It was five years ago, the night of May 31st, 2009 when Air France flight 447 crashed in the Atlantic Ocean on its way from Rio de Janerio, Brazil to Paris, France.
The crew flew into a line of thunderstorms in the intertropical convergence zone north of Brazil with little effort to deviate around it. That storm has been estimated to top over 50,000 feet.
In an occurrence not anticipated by the design engineers, the aircraft's three pitot tubes—the speed measuring sensors—clogged, causing the loss of accurate airspeed indications. While the odds of simultaneous failure of three independent systems is measured in the billions, there was no actual system failure. Instead, all three systems were subjected to the same adverse environmental conditions. Even though the design exceeded the regulatory requirements by a wide margin, the actual conditions exceeded those anticipated by the regulations. Those conditions exceeded the pitot tubes' capacity to deal with the obstruction for about 40 seconds. Those seconds were enough time to put the airplane in serious trouble.
The loss of airspeed indications caused the autopilot, flight director, and autothrust to disconnect—as they require airspeed information to operate. The airplane's handling characteristics also changed as the high-tech airplane's fly-by-wire flight controls degraded from its Normal to Alternate law. Lost also were the airplane's automatic protections built into Normal law, including stall protection. The pilot operating the controls struggled to maintain aircraft control, and in the process climbed nearly 3000 feet losing over 100 knots of critical airspeed. The airplane's stall warning went off for over 50 seconds, but the pilots were poorly trained on how to handle such an event at such a high altitude. They responded by applying full power, as their low-altitude stall training had taught them, but little additional power was available and it did no good. The airplane became deeply stalled. The airplane shook from the poor airflow around its wings, the nose pitched up and down as the airplane rolled side to side as the airplane descended at vertical speeds approaching 20,000 feet per minute. The rapid descent took it into the ocean in less than 3½ minutes.
Even with the nose pitched up 16° the airplane's trajectory was a 45° angle downward. It hit the water going down as fast as it was going forward—123 mph. While 123 mph doesn't sound fast for a jet airplane, imagine an aluminum car hitting a solid concrete wall at that speed you get an idea of the force of the impact. All 228 people on board we instantly killed in the violent impact that completely destroyed the airplane, spreading a cloud of debris over a 1⁄3 mile long path on the ocean floor 12,000 feet below.
During the event maintenance messages from the airplane relayed the resulting cascade of error messages to Air France, leaving little doubt when and where the airplane had impacted the water, with strong clues as to why. Floating debris and fifty of the victims were recovered from the surface starting five days after the crash.
Two years and four undersea searches later, sonar scanning vehicles found the debris field on a flat area on the bottom surrounded by mountainous terrain. Had the debris settled in the mountains, it may never have been found.
Studying aircraft accidents, the factors that lead to them and learning from those findings is one reason that air travel is the safest mode of transportation today. That doesn't just happen by itself. A lot of people work very hard every day to make that a reality.
There were many lessons to be learned from the crash of Air France 447. Many have to do with pilots being trained and able to hand fly the airplane at any time without reliance on automatic systems and with partial instrument failure. Those same automatic systems aid in the safe and efficient operation of the airplane nearly 100% of the time in daily operation, but constant reliance on them can weaken a pilot's skills. Those skills can be essential when failures occur.
Changes have been made in the years since the accident's findings. The FAA has encouraged airline pilots to maintain proficiency in hand flying. Aircraft manufacturers have adjusted their stall recovery techniques. Airlines have improved training in high altitude recoveries and manual flying, and emphasized techniques for proper control of the airplane when faced with instrument failure.
But more can be done, and progress needs to continue. More robust autoflight systems can be designed that are tolerant of data loss, perhaps switching to an attitude-hold mode until the pilot can take over when workload permits instead of simply disengaging when things start to go wrong. Better training in upset recovery techniques using actual aircraft, and reinforced with simulator training . These programs are available, but not part of any major airline's standard curriculum.
Air France 447 was the first airliner lost at sea for decades. Out of its investigation came recommendations including the triggering of transmissions indicating the airplane's location as soon as an emergency condition is detected on board and to extend the transmission life of underwater locator beacons from 30 to 90 days. Those systems are only now being developed. Both of those recommendations certainly ring true in the case of Malaysia flight 370 whose location, after months of searching is still a mystery.
The crew flew into a line of thunderstorms in the intertropical convergence zone north of Brazil with little effort to deviate around it. That storm has been estimated to top over 50,000 feet.
In an occurrence not anticipated by the design engineers, the aircraft's three pitot tubes—the speed measuring sensors—clogged, causing the loss of accurate airspeed indications. While the odds of simultaneous failure of three independent systems is measured in the billions, there was no actual system failure. Instead, all three systems were subjected to the same adverse environmental conditions. Even though the design exceeded the regulatory requirements by a wide margin, the actual conditions exceeded those anticipated by the regulations. Those conditions exceeded the pitot tubes' capacity to deal with the obstruction for about 40 seconds. Those seconds were enough time to put the airplane in serious trouble.
