Description

On 1 June 2009, an Airbus A330-200 (F-GZCP) being operated by Air France on a scheduled passenger flight from Rio de Janeiro to Paris CDG as A447 with a crew of three pilots and in the cruise at FL 350 at night and in Instrument Meteorological Conditions (IMC) became overdue en route and when wreckage was found five days later on the sea surface on track from the last known position, it became clear that aircraft had crashed into the sea with the loss of the aircraft and all 228 occupants. The aircraft had not been within radar cover or VHF R/T range at the time and was reliant on HF radio communications with the controlling ACC. No distress or other radio calls were heard by any other aircraft or any ATC agency.

Investigation

Since the loss of the aircraft occurred over International Waters, it was investigated by the French Bureau d'Enquêtes et d'Analyses (BEA) as State of the Operator and State of the Manufacturer. Indications that erroneous airspeed displays had occurred were obtained from Aircraft Communications, Addressing and Reporting System maintenance messages which had been transmitted automatically at the time. The floating wreckage retrieved in the days following the disappearance suggested to the Investigation that control of the aircraft had been lost prior to sea surface impact. A long period involving sea search in demanding deep water conditions then elapsed before the site of the principal wreckage on the sea bed was located and significant pieces of it and the crash protected recorded data units carried by the aircraft recovered.

A series of communications relating to the ongoing Investigation were issued by the BEA as it became clear that the process would be an extended one delayed by the need to locate and recover essential evidence to understand the circumstances which led up to the loss. These included Interim Reports released on 2 July 2009, 17 December 2009 and 29 July 2011. The first two contained contextual information and details of the difficult search for essential evidence. The third followed the location of the wreckage at a depth of 3900 m on 2 April 2011, 6.5 nm north-north-east of the last position report transmitted by the aircraft and the recovery of both the Cockpit Voice Recorder (CVR) and Flight Data Recorder (FDR) a month later. This Report contained crucial details derived from the recovered recorders which yielded completely successful replays despite the extended period of immersion and a review based thereon of clearly relevant Air France pilot operating procedures and pilot training. Additional evidence was gained from the non-volatile memory (NVM) of some of the specifically recovered solid state units relevant to the Investigation.

It was possible to confirm that prior to the onset of the event sequence, level flight at a speed of Mach 0.82 was being maintained with a pitch attitude which was normal for the circumstances of about 2.5°. The aircraft commander (who had been acting as PNF) had then left the flight deck for a planned rest period leaving the two co-pilots in the flight deck with right hand seat co pilot continuing to act as PF. Shortly afterwards and in quick succession, two of the three airspeed indications, those on the left hand PFD and those on the ISIS (the Integrated Standby Instrument), failed followed by that on the right hand PFD indication. Recorded data showed that the speed displayed on the left hand PFD was incorrect for a total of 29 seconds, that on ISIS for 54 seconds and that on the right hand PFD for up to a total of 61 seconds. After these short intervals, normal function returned to all three displays. Their transient malfunction was subsequently attributed to ice crystal icing of their respective pitot probes, as had occurred previously in similar environmental conditions to other Airbus A330 aircraft flown by various operators.

As the Airbus A330 is a Fly-By-Wire aircraft, a secondary effect of these failures was that the prevailing Control Law changed from 'Normal' to 'Alternate' with the effect of removing Flight Envelope Protection in respect of any attempt to fly at an excessive angle of attack. Crew awareness of such a change is confirmed by the CVR recording of the PNF acknowledging ‘alternate law protections’. The sudden change to manual flight control was found to have been followed almost immediately by a series of inappropriate pitch control inputs by the PF and, as a result of these inputs, two brief activations of the stall warning system. In the presence of some roll instability, the pitch attitude of the aircraft had initially increased to beyond 10 degrees and the aircraft began to climb at up to 7000 fpm with no recorded comments from either co-pilot. The PF then made nose down inputs alternately to the right and to the left and the rate of climb reduced to 700 fpm. After an absence of 29 seconds, valid indications returned to the left side PFD showing Mach 0.68. By this time the aircraft was at about 37,500 ft with a recorded (but not annunciated) angle of attack of around 4°. Thirty nine seconds after the AP disconnection, the stall warning was again activated, this time remaining continuously active. The response of the PF was to select TO/GA and maintain nose-up input. The recorded angle of attack continued to increase and the trimmable horizontal stabiliser (THS) moved from 3° nose-up to 13° nose-up in about a minute in response to pilot control inputs and then remained there until the end of the flight. It was determined that “in less than one minute after the disconnection of the autopilot, the aircraft became fully stalled and exited the Aircraft Flight Manual (AFM) Flight Envelope as a result of the actions of the PF”.

