Aviation News

May 31, 2011

Initial Air France Flight 447 Black Box Info Raises More Questions Than Answers: Pilot

Pitot tubes on an Aribus A330.
Pitot tubes on an Aribus A330.
Imagine the force of driving your car into a brick wall at 120 miles an hour. Now imagine instead of being in a car, you are strapped into an Airbus A330 that is descending vertically (I do not like the term “falling” in referring to aviation incidents) at 120 miles an hour into the Atlantic Ocean. Air France Flight 447 at its point of impact off the coast of Brazil was descending at over 10,000 feet per minute, or, roughly two miles per minute, an unbelievably high rate of descent that unfortunately is only seen in one type of scenario. A grim one.

Hoisting the tail from AF447 aboard a ship during recovery.

The tragedy of Air France Flight 447 is one that will be remembered for a very long time. In this article I will attempt to provide some insight into what I have gleaned from the most recent investigation reports of the accident. I am by no means an air accident investigator, nor can any of my comments be taken as fact. This is merely my professional opinion as to what may have occurred on the night of June 1st, 2009 and the myriad questions that have resulted in my mind after having read the Investigation Update.

Obviously this accident was a terrible tragedy not just for the people on board, but the families, companies, and even the search and rescue crew hoping to find signs that anyone had survived the crash. I remember thinking selfishly to myself the evening that the accident happened that despite the horrific nature of the events, that they needed to be able to recover the black boxes, also known as the Cockpit Voice Recorder (CVR) and Flight Data Recorder (FDR). I say selfishly because as a cockpit crewmember I have a vested interest in learning from every accident out there. In this case, a heavyweight, wide-bodied airliner, traversing an area of strong weather had just “disappeared”. My airline operates that same type of aircraft through similar conditions so I wanted to know how it could be avoided. Without the Black Boxes though, it would be tough to pinpoint the cause. I had a lot of questions going through my mind. What had happened? How could it happen? Why did it happen? Without the CVR and FDR, it would just be lip service and guess work to try to put the pieces together.

On May 1st of this year, after almost two years of on and off searching, the FDR was located in the depths of the Atlantic Ocean. Although this was a tragic accident, my selfish needs were satisfied–as were those of thousands of other aircrew members. I only hoped that the information would be recoverable after almost two years underwater. My hope was that we could learn from this so that the passengers and flight crew would not have died in vain that terrible night over the Atlantic Ocean.

This past Friday morning, an Investigation Update from AF447 was released by the Bureau d’Enquetes et d’Analysis pour la securite de l’aviation civile. This report is very similar to the preliminary report the FAA would issue in a similar accident. It is quite an interesting read, and frankly is relatively similar to what most people had suspected happened onboard that evening. The general consensus was that the aircraft had had a problem with instrumentation possibly due to icing at altitude and the result was that some sort of loss of control occurred resulting in the crash. The only problem was that this was all guesswork.

Flight path of AF447. (click to enlarge)

I must be clear here that this is still very much a rough guide to the accident and not the final report. I also must make it clear again that I am only giving my personal opinion on the accident and it must not be construed as fact. I think after having read the report, I am left with only more questions. The final report will be the only definitive source as to what actually happened that night.

What we do know is that on the night the accident occurred, the aircraft traversed an area of heavy thunderstorms called the Intertropical Convergence Zone (ITCZ). I’m not going to get into specifics of the origins of the ITCZ, but for the sake of this article, all we need to know is that it is very common to have huge areas of storms in this part of the world.

We now know that in the minutes before the accident, the aircraft deviated from its planned heading. Although, the report does not indicate exactly why, I can only infer that it was due to the avoidance of weather (precipitation returns on the radar are typically avoided due to potential turbulence and ice depending on the strength of the return). In some cases, despite a flight crew’s best intention to avoid such areas of weather, the aircraft will penetrate some of it.

My guess is that on the night in question, such an inadvertent penetration of weather occurred. One common element of upper level atmospheric conditions in these types of thunderstorms are super-cooled water droplets. These are droplets of water that are in liquid form until the instant they come in contact with anything at which point they immediately freeze. The build up of ice due to super-cooled water droplets happens almost in an instant when flying through them. The best course of action is to exit this area of moisture as it is generally quite localized.

The problem with ice building up on an airplane is the negative effect it can have on the aerodynamics of the wings and tail, as well as the effect it can have on the instruments that depend on ram and static air sources during flight, namely the airspeed indicators, vertical speed indicators, and altimeters. Because these are such critical instruments, the sources, as well as the wings, are heated to prevent ice build up. As the accident regarding AF447 revolves around airspeed fluctuation, I will focus on the equipment responsible for airspeed readouts, otherwise known as the pitot tube.

