Germanwings Flight 9525

Date

24 March 2015

Phase of flight

Cruise

Location

Prads-Haute-Bléone, Alpes-de-Haute-Provence, France

Aircraft

Airbus A320-211

Registration

D-AIPX

Operator

Germanwings

Flight

Germanwings 9525 (4U9525)

Occupants

150

Fatalities

150144 passengers and 6 crew (2 flight crew and 4 cabin crew); no one on the ground was injured

Investigating body

Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (France)

Final report

BEA2015-0125

Report date

13 March 2016

Report title

Final Report: Accident on 24 March 2015 at Prads-Haute-Bléone (Alpes-de-Haute-Provence, France) to the Airbus A320-211 registered D-AIPX operated by Germanwings

On 24 March 2015 an Airbus A320 operated by Germanwings as flight 4U9525, from Barcelona to Düsseldorf, left its cruising level of FL380 and descended for about ten minutes until it struck mountainous terrain at Prads-Haute-Bléone in the French Alps. All 150 people on board were killed. The captain had left the cockpit a few minutes after the aircraft levelled off, and he was never able to return.

The investigation by France's Bureau d'Enquêtes et d'Analyses (BEA) established from the flight recorders that the co-pilot, alone at the controls, deliberately commanded the descent with the autopilot and kept the reinforced cockpit door locked. The BEA's final report, published on 13 March 2016, does not name him, and neither does this page. Its main subject is not the aircraft, which had no relevant fault, but the system meant to keep an unfit pilot off the flight deck: aeromedical certification, self-declaration of illness, medical confidentiality and support for pilots.

The accident matters to every pilot because it tested two assumptions that underpin multi-crew flying: that a second pilot can always take over from one who is incapacitated, and that a locked door protects the flight deck.

The flight

D-AIPX was an A320-211, serial number 147, which entered service in 1991 and had flown 58,313 hours and 46,748 cycles. It flew for Lufthansa until January 2014, when it joined the Germanwings fleet. The BEA found that the aircraft had a valid certificate of airworthiness, that its maintenance was up to date, and that the recorders showed no system failure or fault that could have contributed to the accident.

The same two pilots had flown the aircraft from Düsseldorf to Barcelona that morning. The captain, aged 34, had 6,763 flying hours, 3,811 of them on type. The co-pilot, aged 27, had 919 hours, 540 on type. He had joined Germanwings in December 2013. Instructors and examiners had judged both pilots above standard, and none of the pilots who had flown with the co-pilot in the preceding months reported any concern about his behaviour.

Flight 4U9525, callsign GWI18G, took off from runway 07R at Barcelona at 09:00 UTC (10:00 local time) with 144 passengers, 2 pilots and 4 cabin crew. The co-pilot was pilot flying. The cruise was in clear skies above scattered cirrus, and visibility at the accident site was greater than 10 km.

The accident

The aircraft levelled at FL380 at 09:27:20. At 09:30:00 the captain read back a clearance direct to the IRMAR waypoint, the last transmission from the flight. Eight seconds later he told the co-pilot he was leaving the cockpit and asked him to take the radio. The door was heard opening at 09:30:24 and closing three seconds later.

At 09:30:53 the altitude selected on the flight control unit (FCU) changed in one second from 38,000 ft to 100 ft, the lowest value the A320 accepts. The autopilot changed to OPEN DES and the autothrust to THR IDLE, and the aircraft began to descend. From 09:33:12 the speed target was selected manually; it was changed several times and at 09:35:03 set to 350 kt, the maximum selectable value, equal to VMO. The rate of descent varied between 1,700 and 5,000 ft/min and averaged about 3,500 ft/min. The autopilot and autothrust remained engaged to the end.

During the descent the Marseille control centre called the flight eleven times on three frequencies, including 121.5 MHz, and asked another aircraft to relay. A French air defence controller made three more calls. None was answered. The cabin interphone call sounded in the cockpit four times without reply. The recorders captured breathing attributed to the co-pilot until seven seconds before impact. Low-amplitude inputs on his sidestick between 09:39:33 and 09:40:07 stayed below the autopilot disconnection threshold and had no effect on the flight path.

