Air France Flight 447

Date

1 June 2009

Phase of flight

Cruise

Location

Atlantic Ocean, near the TASIL point, in international waters

Aircraft

Airbus A330-203

Registration

F-GZCP

Operator

Air France

Flight

Air France 447 (AF 447)

Occupants

228

Fatalities

22812 crew and 216 passengers

Investigating body

Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (France)

Final report

BEA f-cp090601.en

Report date

5 July 2012

Report title

Final Report on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro - Paris

On 1 June 2009 an Airbus A330-203 of Air France, registered F-GZCP and flying as AF 447 from Rio de Janeiro Galeão to Paris Charles de Gaulle, struck the Atlantic Ocean near the TASIL point, in international waters, at 02:14:28 UTC. All 228 people on board, 12 crew and 216 passengers, were killed. The crew sent no emergency message.

The accident began with a failure that the safety model classified as "major" and expected crews to manage with a procedure: a temporary inconsistency between the three measured airspeeds, most likely because ice crystals obstructed the Pitot probes in cruise at FL350. The autopilot and autothrust disconnected, the flight control law changed from normal to alternate, and in less than a minute the aeroplane had left its flight envelope. It then stayed stalled until it struck the sea, from a maximum altitude of about 38,000 ft, while the stall warning sounded repeatedly.

The flight recorders lay on the ocean floor for 23 months. They showed that the engines and the flight control surfaces had responded to the crew's inputs throughout, and a crew that, the BEA concluded, never understood that the aeroplane was stalled. The investigation by the French Bureau d'Enquêtes et d'Analyses (BEA) is essential reading on unreliable airspeed, alternate law, the high-altitude stall and the startle effect.

The flight

The departure from Rio de Janeiro was planned for 22:00 UTC on 31 May, and the A330 took off at 22:29 with 3 flight crew, 9 cabin crew and 216 passengers. Given the length of the flight, the crew was augmented by a second copilot so that each pilot could rest. The Captain was pilot not flying (PNF) for the take-off, and one of the copilots was pilot flying (PF).

Shortly after midnight the aeroplane was in cruise at FL350 with autopilot 2 and autothrust engaged. At about 00:30 the operations centre had told the crew of a convective zone of the inter-tropical convergence zone (ITCZ) between the SALPU and TASIL points, and the pilots noted more than once that the high temperature prevented a climb to FL370. At 01:35 the crew changed to HF with the Atlántico oceanic centre; an ADS-C logon with Dakar Oceanic failed.

Shortly after 02:00 the Captain left the cockpit to rest. He left no specific instructions for crossing the ITCZ, and the copilot in the right seat, the less experienced of the two, had been designated relief Captain only implicitly. The aeroplane was at FL350 and Mach 0.82, weighing about 205 tonnes.

At around 02:08 the crew turned about 12° left of the route to avoid weather radar returns, reduced the speed to about Mach 0.8 and selected engine anti-ice on. Other aeroplanes at about the same altitude, before and after AF 447, also altered their routes to avoid the cloud masses.

The accident

At 02:10:05 the autopilot, then the autothrust, disconnected, and the PF said "I have the controls". The speed displayed on the left primary flight display (PFD) fell sharply from about 275 kt to 60 kt, and the speed on the standby instrument (ISIS) followed a few moments later. The flight control law reconfigured from normal to alternate law. The flight directors were not switched off by the crew, but their crossbars disappeared.

A lateral gust rolled the aeroplane to the right as the autopilot disengaged. The PF made a nose-up and left input, then rapid, high-amplitude roll inputs from stop to stop, and a nose-up input that raised the pitch attitude to 11° in ten seconds.

The stall warning had sounded briefly twice in the first seconds. The PNF read out the ECAM messages in a disorganised way and asked the PF several times to descend; the PF's nose-down inputs reduced the climb, but the aeroplane was still climbing through about 37,000 ft. The nose-up inputs had produced up to 1.6 g and climb rates of up to 7,000 ft/min, and the aeroplane had lost about 50 kt, with thrust at about 84 % N1, below the 95 % N1 needed for level flight.