On the airplane I fly (the Boeing 747-400) the pitot tubes are heated automatically once an engine is running. This is to prevent ice buildup so as to allow a smooth flow air directly into the tube. The airplane’s computers compare this moving, or “ram” air, to the “static” or still air and convert the indication to the indicated airspeed we read on the airspeed indicator. On other modern airline designs, there are sometimes switches that control the heaters, but for almost all intents and purposes, anytime an airliner is in the air, the pitot heat is on.

Recovery of the FDR in the Atlantic Ocean.

I have no doubt that the pitot heat was on onboard Flight 447. But there is a question that I have. What happens if the ice buildup is so rapid, the pitot heat cannot cope with the situation? I have a feeling this is what may have been a factor in the beginning of the end of AF447. Could the aircraft have inadvertently entered an area of precipitation with super-cooled water droplets so intense that the pitot heat on all three sensors on the A330 (yes, the A330 has three pitot tubes) could not keep up?

What leads me to believe this is that according to the report at 2:10:05, the autopilot and autothrust disconnected and the airspeed went from 275KIAS to 60KIAS very quickly. They received stall warnings appropriately as the aircraft thought it was stalling based on the airspeed indications. Why did the automation kick off? In most modern jets, some times severe turbulence will exceed the capabilities of the autopilot resulting in it disconnecting. Thunderstorm cells are ripe with turbulence. In addition, it is not uncommon to get very large (20 knots or more) speed excursions from the cruise speed in these types of conditions. Could the aircraft have entered a cell with severe turbulence resulting in the automatics kicking off? Does a stall warning automatically disconnect the automation in an A330? Possibly, but I do not know. What I do know is that a drop in airspeed from 275 to 60 instantly is almost unheard of. What is likely is that in the cell were super-cooled water droplets that inundated the heating element of the pitot tubes to the point that ice starved the Pitot Tubes of ram air giving an almost instant massive decaying of indicated airspeed.

Now as this all was occurring the aircraft had begun a climb due to the pilot flying (PF) giving the sidestick a nose-up input after the autopilot disconnected. The problem we have here though is that we don’t know if it was a small or very large input. The crew could have been momentarily distracted by the automation disconnecting, the warning horns and ECAM indications going off, the turbulence, the airspeed excursion, the heading diversion, the potential lightning (my imagination at work), that it is entirely possible that there was an inadvertent nose-up attitude established in the heat of the moment. All I know is that there was an awful lot of visual and auditory stimulation going on in that time and it is very possible that the aircraft entered a slow climb at the point. At high speeds, it doesn’t take a large pitch change to result in a very fast change in rate of climb.

Pitot tubes on an Aribus A330.

Only 11 seconds later, the Angle of Attack was at 10 degrees nose up and increasing, and the speed according to the report, “increased to 215KIAS” on the Captain’s side. I do not believe for a minute that the aircraft went from 275 to 60 to 215KIAS. What I do believe is that the aircraft entered a gradual climb after the initial disconnect of the autopilot. As we know, when we climb in an aircraft without adding power the airspeed drops. In this case, I believe it took those 11 seconds for the heating element on the pitot tube to melt the ice that had accumulated on it. So essentially, the aircraft entered a climb at 275KIAS, and after 11 seconds, the angle of attack had increased to above 10 degrees resulting in the speed decaying to 215KIAS. At that point the angle of attack was only four degrees.

About 35 seconds later, there was another stall warning. I believe this to be the first accurate stall warning. Now why did the aircraft stall? One theory I have is based on the fact that the airspeed indicator on the left was working again. Was the right indicator operating? We do not know as the FDR doesn’t have that info. I bring this up because at my carrier, when the Captain is on rest, the relief qualified First Officer (FO) sits in the seat in which he normally operates. So when I am the relief FO, I am always the PF and I always stay in the right seat. Is it possible Air France does the relief duty the same way? I do not know but perhaps it is possible that the PF on AF447 was in the right seat needing to look at the Captain’s PFD to get accurate airspeed indications. Maybe the PF thought, “OK, I have this under control now with pitch and thrust,” but did not have the spare capacity at the moment to look across the cockpit to see the other Captain’s airspeed indicator slowly bleeding off. I do not know and I do not cast judgment. Only more questions. Oh my.

