Air France Flight 447 was a scheduled passenger international flight from Rio de Janeiro, Brazil to Paris, France, which crashed on 1 June 2009. The Airbus A330, operated by Air France, stalled and did not recover, eventually crashing into the Atlantic Ocean at 0214 UTC, killing all 228 passengers, aircrew and cabin crew on board the aircraft.

Accident
Date	1 June 2009
Summary	Entered high-altitude stall, impacted ocean
Site	Atlantic Ocean near waypoint TASIL Coordinates:N3°03′57″-W30°33′42″ ; N3.06583°-W30.56167°
Aircraft
Aircraft type	Airbus A330-203
Operator	Air France
Registration	F-GZCP
Flight origin	Rio de Janeiro–Galeão Airport
Destination	Paris-Charles de Gaulle Airport
Passengers	216
Crew	12
Fatalities	228
Survivors	0

The Brazilian Navy removed the first major wreckage and two bodies from the sea within five days of the accident, but the initial investigation by France’s Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) was hampered because the aircraft’s flight recorders were not recovered from the ocean floor until May 2011, nearly two years later.

The BEA’s final report, released at a news conference on 5 July 2012, concluded that the aircraft crashed after temporary inconsistencies between the airspeed measurements – likely due to the aircraft’s pitot tubes being obstructed by ice crystals – caused the autopilot to disconnect, after which the crew reacted incorrectly and ultimately caused the aircraft to enter an aerodynamic stall, from which it did not recover. The accident was the deadliest in the history of Air France, as well as the deadliest accident involving the Airbus A330.

Aircraft

The aircraft involved in the accident was an Airbus A330-203, with manufacturer serial number 660, registered as F-GZCP. This airliner’s first flight was on 25 February 2005, and it was Air France’s newest A330 at the time of the crash. The aircraft was powered by two General Electric CF6-80E1A3 engines with a maximum thrust of 68,530/60,400 lb (take-off/max continuous) giving it a cruise speed range of Mach 0.82–0.86 (871–913 km/h, 470–493 knots, 540–566 mph), at 35,000 ft (10.7 km altitude) and a range of 12,500 km (6750 nautical miles, 7760 statute miles). On 17 August 2006, this A330 was involved in a ground collision with Airbus A321-211 F-GTAM, at Charles de Gaulle Airport, Paris. F-GTAM was substantially damaged while F-GZCP suffered only minor damage. The aircraft underwent a major overhaul on 16 April 2009 and at the time of the accident had accumulated about 18,870 flying hours.

Passengers and crew

Nationality	Passengers	Crew	Total
Argentina	1	0	1
Austria	1	0	1
Belgium	1	0	1
Brazil	58	1	59
Canada	1	0	1
China	9	0	9
Croatia	1	0	1
Denmark	1	0	1
Estonia	1	0	1
France	61	11	72
Gabon	1	0	1
Germany	26	0	26
Hungary	4	0	4
Iceland	1	0	1
Ireland	3	0	3
Italy	9	0	9
Lebanon	3	0	3
Morocco	3	0	3
Netherlands	1	0	1
Norway	3	0	3
Philippines	1	0	1
Poland	2	0	2
Romania	1	0	1
Russia	1	0	1
Slovakia	3	0	3
South Africa	1	0	1
South Korea	1	0	1
Spain	2	0	2
Sweden	1 (2)	0	1 (2)
Switzerland	6	0	6
Turkey	1	0	1
United Kingdom	5	0	5
United States	2	0	2
Total (33 nationalities)	216	12	228
Notes: Nationalities shown are as stated by Air France on 1 June 2009. Attributing nationality was complicated by the holding of multiple citizenship by several passengers. Passengers who had citizenship in one country but were attributed to another country by Air France are indicated with parentheses ( ).

Cockpit Crew

Captain, 58-year-old Marc Dubois (PNF-Pilot Not Flying) had joined Air France (at the time, Air Inter) in February 1988 and had 10,988 flying hours, of which 6,258 were as captain, including 1,700 hours on the Airbus A330; had carried out 16 rotations in the South America sector since he arrived in the A330/A340 division in 2007.

