The Lessons of AF 447 Did Faulty Computer Indicator Reinforce Pilot Errors?
Brazilian Navy sailors pick a piece of debris from Air France flight AF447 out of the Atlantic Ocean, a week after the crash happened on June 1, 2009.
Foto: ? Ho New / Reuters/ REUTERSWhat happened in the cockpit of Air France flight AF 447 in the fatal minutes before the crash? For a long time, it was a mystery. Aviation experts couldn't understand the behavior of the French pilots whose Airbus A330 hurtled into the Atlantic during a tropical storm on June 1, 2009.
"It's as if someone raced towards a wall and stepped on the gas," says American flight safety consultant William Voss, president of the Flight Safety Foundation, referring to the apparently inexplicable behavior of the French pilots who crashed the Airbus A330 into the Atlantic on the night of June 1, 2009.
But now they appear to have found an explanation. Late last week, the French air accident investigation agency (BEA) presented its final report on the accident. It now seems clear why the crew pulled up their plane when they should have brought the nose down.
The four-minute struggle with death was triggered by the failure of speed sensors, so-called pitot tubes, which iced up just as the aircraft was entering a heavy tropcal storm. It had been known for years that the tubes used by Air France were especially vulnerable.
But the Europe's Aviation Safety Agency (EASA) had neglected to force the airline to replace the sensors. Only a month before the crash, Air France ordered new, more reliable sensors. The first ones were fitted to aircraft on May 30, 2009 -- but they weren't installed in the plane with the registration number F-GZCP, which took off from Rio de Janeiro one day later on what would become its last flight.
Speed Sensors Vital to Safety System
Everyone involved should have been aware of how important the speed sensors are -- especially for a modern Airbus aircraft. If the speed indicator fails, then the whole safety system of the long-haul jet starts to wobble. At Airbus, as well as in the latest Boeing aircraft, flight computers make sure that the plane doesn't get into a dangerous position through erroneous pilot commands. The flight computer also supplies the information the autopilot needs to fly. But if the computers lack important information such as the current speed, they switch into a kind of emergency mode called "Alternate Law."
This is precisely what happened on board AF 447 just after the speed sensors failed. A whole cascade of warning signs ensued, and the autopilot switched itself off.
Graphic: The Final Minutes of Flight AF 447
Foto: DER SPIEGELExperienced flight captain Marc Dubois, 58, wasn't at the controls when this happened. He had handed the plane over to the less experienced of his two co-pilots, Pierre-Cedric Bonin, and had gone to sleep -- he was legally entitled to the break but it turned out to be a fatal decision.
Bonin, 32, only had 800 hours of flying time on that Airbus model. He was soon unable to cope with the situation and pulled the plane up "excessively," the BEA report said.
But the investigators found a plausible reason for his actions. Due to the failure of the speed indicators, the flight computer reported that the plane had lost 100 metres in altitude and was continuing to descend -- that was completely false information.
The investigators have concluded that Bonin trusted the wrong indicator and tried to regain altitude. "That's instinctive," says the A330 pilot of a large German airline -- especially as Bonin had in the back of his mind that the thunderstorm was even more violent at lower altitudes.
In this stressful situation, Bonin and the second co-pilot forgot an old aviation rule: controlling the pitch and the engine thrust. If both are normal, the plane is not in danger.
It took 10 seconds before the crew realized they no longer had reliable speed data. The A330 ascended rapidly and lost speed -- it threatened to stall, which would cause the aircraft to fall out of the sky like a stone. An automated voice came on: "Stall, stall."
Warnings Went Unheeded
An experienced pilot would respond by pushing down the nose of the jet to regain speed. But the French crew, which hadn't practised such a maneuver for far too long, kept on pulling the plane up. Why?
Many of the pilots asked by the BEA experts said they often ignored stall warnings because they frequently got false alarms. It was also possible that the other acoustic signals had been distracting the pilots.
Co-pilot Bonin kept on pulling the plane up, possibly because a faulty computer indicator was telling him to do so. The so-called Flight Director, an instrument straight in front of him, which initially failed but then came on again, told him: pull the plane up!
The investigators detected this computer behavior after analyzing the black box data -- a revelation that alarmed even seasoned pilots. "That definitely reinforced their errors," says the experienced A330 pilot. A new report issued in France arrives at the same conclusion.
Flight safety experts produced the report alongside the BEA investigation, for a lawsuit brought by relatives of the victims in Paris. The Flight Director led to a "strong pull-up" by the pilots, the court report, which is still confidential, says.
Airbus refers to the check list that every pilot must know by heart. According to the list, the crew must switch off the Flight Director when the speed sensors fail. Internally, however, the misleading reading of the flight computer appears to have triggered a lot of concern. Shortly after the crash, Airbus sent out an "Operations Engineering Bulletin" to all airlines warning them never to follow the commands of the Flight Director in comparable situations to that experienced by AF 447.
It may even be that the software of the flight computers has already been discreetly changed. This is indicated by an airworthiness directive issued by EASA on Oct 27, 2011 instructing a software change to be undertaken within 10 months of coming into force: Hundreds of Airbus A330 and A340 planes were affected.
The investigators are convinced that the crew didn't realize its mistake until the very end. Even worse: the pilots ignored a total of 75 stall warnings. The men were sure that their speed was far too high. They inferred this from the loud sound of slipstream -- but the noise was in fact caused by the plane racing towards the ground at a speed of 3,000 meters (9,843 feet) per minute.
If Pilots Had Done Nothing, Plane Woudn't Have Crashed
When the captain finally emerged from his cabin, he didn't understand what was going on either. At that point the A330 was already in a situation "in which no passenger jet has ever been," the BEA investigators said. Even if the pilots had pushed the nose down immediately -- it probably wouldn't have saved them. The trimmable horizontal stabilizer at the tail was already at its maximum lift of 13 degrees and pointing the nose dangerously upwards.
"The pilots would have had to push the control column forward with all their might for the stabilizer to move back and the plane nose to go down at last," said the experienced A330 captain. But the altitude was already too low for that.
What remains is a bitter realization: If the pilots had done nothing at all after their speed sensors malfunctioned, their plane wouldn't have crashed. "Instead of returning to fundamentals principles of flying they followed the false displays of the computers," says flight safety expert William Voss, president of the Flight Safety Foundation. "Pilots must learn to steer the plane by hand again."
For the relatives of the 228 victims, it is little consolation that accident investigators go to a lot of trouble after each crash to make flying safer. Shortly before Christmas 2011, Barbara Crolow received a coffin containing her son. She was told Alexander had been found along with the flight recorders.
The mother asked the undertaker to look at what was in the coffin. A sack, was his answer, carefully folded as if a whole body lay inside. "Inside it the man found two pieces of bone, four and five centimeters in length."