One topic the media loves to talk about is that the PF appears to have continually given nose-up inputs throughout this event. We know now that the attitude of the aircraft was increasing almost the entire time. Is it possible though that those inputs were correct for that aircraft in that state of flight? Obviously in any typical airplane, in a stall you release back pressure and lower the nose, break the stall and recover. An Airbus is no typical airplane, though. There are times when you can haul all the way back on the sidestick and not only not enter a stall but fly at an optimum rate of descent. Anyone here heard of Chesley Sullenberger? He did exactly that on January 15, 2009 when he greased an A320 into the Hudson River. Is it possible that the PF on AF447 possibly thought he was going to be flying at an optimum flight profile by increasing back pressure on the side stick? I am by no means an Airbus pilot so I hope one chimes in, but what I do know is that there are Normal and Direct Laws, and the flight controls do very different things depending on which Law you are operating in. Is it possible that in the heat of the moment there may have been confusion as to what Law they were operating in?

Finally, 49 seconds after the second stall warning, the Captain entered the cockpit, but it was probably too late. At that point the aircraft was pitched up to 16 degrees, descending at over 10,000 FPM, with an angle of attack of more than 40 degrees. That gave the aircraft a 24 degree descent profile. A typical airliner descends on a three degree profile. This was steep, unbelievably so. At this point, the airspeed indications once again became invalid due to the low amount of ram air entering the pitot tubes straight on. The air that was entering the pitot tubes was striking them not only at a low airspeed, but also at an angle of over 40 degrees.

A point I would like to make here is that it took one minute and thirty five seconds to go from cruise speed (275KIAS) to a deep potentially unrecoverable stall. When confronted with all of the potential distractions this is a rather insidious decaying of airspeed. It is not as if this aircraft had slammed on the brakes. Yes, they did lose about 60 knots in the first 11 seconds, but it appeared as though the pilots may have thought they had managed the situation at that point. They lost speed quite slowly for the remainder of the event. They lost on average one knot every two seconds after the initial large pitch up. That is not an overly large deceleration. Could it have been possible that this crept up on them very slowly and gradually? Maybe. It is just one more piece to the puzzle.

A body recovered from AF447 is removed from a helicopter for identification.

A body recovered from AF447 is removed from a helicopter for identification.

Finally the final question must be asked. Was this pilot error? The media, the world, and especially the lawyers are salivating over the answer to this question. The answer is…we just do not know. There are so many questions that need to be answered we cannot make an honest answer yet. Were the systems flawed, was there a poor design in the pitot tubes as has been suggested, was the automation not operating correctly, etc, etc.

One thing this report does not include is the entire cockpit conversation. From reading this, it looks like hardly anything was said at all. I for one suspect there was a lot more conversation than we are being privy to here. I also suspect there is a lot more information from the flight data recorders that we have not been given. Once again this is an “Investigation Update”, not a final report.

What I can say though, is that I cannot imagine what was going in the heads of the pilots as this was unfolding, especially as they must have at some point realized they were in an unrecoverable deep stall. What do you think when you know you are going to die? Do you think this is possible? Do you think you are dreaming? Do you panic? I do not know nor do I hope to ever find out. That is why this crew will not have died in vain, but rather by their own demise they will hopefully prevent another accident like this from ever happening again. Morbid? Yes. Horrible? Yes. But true. We learn not only from our own mistakes but from the actions of those that have not been as fortunate. As terrible as this accident was, we will as an industry be safer once the final report is out and we implement what we have learned from this tragic events into our everyday operations. It cannot happen soon enough.

NYCAviation Columnist Justin Schlechter is a First Officer for an international airline and lives with his family on Long Island, New York. You can read more of his writing on his Positive Rate blog.

  • Anonymous

    There Wasn’t A Legitimate Reason For The Passengers on Air France
    Flight 447 To Die


    For the last ten years there
    hasn’t been a technical reason why the digital flight recorder data isn’t
    securely sent in real-time to the ground for storage (see the BBC/Equinox video
    “The BOX”, 4/2000, A look at the shortcomings found in black box flight
    recorders). During this ten year interval both the US
    and Europe have had the capability of
    implementing remote aircraft flight recording if only they had the will to do
    so. Using a remote aircraft flight recorder, within a couple of seconds, you
    have the planes position/location, its attitude, velocity, etc. safely stored
    on the ground and used for flight safety, aviation security and cost reduction.
    The data used in real-time could have also prevented 9/11 (see http://www.safelander.com).