The First Officer, co-pilot in right seat, 32-year-old Pierre-Cédric Bonin (PF-Pilot Flying) had joined Air France in October 2003 and had 2,936 flight hours, of which 807 hours were on the Airbus A330; had carried out five rotations in the South America sector since arriving in the A330/A340 division in 2008.

First Officer, co-pilot in left seat, 37-year-old David Robert (PNF-Pilot Not Flying) had joined Air France in July 1998 and had 6,547 flying hours, of which 4,479 hours were on the Airbus A330; had carried out 39 rotations in the South America sector since he arrived in the A330/A340 division in 2002. Robert had graduated from École Nationale de l’Aviation Civile (ENAC), one of the elite Grandes Écoles, and had transitioned from a pilot to a management job at the airline’s operations center. He served as a pilot on this flight to maintain his flying credentials.

In  commercial passenger carrying aeroplane, the captain or pilot-in-command sits on the left-hand seat in the cockpit while the copilot or First Officer sits on the right hand seat in the cockpit beside the captain. Since Captain Marc Dubois had left the cockpit for taking rest, he had designated First Officer David Robert (PNF or Pilot Not Flying) to sit on his seat, the left-hand seat in the cockpit. The aeroplane was being flown on the autopilot by the copilot, First Officer Pierre-Cédric Bonin (PF or Pilot Flying).

In a route check of a captain, the pilot-in-command (the route check captain) will occupy the right-hand seat in the cockpit while the captain under check will sit on the left-hand seat. But this case is not applicable here–Mohammad Syed Husain

The aircraft was carrying 216 passengers, three aircrew and nine cabin crew in two cabins of service. Among the 216 passengers were 126 men, 82 women and eight children (including one infant). There were three pilots in the aircrew:

Of the 12 crew members (including aircrew and cabin crew), 11 were French and one was Brazilian. Most passengers were French, Brazilian, or German citizens. The nationalities, as released by Air France, are shown in the adjacent table. The passengers included business and holiday travelers.

 Air France had gathered approximately 60 to 70 relatives and friends who arrived at Charles de Gaulle Airport to pick up arriving passengers. Many of the passengers on Flight 447 were connecting to other destinations worldwide, so other parties anticipating the arrival of passengers were instead to appear at various other airports that were the passengers’ final destinations.

 On 20 June 2009, Air France announced that each victim’s family would be paid roughly €17,500 in initial compensation. In March 2010, relatives of 23 victims filed wrongful death lawsuits against Airbus and several of its component suppliers in a Florida court. The suit maintained that design and manufacturing defects supplied the pilots with incorrect information, rendering them incapable of maintaining altitude and airspeed.

Notable passengers

• Prince Pedro Luiz of Orléans-Bragança, third in succession to the abolished throne of Brazil. He had dual Brazilian–Belgian citizenship. He was returning home to Luxembourg from a visit to his relatives in Rio de Janeiro.
• Silvio Barbato, composer and former conductor of the symphony orchestras of the Cláudio Santoro National Theater in Brasilia and the Rio de Janeiro Municipal Theatre; he was en route to Kiev for engagements there.
• Fatma Ceren Necipoğlu, Turkish classical harpist and academic of Anadolu University in Eskişehir; she was returning home via Paris after performing at the fourth Rio Harp Festival.
• Pablo Dreyfus from Argentina, a campaigner for controlling illegal arms and the illegal drugs trade.

Accident

The aircraft departed from Rio de Janeiro–Galeão International Airport on 31 May 2009 at 2229 UTC, with a scheduled arrival at Paris-Charles de Gaulle Airport at 0903 UTC the following day, after an estimated flight time of 10:34. The last voice contact with the aircraft was at 01:35 UTC, 3 hours and 6 minutes after the 22:29 UTC departure, when it reported that it had passed waypoint INTOL(1°21′39″S 32°49′53″W / 1.36083°S 32.83139°W ), located 565 km (351 mi) off Natal, on Brazil’s north-eastern coast. The aircraft left Brazilian Atlantic radar surveillance at 0149 UTC and entered a communication dead zone. 