At 02:10:51 the stall warning sounded again, this time continuously. The PF selected TO/GA thrust and kept making nose-up inputs, and the trimmable horizontal stabiliser (THS), moved by the flight control computers in response to these orders, went from 3° to 13° nose-up in about one minute and stayed there until the end of the flight. Buffet probably reached a deterrent level at about 02:10:57, at an angle of attack of about 10°. The aeroplane peaked at about 38,000 ft, with the pitch attitude and the angle of attack both at 16°.

Shortly after the Captain returned at 02:11:42, the aeroplane was at about 35,000 ft, descending at about 10,000 ft/min with an angle of attack above 40°, a pitch attitude of no more than 15°, the engines near 100 % N1 and roll oscillations of up to 40°. About fifteen seconds after 02:12:02 the PF made pitch-down inputs; the angle of attack decreased, the speeds became valid again and the stall warning sounded once more. Whenever it was valid, the angle of attack stayed above 35°. Both pilots made simultaneous sidestick inputs in the last minute, and the aeroplane struck the sea at 02:14:28.

The investigation

The wreckage was found on 2 April 2011, in the fourth phase of the sea search, at a depth of 3,900 metres and about 6.5 NM on the 019 radial from the last position transmitted by the aeroplane. The flight data recorder module was raised on 1 May and the cockpit voice recorder on 2 May 2011, and all 1,300 recorded parameters and two hours of cockpit audio were read out. A dedicated human factors working group then joined the investigation.

Pitot probes and ice crystals

F-GZCP still carried its original Thales C16195AA Pitot probes. After a series of airspeed losses in cruise, Airbus and Air France had decided to replace them with the C16195BA model, and the first aeroplane had been modified on 30 May 2009. EASA had analysed Pitot icing events, confirmed the severity of the failure and decided not to make the change mandatory. The probes fitted met requirements stricter than the certification standards, but most unreliable airspeed events in cruise had occurred outside the icing envelope used for certification, and the size of ice crystals in high-altitude cloud was little known.

The loss of speed information was brief: the left PFD speed was wrong for 29 seconds, the ISIS speed for 54 seconds and the right PFD speed for 61 seconds at most. In thirteen earlier unreliable airspeed events on the A330 and A340 studied by the BEA, the autopilot always disconnected and no crew was found to have applied the memory items of the procedure, but those aeroplanes stayed within the flight envelope.

Alternate law and the stall warning

In normal law the A330's fly-by-wire controls protect the flight envelope, including the angle of attack: with the sidestick held fully back the aeroplane will not stall. When the flight control computers reject the air data, the law reverts to alternate, here alternate 2B. The sidestick still commands a load factor in pitch, so the aeroplane feels much the same, but the angle of attack protection is lost and it can be stalled. With the air data rejected, the limit speeds, including the stall warning speed, also disappeared from the speed tape.

In alternate law the stall warning is triggered when the highest valid angle of attack exceeds a threshold that falls as Mach rises. In cruise at Mach 0.8 the margin between the flight angle of attack and the warning threshold was of the order of 1.5°, and in cruise one degree of angle of attack corresponded to about 25 kt of speed, against 5 kt at take-off or on approach. When all three measured airspeeds are below 60 kt, the angle of attack values are treated as invalid and the warning stops. Shortly after 02:11:42 the warning therefore fell silent while the angle of attack was above 40°, and it returned when a nose-down input brought the speeds back above 60 kt.

The BEA also found that the flight directors reappeared several times in different modes and may have encouraged nose-up inputs. It noted that a pitch attitude of about 12.5°, which the flight director displays could have prompted, appears in the stall warning procedure for the take-off phase.

The crew

Although both copilots had called out the loss of speeds, neither called the "Unreliable IAS" procedure. Neither pilot referred to the stall warning or to the buffet, and neither formally identified the stall. Their training material associated buffet with both the stall and overspeed; on the A330, buffet occurs only on the approach to the stall. The BEA described a crew that was surprised, whose cooperation was progressively "de-structured", and that "likely never understood that it was faced with a 'simple' loss of three sources of airspeed information".

