Air France Flight 447

Air France Flight 447

F-GZCP, the aircraft involved in the incident, at Charles de Gaulle Airport in 2007.
Accident
Date	1 June 2009
Summary	Incorrect speed readings likely caused by obstruction of the Pitot tubes by ice crystals (technical failure), responded to by inappropriate control inputs that destabilized the flight path (pilot error)
Site	Near waypoint TASIL, Atlantic Ocean 3°03′57″N 30°33′42″W
Aircraft type	Airbus A330-203
Operator	Air France
Registration	F-GZCP
Flight origin	Rio de Janeiro-Galeão Int'l Airport
Destination	Paris-Charles de Gaulle Airport
Passengers	216
Crew	12
Fatalities	228 (all)
Survivors	0

Air France Flight 447 (abbreviated AF447) was a scheduled commercial flight from Galeão International Airport in Rio de Janeiro, Brazil to Charles de Gaulle International Airport in Paris, France. On Monday, 1 June 2009, the Airbus A330-200 airliner serving the flight crashed into the Atlantic Ocean, killing all 216 passengers and 12 crew. The accident was the deadliest in the history of Air France, and has been described as the worst accident in French aviation history. It was the second fatal accident involving an Airbus A330, the first while in commercial passenger service, and, to date, has the highest-ever death toll of any aviation accident involving an A330.

Preliminary and final reports of the BEA stated that the aircraft crashed following an aerodynamic stall caused by inconsistent airspeed sensor readings, the disengagement of the autopilot, and the pilot making nose-up inputs despite stall warnings, causing a fatal loss of airspeed and a sharp descent. Additionally, reports indicated that the pilots had not received specific training in "manual airplane handling of approach to stall and stall recovery at high altitude", and that this was not a standard training requirement at the time of the accident.

The reason for the faulty readings is unknown, but it is assumed by the accident investigators to have been caused by the formation of ice inside the pitot tubes, depriving the airspeed sensors of forward-facing air pressure. Pitot tube icing has contributed to airliner crashes in the past – such as Northwest Airlines Flight 6231 in 1974 and Birgenair Flight 301 in 1996.

The investigation into the accident, which lasted well around three years after the disaster occurred, was initially hampered by the lack of eyewitness evidence and radar tracks, as well as by difficulty finding the aircraft's black boxes, which were located and recovered from the ocean floor in May 2011, nearly two years after the accident. The final report was released in a news conference on July 5, 2012.. It states that the accident resulted from a succession of events: temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot and computer-controlled flight system to disconnect; inappropriate control inputs that destabilized the flight path and lead to a stall; pilot misunderstanding of the situation and consequently a lack of control inputs that would have made it possible to recover from it.

Aircraft

The aircraft involved in the accident was an Airbus A330-203, with manufacturer serial number 660, registered as F-GZCP. This airliner first flew on 25 February 2005. The aircraft was powered by two General Electric CF6-80E1 engines with a maximum thrust of 72,000 lb giving it a cruise speed range of Mach 0.82–0.86 (871–913 km/h, 470–493 KTAS, 540 – 566 mph), at 35,000 ft (10.7 km altitude) and a range of 12,500 km (6750 nmi). On 17 August 2006, the A330 was involved in a ground collision with Airbus A321-211 F-GTAM, at Charles de Gaulle Airport, Paris. F-GTAM was substantially damaged while F-GZCP suffered only minor damage. The aircraft underwent a major overhaul on 16 April 2009, and at the time of the accident had accumulated 18,870 flying hours. The plane made 24 flights from Paris, to and from 13 different destinations worldwide, between 5 and 31 May 2009.

Accident

The aircraft departed from Rio de Janeiro-Galeão International Airport on 31 May 2009 at 19:03 local time (22:03 UTC), with a scheduled arrival at Paris-Charles de Gaulle Airport approximately 11 hours later. The last verbal contact with the aircraft was at 01:33 UTC, when it was near waypoint INTOL (1°21′39″S 32°49′53″W), located 565 km (351 mi) off Natal, on Brazil's north-eastern coast. The crew reported that they expected to use airway UN873 and enter Senegalese-controlled airspace at waypoint TASIL (4°0′18″N 29°59′24″W) within 50 minutes, and that the aircraft was flying normally at flight level 350 (a nominal altitude of 35,000 ft (10,668 m)) and at a speed of 467 knots (865 km/h; 537 mph). The aircraft left Brazil Atlantic radar surveillance at 01:48 UTC.

At 01:55 UTC, the captain woke the second pilot and said: "[...] he's going to take my place". After having attended the briefing between the two co-pilots, the captain left the cockpit to rest at 02:01:46 UTC. At 02:06 UTC, the pilot warned the cabin crew that they were about to enter an area of turbulence. Four minutes later, the pilots turned the plane slightly to the left and decreased its speed from Mach 0.82 to Mach 0.8 due to increased turbulence.

At 02:10:05 UTC the autopilot disengaged as did the engines' auto-thrust systems 3 seconds later. The pilot made a left nose-up input, as the plane began rolling to the right. The plane's stall warning sounded briefly twice due to the angle of attack tolerance being exceeded by short vertical accelerations due to turbulence. 10 seconds later, the plane's recorded airspeed dropped sharply from 275 knots to 60 knots. The plane's angle of attack increased, and the plane started to climb. The left-side instruments then recorded a sharp rise in airspeed to 215 knots. This change was not displayed by the Integrated Standby Instrument System (ISIS) until a minute later (the right-side instruments are not recorded by the recorder). The pilot continued making nose-up inputs. The trimmable horizontal stabilizer (THS) moved from 3 to 13 degrees nose-up in about 1 minute, and remained in that latter position until the end of the flight.

At around 02:11 UTC, the plane had climbed to its maximum altitude of around 38,000 feet. There, its angle of attack was 16 degrees, and the thrust levers were in the TO/GA detent (fully forward), and at 02:11:15 UTC the pitch attitude was slightly over 16 degrees and falling, but the angle of attack rapidly increased towards 30 degrees. The wings lost lift and the aircraft stalled. At 02:11:40 UTC, the captain re-entered the cockpit. The angle of attack had then reached 40 degrees, and the plane had descended to 35,000 feet with the engines running at almost 100% N₁ (the rotational speed of the front intake fan, which delivers most of a turbofan engine's thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft's computer due to the high angle of attack and/or the airspeed was less than 60 knots. In other words, the plane was oriented nose-up but descending steeply.