The accident site lay in mountainous terrain about 1,550 m above sea level. The wreckage was fragmented and spread over about 4 hectares of a sloping, rocky ravine.

The investigation

Commanding a descent with the autopilot

In OPEN DES the A320 autopilot controls pitch to hold the target speed while the autothrust commands idle. It is engaged by selecting an altitude below the current one and pulling the altitude knob. With 100 ft selected, the autopilot continued the descent in this mode until the end of the recording. The ground proximity warning sounded 25 seconds before impact.

French radars received the aircraft's Mode S Enhanced Surveillance data, including the selected altitude, but in March 2015 those parameters were not yet shown on French controllers' screens. The controllers therefore could not see that 100 ft had been selected.

The flight data recorder also held the morning flight from Düsseldorf. While the captain was out of the cockpit between 07:19:59 and 07:24:29, during a descent cleared by air traffic control, the selected altitude was set to 100 ft several times, and once to the maximum of 49,000 ft. Because of the engaged autopilot modes these selections did not change the flight path. The BEA wrote that these actions "may be interpreted as a rehearsal".

The cockpit door locking system

The A320's cockpit door has a bullet-resistant composite structure and three electric strikes that lock it whenever it is closed. From the cabin, a crew member enters the normal code on a keypad, which sounds a one-second buzzer in the cockpit; the pilots check the camera image and use a three-position switch on the pedestal:

• UNLOCK opens the door.
• LOCK keeps it locked and disables the keypad for 5 minutes. Each new LOCK selection restarts the 5 minutes.
• With no action, the door stays locked.

For suspected crew incapacitation there is an emergency code. It sounds a continuous buzzer for 15 seconds, after which the door unlocks for 5 seconds unless someone in the cockpit selects LOCK or UNLOCK first. The design follows ICAO Annex 6, which requires a door that resists penetration by small arms fire and grenade shrapnel and forcible intrusion, and that can be locked and unlocked from either pilot station.

Sound tests in a similar A320 could not identify door switch movements on the recording; the BEA judged that the buzzer at 09:34:31 was most probably a routine access request.

The co-pilot's medical history

The co-pilot's first class 1 medical certificate was issued without restriction in April 2008. From August 2008 to July 2009 he had a severe depressive episode without psychotic symptoms, was treated and interrupted his training. In July 2009 his certificate was issued again with a waiver stating that it would become invalid if there were a relapse into depression. It was revalidated or renewed every year until July 2014. The examiners knew of the waiver, assessed him through observation and discussion, and saw nothing that called for a psychiatric referral. The waiver did not require specific psychiatric assessments or shorter intervals, and no psychiatrist or psychologist took part in his certificate revalidations or renewals after it was issued.

About five months after his last examination, in December 2014, he began to show symptoms that the experts consulted by the BEA considered may be consistent with a psychotic depressive episode. He consulted several doctors. In February 2015 a physician referred him to a psychotherapist and a psychiatrist, and on 10 March 2015 the same physician diagnosed a possible psychosis and recommended psychiatric hospital treatment. A psychiatrist prescribed anti-depressant and sleeping-aid medication in February and March 2015, and post-mortem toxicology found anti-depressants and a sleeping aid. Several sick leave certificates were issued, and not all reached Germanwings. He continued to fly, including on the day of the accident, and did not contact an aeromedical examiner. None of the doctors informed any authority.

The BEA concluded that on the day of the accident he was unfit to fly, and that no action could have been taken by the authorities or his employer because nobody, including the co-pilot himself, had informed them.

Why self-declaration failed

European rules (MED.A.020) require a licence holder to stop flying and seek aeromedical advice without undue delay when medical fitness decreases or regular medication begins. The BEA identified three factors that might have contributed to his failure to self-declare: the illness itself, which probably impaired his judgement; the financial consequences, since his loss-of-licence insurance offered a one-time payment of €58,799 and nothing covered lost income; and the probable fear of losing his career. It also noted that German law gave doctors no clear guidance on when a threat to public safety outweighs medical confidentiality.