    On June 4, 2009 the Los Angeles Times put following information that I wrote
    into their LETTERS section: “There is no technical reason why digital flight
    recorder data are not sent in real-time to the ground. We have the technology
    to do this. Then, within a couple of seconds, we would have a plane’s position,
    altitude and velocity safely stored on the ground. This information could be
    used for flight safety, aviation security and cost reduction. We don’t know
    what went wrong on Air France Flight 447, but we would sure know where the
    plane went down, why it went down and possibly could have saved lives.” Getting
    to the crash site early may save lives, getting the DFDR can prevent recurring
    fatal crashes. It’s not just position that’s needed, it’s all of the data sent
    to the recorder that is critical to ascertaining the root cause of a crash and
    should be available to prevent some of the crashes from occurring.

    The real-time use of the data recorders will save a substantial amount of
    lives, make our country safer and reduce the cost of flying. Telemetering the
    already digitized flight data to the ground in real-time would assure that we
    have the data. In some crashes the flight data isn’t recovered (e.g. 9/11, et
    al) or has errors in it since no one is looking at it, or using it in real-time
    to find malfunctions. Yet, this valuable digital flight recorder data (DFDR)
    data has been essentially left to the autopsy mode for post mortem simulations
    and not utilized proactively in real-time to save lives on cargo and carrier
    aircraft. We got the astronauts back from the moon by ground personnel
    monitoring the data in real-time. It was the ground personnel that found the
    problem and relayed back to the capsule the safe solution that saved the
    astronauts lives. It is now time to utilize this proven methodology for the
    good of the public.

    A year prior to 9/11 at the International Aviation Safety Association meeting
    in New York, methods for preventing crashes like golfer Payne Stewart’s
    decompression crash were proposed. None of these methods were implemented by
    the aviation industry and we got 9/11 (hijacking is about ten percent of
    aviation fatalities) and the 2005, 100 fatality, Helios decompression crash.
    When a plane deviates from its approved flight plan, we now have the ability to
    securely take remote control of it and land it safely at a designated airfield.
    We presently have remote pilot vehicles (RPVs) flying over Afghanistan
    that are controlled/piloted from continental United States (CONUS). Currently
    we are utilizing secure high bandwidth communication networks (for our RPVs,
    submarines, AWACS planes, etc.) and there isn’t a logical reason for not making
    that technology available for cargo and carrier aircraft. The cost of 9/11
    alone is ten times the cost of putting in a safe system and yet nothing has
    intentionally been done.

    When a plane decompresses there is a good possibility that if we remotely bring
    it down in altitude to a point where there is sufficient oxygen and fly it
    remotely for 15 minutes, the pilot and passengers may regain consciousness. At
    that time the control of the aircraft could be returned to the pilot or
    remotely landing it to save the lives of the people who are onboard. This would
    have saved the lives of those aboard Helios.

    Billions of dollars are wasted on unnecessary airport runway expansion and
    insufficient data programs to reduce fatal ground incursions. The lack of data
    has caused excessive verbal communication between the pilots and the
    controllers that is prone to errors. These ground incursions wouldn’t even
    occur if the flight data was shared so pilots and air traffic control had
    better visibility. But because the digital data isn’t shared automatically the
    pilot sees only a fraction of the information necessary to prevent a crash and
    the same holds true for the air traffic controllers (ATCs). Crashes such as Tenerife (583 fatalities), Comair (49 fatalities), etc.
    are directly caused by the lack of visibility due to not sharing the DFDR, ATC
    and airport runway data in real-time. Too many crashes are listed as pilot
    error when they are a direct result of a lack of visibility brought on by not
    sharing the digital flight data/Black Box in real-time to provide the necessary
    situation awareness. Many of the fatal in-air crashes fall into the same
    category. For example there was a crash where a plane ran out of fuel over JFK.
    The controller thought the pilot had more fuel left and the pilot who said his
    fuel was low didn’t use the correct emergency verbiage. Since the fuel supply
    is another black box input there is no reason why a red light, similar to the
    one on everyone’s car, doesn’t light up on the ATC display. The red low fuel
    light would reduce the controller’s work load and increase his situation
    awareness so that the people aboard a flight similar to the one that crashed
    would now live. Using the Black Box data decreases the work load of the pilot
    the air traffic controller as well as increases their situation awareness. By the lack of
    sharing the already digitized data in real-time we have egregiously curtailed
    the use of automation and expert systems technology for the prevention of
    crashes, increased the cost of flying and jeopardized our national security.
    The real-time use and sharing of the DFDR data to prevent crashes is more
    important then its present post mortem autopsy mode of operation.

