Circumstances:
On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP operated by Air France was programmed to perform scheduled flight AF 447 between Rio de Janeiro-Galeão and Paris Charles de Gaulle. Twelve crew members (3 flight crew, 9 cabin crew) and 216 passengers were on board. The departure was planned for 22 h 00. At around 22 h 10, the crew was cleared to start up engines and leave the stand. Takeoff took place at 22 h 29. The Captain was Pilot Not Flying (PNF); one of the copilots was Pilot Flying (PF). At the start of the Cockpit Voice Recorder (CVR) recording, shortly after midnight, the aeroplane was in cruise at flight level 350. Autopilot 2 and auto-thrust were engaged. Auto fuel transfer in the “trim tank” was carried out during the climb. The flight was calm. At 1 h 35, the aeroplane arrived at INTOL point and the crew left the Recife frequency to change to HF communication with the Atlántico Oceanic control centre. A SELCAL test was successfully carried out, but attempts to establish an ADS-C connection with DAKAR Oceanic failed. Shortly afterwards, the co-pilot modified the scale on his Navigation Display (ND) from 320 NM to 160 NM and noted “…a thing straight ahead”. The Captain confirmed and the crew again discussed the fact that the high temperature meant that they could not climb to flight level 370. At 1 h 45, the aeroplane entered a slightly turbulent zone, just before SALPU point. Note: At about 0 h 30 the crew had received information from the OCC about the presence of a convective zone linked to the inter-tropical convergence zone (ITCZ) between SALPU and TASIL. The crew dimmed the lighting in the cockpit and switched on the lights “to see”. The co-pilot noted that they were “entering the cloud layer” and that it would have been good to be able to climb. A few minutes later, the turbulence increased slightly in strength. Shortly after 1 h 52, the turbulence stopped. The co-pilot again drew the Captain’s attention to the REC MAX value, which had then reached flight level (FL) 375. A short time later, the Captain woke the second co-pilot and said “[…] he’s going to take my place”. At around 2 h 00, after leaving his seat, the Captain attended the briefing between the two co-pilots, during which the PF (seated on the right) said specifically that “well the little bit of turbulence that you just saw we should find the same ahead we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast” and that “the logon with DAKAR failed”. Then the Captain left the cockpit. The aeroplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82. The pitch attitude was about 2.5 degrees. The weight and balance of the aeroplane were around 205 tonnes and 29%. The two copilots again discussed the temperature and the REC MAX. The turbulence increased slightly. At 2 h 06, the PF called the cabin crew, telling them that “in two minutes we ought to be in an area where it will start moving about a bit more than now you’ll have to watch out there” and he added “I’ll call you when we’re out of it”. At around 2 h 08, the PNF proposed “go to the left a bit […]”. The HDG mode was activated and the selected heading decreased by about 12 degrees in relation to the route. The PNF changed the gain adjustment on his weather radar to maximum, after noticing that it was in calibrated mode. The crew decided to reduce the speed to about Mach 0.8 and engine de-icing was turned on. At 2 h 10 min 05, the autopilot then the auto-thrust disconnected and the PF said “I have the controls”. The aeroplane began to roll to the right and the PF made a nose-up and left input. The stall warning triggered briefly twice in a row. The recorded parameters showed a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS). The flight control law reconfigured from normal to alternate. The Flight Directors (FD) were not disconnected by the crew, but the crossbars disappeared. Note: Only the speeds displayed on the left side and on the ISIS are recorded on the FDR; the speed displayed on the right side is not recorded. At 2 h 10 min 16, the PNF said “we’ve lost the speeds ” then “alternate law protections”. The PF made rapid and high amplitude roll control inputs, more or less from stop to stop. He also made a nose-up input that increased the aeroplane’s pitch attitude up to 11° in ten seconds. Between 2 h 10 min 18 and 2 h 10 min 25, the PNF read out the ECAM messages in a disorganized manner. He mentioned the loss of autothrust and the reconfiguration to alternate law. The thrust lock function was deactivated. The PNF called out and turned on the wing anti-icing. The PNF said that the aeroplane was climbing and asked the PF several times to descend. The latter then made several nose-down inputs that resulted in a reduction in the pitch attitude and the vertical speed. The aeroplane was then at about 37,000 ft and continued to climb. At about 2 h 10 min 36, the speed displayed on the left side became valid again and was then 223 kt; the ISIS speed was still erroneous. The aeroplane had lost about 50 kt since the autopilot disconnection and the beginning of the climb. The speed displayed on the left side was incorrect for 29 seconds. At 2 h 10 min 47, the thrust controls were pulled back slightly to 2/3 of the IDLE/CLB notch (85% of N1). Two seconds later, the pitch attitude came back to a little above 6°, the roll was controlled and the angle of attack was slightly less than 5°. The aeroplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb. From 2 h 10 min 50, the PNF called the Captain several times. At 2 h 10 min 51, the stall warning triggered again, in a continuous manner. The thrust levers were positioned in the TO/GA detent and the PF made nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) began a nose-up movement and moved from 3 to 13 degrees pitch-up in about 1 minute and remained in the latter position until the end of the flight. Around fifteen seconds later, the ADR3 being selected on the right side PFD, the speed on the PF side became valid again at the same time as that displayed on the ISIS. It was then at 185kt and the three displayed airspeeds were consistent. The PF continued to make nose-up inputs. The aeroplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and angle of attack were 16 degrees. At 2 h 11 min 37, the PNF said “controls to the left”, took over priority without any callout and continued to handle the aeroplane. The PF almost immediately took back priority without any callout and continued piloting. At around 2 h 11 min 42, the Captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped, after having sounded continuously for 54 seconds. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was about -10,000 ft/min. The aeroplane’s pitch attitude did not exceed 15 degrees and the engines’ N1’s were close to 100%. The aeroplane was subject to roll oscillations to the right that sometimes reached 40 degrees. The PF made an input on the side-stick to the left stop and nose-up, which lasted about 30 seconds. At 2 h 12 min 02, the PF said, “I have no more displays”, and the PNF “we have no valid indications”. At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning triggered again. At 2 h 13 min 32, the PF said, “[we’re going to arrive] at level one hundred”. About fifteen seconds later, simultaneous inputs by both pilots on the side-sticks were recorded and the PF said, “go ahead you have the controls”. The angle of attack, when it was valid, always remained above 35 degrees. From 2 h 14 min 17, the Ground Proximity Warning System (GPWS) “sink rate” and then “pull up” warnings sounded. The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees. No emergency message was transmitted by the crew. The wreckage was found at a depth of 3,900 metres on 2 April 2011 at about 6.5 NM on the radial 019 from the last position transmitted by the aeroplane. Both CVR and DFDR were found 23 months after the accident, in May 2011 at a depth of 3,900 metres. The final report was published in July 2012.
Probable cause:
The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information that resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure. The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF. The destabilization that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM messages, which did not help with the diagnosis. The crew, progressively becoming de-structured, likely never understood that it was faced with a 'simple' loss of three sources of airspeed information. In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioral hypotheses in classifying the loss of airspeed information as 'major' were not validated in the context of this accident. Confirmation of this classification thus supposes additional work on operational feedback that would enable improvements, where required, in crew training, the ergonomics of information supplied to them and the design of procedures. The aeroplane went into a sustained stall, signaled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behavior in any acceptable reliable way. In its current form, recognizing the stall warning, even associated with buffet, supposes that the crew accords a minimum level of 'legitimacy' to it. This then supposes sufficient previous experience of stalls, a minimum of cognitive availability and understanding of the situation, knowledge of the aeroplane (and its protection modes) and its flight physics. An examination of the current training for airline pilots does not, in general, provide convincing indications of the building and maintenance of the associated skills. More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures. A crew can be faced with an unexpected situation leading to a momentary but profound loss of comprehension. If, in this case, the supposed capacity for initial mastery and then diagnosis is lost, the safety model is then in 'common failure mode'. During this event, the initial inability to master the flight path also made it impossible to understand the situation and to access the planned solution.
Thus, the accident resulted from the following succession of events:
- Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;
- Inappropriate control inputs that destabilized the flight path;
- The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;
- The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;
- The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;
- The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.
These events can be explained by a combination of the following factors:
- The feedback mechanisms on the part of all those involved that made it impossible:
* To identify the repeated non-application of the loss of airspeed information procedure and to remedy this,
* To ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences;
- The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for 'Vol avec IAS douteuse';
- Task-sharing that was weakened by:
* Incomprehension of the situation when the autopilot disconnection occurred,
* Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;
- The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;
- The crew not taking into account the stall warning, which could have been due to:
* A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,
* The appearance at the beginning of the event of transient warnings that could be considered as spurious,
* The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,
* The possible confusion with an overspeed situation in which buffet is also considered as a symptom,
* Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,
* The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.