Probable cause and contributing factors

The BEA does not state a single probable cause. It concluded that the accident resulted from a succession of events: a temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals; inappropriate control inputs that destabilised the flight path; no link made between the loss of indicated speeds and the appropriate procedure; the PNF's late identification of the flight path deviation and the PF's insufficient correction; the crew not identifying the approach to stall and not reacting immediately; and the failure to diagnose the stall. On the last point the report states: "the crew never understood that they were stalling and consequently never applied a recovery manoeuvre."

The BEA explained these events by a combination of factors:

• feedback processes that had not revealed the repeated non-application of the procedure, or put Pitot icing into the risk model for crews in cruise;
• no training at high altitude in manual handling or in the unreliable airspeed procedure;
• task-sharing weakened by incomprehension of the situation and by poor management of the startle effect;
• no clear display in the cockpit of the airspeed inconsistencies that the computers had identified;
• the crew not taking the stall warning into account, possibly because of little exposure to stalls in training, early transient warnings, no visual stall indication, confusion with overspeed buffet, flight director orders and the difficulty of understanding alternate law.

Safety recommendations and what changed

The BEA addressed 41 safety recommendations to the DGAC, EASA, the FAA, ICAO and the Brazilian and Senegalese authorities. The main ones asked for:

• Training: regular exercises in manual handling of the approach to stall and stall recovery, including at high altitude; training in every reconfiguration law and in flight mechanics; and training for surprise, with more realistic simulators.
• Augmented crews: additional criteria for the role of relief Captain.
• Displays and warnings: an evaluation of an angle of attack indicator; a visual stall indication with the aural warning; a review of the stall warning at very low measured speeds and of flight director logic when the stall warning sounds; and a dedicated warning when the systems detect inconsistent speeds.
• Recorders and search: longer transmission from underwater locator beacons, an additional low-frequency beacon, triggered transmission of flight data, an image recorder of the instrument panel, and search and rescue coordination plans for maritime and remote areas, including the South Atlantic.
• Certification: studies of the composition of high-altitude cloud and, on that basis, revised certification criteria.

Air France had replaced all its "AA" probes with "BA" probes by 11 June 2009, and later fitted Goodrich probes. EASA's AD 2009-0195 prohibited the C16195AA probe on the A330 and A340. Airbus recommended a high-altitude simulator session in normal and alternate law, and Air France added training in high-altitude flight in alternate law and the approach to stall. From March 2010 its relief copilot, designated by the Captain, sits in the left seat as PNF.

Lessons for pilots

Fly the aeroplane first. The initial failure left the A330 in stable cruise. The simulation showed that with no pilot input it would have rolled slowly to the left but changed little in pitch and altitude; the aeroplane left its envelope because of the inputs made in the first minute. When airspeed is lost, hold a known pitch attitude and thrust, make small inputs, and only then diagnose. See unreliable airspeed.

Know which protections you have lost. In alternate law the A330 feels the same in pitch but no longer protects the angle of attack. A pilot who expects the normal law protection to catch a stall can hold the stick fully back into one. See fly-by-wire.

Respect the margins at altitude. At cruise Mach the stall warning was only about 1.5° of angle of attack away, and each degree was worth about 25 kt. A zoom climb at high altitude cannot be sustained: it converts speed into height until the wing reaches the critical angle. See buffet and buffet margin.

Treat every stall warning as real. The warning is driven by angle of attack, and the recovery is always to reduce it. A nose-up attitude of 16° combined with a descent of almost 11,000 ft/min can only mean a stalled wing. See stall and upset prevention and recovery.

Communicate and share the task. Priority was taken on the sidesticks twice without a callout, and both pilots made simultaneous inputs. Clear transfer of control, mode callouts and a named relief Captain are basic crew resource management tools.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.