AF447 final report could drive critical safety reforms
There is substantially more inside the final report of the French safety agency’s inquiry into the crash of Air France flight AF447 on 1 June 2009 than came out in the press conference in Paris overnight.
And that is notwithstanding some very serious issues that were highlighted in that media briefing on the full report into the crash that killed all 228 people on board an Airbus A330-200 when it slammed down onto the mid Atlantic Ocean more than several hours into a flight from Rio de Janeiro to Paris.
As previously established in the second interim report by the agency, the BEA, the disaster sequence began when external measuring devices called pitots iced up causing the auto-pilot to disconnect, after which two junior co-pilots lost control of the jet, in a four minutes and 23 seconds sequence of events in which the captain, summonsed from his rest break, was also unable or unwilling to effectively intervene to diagnose that the jet had been stalled.
The icing and loss of speed data that triggered the lethal series of events was transitory, and has been dealt with by the pilots of other Airbus wide-bodied aircraft without loss of control or of life, yet in the few minutes that it took before the speed measuring devices cleared and came back on line, the jet had been mishandled to the point where the BEA says without an exceptional and knowledgeable input by the pilots a crash had become inevitable.
The autopilot disconnection, which took the two co-pilots left to manage the jet by surprise, began at 2 hours 10 minutes and 4 seconds into the flight, and at 2 hours 14 minutes and 27 seconds, with all of its mechanical and electronic systems fully functional, it struck the sea at a vertical speed of 10,912 feet per minute ( 102 feet per second), at high engine output, nose high, with the synthetic voice in the cockpit saying ‘pull up, pull up’.
At 2 hours 13 minutes and 32 seconds the pilot flying said “we are going to arrive at level 100” which is 10,000 feet.
At 2 hours 14 minutes and 6 seconds the pilot flying says “I’m pitching up” and second co-pilot not flying says “ Well we need to we are at four thousand feet”.
At 2 hours 14 minutes and 9 seconds the co-pilot not flying says “Let’s go, pull up, pull up, pull up” which is what the annunciator is also saying and has been since it ceased saying ‘sink rate’ three second earlier, some seconds after it ceased saying ‘stall, stall’.
At 2 hours 14 minutes and 23 seconds the co-pilot not flying says “(expletive) We’re going to crash”. A second later he says “I can’t believe this”.
A second after that the co-pilot flying says or makes a noise or observation not transcribed.
This is followed in the final second by the co-pilot not flying saying “But what’s happening” and the last words, spoken by the captain are “ (ten) degrees pitch attitude”.
The final report says that for most of the control crisis the jet was flown at an angle of attack of up to 40 degrees and seldom below 35 degrees when a valid parameter for this was being supplied to its flight management system.
It says that when there was not a valid pitch measurement recorded the stall warning, which at one stage is heard continuously for 54 seconds on the cockpit voice recorder, ceases, and that intermittent cessation of the stall warning has already caused Air France to criticise Airbus for a ‘fault’ which contributed to the crash by misleading its pilots.
At the press conference the chief investigator, Alan Bouillard said “The crew never realised that the plane had stalled”.
He said Air France had not properly trained its pilots to deal with ‘surprises’ in the cockpit nor to handle high altitude stalls (in fact Air France had not been explicitly required to do this under the A330 operating rules) and said the report called for significant revisions and improvements to pilot training, and to redress limitations that the BEA had identified in the safety case that had been applied to Air France’s, and by implication, other airline A330 operations.
The report says that the investigation had uncovered a “profound loss of understanding” in the cockpit in a moment of surprise, when the aircraft went into a stall and lost lift.
The pilots lacked training for stall scenarios, and the safety investigator recommended that flight simulation training be reviewed.
The BEA report points to ‘indications’ of shortcomings in how information is displayed to pilots on the A330, in particular the so-called flight director that pilots rely on to fly the aircraft. It says that after the crew were surprised by the autopilot disengaging the flight director displays at times disappeared and there was also aural overload from alarms that were triggered by the compromised state of the aircraft. While this lead the pilots of AF447 to make incorrect or inappropriate control inputs, the BEA report details 13 instances where pilots were on top of the situation and reacted properly when flying A330s and A340s.
