival): Paris-Charles de Gaulle Airport (LFPG)

1 — The pilots

2 — The weather

3 — The airplane

4 — Narrative: What happened

5 — Analysis: How to prevent recurrence

6 — Technique: communicate as if your life depends on it

7 — Technique: known thrust and pitch settings

image

1

The pilots

The pilots arrived in Rio de Janeiro three days earlier, on May 28, 2009. Their return flight to Paris was scheduled to depart about 2000 Brazil local time, arriving about 1200 France local time; they would be flying through the Window of Circadian Low (WOCL). (For more about that: Fatigue.) Because the flight was scheduled to last 12 hours, 45 minutes, the crew was augmented with a third pilot.

Captain Marc Dubois

The captain, age 58, had 10,988 total flight hours, 6,258 as captain, 1,747 on type as captain.

He started as an Air France flight attendant in 1976, got his commercial pilot's license in 1977, got his ATPL in 1992, and his A320 type rating in 1997 while flying for Air Inter. That airline merged with Air France the next month. He upgraded to captain on the Boeing 737, then the A320, A330, and A340.

Source: BEA Report, §1.5.1.1

Captain Dubois was the pilot monitoring for the first three hours, then went to crew rest, and returned to the cockpit for the final moments, standing behind the two first officers in the pilots' seats.

First Officer Pierre-Cédric Bonin

The first officer, age 32, had 2,936 total flight hours, 807 on type.

He got is private pilot's license in 2000 and was selected by Air France for training in 2003. He got his A320 type rating in 2004, A330 and A340 in 2008.

Source: BEA Report, §1.5.1.3

First Officer Bonin was the pilot flying for most of the flight. He was the least experienced of the three.

Relief First Officer David Robert

The relief first officer, age 37, had 6,547 total flight hours, 4,479 on type.

He got his basic license in 1992, just as Air France stopped hiring and started a waiting list. He started training with Air France in 1998.

Source: BEA Report, §1.5.1.2

First Officer Robert was the relief pilot who assumed pilot monitoring duties when the captain left the cockpit. He was a management pilot and had very little time in the previous three months.

Air France ab initio and other low-time pilots

First Officer Bonin was an ab initio (Latin: "from the start") pilot, hired with virtually no applicable experience and put into large jet aircraft without having gained significant experience in smaller aircraft.

A Flight Safety report was made in 2006 by an airline internal commission following incidents and accidents, in particular the Air France accident at Toronto in August 2005. The commission studied events at the airline that had occurred between 1985 and 2006. Notable elements from the report identified:

  • During the period in question, two-thirds of the events occurred on long-haul flights;
  • The “situational awareness”, “decision-making” and “crew synergy” causal factors were inseparable and constituted by far the most significant contributing factor;
  • Piloting abilities of long-haul and/or ab initio pilots are sometimes weak;
  • A loss of common sense and general aeronautical knowledge were highly noticeable;
  • Weaknesses in terms of representation and awareness of the situation during system failures (reality, seriousness, induced effects).

Source: BEA Report, §1.17.1.5.4

Airlines will tell you that ab initio pilots learn quickly in the simulator and on the line, ignoring the fact that these highly automated aircraft require pilots train to use the automation and leaves little time for building basic skills.

Old tech / new tech, old pilots / young pilots

In my opinion, there is a paradox with modern, highly-automated aircraft that wasn't present with the barely automated aircraft of the past. I base this on my experience flying the oldest models of KC-135As and Boeing 707s before they had autopilots that could be used for climbs, descents, and approaches, as well as engines that could be trusted not to explode at regular intervals.

  • The old. Training for these pre-automation aircraft emphasized dealing with systems that were prone to failure, so you got to know the systems very well. Stick and rudder skills were also emphasized, because these aircraft did not always behave well. Things like Dutch Roll, behind the thrust curve approach speeds, and narrow low- and high-speed buffet margins at altitude demanded pilots be trained to know how their aircraft behaved at high altitudes. Simulators were very basic, so flight training was required.
  • The new. Simulators have become so good that pilots normally leave the simulator fully typed and ready to fly the line. A lot of training time is taken over by having to learn the automation, so less time is devoted to systems. That usually isn't a problem, since the systems themselves have become so reliable. But those systems are so complicated, that few pilots really understand them unless they devote extra time to learn, away from the classroom. Flight training is practically nonexistent. It is quite likely that many modern airline pilots have never hand-flown large aircraft at altitudes above 29,000 feet because of Reduced Vertical Separation Minima.

2

The weather

image

TEMSI chart, BEA Report, fig. 13

The weather for departure and arrival were good, but the flight crossing the equator would be over the Intertropical Convergence Zone (ITCZ), where the north-easterly trade winds in the northern hemisphere converge with the south-easterly trade winds in the southern hemisphere.

The infra-red imagery analysis does not make it possible to conclude that the stormy activity in the zone where flight AF 447 is presumed to have disappeared was exceptional in character, but it shows the existence of a cluster of powerful cumulonimbi along the planned flight path, identifiable from 0 h 30 onwards. This cluster is the result of the fusion of four smaller clusters and its east-west extension is approximately 400 km.

Source: BEA Report, §1.7

The conditions were conducive to condensation at high altitude. One thing to note about convective activity over the oceans is that updrafts can force very small water droplets upward where they become "supercooled." These supercooled water droplets will instantly freeze if they encounter a hard surface, becoming clear ice.


3

The airplane

The aircraft was less than five years old and had no outstanding write ups. In my opinion, however, there were issues with the pitot-static, fly-by-wire, and sidestick systems.