Roughly 20 seconds later, at 02:12 UTC, the pilot decreased the plane's pitch slightly, air speed indications became valid and the stall warning sounded again and sounded intermittently for the remaining duration of the flight, but stopped when the pilot increased the plane's nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35 degrees. During the last minutes, the thrust levers were in the "idle" detent position. The engines were always working, and responsive to commands.

The flight data recordings stopped at 02:14:28 UTC, or 3 hours 45 minutes after takeoff. At that point, the plane's ground speed was 107 knots, and it was descending at 10,912 feet per minute, with the engines' N₁'s at 55%. Its pitch was 16.2 degrees (nose up), with a roll angle of 5.3 degrees left. During its descent, the plane had turned more than 180 degrees to the right to a compass heading of 270 degrees. The plane was stalled during its entire 3 minute 30 second descent from 38,000 feet. It apparently hit the ocean surface at a vertical speed of 150 km/h (90 mph) and broke up on impact.

Automated messages

An Air France spokesperson stated on 3 June that “the aircraft sent a series of electronic messages over a three-minute period, which represented about a minute of information. Exactly what that data means hasn't been sorted out, yet.” These messages, sent from an onboard monitoring system via the Aircraft Communication Addressing and Reporting System (ACARS), were made public on 4 June 2009. The transcripts indicate that between 02:10 UTC and 02:14 UTC, 6 failure reports (FLR) and 19 warnings (WRN) were transmitted. The messages resulted from equipment failure data, captured by a built-in system for testing and reporting, and cockpit warnings also posted to ACARS. The failures and warnings in the 4 minutes of transmission concerned navigation, auto-flight, flight controls and cabin air-conditioning (codes beginning with 34, 22, 27 and 21, respectively).

Among the ACARS transmissions in the first minute is one message that indicates a fault in the pitot-static system (code 34111506). Bruno Sinatti, president of Alter, Air France’s third-biggest pilots’ union, stated that “Piloting becomes very difficult, near impossible, without reliable speed data”. The twelve warning messages with the same time code indicate that the autopilot and auto-thrust system had disengaged, that the TCAS was in fault mode, and flight mode went from 'normal law' to 'alternate law'. The 02:10 transmission contained a set of coordinates which indicated that the aircraft was at 2°59′N 30°35′W.

The remainder of the messages occurred from 02:11 UTC to 02:14 UTC, containing a fault message for an Air Data Inertial Reference Unit (ADIRU) and the Integrated Standby Instrument System (ISIS). At 02:12 UTC, a warning message NAV ADR DISAGREE indicated that there was a disagreement between the three independent air data systems. At 02:13 UTC, a fault message for the flight management guidance and envelope computer was sent. One of the two final messages transmitted at 02:14 UTC was a warning referring to the air data reference system, the other ADVISORY (Code 213100206) was a "cabin vertical speed warning", indicating that the plane was descending at a high rate.

Weather conditions

A meteorological analysis of the area surrounding the flight path showed a mesoscale convective system extending to an altitude of around 50,000 feet (15 km; 9.5 mi) above the Atlantic Ocean before Flight 447 disappeared. From satellite images taken near the time of the incident, it appeared that the aircraft encountered a thunderstorm, likely containing significant turbulence.

Detailed analysis of the weather conditions for the flight shows it is possible that the aircraft's final 12 minutes could have been spent "flying through significant turbulence and thunderstorm activity for about 75 mi (121 km)", and may have been subjected to rime icing, and possibly clear ice or graupel. Satellite imagery loops from the CIMSS clarify that the flight was coping with a series of storms, not just one.

Commercial air transport crews routinely encounter this type of storm in this area. Generally, when storms of this type are encountered at night, pilots use onboard radar to navigate around them.

In this instance, shortly after the last verbal contact was made with Air Traffic Control about 350 mi (560 km) north-east of Natal (station identifier SBNT), the aircraft likely traversed an area of intense deep convection which had formed within a broad band of thunderstorms along the Intertropical Convergence Zone (ITCZ). Turbulence in the vicinity of these rapidly developing storms may have contributed to the accident. Twelve other flights shared more or less the same route that Flight 447 was using at the time of the accident.

Search and recovery

Search effort

Colonel Jorge Amaral, deputy head of the Aeronautical Communications Center of the Brazilian Air Force, discussing the search for the aircraft

Flight 447 was due to pass from Brazilian airspace into Senegalese airspace at approximately 02:20 (UTC), and then into Cape Verde airspace at approximately 03:45. Shortly after 04:00, when the flight had failed to contact air traffic control in either Senegal or Cape Verde, the controller in Senegal attempted to contact the plane. When he received no response, he asked the crew of another Air France flight (AF459) to try to contact AF447; this also met with no success.

After further attempts to contact flight 447 were unsuccessful, an aerial search for the missing Airbus commenced from both sides of the Atlantic. Brazilian Air Force aircraft from the archipelago of Fernando de Noronha and French reconnaissance planes based in Dakar, Senegal led the search. They were assisted by aircraft from Spain and the United States. France requested satellite equipment from the United States to help find the plane. Brazilian Air Force spokesperson Colonel Henry Munhoz told Brazilian TV that radar on Cape Verde failed to pick up the aircraft over the Atlantic Ocean.

By early afternoon on 1 June, officials with Air France and the French government had already presumed that the plane had been lost with no survivors. An Air France spokesperson told L'Express that there was "no hope for survivors," and French President Nicolas Sarkozy told relatives of the passengers that there was only a minimal chance that anyone survived.

