The story of Air France Flight 447 (June 1, 2009)

This was a TRULY tragic event. Horrible in every detail.

I was flying 767s out of Rio at the time, really caught our attention.
 
The captain was looking at the guages, and not the side stick that was all the way back, holding the nose up.
 
The first time I ever sat in the cockpit of an Airbus I was jumpseating on a 320.

I deliberately tried to watch how much stick movement was required in the flare, was just curious. Couldn’t tell, just couldn’t see well enough...
 
I thought he only had seconds, enough to say “no no no” before impact.

Pretty sure they just did their thing (i.e. pulling full back on the stick) from FL370 until impact several minutes later, never once questioning if those control inputs made any type of sense. I hold my tongue mostly because those of us who live in a glass house, but this and Colgan (or more recently, Atlas) were examples of the worst of the worst not being forcibly ejected from professional flying when they should have been. Disturbing that they made it that far, to say the least.
 
I watched one of the documentaries on this accident, kinda painful to see. I like to back things up to where the chain should of been easily broken. At the risk of being the armchair Q.B., that would be to proper radar setup then the timely, early deviation for convective weather.

With that they’d never get to the point of stalling their way down to the water. As I recall, the Captain was called back from his break, then had limited time to correct the state of the A/C. I’d kinda think also the convective weather was present or forecasted in the preflight paperwork, if so, a few comments about it should of lead to heightened alert when approaching.
I didn’t study every nuance of the accident, just some things watching a casual documentary.
 
I was wrong, captain enter the cockpit with plenty of time but never took control:

02:13:40 (Robert) Climb... climb... climb... climb...
02:13:40 (Bonin) But I've had the stick back the whole time!
[At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself.]
02:13:42 (Captain) No, no, no… Don’t climb… no, no.
02:13:43 (Robert) Descend, then… Give me the controls… Give me the controls!

[Bonin yields the controls, and Robert finally puts the nose down. The plane begins to regain speed. But it is still descending at a precipitous angle. As they near 2000 feet, the aircraft's sensors detect the fast-approaching surface and trigger a new alarm. There is no time left to build up speed by pushing the plane's nose forward into a dive. At any rate, without warning his colleagues, Bonin once again takes back the controls and pulls his side stick all the way back.]
02:14:23 (Robert) Damn it, we’re going to crash… This can’t be happening!
02:14:25 (Bonin) But what’s happening?
02:14:27 (Captain) Ten degrees of pitch…
 
Well, it’s a mishap. Mishaps are exceedingly unlikely because of the crazy long list of things that MUST happen for the mishap to occur.

This thing stalled because a pitot tube froze over.

Pilots aren’t well trained in stall anything in a bus because it supposedly can’t stall! They are much more so now...

If only one of a dozen things were different that awful day, it wouldn’t have happened. As is the case with ALL mishaps.

In my opinion, the biggest take away is simple: power plus attitude equals performance. For you instrument veterans out there: remember that? For you newbies: don’t forget it, EVER.

An internal combustion engine needs three things: air, fuel and spark. 50 years after I started messing with them, to this day if one don’t work, I go to THAT mantra. Except the thousand times I didn’t, and guess what I missed EVERY time? You guessed it, it didn’t have one of those three simple things.
 
Pretty sure they just did their thing (i.e. pulling full back on the stick) from FL370 until impact several minutes later, never once questioning if those control inputs made any type of sense. I hold my tongue mostly because those of us who live in a glass house, but this and Colgan (or more recently, Atlas) were examples of the worst of the worst not being forcibly ejected from professional flying when they should have been. Disturbing that they made it that far, to say the least.
To me the problem is in the solution. Procedures make us safer but they also reduce pilot skills. Hard to be proficient if you never fly. My two favorite buttons in the bus are the little red ones on thrust levers and stick.
 
Hehe, the QUICKEST way to stand a captain straight up in his seat in the MD80... click off the auto throttle. Snap!

Corollary, best way to recover from an unusual attitude, ask the student what he’s doing. You know, like when you snap back from your daydream in the middle of SOMETHING and casually ask what he’s doing cause you can’t remember if it’s a wing over or barrel roll... boom... PERFECT unusual attitude recovery!

Back to our regularly scheduled digression.
 
... An internal combustion engine needs three things: air, fuel and spark. 50 years after I started messing with them, to this day if one don’t work, I go to THAT mantra. Except the thousand times I didn’t, and guess what I missed EVERY time? You guessed it, it didn’t have one of those three simple things.
Well, except for diesels, and hot surface ignitors in turbines. But you mean "a source of ignition", of course.
 