The pitot-static system

image

Speed Measurement System, (BEA, Figure 4

  • The speed is deduced from the measurement of two pressures:
    • Total pressure (Pt), by means of an instrument called a Pitot probe;
    • Static pressure (Ps), by means of a static pressure sensor.
  • The Airbus A330 has three Pitot probes and six static pressure sensors.
  • These probes are fitted with drains allowing the removal of water, and with an electrical heating system designed to prevent them from icing up.
  • The pneumatic measurements are converted into electrical signals by eight ADM’s [Air Data Modules] and delivered to the calculators in that form.
  • The CAS and Mach number are the main items of speed information used by the pilots and the systems to control the aeroplane. These parameters are elaborated by three computers, called ADIRU [Air Data Inertial Reference Unit], each consisting of:
    • An ADR [Air Data Reference] module which calculates the aerodynamic parameters, specifically the CAS and the Mach;
    • An IR module that provides the parameters delivered by the inertial units, such as ground speed and attitudes.
  • There are therefore three speed information elaboration systems that function independently of each other. The probes known as “Captain” supply ADR 1, the “First Officer” probes supply ADR 2 and the “Standby” probes supply ADR 3.
  • The standby instruments elaborate their speed and altitude information directly from the pneumatic inputs (“standby” probes), without this being processed by an ADM or ADR. The ISIS [Integrated Standby Instrument System] is a unique standby instrument integrating speed, altitude and attitude information. It uses the same static and total pressure sensors as ADR3.
  • The autopilot, flight director and autothrust functions are ensured by two Flight Management Guidance and Envelope Computers (FMGEC), connected in particular to a Flight Control Unit (FCU). Each of these two computers can perform these three functions.
  • In order to operate, and determine the FD’s cues, the FMGEC need to use the data from at least two ADR’s and two IR’s, which they must consider to be valid. The monitoring performed by the FMGEC on the ADR and IR parameters looks for deviations with respect to two other values. For example, if one of the parameters from an ADR deviates excessively from the values indicated for the same parameter by the two other ADR’s, then the first shall be considered as invalid and will not be used. If at least two ADR’s or two IR’s are invalid, the FMGEC can no longer determine the FD’s cues and the crossbars disappear. However, the FD’s are not disengaged; the corresponding lights on the FCU remain lit.

Source: BEA Report, §1.6.6

Depending on where the static ports are located, the reported static pressure is subject to errors which varies with aircraft speed.

Static ports are located to get an accurate measurement of the outside atmospheric pressure. But the ports have little choice but to be mounted on the fuselage somewhere, subject to local pressure differences as air flows around the complex exterior of the airplane. Almost all airplanes have some error due to the position of the static ports. These errors are carefully recorded during flight testing. The manufacturers provide a correction table and in the case of modern airplanes like the A330, build the corrections into the air-data computer software, so that the values displayed to the pilot are accurate.

Source: Palmer, pp. 54 - 55

Loss of pitot pressure can have a great impact on display altitude:

The first consequence of a drop in measured total pressure is a drop in the Mach and the CAS. The drop in Mach leads to a drop in standard altitude due to the correction of the measured static pressure. This drop is different according to the ADR under consideration: in the flight conditions of the event, it is of the order of 300 to 250 ft for the ADR 1 and 2 and of 80 ft for ADR 3.

Source: BEA Report, §1.6.9.6.3

Ice Crystals

image

Pitot probe diagram, BEA Report, figure 8.

  • When highly specific climatic conditions are met, in particular with the presence of ice crystals in excessive quantities, the conditions for use of the probes can exceed the conditions for qualification and robustness. In this type of situation, a partial obstruction of the total pressure probes in icing conditions and at high altitude (above 30,000 feet) can occur. This results in a temporary and reversible deterioration of total pressure measurement.
  • In the presence of ice crystals, there is no visible accretion of ice or frost on the outside, nor on the nose of the probe, since the crystals bounce off of these surfaces. However, the ice crystals can be ingested by the probe air intake. According to the flight conditions (altitude, temperature, Mach) if the concentration of crystals is greater than the capacity for de-icing of the heating element and evacuation by the purge holes, the crystals accumulate in large numbers in the probe tube.
  • As a result, a physical barrier is created inside the probe that will disturb the measurement of total pressure, this then being able to approach that of the measured static pressure.
  • As soon as the concentration of ice crystals is lower than the de-icing capacity of the probe, the physical barrier created by the accumulation of crystals disappears and measurement of the total pressure becomes correct again.
  • Experience and follow-up of these phenomena in very severe conditions show that this loss of function is of limited duration, in general around 1 or 2 minutes.

Source: BEA Report, §1.6.9.6

Ice Crystal Incidents

Between May 2008 and March 2009, for Air France’s A330/A340 fleet, nine incidents appeared in the ASR associated with unreliable indicated airspeeds: one in May 2008, one in July 2008, three in August 2008, one in September 2008, one in October 2008, and two in March 2009. All occurred in cruise between FL310 and FL380. In seven cases, the ASR [Air Safety Report] mentioned the activation of the stall warning. Two of the nine Captains who submitted an ASR [Air Safety Report] indicated in the “Suggestions” box, in the margin of their report, the potentially detrimental or destabilising nature of this failure, considered as multiple, notably because of the requirement to analyse and make sense of the situation encountered.

Source: BEA Report, §1.17.1.5.3.1

Air France's Airbus A330 and A340 were delivered with Thales C16195AA pitot tubes.

On 24 September and 6 October 2008, Air France asked Airbus for information about the cause of these events and the solutions to implement, and also asked if the Thales C16195BA probe could resolve these problems. Airbus replied that the cause of the problem was probably probe obstruction by a rapid accumulation of ice crystals, and that the Thales C16195BA, developed to address the issue of water ingestion during heavy rainfall, was unlikely to improve the performance in an ice crystal environment.

Source: BEA Report, §1.17.1.5.3.1

Airbus indicated later that year that BF Goodrich probes appeared to be more reliable in icing conditions, which seemed to prompt Thales to further review their C1619BA probes, concluding:

Airbus stated that the icing phenomenon involving ice crystals was a new phenomenon that was not considered in the development of the Thales C16195BA probe, but that the latter appeared to offer significantly better performance in relation to unreliable airspeed indications at high altitude.

Source: BEA Report, §1.17.1.5.3.1

Air France decided to change the pitot probes across their entire A330/A340 fleet.

The first batch of Thales BA probes arrived at Air France on May 25th, 2009, six days before flight 447 crashed. The first aircraft was modified two days before the accident. At the time of the accident, flight 447, registration number F-GZCP, was fitted with the original Thales AA probes. They were due to be replaced upon the airplane's return to Paris.

Source: Palmer, p. 53

The change wasn't considered a time critical upgrade because the ice crystal problem didn't happen often, when it did happen it only lasted a few minutes, and there were procedures to deal with it. The procedure, called "IAS douteuse," which translates to "airspeed doubtful." The procedure was a highlighted training event in simulators at Air France.