Having reached an altitude of 38000 feet, the aircraft began to descend fully stalled. As descent continued, and approximately 30 seconds after the fully stalled condition had begun, the aircraft commander re-entered the flight deck. During the following few seconds, all of the recorded airspeed indications became invalid and the stall warning stopped, after having sounded continuously for 54 seconds. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed of the descent was about 10,000 fpm. Pitch attitude did not exceed 15° and engine thrust remained close to 100%. After the aircraft commander had been present for 20 seconds, the thrust levers were reduced to Flight Idle. As the aircraft continued to descend in a fully stalled condition, “the angle of attack, when it was valid, always remained above 35°”. All recordings ceased 2 minutes and 46 seconds after the aircraft commander had re-entered the flight deck with pitch attitude recorded as 16.2° nose-up.

It was noted that all activations of the stall warning system had occurred in accordance with their design and that the stalled condition had been characterised by the onset of buffet. It was also noted that at no time had there been any reference to the stall warning or any formal identification of the stalled condition by any of the pilots.

In considering the failure of the co-pilots to respond rationally to the onset of unreliable airspeed and subsequently to perform an appropriate and timely recovery from the self-generated incipient and subsequently active stalled condition, the Investigation noted the following in respect of the training which they had received:

“The only opportunities available to the two relatively low experience co-pilots to learn about stall were during their basic training, and then as part of one or two simulator sessions during their initial training for A320 type rating. These exercises were conducted at low altitude (FL100) with the focus on demonstrating and analysing the phenomenon, and with particular attention on the operation of the aircraft’s protections in normal law. In alternate law, the approach to stall exercise exposes the trainee to the stall warning in a situation in which it is expected, and the corrective actions to be performed are prepared in advance. The exercise lets the trainee experience the onset of the vibrations due to buffet, which confirms the stall phenomenon.

At high altitude, the margin between the normal angle of attack in cruise and the angle of attack that activates the stall warning is very small. Trainees who perform the exercise at low altitude note a reduction in speed compared with the reference values but are not sensitized to the proximity of the angle-of-attack threshold at which the warning is triggered.

The demonstrative nature of the exercises undertaken does not enable the crew to appreciate the startle effect generated by the stall warning, nor the reflex actions on the controls that may be induced. Current training practices do not fill the gap left by the non-existence of manual flying at high altitude, or the lack of experience on conventional aeroplanes. Furthermore, they limit the pilots’ abilities to acquire or maintain basic airmanship skills.

More generally, the exercises performed in a simulator follow a predetermined scenario, and even if there are variations from one session to the next, the trainees are more or less familiar with the failures they will have to deal with. In this respect, the training scenarios may significantly differ from the reality of an in-flight failure. The startle effect associated with this operational reality is destabilising and generates stress. It may have a direct impact on the correct execution of a manoeuvre, or on the ability of a crew to diagnose the problem and then recover the situation. However, the conditions in which training is delivered are not conducive to giving instruction in these environmental factors, and thus to the subsequent application in service of the non-technical skills necessary for the correct management of an unexpected situation.”

It was ascertained that the professional flying experience of both co-pilots had been facilitated by cadet training and gained within Air France on Airbus aircraft types. The more experienced of the two overall was the PNF who had been with Air France for 11 years and on type since 2002. The PF had been with Air France for 5 years and had completed A330 type conversion just six months prior to the accident.