    The already digitized data used in
    real-time allows the use of  “Automated
    Expert Systems” to check many of an aircraft’s sensors prior to, and during, a
    flight to assure that everything is functioning correctly without having a
    person in the loop. When a malfunction is detected it can automatically inform
    the pilot and ATC as to the best way to work a round a malfunction. Using cross
    checks and correlation most of the sensors can be checked and work a round’s
    provided to the flight deck crew for safe transportation. It will also
    automatically notify the ground operational center of expected malfunctions and
    the safest work a round’s using a history file that should be followed. By so
    doing, the pilot’s work load will be reduced and his performance enhanced. The
    whole process of recognizing an aircraft problem and telemetering the best
    solution to the flight crew for a safe flight can be done with-in seconds. If
    action isn’t taken it is even possible to take control of the aircraft to
    assure the safety of the passengers.  In
    the case of Flight 447 it is highly likely that if the pilots were given the
    benefit of an Expert System the plane and its passengers would have survived
    the pitot tube problem that occurred. Expert Systems provide the pilot, with-in
    seconds, the best way to handle a life threatening problem.  Without an Expert System automatically
    providing alerts and advisories, the pilot has to thumb through a flight manual
    while in the midst of the problem.

    While pinpointing specific causes of a crash via the autopsy mode has
    merit it doesn’t address the broad generic systemic cause of most crashes
    namely not sharing the already digitized Black Box data in real-time for crash
    prevention. Piloting errors and mechanical failures will always occur but that
    is not a sufficient reason for the passengers to die. The fundamental reason
    for too many of the crashes is because the Black Box data has been denied from
    being utilized in real-time by the aviation industry out of fear for liability.
    We have operated commercial aviation in a dark age’s methodology. The aviation
    industry even fought against Black Boxes for many years. The Black Box
    technology came out of Australia
    and it was years later when it was embraced by the US aviation industry. Even when the
    aviation industry embraced Black Box technology they severely limited the
    number of points that were allowed to be monitored. The net result we had
    recurring crashes such as the horrific USAIR, Flight 427, Aliquippa PA crash
    that was solved by using British QAR (Quick Access Recorder) data. QARs weren’t
    utilized by US carrier aircraft. We must eliminate this liability fear and
    enter into a new age of aviation enlightenment by utilizing the black box data
    in real-time to prevent crashes. The Black Box data should not be suppressed
    under the cover of industry private and parsed out begrudgingly. The Black Box
    data belongs to the public since it is necessary for their safety.

    The Air France flight 447 crash is just the latest example of horrific crashes
    that possibly could have been prevented or saved lives. Using the Black Box
    data safely stored on the ground we surely would be able to minimize the
    anguish of the passenger’s families and recurring crashes. Ground storage
    eliminates the cost, time and risks associated with recorder recovery. The
    flight data used in real-time: reduces the cost of flying; prevents recurring
    fatal crashes; prevents a host of fatal crashes that aren’t directly related to
    Air France Flight 447, and keeps nations safe and secure. For the good of
    nation and its citizens, not only the flying public, we must utilize the Black
    Box data in real time.

    Sy Levine

    [email protected]         

    (310) 559-2965


  • Anonymous

    Not being a pilot, I have a common sense question:

    If the situation becomes so overwhelming that the Airbus 330 must automatically disengage autopilot and autothrust, and the alternate law activates, a pretty good assumption is there is a high degree of chaos in the cockpit.

    A few folks have mentioned the thrust levers don’t change when autothrust disengages, leading to a situation that could be overlooked by pilots.

    Would it not make sense for the Airbus to automatically put itself into a preconfigured 6% pitch / 85% thrust – perhaps go into a new law – “limp along law” (or “flight indicators lost” law) before handing control back to the flight crew, perhaps setting the plane in a configuration that can give the pilots precious minutes to sort out all other issues?

  • Anonymous

    Hi, water currents scattered the parts of the aircraft ; the aircraft stalled/spun from 30 + feet due to inertia coupling due to overload of turbulent air penetration (the oxygen mask did not deploy) ; the computer was given conflicting information and too slow of commands thus induced secondary stall and spin ; the pilots could not speak due to G loads. Solution : Turn around and land at nearest airport do not penetrate turbulent weather above 24,000 feet. To avoid inertia coupling use Hamilton/Nobias Oval Diskettes and initiate a power reduction

  • http://pulse.yahoo.com/_PDFLO7PVW5MR3VHIEHFLV46EK4 anthony

    Great article and a very good analysis of what happen . But there is a lot a of question that do not fit the facts.    

  • Shojib Ashrafi Na Ashrafi

    Oh wow, that’s the least self-aware quote I’ve ever read. I wouldn’t be surprised if there were a quote from that very same day advocating the opposite for a cop.
    Fuck man, these assholes think this party’ll never end, but the longer it goes the worse it’s gonna be.