The BEA also examined the "1% rule" from ICAO's Manual of Civil Aviation Medicine, under which a medical condition carrying a risk of incapacitation of about 1% per year is acceptable because a second pilot can take over. That mitigation fails when the second pilot is outside the cockpit or when the incapacitation takes the form of deliberate unsafe action. The BEA argued that the target for such mental conditions should be at least two orders of magnitude lower, 0.01% per year. Its search of ICAO and BEA databases since 1980 found 12 public transport accidents or incidents involving intentional manoeuvres, possible intentional manoeuvres or a mental disorder of a crew member.

Probable cause and contributing factors

The BEA stated its causes as follows: "The collision with the ground was due to the deliberate and planned action of the co-pilot who decided to commit suicide while alone in the cockpit." It added that the process for medical certification of pilots, "in particular self-reporting in case of decrease in medical fitness between two periodic medical evaluations, did not succeed in preventing the co-pilot, who was experiencing mental disorder with psychotic symptoms, from exercising the privilege of his licence."

Factors that may have contributed to the failure of self-reporting:

• the co-pilot's probable fear of losing his ability to fly as a professional pilot if he had reported his decrease in medical fitness;
• the potential financial consequences of having no insurance against loss of income in case of unfitness to fly;
• the lack of clear guidelines in German regulations on when a threat to public safety outweighs medical confidentiality.

Finally, security requirements had led to cockpit doors designed to resist forcible intrusion, and this made it impossible to enter the flight compartment before the aircraft struck the terrain.

Safety recommendations and what changed

The BEA issued eleven recommendations, FRAN-2016-011 to FRAN-2016-021, and asked that they be treated as a single package, warning that partial implementation could be counter-productive:

The BEA made no recommendation on cockpit door design. It considered alternatives, such as keys or fingerprint access, but judged that the risk of an attack in flight remained the greater threat.

Action began before the final report. On 27 March 2015 EASA issued Safety Information Bulletin 2015-04, recommending that operators require at least two authorised persons in the cockpit at all times, or equivalent measures. An EASA-led task force delivered six recommendations to the European Commission on 16 July 2015: keep the two-person rule and evaluate it after one year; psychological evaluation of pilots before entering service; drug and alcohol testing; stronger oversight of aeromedical examiners; a European aeromedical data repository; and pilot support systems within a just culture.

Lessons for pilots

Fitness to fly is a daily personal decision. Between examinations, the whole system depends on the pilot declaring illness or medication. The BEA showed how illness, money and career fears can all push against that declaration. A pilot who starts regular medication or feels unwell should seek aeromedical advice before flying, not after.

Know the support available. Germanwings pilots had access to peer support programmes, but no record showed that the co-pilot used them. The BEA asks operators to promote confidential peer support that aims to return pilots to flying. Learn how your company's programme works before you or a colleague needs it.

Incapacitation is not only physical. Crews train for the colleague who slumps over the controls, and the "1% rule" assumes that a second pilot is present and able to take over (see fitness to fly and pilot incapacitation). The BEA's review of earlier events shows that the psychological incapacitation of a pilot is difficult for other crew members to control, even with both pilots on the flight deck. Unusual behaviour, confused statements or unexplained changes to automation settings are cues to raise with the other crew member, using the assertiveness taught in crew resource management.

Understand your door. On the A320, the LOCK position overrides the emergency code and blocks the keypad for 5 minutes, and the emergency code only works if nobody inside responds within 15 seconds. The BEA observed that "a door cannot address a risk that could be present from both sides". Cockpit access procedures, including who enters when a pilot leaves, are covered in flight deck security.

Automation does what it is told. One FCU selection produced a stable, automatic descent towards terrain. Selected altitude, the FMA and vertical speed are the first things to check when an aircraft leaves its cleared level.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.