The fly-by-wire system

The aeroplane is controlled by means of two sidesticks whose movements are transmitted in the form of electrical signals to flight control computers.

The laws governing this transformation are called control laws. On the A330 in nominal operation, the control law is called the normal law. In the case where monitoring is triggered in the flight control system, it may be replaced by reconfiguration laws, known as the alternate (alternate 1 or 2) law or direct law.

Normal law offers complete protection of the flight envelope: in terms of attitude (the pitch and bank angles values are limited), load factor, at high speed and at a high angle of attack. When the protections are not triggered, the longitudinal orders from the sidesticks command a load factor according to the aircraft’s normal axis and the lateral orders command a rate of roll.

In alternate law, the longitudinal orders from the sidesticks command a load factor according to the aircraft’s normal axis, like with normal law but with fewer protections. Furthermore: In alternate 1, the lateral orders from the sidesticks still command a rate of roll; in alternate 2, they command the ailerons and lift dumpers directly.

In direct law, the protections are lost and orders from the sidesticks control the position of the various control surfaces directly.

In alternate or direct law, the angle-of-attack protections are no longer available but a stall warning is triggered when the greatest of the valid angle-of-attack values exceeds a certain threshold.

Source: BEA Report, §1.6.9.3

If you've never flown a fly-by-wire airplane, the fact things are managed by "control laws" may be confusing. That is understandable, because this terminology is foreign to conventional aircraft. I found the easiest way to grasp what a control law is, is to think of it as a set of rules the flight control computers use when making decisions. In "normal law," the airplane flies conventionally but the computers interceded on behalf of the pilot to prevent bad things from happening. You cannot stall, for example, in normal law.

The normal law of the fly-by-wire flight control system on the A330 offers high angle of attack protection that limits it to a value that is below the stall angle of attack. When this protection works, the aeroplane can not stall even if the crew maintains a nose-up control input to the stop. Note: At the maximum angle of attack authorized by the normal law, if a nose-up input is maintained and the thrust is not sufficient to maintain level flight, the angle of attack remains lower than the stall angle of attack and the aeroplane will descend. In alternate or direct law, the normal law high angle of attack protection is lost but the stall warning is available.

Source: BEA Report, §1.6.11

I've flown several fly-by-wire aircraft and one of the demonstrations is to try to stall the aircraft with the thrust reduced and full aft stick. The nose comes up and the speed falls, but once you get to a certain Angle of Attack, the fly-by-wire system holds what you have and the aircraft descends. The aircraft does not stall. The problem with this demo, however, is it plants into the pilot's mind that the aircraft cannot be stalled. That is only true in normal law. That begs the question, when do you lose normal law?

In the Airbus fly-by-wire system, there are three Air Data Inertial Reference Units (ADIRUs). As long as two of the three agree on their inputs, you will probably have what you need for normal law. If two of the three have problems, you can have a cascade of issues, such as the autopilot and autothrottles disengaging, flight directors removing guidance, and ending with a degrade to alternate law.

When one of the three speeds deviates too much from the other two, it is automatically rejected by the PRIM’s [Primary Computers] and the voted value then becomes the average of the two remaining values. But if the difference between these two remaining values becomes too great the PRIM’s reject them and the control law reconfigures to alternate 2.

Source: BEA Report, §1.6.9.3

Of critical importance: if one of the airspeeds deviates, it gets thrown out. If the other two speeds differ too much, you go to alternate law and lose your stall protection. You still get stall warning, but it will be up to you to break the stall. An Alternate 2 Law, you can stall the aircraft and your roll inputs, instead of resulting in a roll rate with bank angle limits, will result in a direct connection to the roll creating flight controls.

Inactive Sidesticks: "Who has control of the aircraft?"

image

Airbus A380 cockpit
(Creative Commons)

It is an age-old problem, who has control of the aircraft? When I was in Air Force pilot training, we lost a Northrop T-38 Talon when the front seat pilot thought the back seat pilot had control, and vice versa. Our practice was to wiggle the stick and say "I have the jet." When pilots sit side by side with a yoke in front of them, things become a little easier, since you can see the other pilot's hand on the yoke. With a sidestick, things become complicated.

If the sticks are mechanically linked, you can feel the stick move in your hand when the other pilot moves it. Some fly-by-wire systems have electrical servos to duplicate the mechanical linkage, these are often called "active" sidesitcks. In the Airbus, there is no such linkage, mechanical or electrical, sometimes called "passive" sidesticks. If the other pilot has control, you won't know it by feel alone.

The Airbus solution when both pilots are moving their sticks is a voice warning, "Dual Input," repeated every few seconds, and a green "Sidestick Priority" Light. When one pilot intentionally takes control using the red "takeover" pushbutton on the stick: (1) a red light illuminates on the deactivated stick's "Sidestick Priority" light, (2) a green light illuminates on the active sidestick's "Sidestick Priority" light, and (3) an aural alert announces "Priority Left" or "Priority Right." One pilot can lock the other pilot out by tapping his takeover button twice. If that happens, the other pilot has to press and hold the takeover button to regain control.

Fly-by-wire pilots tend to prefer the system they spend the most time with, and I am certainly guilty of that. Most of my fly-by-wire system time is with the Gulfstream GVII, where the active sidesticks move in concert. If the right seat pilot moves the right stick, the left stick moves. I think this is vastly safer than the Airbus solution because in times of stress, one of your first senses to fail you is your hearing. As with Air France 447, you are unlikely to hear "priority left" or "priority right." So too with the priority lights. In these stressful situations, are you likely to see the lights?

In the Airbus fly-by-wire system, if neither pilot has taken priority, both sticks are active and the inputs are averaged. If one pilot pitches up 10 degrees and the other pitches down 10 degrees, you end up with 0 degrees pitch. If one pilot takes priority, only that stick is active and the other is ignored.

Crew rest area

You could argue that getting the captain back to the cockpit sooner might have made a difference, I'm not so sure. But the absence of a interphone didn't help.

The A330 crew rest area is a small room right behind the cockpit. . . . A dedicated button on the left side of the cockpit overhead panel rings a call chime in the rest area. . . . Many A330's have an interphone handset in the rest area that allows for voice communication between the cockpit and the rest area. . . . Air France did not take this option.