Secondary matters reviewed by the Investigation included ‘Search and Rescue (SAR) and Accident Investigation issues, ATC communications and flight deck ergonomics.

The Findings of the Investigation also included the following:

• The meteorological situation was not exceptional for the month of June in the inter-tropical convergence zone.
• There was an implicit (but not explicit) designation of (one of the two co pilots) as relief Captain.
• The PNF (had initially) called out imprecise flight path corrections. They were however essential and sufficient for short-term management of the situation.
• The pitot probes installed on (the accident aircraft) met requirements that were stricter than the (EASA) certification standards.
• EASA had analysed (previous) pitot probe icing events; it had confirmed the severity of the failure and had decided not to make the probe change mandatory.

The Causes of the Accident were documented formally as follows:

“The obstruction of the pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information that resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.

The occurrence of the failure in the context of flight in cruise completely surprised the pilots of (the accident flight). The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF. The destabilisation that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM messages, which did not help with the diagnosis. The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information.

In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioural hypotheses in classifying the loss of airspeed information as “major” were not validated in the context of this accident. Confirmation of this classification thus supposes additional work on operational feedback that would enable improvements, where required, in crew training, the ergonomics of information supplied to them and the design of procedures.

The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behaviour in any acceptable reliable way.

In its current form, recognising the stall warning, even associated with buffet, supposes that the crew accords a minimum level of “legitimacy” to it. This then supposes sufficient previous experience of stalls, a minimum of cognitive availability and understanding of the situation, knowledge of the aeroplane (and its protection modes) and its flight physics. An examination of the current training for airline pilots does not, in general, provide convincing indications of the building and maintenance of the associated skills.

More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures. A crew can be faced with an unexpected situation leading to a momentary but profound loss of comprehension. If, in this case, the supposed capacity for initial mastery and then diagnosis is lost, the safety model is then in “common failure mode”. During this event, the initial inability to master the flight path also made it impossible to understand the situation and to access the planned solution.”

It was thus concluded that the accident resulted from the following succession of events:

• Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;
• Inappropriate control inputs that destabilized the flight path;
• The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;
• The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;
• The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;
• The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.”

And that these events can be explained by a combination of the following factors:

• The feedback mechanisms on the part of all those involved that made it impossible:
  • to identify the repeated non-application of the loss of airspeed information procedure and to remedy this
  • to ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences
• The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for (flight with unreliable airspeed);
• Task-sharing that was weakened by:
  • incomprehension of the situation when the autopilot disconnection occurred,
  • poor management of the startle effect that generated a highly charged emotional factor for the two copilots;
• The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;
• The crew not taking into account the stall warning, which could have been due to:
  • A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,
  • The appearance at the beginning of the event of transient warnings that could be considered as spurious
  • The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds
  • The possible confusion with an overspeed situation in which buffet is also considered as a symptom
  • Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not
  • The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection

Safety Recommendations

A total of 41 Safety Recommendations were issued during the course of the Investigation as a consequence of its findings.

Six un-numbered Recommendations relating to the task of accident investigation were included in the Second Interim Report, four in respect of flight recorders and two more in respect of aircraft certification:

• that EASA and ICAO extend as rapidly as possible to 90 days the regulatory transmission time for ULB’s installed on flight recorders on aeroplanes performing public transport flights over maritime areas.
• that EASA and ICAO make it mandatory, as rapidly as possible, for aeroplanes performing public transport flights over maritime areas to be equipped with an additional ULB capable of transmitting on a frequency (for example between 8.5 kHz and 9.5 kHz) and for a duration adapted to the pre-localisation of wreckage.
• that EASA and ICAO study the possibility of making it mandatory for aeroplanes performing public transport flights to regularly transmit basic flight parameters (for example position, altitude, speed, heading).
• that ICAO ask the FLIRECP group to establish proposals on the conditions for implementing deployable recorders of the EUROCAE ED-112 type for aeroplanes performing public transport flights.
• that EASA undertake studies to determine with appropriate precision the composition of cloud masses at high altitude
• that EASA in coordination with the other regulatory authorities, (uses) the results obtained (from the separately recommended studies into the composition of cloud masses at high altitude) to modify the certification criteria.