The Airbus A330 is designed to be flown by a crew of two pilots. However, because the 13-hour duty time (flight duration, plus pre-flight preparation) for the Rio-Paris route exceeds the maximum 10 hours permitted by Air France’s procedures for pilots to operate an aircraft without a break, Flight 447 was crewed by three pilots: a captain and two first officers. With three pilots on board, each of them can take a rest during the flight, and for this purpose the A330 has a rest cabin, situated just behind the cockpit.

 

In accordance with common practice, Captain Dubois had sent one of the co-pilots for the first rest period with the intention of taking the second break himself. At 0155 UTC, he woke first officer Robert and said: … he’s going to take my place. After having attended the briefing between the two co-pilots, the captain left the cockpit to rest at 0201:46 UTC. At 0206 UTC, the pilot warned the cabin crew that they were about to enter an area of turbulence. Probably two to three minutes after this the aircraft encountered icing conditions (the cockpit voice recorder recorded what sounded like hail or graupe on the outside of the aircraft, and the engine anti-ice system came on) and ice crystals started to accumulate in the pitot tubes (pitot tubes are devices that provide critical information about how fast the aircraft is moving through the air). Bonin turned the aircraft slightly to the left and decreased its speed from Mach 0.82 to Mach 0.8 (the recommended turbulence penetration speed).

At 0210:05 UTC the autopilot disengaged because the blocked pitot tubes were no longer providing valid airspeed information, and the aircraft transitioned from normal law to alternate law 2. The engines’ auto-thrust systems disengaged three seconds later. Without the auto-pilot, the aircraft started to roll to the right due to turbulence, and Bonin reacted by deflecting his side-stick to the left. One consequence of the change to alternate law was an increase in the aircraft’s sensitivity to roll, and the pilot’s input over-corrected for the initial upset. During the next 30 seconds, the aircraft rolled alternately left and right as Bonin adjusted to the altered handling characteristics of his aircraft. At the same time he abruptly pulled up on his side-stick, raising the nose. This action was unnecessary and excessive under the circumstances. The aircraft’s stall warning sounded briefly twice due to the angle of attack tolerance being exceeded, and the aircraft’s recorded airspeed dropped sharply from 274 knots (507 km/h; 315 mph) to 52 knots (96 km/h; 60 mph). The aircraft’s angle of attack increased, and the aircraft started to climb above its cruising level of FL350. By the time the pilot had control of the aircraft’s roll, it was climbing at nearly 7,000 feet per minute (36 m/s) (for comparison, typical normal rate of climb for modern airliners is only 2,000–3,000 feet per minute (10–15 m/s) at sea level, and much smaller at high altitude).

At 0210:34 UTC, after displaying incorrectly for half a minute, the left-side instruments recorded a sharp rise in airspeed to 223 knots (413 km/h; 257 mph), as did the Integrated Standby Instrument System (ISIS) 33 seconds later (the right-side instruments are not recorded by the recorder). The icing event had lasted for just over a minute. The pilot continued making nose-up inputs. The trimmable horizontal stabilizer (THS) moved from three to 13 degrees nose-up in about one minute and remained in that latter position until the end of the flight.

At 0211:10 UTC, the aircraft had climbed to its maximum altitude of around 38,000 feet (12,000 m). There, its angle of attack was 16 degrees, and the engine thrust levers were in the fully forward Takeoff/Go-around detent (TOGA). As the aircraft began to descend, the angle of attack rapidly increased toward 30 degrees. A second consequence of the reconfiguration into alternate law was that stall protection no longer operated. Whereas in normal law, the aircraft’s flight management computers would have acted to prevent such a high angle of attack, in alternate law this did not happen. (Indeed, the switch into alternate law occurred precisely because the computers, denied reliable speed data, were no longer able to provide such protection – nor many of the other functions expected of normal law). The wings lost lift and the aircraft stalled.

In response to the stall, first officer Robert took over control and pushed his control stick forward to lower the nose and recover from the stall; however, Bonin was still pulling his control stick back, lifting the nose further up. The inputs cancelled each other out.