Source: Palmer, p. 23


4

Narrative

What happened

Rumors of fatigue

The French news magazine Le Point released a story on March 15, 2013 based on a previously undisclosed judicial report that included a voice recorder conversation not included in the official accident report. The magazine revealed a comment made by Captain Dubois at 01:04, "I didn't sleep well enough last night. Once hour — it's not enough." It also claimed that the two first officers were also dangerously tired. In his book, Air Crashes and Miracle Landings, Christopher Bartlett states "it has been said that Air France pilots regard the long flight back to France as a good chance to have a good rest and recuperate after having fun in Rio de Janeiro."

Source: Palmer. pp. 19 - 20

Palmer acknowledges that these allegations fall short of "factual evidence." But given what happened, this explanation seems plausible.

From departure to the captain's rest period

  • At the start of the Cockpit Voice Recorder (CVR) recording, shortly after midnight, the aeroplane was in cruise at flight level 350. Autopilot 2 and auto-thrust were engaged. Auto fuel transfer in the “trim tank” was carried out during the climb. The flight was calm.
  • At 1 h 35, the aeroplane arrived at INTOL point and the crew left the Recife frequency to change to HF communication with the Atlántico Oceanic control centre. A SELCAL test was successfully carried out, but attempts to establish an ADS-C connection with DAKAR Oceanic failed.
  • Shortly afterwards, the co-pilot modified the scale on his Navigation Display (ND) from 320 NM to 160 NM and noted “. . . a thing straight ahead”. The Captain confirmed and the crew again discussed the fact that the high temperature meant that they could not climb to flight level 370.
  • At 1 h 45, the aeroplane entered a slightly turbulent zone, just before SALPU point. Note: At about 0 h 30 the crew had received information from the OCC about the presence of a convective zone linked to the inter-tropical convergence zone (ITCZ) between SALPU and TASIL.
  • The crew dimmed the lighting in the cockpit and switched on the lights “to see”. The co-pilot noted that they were “entering the cloud layer” and that it would have been good to be able to climb. A few minutes later, the turbulence increased slightly in strength.
  • Shortly after 1 h 52, the turbulence stopped. The co-pilot again drew the Captain’s attention to the REC MAX [Recommended Maximum Altitude] value, which had then reached flight level (FL) 375. A short time later, the Captain woke the second co-pilot and said “[…] he’s going to take my place”.
  • At around 2 h 00, after leaving his seat, the Captain attended the briefing between the two co-pilots, during which the PF (seated on the right) said specifically that “well the little bit of turbulence that you just saw we should find the same ahead we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast” and that “the logon with DAKAR failed”. Then the Captain left the cockpit.

Source: BEA Report, §1.1

The least qualified is now Pilot in Command (PIC)

First Officer Bonin (in the right seat) was the pilot flying, Relief First Officer Robert (in the left seat) was the pilot monitoring.

According to Air France procedures at the time, because he was the pilot flying in the right seat, he would assume command in the captain's absence.

Source: Palmer. p. 22

  • The aeroplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82. The pitch attitude was about 2.5 degrees. The weight and balance of the aeroplane were around 205 tonnes and 29%.
  • The two copilots again discussed the temperature and the REC MAX. The turbulence increased slightly. At 2 h 06, the PF called the cabin crew, telling them that “in two minutes we ought to be in an area where it will start moving about a bit more than now you’ll have to watch out there” and he added “I’ll call you when we’re out of it”.
  • At around 2 h 08, the PNF proposed “go to the left a bit [. . . ]”. The HDG mode was activated and the selected heading decreased by about 12 degrees in relation to the route. The PNF changed the gain adjustment on his weather radar to maximum, after noticing that it was in calibrated mode. The crew decided to reduce the speed to about Mach 0.8 and engine de-icing was turned on.

Source: BEA Report, §1.1

Radar

This Airbus A330 radar was conventional for the time. It was a Rockwell-Collins WXR 700, with manual tilt and gain, and displayed returns in colors from green (least intense) to red (most intense) on the navigation display. The returns would be seen superimposed against the aircraft's position, route, and upcoming waypoints. The gain is normally left in "CAL" position to be able to interpret the display colors in a calibrated mode, so that a particular color represents a particular amount of rainfall. The gain can be adjusted to see beyond return shadows or in conditions where the returns are particularly weak. (See Radar for a deeper discussion about this.) Radar returns from ITCZ weather at this altitude can escape notice when the gain is set to CAL. The BEA interviewed the captain of an A330 which was 37 minutes behind Air France 447:

After flying through a turbulent zone in the head of a cumulus congestus formation at the level of NATAL [a waypoint along the route], without having detected this zone on the radar, the Captain selected gain in MAX mode. At about 2 h 00, he observed a first return that differed significantly depending on whether the radar's gain was in CAL or MAX mode. The tilt was set between -1° and 1.5°. he decided to take evasive action to the west, which resulted in a deviation of 20 NM to the left of the route. During this evasive action, a vast squall line with an estimated length of 150 NM appeared on the screen, which was set to a scale of 160 NM. The returns were yellow and red when the radar was set with gain on the MAX position and green and yellow when the gain was set on the CAL position.

Source: BEA Report, §1.18.5.1

Relief First Officer Robert selected MAX 8 minutes later in the flight than did the captain on the following flight.

The crew's failure to operate the radar in such as way as to avoid the massive area of weather ahead of time, put them in a position of just avoiding the worst parts as they entered the line of weather. But even while avoiding the heaviest radar returns, the airplane soon encountered conditions that overwhelmed the pitot tubes' ability to measure airspeed.

Source: Palmer, p. 46

Ice crystal encounter

02:09:46 The flight encountered an updraft. A sound typical of the ice crystals hitting the fuselage was heard. [The first officer] reduced the cruise speed from Mach .82 to Mach .80, which is the recommended speed for turbulence penetration. The engine speed automatically reduced from 100% N1 to 84%.

02:10:00 The updraft intensified as the airplane pitched down from 2° to 0° to maintain altitude; the autothrust system reduced thrust in order to maintain the aircraft's speed.