Diagram of seat locations of 44 of the 51 people whose bodies were found during the 2009 recovery mission

The crew of a TAM Airlines flight from Europe to Brazil reported the sighting of "orange dots" in the middle of the Atlantic, which could indicate the glow of wreckage on fire, at approximately 1,300 km (810 mi) from Fernando de Noronha. Another similar sighting of "something flashing brightly over the ocean then taking a descending vertical trajectory" was reported by the Spanish pilot of Air Comet Flight 974 flying from Lima to Madrid. The Brazilian newspaper O Globo reported that wreckage debris was discovered off the Senegalese coast, but that its origin was still uncertain. The crew of the French freighter Douce France reported seeing debris floating on the ocean in the area earlier indicated by the TAM crew.

On 2 June at 15:20 (UTC), a Brazilian Air Force Embraer R-99A spotted wreckage and signs of oil, possibly jet fuel, strewn along a 5 km (3 mi) band 650 km (400 mi) north-east of Fernando de Noronha Island, near the Saint Peter and Saint Paul Archipelago. The sighted wreckage included a plane seat, an orange buoy, a barrel, and "white pieces and electrical conductors". Later that day, after meeting with relatives of the Brazilians on the aircraft, Brazilian Defence Minister Nelson Jobim announced that the Air Force believed the wreckage was from Flight 447. Brazilian vice-president José Alencar (acting as president since Luiz Inácio Lula da Silva was out of the country) declared three days of official mourning.

Also on 2 June, two French Navy vessels, Foudre and Ventôse, were en route to the suspected crash site. Other ships sent to the site included the French research vessel Pourquoi Pas?, equipped with two mini-submarines able to descend to 6,000 m (20,000 ft), since the area of the Atlantic in which the plane went down may be as deep as 4,700 m (15,400 ft). A US Navy Lockheed Martin P-3 Orion anti-submarine warfare and maritime patrol aircraft was deployed in the search.

On 3 June, the first Brazilian Navy ship, the patrol boat Grajaú, reached the area in which the first debris was spotted. The Brazilian Navy sent a total of five ships to the debris site; the frigate Constituição and the corvette Caboclo were scheduled to reach the area on 4 June, the frigate Bosísio on 6 June and the replenishment oiler Almirante Gastão Motta on 7 June.

On 5 June 2009, the nuclear submarine Émeraude was despatched to the crash zone, arriving in the area on the 10th. Its mission was to assist in the search for the missing flight recorders or "black-boxes" which might be located at great depth. The submarine would use its sonar to listen for the ultrasonic signal emitted by the black boxes' "pingers", covering 13 sq mi (34 km²) a day. The Émeraude was to work with the mini-sub Nautile, which can descend to the ocean floor. The French submarines would be aided by two U.S. underwater audio devices, capable of picking up signals at a depth of 20,000 ft (6,100 m).

Colour bathymetry relief map of the part of Atlantic Ocean into which Air France Flight 447 crashed. Image shows two different data sets with different resolution.

Search results

On 4 June 2009, the Brazilian Air Force claimed they had recovered the first debris from the Air France crash site, 340 miles (550 km) northeast of the Fernando de Noronha archipelago, but on 5 June, around 13:00 UTC, Brazilian officials announced that they had not yet recovered anything from Flight 447, as the oil slick and debris field found on 2 June could not have come from the plane. Ramon Borges Cardoso, director of the Air Space Control Department, said that the fuel slicks were not caused by aviation fuel but were believed to have been from a passing ship. Even so, a Brazilian Air Force official maintained that some of the material that had been spotted (but not picked up) was in fact from Flight 447. Poor visibility had prevented search teams from re-locating the material.

On 6 June 2009, five days after Flight 447 disappeared, it was reported that the Brazilian Air Force had located "bodies and debris" from the missing aircraft, after they had been spotted by a special search radar-equipped aircraft near the Saint Peter and Saint Paul Archipelago. The bodies and objects were reportedly found at 08:14 Brazilian time (11:14 UTC), and experts on human remains were sent to investigate. Brazilian Air Force Colonel Jorge Amaral stated that "We confirm the recovery from the water of debris and bodies from the Air France plane. Air France boarding passes for Flight 447 were also found. We can't give more information without confirming what we have." Two male bodies were later found along with a seat, a nylon backpack containing a computer and vaccination card and a leather briefcase containing a boarding pass for the Air France flight.

Authorities also corrected the misunderstanding about the earlier debris findings: except for the wooden pallet, the debris did come from Flight 447, but rescue aircraft and ships had made the search for possible survivors and bodies a priority, delaying the verification of the origins of the other recovered debris.

The Airbus's vertical stabilizer recovered

On 7 June, search crews recovered the Airbus's vertical stabilizer, the first major piece of wreckage to be discovered.

By 17 June 2009, a total of 50 bodies had been recovered in two distinct groups more than 50 miles (80 km) apart, and more than 400 pieces of debris from the plane had been recovered. 49 of the 50 bodies had been transported to shore, first by the frigates Constituição and Bosísio to the islands of Fernando de Noronha and thereafter by plane to Recife for identification. As of 23 June 2009, officials had identified 11 of the 50 bodies recovered from the crash site off the coast of Brazil, by using dental records and fingerprints. Of those identified, ten were Brazilian, although no names had been released. On 25 June, Le Figaro reported that the bodies of the pilot, Marc Dubois, and a flight attendant had been retrieved and identified. On 26 June, the Brazilian Military announced it had ended the search for bodies and debris, having recovered 50 bodies with the help of French vessels and French, Spanish and U.S. aircraft.

Following the end of the search for bodies, the search for the flight data recorder and the cockpit voice recorder, the "black boxes", continued with the French nuclear submarine and with two French-contracted ships (towing the U.S. Navy listening devices) trawling a search area with a radius of 80 kilometres (50 mi). By mid July, recovery of the black boxes had still not been announced. French search teams denied an earlier report that a "very weak" signal had been picked up from the black box locator beacon. The finite beacon battery life meant that, as the time since the crash elapsed, the likelihood of location diminished. In late July, the search for the black boxes entered its second phase, with a French research vessel resuming the search using a towed sonar array. In July 2009, Airbus announced that they would fund an extended search for the aircraft's black boxes. This announcement came amidst their official backing to determine the root cause of the accident. The second phase of the search ended on 20 August without finding wreckage within a 75 km radius of the last position, as reported at 02:10.

On 13 December 2009, the BEA announced that a search for the recorders for three months more would be conducted using "robot submarines" beginning in February 2010.