At 0211:40 UTC, captain Dubois re-entered the cockpit after being summoned by first officer Robert. The angle of attack had then reached 40 degrees, and the aircraft had descended to 35,000 feet (11,000 m) with the engines running at almost 100% N₁ (the rotational speed of the front intake fan, which delivers most of a turbofan engine’s thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft’s computer due to the high angle of attack. In other words, the aircraft had its nose above the horizon but was descending steeply. Roughly 20 seconds later, at 0212 UTC, the pilot decreased the aircraft’s pitch slightly, airspeed indications became valid, and the stall warning sounded again; it then sounded intermittently for the remaining duration of the flight, but stopped when the pilot increased the aircraft’s nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35 degrees. From the time the aircraft stalled until its impact with the ocean, the engines were primarily developing either 100 percent N₁ or TOGA thrust, though they were briefly spooled down to about 50 percent N₁ on two occasions. The engines always responded to commands and were developing in excess of 100 percent N₁ when the flight ended. First officer Robert said: We’ve lost all control of the aeroplane, we don’t understand anything, we’ve tried everything and then: climb climb climb climb. When Bonin replied: But I’ve been at maximum nose-up for a while! Captain Dubois realized that Bonin was causing the stall, causing him to shout: No no no, don’t climb! However, the aircraft was now too low to recover from the stall. Shortly thereafter, the Ground proximity warning system sounded an alarm, warning the crew about the aircraft’s now imminent crash with the ocean. Bonin, realizing the situation was now hopeless, said: Fuck! We’re going to crash! This can’t be true. But what’s happening? The last CVR recording was captain Dubois saying [ten] degrees pitch attitude.

The flight data recordings stopped at 0214:28 UTC, or three hours 45 minutes after takeoff. At that point, the aircraft’s ground speed was 107 knots (198 km/h; 123 mph), and it was descending at 10,912 feet per minute (55.43 m/s) (108 knots (200 km/h; 124 mph) of vertical speed). Its pitch was 16.2 degrees (nose up), with a roll angle of 5.3 degrees left. During its descent, the aircraft had turned more than 180 degrees to the right to a compass heading of 270 degrees. The aircraft remained stalled during its entire 3 minute 30 second descent from 38,000 feet (12,000 m). The aircraft crashed belly-first into the ocean at a speed of 152 knots (282 km/h; 175 mph), comprising vertical and horizontal components of 108 knots (200 km/h; 124 mph) and 107 knots (198 km/h; 123 mph) respectively. The Airbus broke up on impact; all 228 passengers and crew on board were killed instantly.

Automated messages

Air France’s A330s are equipped with a communications system, Aircraft Communication Addressing and Reporting System (ACARS), which enables them to transmit data messages via VHF or satellite. ACARS can be used by the aircraft’s on-board computers to send messages automatically, and F-GZCP transmitted a position report approximately every ten minutes. Its final position report at 0210:34 gave the aircraft’s coordinates as : 2°59′N 30°35′W / 2.98°N 30.59°W 

In addition to the routine position reports, F-GZCP’s Centralized Maintenance System sent a series of messages via ACARS in the minutes immediately prior to its disappearance. These messages, sent to prepare maintenance workers on the ground prior to arrival, were transmitted between 0210 UTC and 0215 UTC, and consisted of five failure reports and nineteen warnings. Until the black box flight recorders were recovered two years later, these messages represented the only recorded data available to the investigators. They offered a tantalizing but incomplete picture of what had happened to Flight 447.

Among the ACARS transmissions at 0210 is one message that indicates a fault in the pitot-static system. Bruno Sinatti, president of Alter, Air France’s third-biggest pilots’ union, stated that Piloting becomes very difficult, near impossible, without reliable speed data. The 12 warning messages with the same time code indicate that the autopilot and auto-thrust system had disengaged, that the TCAS was in fault mode, and flight mode went from normal law to alternate law.

The remainder of the messages occurred from 0211 UTC to 0214 UTC, containing a fault message for an Air Data Inertial Reference Unit (ADIRU) and the Integrated Standby Instrument System (ISIS). At 0212 UTC, a warning message NAV ADR DISAGREE indicated that there was a disagreement between the three independent air data systems. At 0213 UTC, a fault message for the flight management guidance and envelope computer was sent. One of the two final messages transmitted at 0214 UTC was a warning referring to the air data reference system, the other ADVISORY was a cabin vertical speed warning, indicating that the aircraft was descending at a high rate.