The flight-recorder readings revealed that Chief Pilot Marc Dubois, 58, had been on a routine break when the autopilot disengaged, and that he at no point until the crash took back control of the jet. Instead, the two junior co-pilots, aged 37 and 32, shared the task of stabilizing the plane, with the senior pilot giving occasional commands from the background.
The report says that the failure in the context of flight in cruise completely surprised the crew.
“The apparent difficulties in handling the aeroplane in turbulence in high altitude resulted in over- handling in roll and a sharp nose-up input” by the co-pilot, the report said.
“The startle effect played a major role in the destabilisation of the flight path and in the two pilots understanding of the situation.”
However it also said other things more explicitly on a full reading, and the English version can be found at this page, where you will need to also download various annexes including the voice recorder transcript using separate links not just the one marked full report.
It says of the conduct of the flight that:
The two co-pilots left in the cabin after the departure of the captain for a rest break were left with an uncertain strategy for the rest of the flight.
The captain had not formally declared the pilot flying, the less experience of the two co-pilots, to be in charge, and did not answer his concerns before his departure for the rest break about handling the turbulence that was anticipated while crossing the inter tropical convergence zone [a storm belt that stretches across the mid-Atlantic from South America to Africa].
In terms of experience on the type and total experience the pilot designated as flying was significantly less experienced than the other co-pilot.
The latter also held a managerial position with Air France at its operational centre and was therefore considered to be an expert by his peers.
This raises questions about the rationality of (informally) designating this co-pilot as the relief captain. The difference in experience of the two co-pilots naturally resulted in the more experienced of them taking over from the informally designated relief captain, and “without generating any conflict” this takeover lead rapidly after the auto-pilot disconnection to the inversion of the normal hierarchical structure in the cockpit.
The leadership role switched to the pilot not flying without the command structure formally and explicitly (being) transferred.
The operators training program doesn’t give co-pilots the opportunity to systematically develop the mind-set necessary to perform the role of relief captain aboard flights with augmented crews.
It draws attention to the more experienced co-pilot diverting much of his attention to efforts to bring the captain back to the cockpit from his rest break than perceiving the seriousness of stall warning sounding in the background of the cockpit voice recording and notes that there is no evidence that either co-pilot actually recognised the warning for what it was.
The more experienced co-pilot, who was not flying the jet, tells the captain once he had arrived that they had tried everything but did not understand the situation and had lost control of the aircraft.
The report says:
Only an extremely purposeful crew with a good comprehension of the situation could have carried out an manoeuvre that would have made it possible to recover control of the aircraft. The crew had almost completely lost control of the situation. Until impact there was no valid angle of attack of less than 35 degrees.
In the first minute after the disconnection of the autopilot neither crew member had the clarity of thought necessary to take the corrective actions.
The report emphasises the failure of knowledge and appropriate responses by the crew several times, and uses language which is similar to that employed by psychologists in discussing clinical hysteria, rather than histrionics.
The crew progressively becoming destructured, and likely never understood they were faced with a simple loss of three sources of air speed information.
The loss of coordination and the willing but chaotic cooperation in managing the surprise generated by the autopilot disconnection led quickly to loss of cognitive control of the situation and subsequently to loss of physical control of the aircraft.
As foreshadowed in an earlier article, AF447 may become something of a lightning rod for concerns that undue reliance on automation in any modern Airbus or Boeing poses increased safety risks.
This is something the major airline manufacturers have already raised out of the public gaze at safety and technical forums. There has been a disconnection between airline managements and flight or safety standards as executives increasingly come from business schools that may not understand nor value the ‘excessive’ costs of engineering or piloting excellence.
Just as there has been a disconnection between some in those professions with the economic realities of airlines in the 21st century.
However while this divide can on one hand contribute to airlines going broke slowly, it can on the other hand result in the quick and unexpected death of hundreds of people in an avoidable crash, destroying brand and shareholder value even faster the ferocity of airline competition.
AF447 shouldn’t be a debate about how airliners are designed so much as one about how they are operated by appropriately trained professionals in an effective regulatory environment.