The BEA announced that they expected the search to resume in mid-March, depending on the weather. The third phase of the search was planned to take four weeks. Air France, Airbus, the US Navy, and the National Transportation Safety Board were to aid in the search. The new search plan covered an area of 770 square miles (2,000 km²) and was to utilize four sonar devices and two underwater robots. Oceanographers from France, Russia, Britain, and the United States each separately analysed the search area, to select a smaller area for closer survey.

The search continued in the beginning of April 2010 and was planned to last for 30 days.

On 6 May 2010, the French Minister of Defense reported that the cockpit voice recorders had been localized to a zone 5 km by 5 km, following analysis of the data recorded by the French submarine during the initial search conducted in mid-2009. On 12 May 2010, it was reported that the search following the 6 May report of the possible location of the voice recorders had not led to any findings and that the search had resumed in a different area from the one identified by the French submarine. The third phase of the search ended on 24 May 2010 without any success, though the French Bureau d'Enquetes et d'Analyses (BEA) says that the search 'nearly' covered the whole area drawn up by investigators.

In November 2010, French officials announced that a fourth search would start in February 2011, using the most sophisticated technology available.

2011 search and recovery

Cable ship Île de Sein was assigned to assist in the recovery of materials from the ocean floor.

On 3 April 2011, during Phase 4 of the search and recovery operation, a team led by the Woods Hole Oceanographic Institution operating full ocean depth autonomous underwater vehicles (AUVs) owned by the Waitt Institute discovered, by means of sidescan sonar, a large portion of debris field believed to be that of flight AF447. Further debris and bodies, still trapped in the partly intact remains of the aircraft's fuselage, were located in water depths of between 3,800 to 4,000 metres (2,100 to 2,200 fathoms; 12,500 to 13,100 ft). The debris was found to be lying in a relatively flat and silty area of the ocean floor (as opposed to the extremely mountainous topography that was originally believed to be AF447's final resting place). Other items found were engines, wing parts and the landing gear.

The debris field was described as "quite compact", measuring some 200 by 600 metres (660 by 1,970 ft) and located a short distance to the north of where pieces of wreckage had been recovered previously, suggesting that the aircraft hit the water largely intact. The French Ecology and Transportation Minister Nathalie Kosciusko-Morizet stated the bodies and wreckage would be brought to the surface and taken to France for examination and identification. It was not yet possible to determine how many bodies had been discovered. The French government chartered three vessels – the René Descartes, the Île de Sein and an American-based vessel, which are normally used by telecommunications companies for deep-ocean cable-laying and the Alucia, a deepwater expedition research vessel, to retrieve debris and bodies. An American Remora 6000 remotely operated vehicle (ROV) and operations crew experienced in the recovery of aircraft for the United States Navy were on board the Île de Sein.

Building 153, the head office of the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) at Le Bourget Airport, where the flight recorders are analysed

The BEA announced that on 26 April, after a 12-hour dive by the Remora 6000, the flight data recorder chassis had been found, although without the crash-survivable memory unit, which is the actual data storage medium. On 1 May the memory unit was found and lifted on board the Île de Sein by the ROV. According to the BEA's director Jean-Paul Troadec, the photos of the memory module showed that it had suffered little exterior corrosion, but it was not possible to say whether the memory chip remained readable. The plane's cockpit voice recorder was found at 2150 UTC (GMT) on 2 May 2011, and was raised and brought on board the Île de Sein the following day.

On 7 May the flight recorders, under judicial seal, were taken aboard the French Navy patrol boat La Capricieuse for transfer to the port of Cayenne. From there they were transported by air to the BEA's office in Le Bourget near Paris for data download and analysis. One engine and the avionics bay, containing onboard computers, had also been raised. On 5 May 2011, efforts to recover the bodies of passengers from the sea bed began. 51 bodies had been previously recovered from the sea.

The BEA confirmed on 16 May that all the data from both the flight data recorder and the cockpit voice recorder had been successfully downloaded. The data would be subjected to detailed in-depth analysis taking several weeks, after which another interim report would be released during the summer. The download was completed in the presence of two Brazilian investigators of the Aeronautical Accidents Investigation and Prevention Center (CENIPA), two British investigators of the Air Accidents Investigation Branch (AAIB), two German investigators of the German Federal Bureau of Aircraft Accidents Investigation (BFU), one American investigator of the National Transportation Safety Board (NTSB), an officer of the French judicial police, and a court expert. The entire download was filmed and recorded.

On 3 June, the last 27 bodies from the wreckage were recovered. With this, the number of bodies recovered from the wreckage reached 104 and the total number of recovered bodies was 154. The remaining 74 bodies from the flight have not been found.

Investigation

East-west cross-section of Atlantic Ocean portion in which Air France Flight 447 was thought to have crashed, showing depth of the sea floor. The vertical scale is exaggerated by a factor of 100 relative to the horizontal.

The French authorities opened two investigations:

• A criminal investigation for manslaughter began 5 June 2009, under the supervision of Investigating Magistrate Sylvie Zimmerman from the Paris Tribunal de Grande Instance. This is standard procedure for any accident involving a loss of life and implies no presumption of foul play. The judge gave the investigation to the Gendarmerie nationale, which would conduct it through its aerial transportation division (Gendarmerie des transports aériens or GTA) and its forensic research institute (the "Institut de Recherche Criminelle de la Gendarmerie Nationale", FR).
  • In June 2009, the DGSE (the external French intelligence agency) revealed that the names of two registered passengers on board corresponded to the names of two individuals thought to be linked to Islamic terrorist groups.

In March 2011, a French judge filed preliminary manslaughter charges against Air France and Airbus over the crash.

• A technical investigation, the goal of which is to enhance the safety of future flights. As the aircraft was of French registration and crashed over international waters, this is the responsibility of the French government, under the ICAO convention. The Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) is in charge of the investigation. Representatives from Brazil, Germany, the United Kingdom, and the United States became involved under the provisions of ICAO Annex 13; representatives of the United States were involved since the engines of the aircraft were manufactured there, and the other representatives could supply important information. The People's Republic of China, Croatia, Hungary, Republic of Ireland, Italy, Lebanon, Morocco, Norway, South Korea, Russia, South Africa, and Switzerland appointed observers, since citizens of those countries were on board. The BEA issued a press release on 5 June 2009, that stated: 

A large quantity of more or less accurate information and attempts at explanations concerning the accident are currently being circulated. The BEA reminds those concerned that in such circumstances, it is advisable to avoid all hasty interpretations and speculation on the basis of partial or non-validated information.

