Status:	Final
Date:	01 JUN 2009
Time:	00:14
Type:	Airbus A330-203
Operator:	Air France
Registration:	F-GZCP
C/n / msn:	660
First flight:	2005-02-25 (4 years 3 months)
Total airframe hrs:	18870
Cycles:	2644
Engines:	2 General Electric CF6-80E1A3
Crew:	Fatalities: 12 / Occupants: 12
Passengers:	Fatalities: 216 / Occupants: 216
Total:	Fatalities: 228 / Occupants: 228
Airplane damage:	Destroyed
Airplane fate:	Written off (damaged beyond repair)
Location:	c 160km NNW off São Pedro and São Paulo Archipelago (Atlantic Ocean)
Phase:	En route (ENR)
Nature:	International Scheduled Passenger
Departure airport:	Rio de Janeiro-Galeão International Airport, RJ (GIG/SBGL), Brazil
Destination airport:	Paris-Charles de Gaulle Airport (CDG/LFPG), France
Flightnumber:	447

Narrative:
An Air France Airbus A330-200 was destroyed when it crashed into the sea while on transatlantic flight from Rio de Janeiro-Galeao International Airport, RJ (GIG) to Paris-Charles de Gaulle Airport (CDG).
The airplane carried 12 crew members an 216 passengers. Flight AF447 departed at 19:29 local time (May 31) from Rio de Janeiro (GIG). The takeoff weight was 232.8t (for a MTOW of 233 t), including 70.4 tonnes of fuel. The captain was PNF, one of the co-pilots was Pilot Flying (PF).
The flight progressed as planned with the crew contacting several air traffic control centres along the way. Cruising altitude was FL350.
At 23:35 local time (01:35 UTC), the crew informed the Atlantic Area Control Centre (CINDACTA III) controller that they had passed the INTOL waypoint. INTOL is an RNAV waypoint located in the Atlantic Ocean, 565 km from Natal, Brazil.
At 01:48 UTC the aircraft went out of the radar coverage of CINDACTA III, Fernando de Noronha. The meteorological situation in the area of AF447's flight path over the Atlantic was typical of that encountered in the month of June in the inter-tropical convergence zone. There were powerful cumulonimbus clusters on the route of AF447. Some of them could have been the centre of some notable turbulence.
At 01:55, the captain woke the second co-pilot and said "[...] he’s going to take my place". The captain then attended the briefing between the two co-pilots, during which the Pilot Flying said, in particular "the little bit of turbulence that you just saw [...] we should find the same ahead [...] we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast" and that "the logon with Dakar failed". The captain left the cockpit at 02:01:46 UTC.
The airplane was flying at FL350 and at Mach 0.82 and the pitch attitude was about 2.5 degrees. Autopilot 2 and auto-thrust were engaged. At 02:06:04, the PF called the cabin crew, telling them that "in two minutes we should enter an area where it’ll move about a bit more than at the moment, you should watch out" and he added "I’ll call you back as soon as we’re out of it".
At 02:08:07, the PNF said "you can maybe go a little to the left [...]". The airplane began a slight turn to the left, the change in relation to the initial route being about 12 degrees. The level of turbulence increased slightly and the crew decided to reduce the speed to about Mach 0.8.
From 02:10:05, the autopilot then auto-thrust disengaged and the PF said "I have the controls". The airplane began to roll to the right and the PF made a left nose-up input. The stall warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS).
At 02:10:16, the PNF said "so, we’ve lost the speeds" then "alternate law [...]".
The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs. The vertical speed, which had reached 7,000 ft/min, dropped to 700 ft/min and the roll varied between 12 degrees right and 10 degrees left. The speed displayed on the left side increased sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the recorded angle of attack was around 4 degrees. From 02:10:50, the PNF tried several times to call the captain back.
At 02:10:51, the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and remained in the latter position until the end of the flight.
Around fifteen seconds later, the speed displayed on the ISIS increased sharply towards 185 kt; it was then consistent with the other recorded speed. The PF continued to make nose-up inputs. The airplane’s altitude reached its maximum of about 38,000 ft, its pitch attitude and angle of attack being 16 degrees.
At around 02:11:40, the captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was about -10,000 ft/min. The airplane’s pitch attitude did not exceed 15 degrees and the engines' N1's were close to 100%. The airplane was subject to roll oscillations that sometimes reached 40 degrees. The PF made an input on the sidestick to the left and nose-up stops, which lasted about 30 seconds.
At 02:12:02, the PF said "I don’t have any more indications", and the PNF said "we have no valid indications". At that moment, the thrust levers were in the IDLE detent and the engines' N1's were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning sounded again.
At 02:13:32, the PF said "we’re going to arrive at level one hundred". About fifteen seconds later, simultaneous inputs by both pilots on the sidesticks were recorded and the PF said "go ahead you have the controls".
The angle of attack, when it was valid, always remained above 35 degrees. The recordings stopped at 02:14:28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees. The airplane struck the surface of the sea.

Several attempts were made to locate the wreckage of the airplane. Finally on April 3, 2011, a search vessel using unmanned subarmines located pieces of wreckage including an engine, landing gear and fuselage and wing parts on the Ocean floor.

CAUSES OF THE ACCIDENT:
The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information that resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.
The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF. The destabilisation that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM messages, which did not help with the diagnosis.
The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information.
In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioural hypotheses in classifying the loss of airspeed information as “major” were not validated in the context of this accident. Confirmation of this classification thus supposes additional work on operational feedback that would enable improvements, where required, in crew training, the ergonomics of information supplied to them and the design of procedures.
The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behaviour in any acceptable reliable way.
In its current form, recognizing the stall warning, even associated with buffet, supposes that the crew accords a minimum level of “legitimacy” to it. This then supposes sufficient previous experience of stalls, a minimum of cognitive availability and understanding of the situation, knowledge of the aeroplane (and its protection modes) and its flight physics. An examination of the current training for airline pilots does not, in general, provide convincing indications of the building and maintenance of the associated skills.
More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures. A crew can be faced with an unexpected situation leading to a momentary but profound loss of comprehension. If, in this case, the supposed capacity for initial mastery and then diagnosis is lost, the safety model is then in “common failure mode”. During this event, the initial inability to master the flight path also made it impossible to understand the situation and to access the planned solution.
Thus, the accident resulted from the following succession of events:
- Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;
- Inappropriate control inputs that destabilized the flight path;
- The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;
- The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;
- The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;
- The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.
These events can be explained by a combination of the following factors:
- The feedback mechanisms on the part of all those involved that made it impossible:
* To identify the repeated non-application of the loss of airspeed information procedure and to remedy this,
* To ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences;
- The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for ”Vol avec IAS douteuse”;
- Task-sharing that was weakened by:
* Incomprehension of the situation when the autopilot disconnection occurred,
* Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;
- The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;
- The crew not taking into account the stall warning, which could have been due to:
* A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,
* The appearance at the beginning of the event of transient warnings that could be considered as spurious,
* The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,
* The possible confusion with an overspeed situation in which buffet is also considered as a symptom,
* Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,
* The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.

Events:

Sources:
» Air France news releases
» BBC News
» Ministério da Defesa news releases
» Air France Flight 447: A detailed meteorological analysis / by Tim Vasquez
» Air France Flight AF447. The Last 4 Minutes. / Tim Marshall