Weather conditions

Weather conditions in the mid-Atlantic were normal for the time of year, and included a broad band of thunderstorms along the Intertropical Convergence Zone (ITCZ). A meteorological analysis of the area surrounding the flight path showed a mesoscale convective system extending to an altitude of around 50,000 feet (15,000 m) above the Atlantic Ocean before Flight 447 disappeared. During its final hour, Flight 447 encountered areas of light turbulence.

Commercial air transport crews routinely encounter this type of storm in this area. With the aircraft under the control of its automated systems, one of the main tasks occupying the cockpit crew was that of monitoring the progress of the flight through the ITCZ, using the on-board weather radar to avoid areas of significant turbulence. Twelve other flights shared more or less the same route that Flight 447 was using at the time of the accident.

Third interim report

On 29 July 2011, the BEA released a third interim report on safety issues it found in the wake of the crash. It was accompanied by two shorter documents summarizing the interim report and addressing safety recommendations.

The third interim report stated that some new facts had been established. In particular:

• The pilots had not applied the unreliable-airspeed procedure.
• The pilot-in-control pulled back on the stick, thus increasing the angle of attack and causing the aircraft to climb rapidly.
• The pilots apparently did not notice that the aircraft had reached its maximum permissible altitude.
• The pilots did not read out the available data (vertical velocity, altitude, etc.).
• The stall warning sounded continuously for 54 seconds.
• The pilots did not comment on the stall warnings and apparently did not realize that the aircraft was stalled.
• There was some buffeting associated with the stall.
• The stall warning deactivates by design when the angle of attack measurements is considered invalid, and this is the case when the airspeed drops below a certain limit.
• In consequence, the stall warning came on whenever the pilot pushed forward on the stick and then stopped when he pulled back; this happened several times during the stall and this may have confused the pilots.
• Even though they were aware that altitude was declining rapidly, the pilots were unable to determine which instruments to trust: it may have appeared to them that all values were incoherent.

The BEA assembled a human factors working group to analyze the crew’s actions and reactions during the final stages of the flight.

A brief bulletin by Air France indicated that the misleading stopping and starting of the stall warning alarm, contradicting the actual state of the aircraft, greatly contributed to the crew’s difficulty in analyzing the situation.

Final report

On 5 July 2012, the BEA released its final report on the accident. This confirmed the findings of the preliminary reports and provided additional details and recommendations to improve safety. According to the final report, the accident resulted from the following succession of major events:

• temporary inconsistency between the measured speeds, likely as a result of the obstruction of the pitot tubes by ice crystals, causing autopilot disconnection and reconfiguration to alternate law;
• the crew made inappropriate control inputs that destabilized the flight path;
• the crew failed to follow appropriate procedure for loss of displayed airspeed information;
• the crew were late in identifying and correcting the deviation from the flight path;
• the crew lacked understanding of the approach to stall;
• the crew failed to recognize that the aircraft had stalled and consequently did not make inputs that would have made it possible to recover from the stall.

These events resulted from the following major factors in combination:

• feedback mechanisms on the part of those involved made it impossible to identify and remedy the repeated non-application of the procedure for inconsistent airspeed, and to ensure that crews were trained in icing of the pitot probes and its consequences;
• the crew lacked practical training in manually handling the aircraft both at high altitude and in the event of anomalies of speed indication;
• the two co-pilots’ task sharing was weakened both by incomprehension of the situation at the time of autopilot disconnection, and by poor management of the startle effect, leaving them in an emotionally charged situation;
• the cockpit lacked a clear display of the inconsistencies in airspeed readings identified by the flight computers;
• the crew did not respond to the stall warning, whether due to a failure to identify the aural warning, to the transience of the stall warnings that could have been considered spurious, to the absence of any visual information that could confirm that the aircraft was approaching stall after losing the characteristic speeds, to confusing stall-related buffet for overspeed-related buffet, to the indications by the Flight Director that might have confirmed the crew’s mistaken view of their actions, or to difficulty in identifying and understanding the implications of the switch to alternate law, which does not protect the angle of attack.

 Courtesy of Wikipedia.org