At this stage of the investigation, the only established facts are:

• the presence near the airplane’s planned route over the Atlantic of significant convective cells typical of the equatorial regions;
• based on the analysis of the automatic messages broadcast by the plane, there are inconsistencies between the various speeds measured.

— BEA

By June 2009 the main task occupying the investigators was the recovery of aircraft parts, primarily the flight recorders. BEA chief Paul-Louis Arslanian said that he was not optimistic about finding them since they might be under as much as 3,000 m (9,800 ft) of water and the terrain under this portion of the ocean was very rugged. Investigators were hoping to find the aircraft's lower aft section, since that was where the recorders were located. Although France had never recovered a flight recorder from such depths, there was precedent for such an operation: in 1988, an independent contractor was able to recover the cockpit voice recorder of South African Airways Flight 295 from a depth of 4,900 m (16,100 ft) in a search area of between 80 and 250 square nautical miles (270 and 860 km²). The Air France flight recorders were fitted with water-activated acoustic underwater locator beacons or "pingers", which should have remained active for at least 30 days, giving searchers that much time to locate the origin of the signals.

On 2 July 2009, the BEA released an intermediate report, which described all known facts, and a summary of the visual examination of the rudder and the other parts of the aircraft that had been recovered at that time. According to the BEA, this examination showed that:

• the airliner was likely to have struck the surface of the sea in a normal flight attitude, with a high rate of descent;
• There were no signs of any fires or explosions.
• The airliner did not break up in flight. The report also stresses that the BEA had not had access to the post-mortem reports at the time of its writing. Some of these might have suggested otherwise.

In May 2010 the French newspaper Le Figaro suggested that the plane had been heading back to Brazil when it had crashed.

On 16 May 2011, Le Figaro reported that the BEA investigators had ruled out an aircraft malfunction as the cause of the crash, according to preliminary information extracted from the Flight Data Recorder. The following day, the BEA issued a press release explicitly describing the Le Figaro report as a "sensationalist publication of non-validated information". They stated that no conclusions had yet been made, that investigations were continuing, and that no interim report was expected before the summer. On 18 May the head of the investigation clarified this contradictory information, stating that no major malfunction of the aircraft had been found so far in the data from the flight data recorder, but that minor malfunctions had not yet been ruled out.

On 27 May 2011, the BEA released a short factual report of the findings from the data recorders without any conclusions.

Airspeed inconsistency

In the minutes before its disappearance, the aircraft's onboard systems had sent a number of messages, via ACARS, indicating disagreement in the indicated airspeed (IAS) readings. A spokesperson for the BEA claimed that "the air speed of the aircraft was unclear" to the pilots and, on 4 June, Airbus issued an Accident Information Telex to operators of all its aircraft reminding pilots of the recommended Abnormal and Emergency Procedures to be taken in the case of unreliable airspeed indication. French Transport Minister Dominique Bussreau said "Obviously the pilots [of Flight 447] did not have the [correct] speed showing, which can lead to two bad consequences for the life of the aircraft: under-speed, which can lead to a stall, and over-speed, which can lead to the aircraft breaking up because it is approaching the speed of sound and the structure of the plane is not made for resisting such speeds".

Paul-Louis Arslanian, of France's air accident investigation agency, confirmed that there had been previous problems affecting the speed readings on other A330 aircraft stating, "We have seen a certain number of these types of faults on the A330 ... There is a programme of replacement, of improvement". The problems primarily occurred on the Airbus A320, but, awaiting a recommendation from Airbus, Air France delayed installing new pitots on A330/A340, yet increased inspection frequencies.

On 6 June 2009, Arslanian said that Air France had not replaced pitot probes as Airbus recommended on F-GZCP, saying that "it does not mean that without replacing the probes that the A330 was dangerous." Air France issued a further clarification of the situation:

Malfunctions in the pitot probes on the A320 led the manufacturer to issue a recommendation in September 2007 to change the probes. This recommendation also applies to long-haul aircraft using the same probes and on which a very few incidents of a similar nature had occurred.

— 

When it was introduced in 1994, the Airbus 330 had been equipped with pitot tubes, part number 0851GR, manufactured by Goodrich Sensors and Integrated Systems. A 2001 Airworthiness Directive required these to be replaced with either a later Goodrich design, part number 0851HL, or with pitots made by Thales, part number C16195AA. Air France chose to equip its fleet with the Thales pitots. In September 2007, Airbus recommended that Thales C16195AA pitot tubes should be replaced by Thales model C16195BA, to address the problem of water ingress which had been observed. Since it was not an Airworthiness Directive, the guidelines allow the operator to apply the recommendations at its discretion. Air France implemented the change on its A320 fleet where the incidents of water ingress were observed, and decided to do so in its A330/340 fleet only when failures occurred.

Starting in May 2008 Air France experienced incidents involving a loss of airspeed data in flight (...) in cruise phase on A340s and A330s. These incidents were analysed with Airbus as resulting from pitot probe icing for a few minutes, after which the phenomenon disappeared.

— 

After discussing these issues with the manufacturer, Air France sought a means of reducing these incidents, and Airbus indicated that the new pitot probe designed for the A320 was not designed to prevent cruise level ice-over. In 2009, tests suggested that the new probe could improve its reliability, prompting Air France to accelerate the replacement program, but this work had not been carried out on F-GZCP. By 17 June 2009, Air France had replaced all pitot probes on its A330 type aircraft.

On 11 June 2009, a spokesman from the BEA reminded that there was no conclusive evidence at the moment linking pitot probe malfunction to the AF447 crash, and this was reiterated on 17 June 2009 by the BEA chief, Paul-Louis Arslanian.

Example of a heated pitot probe on a small aircraft.

In July 2009, Airbus issued new advice to A330 and A340 operators to exchange Thales pitot tubes for tubes from Goodrich Sensors and Integrated Systems.