02:10:05 The pitot tubes clogged with ice crystals and the left side indicated airspeed fell from 275 to 60 knots but remained displayed on the PFD (Primary Flight Display). The indicated airspeed on the standby instrument fell from 275 to 139 then rose to 223 knots. The right side displays are not recorded, but it is likely that they suffered similar degradations. The autopilot disconnected and the flight director bars disappeared. The airplane's flight control law changed from normal to alternate 2, shutting down many of the built-in protections and increasing the sensitivity to roll inputs.

Due to the loss of indicated airspeed, internal altimeter corrections were automatically recalculated as if the airplane were flying at the lower speeds. This resulted in false indications of a decrease in altitude of about 200 feet and a downward vertical speed approaching 600 feet per minute.

Source: Palmer, p. 5

The loss of airspeed caused the altimeters to drop, perhaps starting First Officer Bonin's perception of a need to climb.

Pilot inputs that were "abrupt and excessive"

Following the autopilot disconnection, the PF very quickly applied nose-up sidestick inputs. The PF’s inputs may be classified as abrupt and excessive. The excessive amplitude of these inputs made them unsuitable and incompatible with the recommended aeroplane handling practices for high altitude flight. This nose-up input may initially have been a response to the perception of the aeroplane’s movements (in particular the reduction in pitch angle of 2° associated with the variation in load factor) just before the AP disconnection in turbulence. This response may have been associated with a desire to regain cruise level: the PF may have detected on his PFD the loss of altitude of about 300 ft and loss of vertical speed of the order of 600 ft/min in descent. The excessive nature of the PF’s inputs can be explained by the startle effect and the emotional shock at the autopilot disconnection, amplified by the lack of practical training for crews in flight at high altitude, together with unusual flight control laws.

Source: BEA Report, §2.1.2.3

  • At 2 h 10 min 16, the PNF said “we’ve lost the speeds” then “alternate law protections”. The PF made rapid and high amplitude roll control inputs, more or less from stop to stop. He also made a nose-up input that increased the aeroplane’s pitch attitude up to 11° in ten seconds.
  • Between 2 h 10 min 18 and 2 h 10 min 25, the PNF read out the ECAM messages in a disorganized manner. He mentioned the loss of autothrust and the reconfiguration to alternate law. The thrust lock function was deactivated. The PNF called out and turned on the wing anti-icing.
  • The PNF said that the aeroplane was climbing and asked the PF several times to descend. The latter then made several nose-down inputs that resulted in a reduction in the pitch attitude and the vertical speed. The aeroplane was then at about 37,000 ft and continued to climb.
  • At about 2 h 10 min 36, the speed displayed on the left side became valid again and was then 223 kt; the ISIS speed was still erroneous. The aeroplane had lost about 50 kt since the autopilot disconnection and the beginning of the climb. The speed displayed on the left side was incorrect for 29 seconds.
  • At 2 h 10 min 47, the thrust controls were pulled back slightly to 2/3 of the IDLE/CLB notch (85% of N1). Two seconds later, the pitch attitude came back to a little above 6°, the roll was controlled and the angle of attack was slightly less than 5°.

Source: BEA Report, §1.1

Note: The AOA is not displayed in this cockpit.

The flight directors reappeared for 53 seconds (until 2:11:40), again the guidance was to maintain the climb rate of 1,400 feet per minute. The thrust levers were moved back to 2/3 between the idle and climb settings, and the N1 decreased to 85%.

Source: Palmer, p. 7

The first officer's pitch inputs increased to 16° after having been reduced to no lower than 10°. The pitch setting before the event was around 2.5° and N1 was 100%.

  • The aeroplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb.
  • From 2 h 10 min 50, the PNF called the Captain several times.
  • At 2 h 10 min 51, the stall warning triggered again, in a continuous manner. The thrust levers were positioned in the TO/GA detent and the PF made nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) began a nose-up movement and moved from 3 to 13 degrees pitch-up in about 1 minute and remained in the latter position until the end of the flight. Around fifteen seconds later, the ADR3 being selected on the right side PFD, the speed on the PF side became valid again at the same time as that displayed on the ISIS. It was then at 185 kt and the three displayed airspeeds were consistent. The PF continued to make nose-up inputs. The aeroplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and angle of attack were 16 degrees.
  • At 2 h 11 min 37, the PNF said “controls to the left”, took over priority without any callout and continued to handle the aeroplane. The PF almost immediately took back priority without any callout and continued piloting.

Source: BEA Report, §1.1

The control sticks on each side do not provide any tactile feedback from the opposite side. In this case, the PNF pushing nose down would be unnoticed by the PF, and the PF pulling nose up would be unnoticed by the PNF. The displayed airspeeds and altitudes were now consistent and validated the fact the aircraft was in an aerodynamic stall. Stall warning was the aural voice saying "Stall" and a red band on the airspeed tape. There is no stick shaker.

Consider that in normal operation, the angle of the airflow along the fuselage is no more than a few degrees. At 02:11:45, as the airplane was descending through 35,000 feet, the angle of attack started to exceed 45° on a regular basis. At the same time the indicated airspeed fell to values that were well below its actual forward speed. If it were only a matter of the air striking the pitot tube at the 45° angle, geometry tells us that the resulting ram pressure would be 70% of its actual value, but the indicated airspeeds were often below 60 knots for the number one air data system and near zero for the standby instrument.

This created a situation where the air was pushing into, in addition to flowing over, the static ports. Dynamic pitot pressure is only calculable by subtracting the static pressure component. If the air is directed at the pitot inlet and the static port inlet at the same angle then the differential will fall to zero, or perhaps beyond. This dynamic accounts for the repeated falling of the airspeed indications to invalid values.

Source: Palmer, p. 57

This excessive high angle of attack created a paradox for the remainder of the flight. When the pitch was high enough to cause pitot and static pressures to become invalid, the the stall warning ceased. When the pitch was lowered and allowed the pitot and static pressures to become valid, the stall warning resumed.

