AF 447 Likely Crashed Because of Pilot Error

The first thing I did Friday morning was to go to BEA's website and read the most recent note about AF 447. For the first time the investigators published excerpts from the voice recorder of the downed A330-200. After reading the note it was pretty clear to me that major errors by the pilots caused this tragic accident in June 2009.

As already known, the pitot probes failed during the Airbus's flight through the Intertropical Convergence Zone (ITCZ). Experts believe that super cold water hit the tubes and froze on contact. The tubes failed and the Airbus suddenly did not have any reliable speed data. Consequently, the auto pilot and auto thrust disengaged. The A330 switched into alternate mode, giving the pilots full control of the plane. According to the transcript, the two first officers in the cockpit tried to call the captain, who was resting at the time, but he did not respond. Even though at least one of the first officers was pretty experienced on the A330, they failed to correctly interpret the computer's error messages. They were too consumed by figuring out what all the error messages meant to just focus on flying the plane.

Finally, the captain was back in the cockpit, but the situation worsened. The first officer pulled the plane up and it climbed from 35,000 feet to 38,000 feet, which was too high for the current situation in the ITCZ. Climbing also slowed down the plane and signals went off indicating that the Airbus was about to stall. At an altitude of 35,000 feet, the speed of a plane has to be within a very narrow limit, otherwise it will stall if the angle of attack is not adjusted. A difference of only 20 knots can cause a plane to stall. However, the first officers did not react correctly. The plane was still too slow and turbulence was rocking the plane to the sides.

With the fly-by-wire's envelope system down the first officers pushed the sidesticks too hard and the plane began to roll. Normally, the A330's fly-by-wire system would prevent that, but since it was down, there was no automatic protection anymore. However, and contrary to earlier reports, the Airbus was completely controllable. No primary flight systems failed. The envelope system was down, but the fly-by-wire system was still intact. The pilots had 100% control over the plane.

The first officers were not able to stop the stall. With very high vertical speed, the A330 shot toward the Atlantic. Ironically, one first officer increased thrust to 100%, increasing the plane's speed even more as it was heading toward the water. Pretty soon, the first officer realized he was not able to regain control of the plane. At 10,000 feet, he handed the controls over to the second first officer in the cockpit, who only had a few months flying experience on the A330. They must have realized they were doomed. Ironically, the pitot tubes worked again after less than one minute. The last words in the cockpit were "go ahead, you have the controls," when the first officer handed the controls over to the second first officer. A few seconds later they hit the water and were dead. And with them all 225 people on board flight AF 447.

So what happened? First, the Airbus's systems did not fail. The only thing that did fail were the pitot tubes. This is not really cause for a crash if pilots are well trained in these situations. Pitot tubes have frozen over before and never did a plane crash because of it. In this case, a chain of unfortunate events caused the accident. The following is a list of all the errors and issues that led to this terrible accident:

1) Instead of focusing on flying the plane, the two first officers were too focused on the computer's error messages. Flying the plane at an angle of 5 degrees with thrust at 85% would have been enough to fly without working pitot probes.
2) The first officers made the plane climb to 38,000 feet instead of descending. This decreased speed and caused the stall.
3) They were not well trained to regain control of the stalling plane. This had not been part of their pilot training.
4) They were not trained to realize that the frozen pitot tubes caused these problems.
5) The most experienced captain was not at the controls when the problems started.
6) At 10,000 feet - the most crucial phase of the accident - the least experienced first officer was in control of the plane.

In my opinion, well-trained pilots should have been able to handle this situation. In a BBC documentary from 2010, pilots encountered the exact situation in a simulator and managed the situation very well. Of course a simulator is not a real plane and the pilots in the simulator knew what was happening, but I strongly believe that all pilots should have the training to handle such a situation and a stall.

I am convinced that the crash of AF 447 will result in lots of troubles for Air France and Thales, the manufacturer of the pitot tubes, as they will be charged with manslaughter. Air France will be blamed for not training its pilots well enough and Thales will be blamed for building faulty pitot probes, even though the company claimed that they are able to handle all real-world challenges.

For Airbus, this is a result they can live with. The A330's fly-by-wire system was working and the plane is not to blame for the crash. But that's the only good news...