On 12 August 2009, Airbus issued three Mandatory Service Bulletins, requiring that all A330 and A340 aircraft be fitted with two Goodrich 0851HL pitot tubes and one Thales model C16195BA pitot (or alternatively three of the Goodrich pitots); Thales model C16195AA pitot tubes were no longer to be used. This requirement was incorporated into Airworthiness Directives issued by the European Aviation Safety Agency (EASA) on 31 August and by the Federal Aviation Administration (FAA) on 3 September. The replacement was to be completed by 7 January 2010. According to the FAA, in its Federal Register publication, use of the Thales model has resulted in "reports of airspeed indication discrepancies while flying at high altitudes in inclement weather conditions", that "could result in reduced control of the airplane." The FAA further stated that the Thales model probe "has not yet demonstrated the same level of robustness to withstand high-altitude ice crystals as Goodrich pitot probes P/N 0851HL,".

On 20 December 2010, Airbus issued a warning to roughly 100 operators of A330, A340-200 and A340-300 aircraft, regarding pitot tubes, advising pilots not to re-engage the autopilot following failure of the airspeed indicators.

Findings from the flight data recorder

On 27 May 2011, the BEA released an update on its investigation describing the history of the flight as recorded by the flight data recorder. This confirmed what had previously been concluded from post-portem examination of the bodies and debris recovered from the ocean surface, that the aircraft had not broken up at altitude but had fallen into the ocean intact. The flight recorders also revealed the reason for its descent into the sea: not mechanical failure or because the aircraft had been overwhelmed by the weather, but because the flight crew had raised the nose of the aircraft reducing its speed until it entered an aerodynamic stall.

While the incorrect airspeed data was the apparent cause of the disengagement of the autopilot, the reason the pilots lost control of the aircraft remains something of a mystery, in particular because pilots would normally try to lower the nose in case of a stall. Multiple sensors provide the pitch (attitude) information and there was no indication that any of them were malfunctioning. One factor may be that since the A330 does not normally accept control inputs that would cause a stall, the pilots were unaware that a stall could happen when the aircraft switched to an alternate mode due to failure of the air speed indication. Some reports have described this as a deep stall, but this was a steady state conventional stall. A deep stall is associated with an aircraft with a T-tail, but this aircraft does not have a T-tail.

In October 2011, a transcript of the voice recorder was leaked and published in the book Erreurs de Pilotage (Pilot Error) by Jean Pierre Otelli, The BEA and Air France both condemned the release of this information however, with Air France calling it "sensationalized and unverifiable information" that "impairs the memory of the crew and passengers who lost their lives."

Official analysis from the BEA of the transcript is yet to be published.

Third interim report

On 29 July 2011, the BEA released a third interim report on safety issues it found in the wake of the crash. It was accompanied by two shorter documents summarizing the interim report and addressing safety recommendations.

The third interim report stated that some new facts had been established. In particular:

• The pilots had not applied the unreliable airspeed procedure.
• The pilot-in-control pulled back on the stick, thus increasing the angle of attack and causing the plane to climb rapidly.
• The pilots apparently did not notice that the plane had reached its maximum permissible altitude.
• The pilots did not read out the available data (vertical velocity, altitude, etc.).
• The stall warning sounded continuously for 54 seconds.
• The pilots did not comment on the stall warnings and apparently did not realize that the plane was stalled.
• There was some buffeting associated with the stall.
• The stall warning deactivates by design when the angle of attack measurements are considered invalid and this is the case when the airspeed drops below a certain limit.
• In consequence, the stall warning stopped and came back on several times during the stall; in particular, it came on whenever the pilot pushed forward on the stick and then stopped when he pulled back; this may have confused the pilots.
• Despite the fact that they were aware that altitude was declining rapidly, the pilots were unable to determine which instruments to trust: it may have appeared to them that all values were incoherent.

The BEA assembled a human factors working group to analyze the crew's actions and reactions during the final stages of the flight.

A brief bulletin by Air France indicated that "the misleading stopping and starting of the stall warning alarm, contradicting the actual state of the aircraft, greatly contributed to the crew’s difficulty in analyzing the situation."

Final report

On 5 July 2012, the BEA released its final report on the accident. This confirmed the findings of the preliminary reports and provided addtional details and recommendations to improve safety. According to this report the accident resulted from the following succession of events:

• Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;
• Inappropriate control inputs that destabilized the flight path;
• The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;
• The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;
• The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;
• The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.

These events can be explained by a combination of the following factors:

• The feedback mechanisms on the part of all those involved that made it impossible:
  • To identify the repeated non-application of the loss of airspeed information procedure and to remedy this,
  • To ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences;
• The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for ”Vol avec IAS douteuse” (Flight with questionable Indicated Airspeed);
• Task-sharing that was weakened by:
  • Incomprehension of the situation when the autopilot disconnection occurred,
  • Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;
• The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;
• The crew not taking into account the stall warning, which could have been due to:
  • A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,
  • The appearance at the beginning of the event of transient warnings that could be considered as spurious,
  • The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,
  • The possible confusion with an overspeed situation in which buffet is also considered as a symptom,
  • Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,
  • The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.

Passengers and crew

Nationality	Passengers	Crew	Total
Argentina	2	0	2
Austria	1	0	1
Belgium	1	0	1
Brazil	58	1	59
Canada	1	0	1
China	9	0	9
Croatia	1	0	1
Denmark	1	0	1
Estonia	1	0	1
France	61	11	72
Gabon	1	0	1
Germany	26	0	26
Hungary	4	0	4
Iceland	1	0	1
Ireland	3	0	3
Italy	9	0	9
Lebanon	3	0	3
Morocco	3	0	3
Netherlands	1	0	1
Norway	3	0	3
Philippines	1	0	1
Poland	2	0	2
Romania	1	0	1
Russia	1	0	1
Slovakia	3	0	3
South Africa	1	0	1
South Korea	1	0	1
Spain	1	0	1
Sweden	1 (3)	0	1 (3)
Switzerland	6	0	6
Turkey	1	0	1
United Kingdom	5	0	5
United States	2	0	2
Total (33 nationalities)	216	12	228

The aircraft was carrying 216 passengers and 12 aircrew in two cabins of service. Among the 216 passengers were one infant, seven children, 82 women, and 126 men. There were three pilots: 58-year-old flight captain Marc Dubois had joined Air France in 1988 and had approximately 11,000 flight hours, including 1,700 hours on the Airbus A330; the two first officers, 37-year-old David Robert and 32-year-old Pierre-Cedric Bonin, had over 9,000 flight hours between them. Of the 12 crew members, 11 were French and one Brazilian.