The Third Interim Report contained ten further Recommendations, also un-numbered, three relating to pilot training and procedures following an examination of those in place at Air France, one in respect of data presentation to the pilots and six more concerning accident investigation issues:

• that EASA review the content of check and training programmes and make mandatory, in particular, the setting up of specific and regular exercises dedicated to manual aircraft handling of approach to stall and stall recovery, including at high altitude.
• that EASA define additional criteria for access to the role of relief Captain so as to ensure better task-sharing in case of relief crews.
• that, provisionally, the DGAC define additional criteria for access to the role of relief Captain so as to ensure better task-sharing in case of relief crews.
• that EASA and the FAA evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on board airplanes.
• that ICAO require that aircraft undertaking public transport flights with passengers be equipped with an image recorder that makes it possible to observe the whole of the instrument panel.
• that at the same time, ICAO establish very strict rules for the readout of such (image) recordings in order to guarantee the confidentiality of the recordings.
• that EASA and the FAA make mandatory the recording of:
  • the position of the flight director crossbars,
  • the parameters relating to the conduct of the flight displayed on the right side, in addition to those displayed on the left side.
• that EASA and the FAA evaluate the relevance of making mandatory the recording of the air data and inertial parameters of all of the sources used by the systems.
• that EASA and ICAO make mandatory as quickly as possible, for aeroplanes making public transport flights with passengers over maritime or remote areas, triggering of data transmission to facilitate location as soon as an emergency situation is detected on board;
• that EASA and ICAO study the possibility of making mandatory, for airplanes making public transport flights with passengers over maritime or remote areas, the activation of the emergency locator transmitter (ELT), as soon as an emergency situation is detected on board

A further 25 Recommendations were made in the Final Report covering the following subjects:

• SAR coordination plans over maritime and remote areas
• Training of SAR operators
• Organisation of SAR in France
• Air Traffic Control
• Initial and recurrent training of pilots
• Flight simulators and pilot training exercises
• Flight deck ergonomics
• Operational and Technical Feedback from line operations
• AOC Regulatory Oversight effectiveness
• The release of Drift Measuring Buoys at sea accident sites

These Recommendations are as follows:

• that ICAO ensure the implementation of SAR coordination plans or regional protocols covering all of the maritime or remote areas for which international coordination would be required in the application of SAR procedures, including in the South Atlantic area. [FRAN-2012-032]
• that the DGAC in concert with the other services responsible develop a homogeneous framework for training and for approval of operators responsible for search and rescue activities in France. [FRAN-2012-033]
• that ICAO define the framework for the training of SAR operators in its standards and recommended practices. [FRAN 2012 034]
• that the DGAC designate a point of contact at ICAO for the ARCC that has adequate means to accomplish his/her missions. [FRAN‑2012‑035]
• that ICAO ensure each Member State has a national point of contact and makes his/her contact information available. [FRAN‑2012‑036]
• that the Brazilian and Senegalese authorities make mandatory the utilisation, by aeroplanes so equipped, of ADS-C and CPDLC functions in the zones in question. [FRAN‑2012‑037]
• that ICAO request the involved States to accelerate the operational implementation of air traffic control and communication systems that allow a permanent and reliable link to be made between ground and aeroplane in all of the areas where HF remains the only means of communication between the ground and aeroplanes. [FRAN‑2012‑038]
• that EASA ensure the integration, in type rating and recurrent training programmes, of exercises that take into account all of the reconfiguration laws. The objective sought is to make its recognition and understanding easier for crews especially when dealing with the level of protection available and the possible differences in handling characteristics, including at the limits of the flight envelope. [FRAN 2012 039]
• that more generally, EASA ensure that type rating and recurrent training programmes take into account the specificities of the aircraft for which they are designed. [FRAN 2012 040]
• that EASA define recurrent training programme requirements to make sure, through practical exercises, that the theoretical knowledge, particularly on flight mechanics, is well understood. [FRAN 2012 041]
• that EASA review the requirements for initial, recurrent and type rating training for pilots in order to develop and maintain a capacity to manage crew resources when faced with the surprise generated by unexpected situations. [FRAN 2012 042]
• that EASA ensure that operators reinforce CRM training to enable acquisition and maintenance of adequate behavioural automatic responses in unexpected and unusual situations with a highly charged emotional factor. [FRAN.2012.043]
• that EASA define criteria for selection and recurrent training among instructors that would allow a high and standardized level of instruction to be reached. [FRAN.2012.044]
• that EASA modify the basis of the regulations in order to ensure better fidelity for simulators in reproducing realistic scenarios of abnormal situations. [FRAN.2012.045]
• that EASA ensure the introduction into the training scenarios of the effects of surprise in order to train pilots to face these phenomena and to work in situations with a highly charged emotional factor. [FRAN.2012.046]
• that EASA require a review of the re-display and reconnection logic of the flight directors after their disappearance, in particular to review the conditions in which an action by the crew would be necessary to re-engage them. [FRAN.2012.047]
• that EASA require a review of the functional or display logic of the flight director so that it disappears or presents appropriate orders when the stall warning is triggered. [FRAN.2012.048]
• that EASA study the relevance of having a dedicated warning provided to the crew when specific monitoring is triggered, in order to facilitate comprehension of the situation. [FRAN.2012.049]
• that EASA determine the conditions in which, on approach to stall, the presence of a dedicated visual indications, combined with an aural warning should be made mandatory. [FRAN.2012.050]
• that EASA require a review of the conditions for the functioning of the stall warning in flight when speed measurements are very low. [FRAN.2012.051]
• that EASA improve the feedback process by making mandatory the operational and human factors analysis of in-service events in order to improve procedures and the content of training programmes. [FRAN.2012.052]
• that the DGAC take steps aimed at improving the relevance and the quality of incident reports written by flight crews and their distribution, in particular to manufacturers. [FRAN.2012.053]
• that the DGAC review the organisation of its oversight so as to improve its cohesion and effectiveness. [FRAN.2012.054]
• that the DGAC ensure the adequacy of the conditions of recruitment and training so that all of its inspectors have the skills required to exercise their functions. [FRAN.2012.055]
• that ICAO amend Annex 12 on search and rescue operations so as to encourage Contracting States to equip their search aircraft with buoys to measure drift and to drop them, when these units are involved in the search for persons lost at sea. [FRAN 2012 056]

Safety Action by Air France following the accident included the following:

• the completion of the already-started but non-mandatory A330 fleet replacement of the Thales ‘C16195AA’ probes fitted to all three probe positions with Thales ‘C61965BA’ probes within 10 days of the accident
• compliance with an EASA AD to subsequently replace all A330 fleet Thales ‘C16195BA’ probes fitted in two of the three probe positions with Goodrich in August 2009
• the non mandated replacement of the A330 fleet Thales ‘C16195BA’ probes fitted in the remaining probe position with Goodrich probes during January and February 2010.
• the introduction of more prescriptive procedures for the routine substitution the aircraft commander of an augmented crew.
• a decision to change to manufacturer’s documentation in English rather than French beginning with the Boeing 777 fleet in October 2012.
• a range of enhancements to pilot type rating and recurrent training and the adoption of a ‘preliminary version’ of ATQP on the A320 fleet from March 2012.

The Final Report of the investigation was published on 5 July 2012.

Editor's Note: The final report is 26mb in size and will therefore take some time to download depending on the capability of your internet connection.

Related Articles

• Unreliable Airspeed Indications
• Fly-By-Wire
• Flight Control Laws
• Aerodynamic Stall Awareness and Avoidance
• High Altitude Flight Operations
• Inter Tropical Convergence Zone (ITCZ)
• High Level Ice Crystal Icing: Effects on Engines
• Aircraft Communications, Addressing and Reporting System
• Underwater Locator Beacon (ULB)

Further Reading

• "Search Analysis for the Location of the AF447 Underwater Wreckage" A Report for the BEA by Contractor Metron, January 2011.