The captain's return

  • At around 2 h 11 min 42, the Captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped, after having sounded continuously for 54 seconds. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was about -10,000 ft/min. The aeroplane’s pitch attitude did not exceed 15 degrees and the engines’ N1’s were close to 100%. The aeroplane was subject to roll oscillations to the right that sometimes reached 40 degrees. The PF made an input on the sidestick to the left stop and nose-up, which lasted about 30 seconds.
  • At 2 h 12 min 02, the PF said, “I have no more displays”, and the PNF “we have no valid indications”. At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning triggered again.
  • At 2 h 13 min 32, the PF said, “[we’re going to arrive] at level one hundred”. About fifteen seconds later, simultaneous inputs by both pilots on the sidesticks were recorded and the PF said, “go ahead you have the controls”.
  • The angle of attack, when it was valid, always remained above 35 degrees.
  • From 2 h 14 min 17, the Ground Proximity Warning System (GPWS) “sink rate” and then “pull up” warnings sounded.
  • The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees.
  • No emergency message was transmitted by the crew. The wreckage was found at a depth of 3,900 metres on 2 April 2011 at about 6.5 NM on the radial 019 from the last position transmitted by the aeroplane.

Source: BEA Report, §1.1


5

Analysis

How to prevent recurrence

The loss of airspeed indications and . . .
panic (avoiding)

The loss of airspeed indications caused the autopilot to disconnect. The loss of airspeed indications isn't announced, but the loss of the autopilot generates a loud "cavalry charge," three musical tones that cannot be missed.

As the report notes, the loss of reliable airspeed caused the position error corrections in the altimeters to drop as well, causing the indicated altitude to drop 300 feet. The report speculates that this may have something to do with the First Officer Bonin's immediate reaction to pull the stick aft. Perhaps he noticed the swing of the altimeter needle down and reacting by pulling up.

When the autopilot disconnected, the roll angle increased in two seconds from 0 to +8.4 degrees without any inputs on the sidesticks. The PF was immediately absorbed by dealing with roll, whose oscillations can be explained by: A large initial input on the sidestick under the effect of surprise; The continuation of the oscillations, in the time it took to adapt his piloting at high altitude, while subject to an unusual flight law in roll (direct law).

Source: BEA Report, §2.1.2.3

The report contradicts itself between "without any inputs of the sidesticks" to "a large initial input on the sidestick under the effect of surprise." I think the latter is more likely than the former.

When the autopilot disconnected, First Officer Bonin immediately said, "I have the controls," which is the correct response. But within two seconds he applied enough back pressure on his sidestick to pitch the airplane up 11° in ten seconds. The BEA report notes that the "salience of the speed anomaly was very low compared to that of the autopilot disconnection." In other words, Bonin reacted in alarm at suddenly losing the autopilot and didn't take the time to ask why it had disconnected in the first place.

The correct response to the surprise of losing the autopilot would have been to do nothing other than lightly cradle the stick without making any inputs, while watching the aircraft's attitude to ensure it remains steady. Then, calmly announce the problem and attempt to collect information to help in your analysis.

That's all well and good, but how does one avoid panic and remain calm in a stressful situation? The conventional answer is to practice in the simulator but that doesn't work for most people, since you know no matter what happens, you are walking away from the simulator in one piece. I can offer two suggestions. First, practice being calm in everyday life. If you are prone to flying off the handle in day-to-day life, try to remind yourself that this kind of behavior on the ground impacts your behavior in the air. The next time the dog soils the carpet or your five-year-old drops her plate from the dinner table, try to avoid raising your voice. With practice, this becomes easier. See: Rule 3 - A Practiced Calm Will Serve You Well. Second, try having a saying ready to go to remind you that you need to keep it together. This is something you can practice in the simulator. I'll go into greater detail, below.

Flight control laws and . . .
systems knowledge (knowing more than you are taught)

Bonin's over-controlling the ailerons was a result of the aircraft degrading to alternate law. In Airbus normal law, aileron inputs are translated to roll rates and pitch inputs to G-loads to make the resulting aircraft movements smoother, limited and protected. In alternate law, these stick inputs go directly to the controls, making it more likely to over bank and pitch erratically.

Relief First Officer Robert mentioned the loss of autothrust and the reconfiguration to alternate law while reading the several ECAM warnings, but the fact they were in alternate law didn't seem to register with Bonin. Having spent all of their flight time in normal law, the affects of alternate law may have been just an academic exercise. When learning a new system — especially something radically different than anything you've experienced before — it is common to focus on what you need to fly the jet and leave everything else for later. Get normal law down, worry about alternate law later. But once you get your type rating and spend every flight in normal law, later never comes. In a stressful situation, saying "you are in alternate law" may not register.

The primary duty of the pilot monitoring is to monitor the aircraft's attitude. Relief First Officer Robert did notice that First Officer Bonin was over-controlling, but didn't do enough to get Bonin to stop. Let's assume that Bonin was in panic, as he appeared to be. Let's also assume that at this point, Robert had not yet panicked. When faced with this situation, you must get the panicked pilot's attention and give him or her direct instruction. Call them by position and name, sort of like when your parents called you with your full name. State the problem succinctly. Then direct the solution. For example: "First Officer Bonin! We are not in normal law anymore! Limit your stick movements to half, no more!"

It is also probable that neither pilot really understood the ramifications of being in alternate law. Most aircraft qualification training is on a tight schedule with the objective of passing a check ride. Instructors will emphasize the things most likely to be examined and pay only cursory attention to everything else. You may see a question on a test, such as, "how is aileron control affected by a degrade to Alternate 2?" You competently answer, "direct control of ailerons and lift dump, loss of bank angle protection." Job done, as long as you can spit that out when asked. But do you really understand?

How do you really learn something so you understand beyond rote memorization? Your answer may be different than mine, but you need to find that answer. For me, the best way to learn — to really learn — is to instruct. If I don't have a student, then I instruct by writing lesson plans for the day I will have a student. The process of writing cements knowledge for me. For others, it might be talking to others. Back to our aileron control example. I would dive deeper and find out how normal law filters stick movements into aileron deflection, why that doesn't happen in alternate law, and how the pilot takes on that duty. A good exercise is to pretend you are explaining this to an annoying child who always responds with "why?" Answer as many why's as you can, and you will understand well enough to recall that knowledge in times of stress. See: Being a Better Student / Do a better job teaching as well as learning.

Stall recovery and . . .
stall recovery (there is a difference)

We must first address a common misperception about stall angle of attack and then discount a factor that some say delayed the stall warning for the pilots of Air France 447.