First Clues in AF 447 Crash

About a month and a half ago I wrote on this blog that I was hoping the search teams would find the black boxes of downed Air France flight 447. To my own surprise, they recovered both boxes last week. Yesterday, investigators were able to have a first look at the data stored in one of the black boxes, but the voice recorder still needs to be analyzed. The families of the people who died in the crash as well as the public will finally know what happened to the A330-200 on June 1, 2009. French investigators confirmed they will be able to fully understand the causes of the crash.

In my opinion, the most surprising development was a telex Airbus issued to all A330 customers today, which stated that there are no recommendations for Airbus's highly successful widebody aircraft. Many of us asked ourselves today: What does that actually mean? And this is the sensational part of today's news - it means that AF 447 did not crash because of any technical difficulties or errors with the fly-by-wire system. This is shocking news. In a good way though for Airbus and everybody who believes in and trusts Airbus's fly-by-wire technology.

After AF 447 crashed almost two years ago, many people - and even experts - believed the jet crashed because of a "stroke inside the plane's computers," as Germany's Der Spiegel wrote in 2009. They assumed the plane's fly-by-wire system shut down, following the icing of the Airbus's pitot tubes, rendering the pilots unable to fly the plane manually. I never believed in this theory as my earlier blog posts about the topic pointed out. Many aircraft have had issues with iced pitot tubes and none of them crashed. It was just not a good reason for a modern, state-of-the art airliner to crash.

But this brings us to the next question: Now what caused AF 447 to go down in early June 2009? Well, it is still too early to know that. We now know more about what didn't cause the crash, but we still do not yet know what caused it. The investigators mentioned today it would take until this summer to come to a final conclusion. There is still a list of numerous reasons for the crash, among them pilot error. Indeed, errors by the crew now seem to be the likeliest possibility. Listening to the voice recorder will answer a lot, if not all, of these questions. While today is a good day for Airbus and the A330, there are still no good answers for the families of those who died on June 1, 2009.

AF 447 Found in Atlantic

To be honest, I was not very hopeful that we would ever hear anything again about AF 447. So you can imagine how surprised and excited I was when I read the news two days ago about a submarine finding parts of the downed A330-200.

AF 447 was en route from Rio to Charles de Gaulle when it crashed into the Atlantic after passing a bad weather front in the ITCZ in June 2009. The emphasis here is on AFTER, not during - contrary to many media reports. Almost two years after the accident, even experts are still unsure about what happened to F-GZCP.

A popular theory is that the Airbus's fly-by-wire system, including all flight computers, broke down, rendering the pilots unable to fly the plane. Based on the automated messages AF 447 sent to the Airbus headquarters in Toulouse, this is not very likely. Another theory is that the pilots did not know the aircraft's exact speed, because the pitot tubes were jammed with ice (the plane was flying through a very moist bad weather front) and the Airbus did not receive any consistent airspeed data anymore. The automated messages confirm that this happened. However, this alone cannot be the cause of the crash. Yes, the pilots may not have had exact airspeed data, but they still had over-ground speed information based on GPS. This is not exact, but enough to fly the plane safely in a situation like this.

As in most cases, I strongly believe that many causes led to this fatal accident: Pilots who probably were not very familiar with the aircraft's computers and technology; a stressful and highly demanding situation they were not well trained for and never experienced before; multi-system failure; and it was in the middle of the night, so the crew probably couldn't see anything (contrary to earlier reports, the A330 has a manual horizon, so the crew always knew where up, down, right and left were).

Two years later, important questions remain, which make this accident so mysterious: Why didn't the crew radio to other planes traveling the same route that they were experiencing difficulties? They still had electricity and another Air France jet was directly behind them. A Lufthansa plane directly in front of them. Why did the Airbus hit the water belly first if the crew couldn't control it? Why was the captain not in the cockpit if it was a tricky situation?

Hopefully, in a few weeks from now, we will have answers to these questions. Fingers crossed that the search teams will find the black boxes!

Bruce Dickinson Flying the A320

Beautiful video on the fly-by-wire system of the A320.

So What Happened in Hamburg in March 2008?

