Discussion

Case Study Air France 447 – A Cascading Series of Human Errors In the early morning of 1 June 2009, Air France flight 447 (AF 447) was travelling at a cruising altitude of 35 000 feet above the Atlantic Ocean. The flight was an Airbus A330–203 en route from Rio de Janeiro–Galeão International Airport headed to Paris’ Charles de Gaulle Airport. The flight carried 216 passengers, nine cabin crew, and three pilots. As it was an 11-hour flight, the three pilots were scheduled to take turns flying and resting. The Captain was the most experienced pilot, with nearly 11 000 hours of flight time. The second co-pilot, relief pilot for the Captain, had more than 6500 flying hours. (In this case study, he is referred to as PNF (pilot not flying).) Lastly, the first officer in the right seat was the least experienced with just under 3000 flying hours. (He is referred to as PF (pilot flying) in this case study). At about 2:00 a.m., AF 447 was over the Atlantic Ocean. The Captain called the second co-pilot (PNF) up from the rest bunk to take over controls so the Captain could rest. The PNF entered the cockpit and was quickly briefed on the flight. The pilots discussed an area of convective turbulence ahead and then the Captain left the cockpit. The first officer in the right seat became the PF, effectively taking the role of Captain, and the second co-pilot in the left seat became the PNF. Approximately 10 minutes later, the pilots ran into trouble as detailed below: 2:10 a.m.: The autopilot and auto-thrust systems disconnected and the airspeed instruments began displaying unusual readings. The instruments incorrectly displayed a 400-foot descent. The PF said, ‘I have the controls’, and began manually flying the aircraft. The aeroplane rolled right and the PF, trusting the failed instruments, responded with a nose-up and left input on the controls, causing the aircraft to slow from 275 to 60 knots and the stall warning to sound. The PNF said, ‘we’ve lost the speeds’. The PF then made rapid high-amplitude control inputs to roll the aircraft left-and-right (the full range of motion of the controls) and a nose-up input that increased the pitch to 11 degrees in 10 seconds. The pilots performed some checklist items, including turning on wing anti-icing. The PNF said the aircraft was climbing and asked the PF several times to descend. The PF made a slight nose- down input on the controls, but the aircraft continued to climb (from 35 000 feet to more than 37 000 feet). 2:10:36 a.m.: The PNF’s airspeed indicator began functioning correctly. The thrust controls were pulled back. The PNF called the Captain to return to the cockpit several times. The stall warning triggered again and its alarm sounded in the cockpit. The PF continued nose-up control inputs, increasing the aircraft’s pitch and reaching an altitude of 38 000 feet and a pitch attitude of 16 degrees. At that point, all airspeed indications were functioning correctly.

2:11:37 a.m.: The PNF said, ‘controls to the left’ and took over control of the aircraft without any call-out (i.e., the PF did not verbally acknowledge this transfer of control). The PF immediately took back control, also without any call-out, and continued making control inputs. 2:11:42 a.m.: The Captain re-entered the cockpit and sat in the jump seat behind the PF and PNF, who told him that they had lost control. The PNF said he didn’t understand what was happening, that they had tried everything. Within a few seconds, all recorded speeds went invalid and the stall warning stopped. The aircraft began falling at 10 000 feet per minute and rolled to the right. The PF made an input fully to the left and nose-up for about 30 seconds. 2:13:32 a.m.: The PF said, ‘at level one hundred’ meaning they were at an altitude of 10 000 feet. Shortly thereafter, simultaneous inputs by both pilots were made on the controls. The aircraft was quickly losing altitude in a nose-up attitude. The stall warning had been running continuously for three minutes. The ground proximity warning system (GPWS) began broadcasting ‘sink rate’ and then ‘ pull up’ to the pilots. The PNF expressed confusion, saying ‘I’ve got control, haven’t I?’ before seeming to understand that the PF had been maintaining a nose-up attitude the entire time. The flight data recorder (FDR) stopped recording at 2:14:28 a.m., with the last readings showing a descent of 10 912 feet per minute and a ground speed of 107 knots on impact with the ocean. The aircraft was destroyed and there were no survivors of the accident. No emergency messages were broadcast by the flight crew. With the aircraft wreckage on the ocean seabed at a depth of 3900 meters (2.5 miles), the black boxes were not recovered until April 2 2011 (nearly two years after the accident). With the recovery of the FDR and CVR, investigators, investigators began to unravel the mystery of what had happened on board AF 447.

Anticipated flight path of Air France 447 Source: By Jolly Janner [Public domain], via Wikimedia Commons

Approximately 10 minutes after the Captain left the cockpit, the CVR picked up a loud sound the investigators believed to be ice crystals hitting the aircraft. Unknown to the pilots, the aircraft’s pitot tubes (which inform the aircraft’s airspeed instruments) had become blocked with ice crystals. This caused the autopilot and auto-thrust systems to disconnect. Incorrect speed information was presented to the pilots. This situation would have permitted continued straight- and-level flight, giving the crew time to troubleshoot the airspeed indicator issue (if incorrect manual flight inputs not been made). Although all pilots were licensed, trained, and experienced, they were confused by what was happening to their aircraft. Some of their instruments failed while others were functioning correctly. They thought they were flying too fast when they were actually in a stall condition (going too slow). Investigators determined that the accident was caused by the flight crew’s incorrect inputs on the flight controls, following the failure of flight instruments, which destabilized the aircraft. The PNF was late identifying that the PF was making incorrect control inputs. None of the pilots immediately identified or reacted to the stall condition. This accident illustrates how technical and human factors can combine to cause an accident. The failure of AF 447’s instruments, part of a complex and automated modern cockpit, did not cause the accident but it placed the pilots in a confusing situation. The pilots’ human limitations led to errors in judgement – perhaps because of stress, fatigue, lack of situational awareness, and a failure to communicate effectively. Yet if the instruments had not failed initially, it is possible that the pilots would have completed the flight without incident.