In primary flight training, pilots are taught that an airplane always stalls at the same angle of attack (for a given wing configuration), no mater what the speed, weight, or attitude. That is true enough throughout the normal operating range of airplanes that pilots learn to fly in. However, that is not necessarily the case for high performance aircraft operating at high altitudes.

Source: Palmer, p. 67

We know that parts of the wing can go supersonic well before the airplane because the wing shape requires a longer distance over the same time. This occurs at the "Critical Mach Number," which could be accompanied by Mach buffet. Older, high speed aircraft could experience Mach buffet and Mach tuck, which happens when the redistribution of air flow and/or loss of effectiveness of the tail results in a pitch down. Most of us have never experienced Mach buffet or Mach tuck because our wings are designed to allow for better high speed behavior. These airfoils are called "supercritical," because they are designed to perform efficiently at and just above the critical Mach number. One of the few downsides of supercritical wings, however, is that they stall at lower angles of attack at high Mach numbers, because the shock wave on the wing impacts boundary layer separation.

On some types of airplanes (Airbus A320, for example), because of the aerodynamic characteristics in the approach to stall, the stall warning threshold is often independent of Mach. On the A330 and other airplanes of its generation, the stall warning angle of attack is adjusted by Mach number.

To use the stall warning as a point of reference, at 0.3 Mach the A330 stall warning comes on at an angle of attack of about 10°, at M.82, it is only 4°.

On the A330, if no Mach is valid the warning threshold for values below Mach 0.3 is used. If the actual Mach number is .82 then th stall warning requires an angle of attack of over two times the correct one to activate, potentially resulting in no warning prior to the stall. However, in the AF447 case that was not a factor. There was never a time when the stall warning was inhibited by the stall warning threshold being incorrectly high. From the time of the initial stall at about 02:10:50, which was about 10 seconds before the peak altitude of 37,9234 feet was reached, the actual angle of attack was always high enough to generate the stall warning whenever the AOA was considered valid (i.e., the airspeed was above 60 knots).

Source: Palmer, pp. 70 -71

Is it important to know that the stall angle of attack can change at high speeds for some wings? I don't think so. In fact, I usually ignore that fact because if you respect the stall warning systems of your aircraft, you will never need this information. I bring it up here, only because there are those who say the two first officers of Air France 447 were not warned. An examination of the cockpit voice recorder proves there were multiple stall warnings, but it is unclear if the pilots heard each or fully understood that the aircraft was actually in a stall. I think a stick shaker could have gotten their attention. But later in the flight, they clearly heard the off-again, on-again stall warning. They just didn't recover properly.

Stall training, not only at Air France but industry-wide prior to the accident, concentrated on stall recognition and recovery at low altitude, where these incidents were considered most likely to occur. Even though there had been stall accidents originating at high altitude.

While the principles of stall recovery are similar in both altitude regimes, significant differences between low and high altitude do exist:

  • Significantly less excess power is available at high altitude, requiring recovery primarily with pitch for angle of attack reduction.
  • A lower stall angle of attack at the Mach numbers experienced with high altitude flight, and consequently a narrower stall margin at low altitude.

Prior to the accident most stall recovery training also focused on minimal loss of altitude in the recovery. Rapid application of full power was the initial action, and at low altitude the application of full power often solved the angle of attack problem by itself. Very little pitch down was required to make the recovery and altitude loss was minimized. But again this was recovery from an incipient stall, not a full stall. Pilots were taught to take action as soon as the stall warning or other signs of stall presented themselves.

Source: Palmer, pp. 160 - 161

The Air France 447 pilots obviously didn't think to aggressively decrease the angle of attack to break the stall, as we are taught today. However, I still hear of instructors teaching to minimize altitude loss as a sign of good airmanship, disregarding the fact the training is done for the approach to stall at low altitude, building poor muscle memory for actual stalls at high altitudes. The fix is obvious: treat all training approaches to stalls as if they were the real thing: aggressively break the stall with a reduction in the angle of attack while adding thrust. Get the airplane flying again before worrying about altitude loss.

Recommendations: two from the BEA and . . .
two more from me

The BEA report lists the causes of the accident:

  • The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident.
  • The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF.
  • The crew, progressively becoming [distracted], likely never understood that it was faced with a “simple” loss of three sources of airspeed information.
  • The aeroplane went into a sustained stall, signaled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre.

Source: BEA Report, §3.2

This BEA report has all the facts, but fails to use them to clearly delineate causes. In this situation, the best window into what really happened and how to prevent recurrence is to look at the recommendations. In this case, these two from Section 4 of the report:

"Consequently, the BEA recommends: that EASA review the content of check and training programmes and make mandatory, in particular, the setting up of specific and regular exercises dedicated to manual aircraft handling of approach to stall and stall recovery, including at high altitude."

"Consequently, the BEA recommends: that EASA and the FAA evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on board aeroplanes."

I would add to that list: the Airbus needs a stick shaker. The only thing in the cockpit to indicate a stall is an aural, "Stall, stall" voice. There are several studies about "Auditory exclusion as a stress response," showing that one of the first things to shut down when we are under high stress is our ability to hear and discern. That is also the reason an active sidestick is superior to a passive one.


6

Technique: communicate as if your life depends on it

Highly experienced pilots too often keep quiet with a smug confidence that they are smarter than everyone else. These overconfident pilots may find out they've assumed too much and will miss the opportunity to learn they were wrong, if they were wrong, or to teach others, if they were right. Young pilots too often keep their mouths shut rather than being discovered as being ignorant about something important. They can, as a result, find themselves in critical moments lacking a critical procedure or technique that could have saved them. Even if the pilots had communicated well prior to a crisis, their performance during a crisis will depend on their ability to impart meaningful information in a timely manner.

Share knowledge, ensure understanding

Once the maximum recommended climb altitude increased to FL375 and the first officer asked the captain if it would be okay to climb to FL370, the captain "vaguely rejected" the first officer, saying "it might be bad." He was evidently thinking that with only a 500 foot margin, the aircraft would be thrust limited if the temperature went up. That was a good call, but he should have articulated that to the first officer. It would have helped the first officer understand this critical limitation of high altitude flight, and it may have prevented him from instinctively climbing when the autopilot disengaged on its own.