The loss of airspeed indications caused the autopilot, flight director, and autothrust to disconnect—as they require airspeed information to operate. The airplane's handling characteristics also changed as the high-tech airplane's fly-by-wire flight controls degraded from its Normal to Alternate law. Lost also were the airplane's automatic protections built into Normal law, including stall protection. The pilot operating the controls struggled to maintain aircraft control, and in the process climbed nearly 3000 feet losing over 100 knots of critical airspeed. The airplane's stall warning went off for over 50 seconds, but the pilots were poorly trained on how to handle such an event at such a high altitude. They responded by applying full power, as their low-altitude stall training had taught them, but little additional power was available and it did no good. The airplane became deeply stalled. The airplane shook from the poor airflow around its wings, the nose pitched up and down as the airplane rolled side to side as the airplane descended at vertical speeds approaching 20,000 feet per minute. The rapid descent took it into the ocean in less than 3½ minutes.
Even with the nose pitched up 16° the airplane's trajectory was a 45° angle downward. It hit the water going down as fast as it was going forward—123 mph. While 123 mph doesn't sound fast for a jet airplane, imagine an aluminum car hitting a solid concrete wall at that speed you get an idea of the force of the impact. All 228 people on board we instantly killed in the violent impact that completely destroyed the airplane, spreading a cloud of debris over a 1⁄3 mile long path on the ocean floor 12,000 feet below.
During the event maintenance messages from the airplane relayed the resulting cascade of error messages to Air France, leaving little doubt when and where the airplane had impacted the water, with strong clues as to why. Floating debris and fifty of the victims were recovered from the surface starting five days after the crash.
Two years and four undersea searches later, sonar scanning vehicles found the debris field on a flat area on the bottom surrounded by mountainous terrain. Had the debris settled in the mountains, it may never have been found.
Studying aircraft accidents, the factors that lead to them and learning from those findings is one reason that air travel is the safest mode of transportation today. That doesn't just happen by itself. A lot of people work very hard every day to make that a reality.
There were many lessons to be learned from the crash of Air France 447. Many have to do with pilots being trained and able to hand fly the airplane at any time without reliance on automatic systems and with partial instrument failure. Those same automatic systems aid in the safe and efficient operation of the airplane nearly 100% of the time in daily operation, but constant reliance on them can weaken a pilot's skills. Those skills can be essential when failures occur.
Changes have been made in the years since the accident's findings. The FAA has encouraged airline pilots to maintain proficiency in hand flying. Aircraft manufacturers have adjusted their stall recovery techniques. Airlines have improved training in high altitude recoveries and manual flying, and emphasized techniques for proper control of the airplane when faced with instrument failure.
But more can be done, and progress needs to continue. More robust autoflight systems can be designed that are tolerant of data loss, perhaps switching to an attitude-hold mode until the pilot can take over when workload permits instead of simply disengaging when things start to go wrong. Better training in upset recovery techniques using actual aircraft, and reinforced with simulator training . These programs are available, but not part of any major airline's standard curriculum.
Air France 447 was the first airliner lost at sea for decades. Out of its investigation came recommendations including the triggering of transmissions indicating the airplane's location as soon as an emergency condition is detected on board and to extend the transmission life of underwater locator beacons from 30 to 90 days. Those systems are only now being developed. Both of those recommendations certainly ring true in the case of Malaysia flight 370 whose location, after months of searching is still a mystery.
6 comments:
Hard to believe it's been five years. Hopefully they will build better technology. A friend met with a Boeing engineer who said they are busy working on planes without pilots. They should be working on technology to better assist pilots.
Great book by the way.
I think we're a long way from where pilotless planes on planes carrying passengers is a good idea.
Better technology to help pilots when the chips are down IS a good idea.
Are you sure AF have learnt their lessons? Really? I doubt it!
Why doesn't SkyTeam have a combined Safety Board?
Well, I never claimed exactly who learned which lessons and I can't speak for AF.
Bill
Great post; I recently finished your book on AF447; very informative and I learned a lot. With respect to the (fairly) recent Asiana SFO 777 incident....do you think the same thing would have happened if that crew was flying an Airbus? I seem to remember they were all fairly high-time Airbus guys. Specifically, is the stall protection/autothrust automation on the Airbus easier to use than the Boeing's in that type of situation? Again, thanks for the great blog and book!
Brad
Brad,
Had Asiana 214 been in an Airbus, there are two automatic functions that would have been working that would have greatly reduced the likelihood that the flight would have ended the same way:
Low energy warning:This function was called for in the Asian 214 investigation as something Boeing should investigate. Of course, Airbus fly-by-wire airplanes (A320 and later) have had it for almost three decades. Simply stated, this function issues an audible warning of "speed speed speed" when the airplane's energy falls below the point that it can level off.
The second function is the alpha floor autothrottle activation function. Boeing has this function- called autothrottle wake up, but it does notwork in FLCH (flight level change) the mode Aisian 214 pilots found themselves in-though it is not intended for use during landing and neither recall selecting it.
A low speed warning did activate on the B-777 but it was at a point that was not in time to be able to take effective action due to the time it takes for the large engines to accelerate.
Post a Comment