According to an official list released by Air France on 1 June 2009, the majority of passengers were French, Brazilian, or German citizens. Attributing nationality was complicated by the holding of multiple citizenship by several passengers. The nationalities as released by Air France are shown in the table to the right. The passengers included business and holiday travelers.

Air France had gathered approximately 60–70 relatives and friends to pick up arriving passengers at Charles de Gaulle Airport. Many of the passengers on Flight 447 were connecting to other destinations worldwide, so other parties anticipating the arrival of passengers were at various connecting airports.

On 20 June 2009, Air France announced that each victim's family would be paid roughly €17,500 in initial compensation. Wrongful death lawsuits maintaining that design and manufacturing defects supplied pilots with incorrect information, rendering them incapable of maintaining altitude and air speed, have been filed in US Courts.

Notable passengers

• Prince Pedro Luís of Orléans-Bragança, third in succession to the abolished throne of Brazil. He had dual Brazilian-Belgian citizenship. He was returning home to Luxembourg from a visit to his relatives in Rio de Janeiro.
• Silvio Barbato, composer and former conductor of the symphony orchestras of the Brasilia National Theatre and the Rio de Janeiro Municipal Theatre; he was en route to Kiev for engagements there.
• Fatma Ceren Necipoğlu, Turkish classical harpist and academic of Anadolu University in Eskişehir; she was returning home via Paris after performing at the fourth Rio Harp Festival.
• Pablo Dreyfus from Argentina, a campaigner for controlling illegal arms and the illegal drugs trade.

Other incidents

Shortly after the crash, Air France changed the number of the regular Rio de Janeiro-Paris flight from AF447 to AF445.

Some six months later, on 30 November 2009, Air France Flight 445 (F-GZCK) made a mayday call because of severe turbulence around the same area and at a similar time to when Flight 447 had crashed. Because the pilots could not obtain immediate permission from air traffic controllers to descend to a less turbulent altitude, the mayday was to alert other aircraft in the vicinity that the flight had deviated from its normal flight level. This is standard contingency procedure when changing altitude without direct ATC authorization. After 30 minutes of moderate to severe turbulence the flight continued normally. The plane landed safely in Paris six hours and 40 minutes after the mayday call.

On 6 September 2011, the French media reported that the BEA was investigating a similar incident on an Air France flight from Caracas to Paris. The aircraft in question was an Airbus A340.

There have been several cases where inaccurate airspeed information led to flight incidents on the A330 and A340. Two of those incidents involved pitot probes. In the first incident, an Air France A340-300 (F-GLZL), en route from Tokyo, Japan, to Paris, France, experienced an event at 31,000 feet (9,400 m) in which the airspeed was incorrectly reported and the autopilot automatically disengaged. Bad weather, together with obstructed drainage holes in all three pitot probes, were subsequently found to be the cause. In the second incident, an Air France A340-300 (F-GLZN), en route from Paris to New York, encountered turbulence followed by the autoflight systems going offline, warnings over the accuracy of the reported airspeed and two minutes of stall alerts. Another incident on TAM Flight 8091, from Miami to Rio de Janeiro on 21 May 2009, involving an A330-200, showed a sudden drop of outside air temperature, then loss of air data, the ADIRS, autopilot and autothrust. The aircraft fell 1,000 metres (3,300 ft) before being manually recovered using backup instruments. The NTSB also examined a similar 23 June 2009 incident on a Northwest Airlines flight from Hong Kong to Tokyo.

Media speculation and independent analysis

New York Times

Wil S. Hylton of The New York Times said that the crash "was easy to bend into myth" because "no other passenger jet in modern history had disappeared so completely – without a Mayday call or a witness or even a trace on radar." Hylton explained that the A330 "was considered to be among the safest" of the passenger aircraft. Hylton added that when the aircraft disappeared, "Flight 447 seemed to disappear from the sky, it was tempting to deliver a tidy narrative about the hubris of building a self-flying airplane, Icarus falling from the sky. Or maybe Flight 447 was the Titanic, an uncrashable ship at the bottom of the sea." Dr. Guy Gratton, an aviation expert from the Flight Safety Laboratory at Brunel University, said "This is an air accident the like of which we haven't seen before. Half the accident investigators in the Western world – and in Russia too – are waiting for these results. This has been the biggest investigation since Lockerbie. Put bluntly, big passenger planes do not just fall out of the sky."

Sullenberger

In an article on High-Altitude Upset Recovery, C. B. "Sully" Sullenberger described it as a seminal accident. "We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircraft design and certification, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure..."

Sullenberger also believes that accurate airspeed indications alone aren't the best data the crew needs to recover from an upset. That requires knowing the wing's angle of attack (AoA). "We have to infer angle of attack indirectly by referencing speed. That makes stall recognition and recovery that much more difficult. For more than half a century, we've had the capability to display AoA (in the cockpits of most jet transports), one of the most critical parameters, yet we choose not to do it."

BBC / Nova

A one hour documentary titled "Lost: The Mystery of Flight 447" detailing an independent investigation into the crash was produced by Darlow Smithson in 2010 for Nova and the BBC. It employed the skills of an expert pilot, an expert accident investigator, an aviation meteorologist and an aircraft structural engineer. Using the publicly available evidence and information, without the black boxes, a critical chain of events was postulated:

• flying into an intense thunderstorm which had been hidden on the aircraft weather radar by a smaller nearer storm.
• reducing aircraft speed to anticipate impending turbulence.
• configuring the aircraft to avoid a stall by trimming aircraft pitch with the elevators, but not noticing that the autothrust system reduced aircraft speed (without corresponding thrust lever movement).
• simultaneous failure of all three pitot tubes due to supercooled water very rapidly forming ice.
• aircrew being unable to interpret a large number of flight deck failure alerts caused by the loss of air data.
• suffering a catastrophic loss of altitude due to a stall.
• falling uncontrollably to the sea and breaking up on impact.