To me the problem is in the solution. Procedures make us safer but they also reduce pilot skills. Hard to be proficient if you never fly. My two favorite buttons in the bus are the little red ones on thrust levers and stick.
OTOH, how often have pilot hand-flying miscues caused a crash? Fewer every year, and automation/autonomy is only growing. The weakest link is the meatbag behind the yoke, whether we like it or not. People panic, and stop thinking, and forget their training, in all kinds of situations, every day.
 
OTOH, how often have pilot hand-flying miscues caused a crash? Fewer every year, and automation/autonomy is only growing. The weakest link is the meatbag behind the yoke, whether we like it or not. People panic, and stop thinking, and forget their training, in all kinds of situations, every day.
How often do automation miscues cause crashes? Same weakest link.
 
OTOH, how often have pilot hand-flying miscues caused a crash? Fewer every year, and automation/autonomy is only growing. The weakest link is the meatbag behind the yoke, whether we like it or not. People panic, and stop thinking, and forget their training, in all kinds of situations, every day.
Don’t agree at all. Reliance on automation and a step away from maintaining pilot skills are very problematic.
 
So.. not to s#!t on Air France too hard.. but did you guys see the recent AF 777 botched approach and go around? The pilots, again, were fighting each other on the control yoke bad enough that they disconnected!

Of course they also nearly flew into terrain recently https://avherald.com/h?article=4867f2bd&opt=0 .. (PS, AF's revenue on a 37 pax 777 flight must be trash)


I've had my share of Air France flights, they were one of the last operating the 747-400 out of Boston so I was partial to booking with them, but, not super confidence inspiring reading about some of their misadventures
 
how often have pilot hand-flying miscues caused a crash
How often do automation miscues cause crashes
Is it only one or the other? I think it would be hard to argue that automation has made flying less safe.. but, removing the pilot too much risks creating the situation of "what the hell is the plane doing?!"
 
Is it only one or the other? I think it would be hard to argue that automation has made flying less safe.. but, removing the pilot too much risks creating the situation of "what the hell is the plane doing?!"
In an automated airplane, both the ability to reduce automation and the ability to manage automation are required, and lack of ability to do either will make flying less safe. Unfortunately that generally means more training and experience are required.
 
Last edited:
They AF447 pilots didn't understand they were in a stall (partly) because the airplane hid common signs of a stall from them.

The frozen pitot tubes produced an indicated airspeed so low that the airplane silenced the stall warning because the data was in the range that is assumed to be invalid. The flight control laws managed roll so well that the didn't get the loss of positive roll control that is indicative of a stall. The flight control laws managed pitch attitude so well that you didn't get the loss of positive pitch control that is indicative of a stall.

A couple of times the pilots did lower the nose. When they did, the stall warnings, no longer in the 'invalid data' range, activated making it seem as though lowering the nose was making the problem worse.

They were flying pitch and power. Pitch was at a climb attitude and power was at a high setting (CLB/CONT/MAX).

As a result of this accident, our training has changed significantly. We know train for upset recoveries, not stall recoveries. The excessive sink rate alone is enough to trigger the upset recovery procedure which starts with disconnecting the automation (AP & AT) and pushing the nose down at ~1/2g. A recovery from a high-altitude upset will result in shockingly-low pitch attitudes and the loss of thousands of feet of altitude but, you will recover. "UPSET... PUSH, ROLL, THURST, STABILIZE" The accident crew did not have the benefit of that training.
 
I also disagree that people forget their training. What people do in an emergency is what they were trained. What is surprising, is to dispositively know what they were taught.

It’s like a kid mimicking their parents... you suddenly see what you’ve been doing! Whether you realized it or not.

Automation makes flying less tiresome, not safer. You can fly longer safer, because you’re less fatigued. In and of itself, no more safe.
 
I also disagree that people forget their training. What people do in an emergency is what they were trained.
Whether that training was good or bad, that’s what people revert to.

And the difference between good and bad training often has more to do with the trainee than the trainer.
 
Were they flying pitch and power before the stall?
They were on autopilot, as required in RVSM airspace, until it disconnected. At that point they had a lot of invalid data. I don't remember the details, as it's been several years since I read the data, but I don't think the flying pilot did a very good job at flying pitch/power prior to the stall. Those pitch/power settings are memory items on my airplane for an unreliable airspeed situation.
 
Well, kinda... it’s STILL fly by computer!

Pitch input commands g onset, not an elevator position exactly.... and such.
 
Apologies
It turns off the French version of HAL 2000 so I can be a pilot.
No apologies necessary. I’m always a little leery, though, of systems that remove any vestige of direct control of the vehicle by the operator. Cars are well down that road already, with throttle by wire and a lot of other changes that most people aren’t even aware of. The problem that I see is that you’re now left hoping that the programmers thought of everything and anticipated every possible eventuality and failure mode.

They never do.
 