Admit ignorance

When First Officer Bonin became concerned about the sound of the ice crystals and the way the conditioned air started to smell and become more humid, he asked the Relief First Officer Robert who simply said it was the ozone in the air. Had Robert followed up and asked what ozone had to do with the humidity, he might have provoked a discussion of the many effects of flying in the ITCZ. With those thoughts fresh in his mind, Bonin might have been less prone to panic in the moments to come.

During a crisis, communicate to impart meaningful information in a timely manner

When Bonin was trying to level the wings with the increased sensitivity of alternate law, Robert's job was to handle the ECAM messages, but he did so by just reading them in what seemed a random order. If he had instead zeroed in on the fact they were in alternate law, he might have been able to make Bonin understand why the aircraft was handling differently than he was used to. "We're in alternate law! You no longer have filtered ailerons inputs so you need to be gentle!"

Additionally, neither of the pilots in the cockpit at the time of the stall verbalized the fact they were in a stall. Had either simply said "Stall," it might have triggered the correct stall recovery technique.

Replace panic with a pre-planned thought

It is easy to arm chair quarterback what happened to the two young first officers and criticize their lack of composure when the autopilot disengaged. Perhaps older pilots from earlier generations were well practiced at dealing with sudden crises in the air, but that doesn't do newer pilots any good. I was once flying with a fairly experienced pilot who became completely unglued when our aircraft lost a hydraulic system, forcing us to declare an emergency and use the aircraft's alternate gear extension. I had to talk him through the process and prevent him from panic. When we were on the ground, I asked him how many times he had ever declared an emergency. "Including today, once." So, if you are in that boat and might be prone to panic, what can you do? You should have a pre-planned thought, ready for emergencies.

The idea of the pre-planned thought is one I've been using for a very long time, but I've seen it best articulated by professional race car driver and performance coach Ross Bentley. If you practice having this thought ready to go in the simulator, it might save you in the airplane. More about pre-planned thoughts: Compartmentalization and Flight.

For my pre-planned thought in the event of an emergency, I used to think, "I've tried A. I've tried B. I've tried C. Now what do I try?" This comes from the book "The Right Stuff" and thinking about it makes me smile. More importantly, it forces me to slow down. After a few years, I started saying "Pie-oh-see." Having a structured way to approach a problem is key to avoiding panic. There are various methods out there, here is PIOSSEE:

P – Problem: Identify what’s wrong (e.g., engine failure, abnormal indications).

I – Immediate Action: Perform any critical emergency memory items or boldface procedures that must be done without delay.

O – Options: Consider all feasible courses of action (e.g., divert, eject, continue, troubleshoot).

S – Select: Choose the best available option based on the situation.

S – Start Execution: Begin carrying out the selected course of action.

E – Evaluate: Continuously monitor the results and adjust as needed.

E – Execute Backup Plan (sometimes interpreted as a second evaluation or finalize execution depending on training context).

That doesn't mean I have to go through the PIOSSEE process whenever something goes awry, but saying "Pie-oh-see" slows me down and reminds me I have a better way to approach problems than simply reacting.

If it was you at high altitude, in the ITCZ, and the autopilot suddenly disengaged, how would you prevent panic? If you think, "PIOSSEE," it will give your mind someplace to go rather than panic. In fact, you should speak your thoughts aloud to get the crew's help. "Problem? No autopilot." "Immediate Action? Fly the airplane." "Options? Well, we need to figure out why the autopilot disengaged before we can do that!" Having something to think about may prevent the panic that caused the first officer to pull up into a stall. But once he started down that path, then what? Both pilots should have realized that flying with the pitch up 11 degrees wasn't going to work . . .


7

Technique: known thrust and pitch settings

You may think the cases of Birgenair 301 and AeroPerú 603 have little to do with Air France 447. In those cases, the pitot tube or static ports were blocked on the ground and the blockage was permanent. In this case, the blockage was momentary. But in all three cases, had the pilots known where to set the thrust levers and the aircraft pitch, they would have survived. This should be required knowledge before being awarded a type rating.

The known thrust and pitch setting technique

If you ever find yourself with uncertain airspeed or altitude information you can sort things out, but it will take time. To buy yourself that time, it is vitally important that you set the pitch and thrust of the aircraft to known settings that will keep the airplane flying. For most aircraft, you only need to know values that will work at maximum weights during initial climb after takeoff, during cruise altitude, and in the approach environment. There are countless aircraft accidents, including AeroPerú 603, where this knowledge would have saved the day.

If your manufacturer doesn't provide this information, you should arrange these three scenarios in the simulator or record them during actual flight the next time you have the right conditions:

  • Climb after takeoff, maximum weight
  • Cruise at high altitude, after a maximum weight takeoff
  • Missed approach, at maximum weight for landing

I've found over the years that the answer for the initial climb tends to be between 10 and 15 degrees of pitch at takeoff thrust, between 2 and 3 degrees at maximum continuous thrust for cruise, and between 10 and 15 degrees at just below maximum continuous thrust for a missed approach. You should record these either in the simulator or the aircraft when the opportunity arises.

Finally, if your aircraft has an Angle of Attack indicator that is usable for flight, you have another ace up your sleeve. Most cockpit AOA indicators are normalized, meaning they don't report the actual angle in degrees, but a ratio of that angle over the stall angle of attack. It is slightly more complicated than that, if you want to get into the nuts and bolts, see: Angle of Attack. You should scour your manuals and record values in the simulator. For many aircraft, you should see 0.66 NAOA on approach at VREF and something lower when you apply a wind additive. As the NAOA increases, you are getting closer to the stall. In the Gulfstream GVII, for example, the stick shaker occurs at 0.97 NAOA. Also realize that some aircraft give you instantaneous AOA while others dampen the result. In my Gulfstream I can see the AOA on appraoch dance between 0.3 and 0.7 and even higher, but I make sure the average is lower than 0.66. In other aircraft, the instrument dampens out the oscillations for you. Knowing what's about right can save you someday.

References

(Source material)

Final Report on the Accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro - Paris, Bureau d'Enquêtes et d'Analyses (BEA) pour la sécurité de l’aviation civile, Published July 2012.

Langewiesche, William, Should Airplanes Be Flying Themselves, Vanity Fair, October 2014.

Palmer, Bill. Understanding Air France 447. 2013.