The program was broadcast in the United Kingdom on 30 May 2010, and in the United States on 16 February 2011.

Popular Mechanics

On 6 December 2011 Popular Mechanics magazine published an English translation of the analysis of the transcript of the cockpit voice recorder leaked in the book Erreurs de Pilotage. It blames one of the co-pilots for stalling the aircraft while the flight computer was under alternate law at high altitude. The article concludes, based on the information downloaded from the Cockpit Voice Recorder and from the Flight Data Recorder that Pierre-Cedric Bonin continually pulled back on the stick despite repeated stall warnings that should have prompted him to do the opposite. Pierre-Cedric Bonin had only 800 hours in-type, and had not met the qualifications specified by Air France to be a first officer on an A330 aircraft.

Failings in crew resource management were also a contributory factor; specifically the fact that the Captain Marc Dubois had left the cockpit to take a nap while the most junior of the two pilots remaining in the cockpit Pierre-Cedric Bonin was in control of the aircraft. In addition, the more senior of the two pilots David Robert was not alert or assertive during the three minutes leading up to impact.

A series of human errors or failings were the most direct cause of this incident. The crew should have prepared for the flight more diligently, by checking and re-checking the weather, to have alternate routes already selected in case of storms. The on-board radar system was not properly operated until much later in the flight as the Captain left the cabin for his nap. At this time, David Robert reset the radar system to discover a significant storm cell directly in front of the aircraft's path. It was at this time that the more senior pilot David Robert suggested to the more junior pilot Pierre-Cedric Bonin a course of action, rather than acting more assertively and assuming control of the aircraft or recalling the Captain back from his nap.

Training had not been accomplished for Air France pilots on how to control an A330 Airbus when the flight computer operates in alternate law and this lack of training was a significant factor in the most junior pilot's Pierre-Cedric Bonin improper constant control input which caused the aircraft to stall. Pierre-Cedric Bonin waited until it was too late to inform David Robert that he had always been providing stick-back input during the entire emergency incident. Pierre-Cedric Bonin questions his own judgment by asking David Robert whether or not he should be in Takeoff and Go Around aircraft configuration. This self-assessment by Pierre-Cedric Bonin reaffirms after-the-fact independent criticism of his lack of experience being in command of an A330 and the Captain's misplaced trust in Pierre-Cedric Bonin rather than David Robert.

The article indirectly challenges the Captain's action of leaving the cockpit in the charge of Pierre-Cedric Bonin for a nap knowing the aircraft was heading for turbulence based on the weather reports available at the time the air crew should have received one or more weather briefings.

Daily Telegraph

Side stick control in an Airbus aircraft

On 28 April 2012 in The Daily Telegraph the British journalist Nick Ross published a comparison of Airbus and Boeing flight controls; unlike the control yoke used on Boeing flight decks, the Airbus side stick controls give no sensory or tactile and little visual feedback to the second pilot. Ross reasoned this might have been a factor in the failure of David Robert and Marc Dubois to countermand the manual input by pilot Pierre-Cédric Bonin that some independent analysts suspect proved fatal for the aircraft. Nick Ross's thesis was also broadcast in the US.

Mayday Program

In 2012 it was announced that the accident would feature in the last episode of the 12th season of the Mayday Canadian documentary television series.

See also

• Pulkovo Aviation Enterprise Flight 612
• Colgan Air Flight 3407
• Birgenair Flight 301

Further reading

• Jean-Pierre Otelli (2011). Erreurs de pilotage : Tome 5 (Pilot Error: Chapter 5). Altipresse. ISBN 979-1090465039.
• Roger Rapoport (2011). The Rio/Paris Crash: Air France 447. Lexographic Press. ISBN 978-0-9847142-0-9.

External links

External image
Photos of F-GZCP at Airliners.net

• BEA report 2 July 2009 (First interim report ): English version, French version
• BEA report 17 December 2009 (Second interim report ): English version, French version
• BEA report 29 July 2011 (Synopsis of the Third interim report): English version, French version
• BEA report 30 July 2011 (Third interim report, including CVR transcripts) English version, French version

• Accident / Serious Incident Report for Air France Flight 447 on SKYbrary categorised under Loss of Control / Human Factors / Airworthiness / Weather
• Air France Flight 447 – Air France
• Information on the investigation – Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile
• Informações sobre o voo AF 447 – Brazilian Air Force Template:Pt icon / Template:En icon
• Manuel Garcia Jr, CounterPunch, 1 July 2009, Clouds, Computers and Composites: The New Crisis in Aviation
• "Air France Crash Stories." Sky News
• By Hichri, Hédi. "Flight AF 447 – Analysis of Air France’s crisis communications." (Archive) Fleishman-Hillard France, September 2009.
• "Timeline of Flight AF 447." BBC. Wednesday 10 June 2009.
• N.V. "The Difference Engine: Wild blue coffin corner." The Economist. 25 March 2011. A clear description of the "coffin corner", where a small change in air speed causes either stalling or breaking up of the aircraft.
• "Stall led to Air France crash." AAP at Herald Sun. 23 May 2011. Retrieved on 23 May 2011.
• "Airline training guides, Aviation, Operations, Safety -Navigation A330". SmartCockpit. Retrieved 12 June 2009.
• "Les pilotes sont répartis en deux catégories : commandant de bord et officier pilote de ligne. (Pilots are divided into two categories: captain and first officer)".
• Sibaja, Marco; Keller, Greg (6 June 2009). "Air France says it's replacing flight instruments". The Boston Globe. Associated Press. Retrieved 31 May 2011.{{cite news}}: CS1 maint: multiple names: authors list (link)
• "Corpos de possíveis passageiros do Airbus chegam amanhã a Fernando de Noronha". Opovo Online. Agencia Brasil. 6 June 2009. Retrieved 31 May 2011.

Press releases

• From the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile
• From the Brazilian Air Force (Archive)
• From Air France