No apologies necessary. I’m always a little leery, though, of systems that remove any vestige of direct control of the vehicle by the operator. Cars are well down that road already, with throttle by wire and a lot of other changes that most people aren’t even aware of. The problem that I see is that you’re now left hoping that the programmers thought of everything and anticipated every possible eventuality and failure mode.

They never do.
I hear you and won’t disagree but the system architecture of the Airbus 320 is cutting edge tech from the early 1980’s. It is very mature and has been refined over the last four decades. I’m a stick and rudder guy at heart and have no qualms flying the Airbus. Its still just an airplane behind the curtains.
 
Last edited:
Agree on over dependence on automation. I think the primary problem is around base assumptions on responsibility. Maybe I'm jaded from being involved in commercial software development for a long time, but in many areas it's called "done" when it mostly works. I understand that, in general, flight control software is supposed to be held to higher standards.

I think we'd be better off if we viewed software as "guilty until proven innocent", or in other words assume that it didn't work right until we know otherwise, just as we're supposed to assume the human is doing the right thing unless proven otherwise. For well proven systems, that shouldn't be a big deal, they should be logging everything they're doing. For mechanical systems, we kind of already do that - NTSB verifying control cable continuity for example. The idea that computers are infallible is a myth.

To me the safest option would be an electro-mechanical or analog electrical backup that the pilot could revert to for primary control surfaces, and training to make sure that pilots could actually hand fly the airplane, but that would be add to the cost of design, build, operation and training; and pretty much everybody feels that Airbus and other fly by computer systems are safe enough for people to fly in.
 
They were on autopilot, as required in RVSM airspace, until it disconnected. At that point they had a lot of invalid data. I don't remember the details, as it's been several years since I read the data, but I don't think the flying pilot did a very good job at flying pitch/power prior to the stall. Those pitch/power settings are memory items on my airplane for an unreliable airspeed situation.

A NWA A330 had almost the exact same situation. They simply flew pitch and power until they exited the clouds and the pitot heat cleared the tubes and everything returned to normal.
 
A NWA A330 had almost the exact same situation. They simply flew pitch and power until they exited the clouds and the pitot heat cleared the tubes and everything returned to normal.
Was that before or after this one? Or should I say before or after the cause was released?
 
Ice crystals blocked the pitot probes on two Airbus A330s that were cruising at high altitudes in the vicinity of convective weather activity, causing erroneous airspeed indications and reduced autoflight systems operation, according to a report issued in June by the U.S. National Transportation Safety Board (NTSB).

The incidents reported by NTSB involved an A330-200 of Brazilian registry that was en route with 176 people aboard from Miami to São Paulo, Brazil, on May 21, 2009, and an A330-300 of U.S. registry that was en route with 217 people from Hong Kong to Tokyo on June 23, 2009.

“Crew statements and recorded data for both flights did not indicate any airplane anomalies prior to the events,” the report said.

The Brazilian airplane was at Flight Level (FL) 370 (approximately 37,000 ft) over Haiti when the flight crew noticed an abrupt decrease in outside air temperature and observed St. Elmo’s fire, a coronal discharge of plasma that produces a faint flame-like glow on an aircraft flying through an electrically charged atmosphere. The airplane’s air data reference system ceased operating, primary displays of airspeed and altitude were lost, the autopilot and autothrottle disengaged, and the fly-by-wire system reverted from normal control law to alternate control law, which provides fewer protections against exceeding performance limitations.

“The flight crew continued using backup instruments,” the report said. “After approximately five minutes, primary data was restored. … The crew determined they could not restore normal law and continued the flight under the appropriate procedures.” The airplane was landed in São Paulo without further incident.

In the second incident, the crew of the U.S. airplane was using the on-board weather radar system to avoid thunderstorms while flying over Japan at FL 390. However, “just prior to the event, the airplane entered an area of cirrus clouds with light turbulence and moderate rain, with a brief period of intense rain and hail aloft,” the report said.

The autopilot and autothrottle disengaged, fluctuating airspeed indications were displayed, and a stall warning was generated. The crew “reported that the airspeed fluctuations and warnings lasted about one minute, and they controlled the airplane by pitch and power reference, per applicable checklist procedures, until normal airspeed indications returned,” the report said.

Airspeed fluctuations occurred again briefly as the crew turned the airplane farther away from the convective activity. After about two minutes, “the airspeed indicators returned to normal, and the crew re-engaged the autopilot and completed the flight in alternate [control] law,” the report said.

Investigators determined that the incidents were initiated when at least two of the three pitot probes on each airplane were blocked by an accretion of ice crystals.
 
A NWA A330 had almost the exact same situation. They simply flew pitch and power until they exited the clouds and the pitot heat cleared the tubes and everything returned to normal.
Exactly what they should do and the AF447 crew did not.
 
Back
Top