The weather in Hamburg was nasty on March 1, 2008. It was nasty pretty much all over Europe. LH 44, an Airbus A320, was en route from Munich to Hamburg during the storm "Emma" when it tried to land at Hamburg's Fuhlsbüttel airport in strong crosswinds. Seconds before touch down, the Airbus was hit by a strong gust of wind and its left wingtip made contact with the rundway, causing the pilots to go around. The plane landed without any problems a few minutes later and nobody was injured. However, thousands of people who watched the video online or on TV have been asking themselves what happened here? Was it the pilots' fault? Was the wind just too strong and should they have shut down the airport during the storm? Was there a problem with the fly-by-wire system? Last week, the German Federal Bureau of Aircraft Accident Investigation (BFU) issued its final report on the accident.

But before I summarize the report's key facts, you should watch the video again:



Initially, people praised the pilots for their "heroic" reaction. They pulled the plane back up and, consequently, avoided a crash. Then, experts started to doubt this version and asked why the pilots didn't use a different runway at the airport in the first place, one that was better suited for landing in strong winds? And why was the 24-year old, inexperienced co-pilot flying in such bad conditions and not the captain himself? Finally, Airbus's fly-by-wire system was blamed for causing the accident. By switching to "Ground Mode" when the plane's first pair of tires hit the runway, the system didn't allow the pilots to fully control the plane anymore - it limited the inputs the pilots could give via the sidesticks, which prevented them from leveling the wings again quickly.

The BFU's report offers some interesting insight into what really went wrong on March 1, 2008. First of all, the crew was well trained to land the plane in weather conditions like those present on this day in the spring of 2008. Even the 24-year old co-pilot had adequate training to land the A320 in strong crosswinds and the captain is not to be blamed for letting her land the plane. He took over control as soon as it was clear a go-around was necessary. However, the cockpit crew is is still at least partly to be blamed for this accident. They knew that there were crosswinds with gusts of up to 55 kts and they still decided to land on one particular runway that was not the wisest pick under the given conditions. Also, the A320 is only approved for crosswinds of up to 38 kts. The cockpit crew should have been aware of that. The BFU report states that most pilots are not aware of the crosswinds limits and the BFU blames Airbus and Lufthansa for not communicating those limits clearly enough. I think this is pretty ridiculous, since even I know that there are limits for landing a plane in crosswinds and I am not (yet) a pilot. So this is a pretty lame excuse.

Another factor here was the impact of Airbus's fly-by-wire (FBW) system. As soon as an Airbus plane touches the runway with one of its tires, the FBW automatically switches from "Flare Mode" (which is operating during the approach) to "Ground Mode" (which applies when a plane is on the ground). During Flare Mode the pilots are allowed to give inputs within the entire scope of permissible commands, during Ground Mode this is no longer the case. But why did Airbus design the FBW to switch into Ground Mode before at least all of the tires in the rear of the plane touch the ground? Well, the reason for this is: Airbus wants to prevent pilot-induced oscillation shortly before the plane touches the runway, which is actually pretty smart. This means, the pilots' controls over the ailerons are very limited when the system switches to Ground Mode. Ironically, this was implemented to prevent the plane from hitting the ground with its wingtips. In this specific instance, however, it caused some trouble, since the plane didn't react to the pilots' inputs and the FBW took over control for several seconds, leaving the pilots with very limited control over the plane. The only option for them was: Get the plane to switch into Flare Mode by increasing speed and taking off again. However, the pilots said they were not aware of these Ground Mode limitations either.

To summarize this: In the end, several factors contributed to the accident. I have to say though that this was not as severe as some people and the media made it look like. This was not an "almost crash" at all. There was some minor damage to the plane, but it absolutely didn't render it uncontrollable. The first factor was: The pilots landed in crosswinds that were too high for the A320 and they should have known that. However, they didn't. I blame Lufthansa more than Airbus. Lufthansa should inform all their pilots about crosswind limits for all its planes. Second, the crew didn't choose the best runway for the wind conditions. They should have chosen the runway they used for their second (successful) landing attempt in the first place. Third, pilots have to be aware that Airbuses switch into Ground Mode as soon as one tire hits the runway. It wouldn't have helped in this case, since there was nothing they could have done, but at least it wouldn't have been a surprise.

Should Airbus change their FBW system and make it switch to Ground Mode only after the tires on both sides touch the ground? Absolutely not! This was probably the first time an accident happened because of the FBW during landing in crosswinds. I am sure it has already prevented dozens of accidents in the past.