Understanding Air France 447

by Palmer, Bill

  I disagree with his assessment. 20 seconds earlier Bonin had also commented “we’re in climb.” I believe both statements refer only to the position of the thrust levers, not attempting to perform a go-around maneuver.

  The stall warning announced “STALL” five times before Bonin positioned the thrust levers to TOGA, and continued to sound afterwards. It is apparent that he expected the application of TOGA thrust to accelerate the airplane out of the stall situation on its own, like it can at low altitude. He appeared to be completely puzzled why this did not solve the problem. He had forgotten that a stall is primarily an angle of attack problem, not a power problem.

  Commentary on Design Flaws

  Few machines from the simplest screwdriver to the most sophisticated jet airliner could not use a little tweaking here and there.

  More than a few have claimed that the airplane suffered from “design flaws,” but they were often unable to articulate exactly what those “flaws” were, though they generally revolved around the design philosophy of the fly-by-wire system.

  It is my contention that simply designing a system differently than the commenter prefers is not by itself a design flaw.

  Additionally, a system that shuts itself off when it is designed to shut itself off, due to a lack of data or failure of another part, does not necessarily constitute a “failure.” We see this in the AF447 case when the flight directors are removed from view. The autopilot, flight directors, and autothrust did not “fail.” They suffered from a loss of data required to operate. When that data became available again, the flight directors were displayed again, as per design.

  Chapter 7: Stalling and Falling

  After the autopilot disconnected at 02:10:05, the remainder of the flight can be divided into four phases characterized by pilot actions and trends of pitch attitude, vertical speed, altitude, and angle of attack. These phases are derived from my own analysis, as follows:

  Phase 1: A period of 20 seconds from 02:10:07-02:10:27, starting two seconds after the autopilot disconnected where large lateral and almost exclusively, nose-up pitch inputs were made. Pitch attitude increased up to 12°, vertical speed rose up to 6,900 ft/min, altitude increased from 35,000 ft to 36,200 ft, and angle of attack, while higher than normal, was only momentarily high enough to meet the stall warning threshold - but not actually stalling.

  Phase 2: A period of 23 seconds from 02:10:27-02:10:50. Roll oscillations continued, but the pitch inputs were mostly nose down, the pitch attitude decreased from 12° to 6°, vertical speed reduced to 1,100 ft/min, and altitude continued to rise through 37,500 ft. The bank angle came under control for the last 10 seconds, angle of attack remained below the stall warning threshold, and the stall warning remained off.

  Phase 3: A period of 24 seconds from 02:10:50-02:11:14. In this phase, altitude was fairly constant at the cost of decaying airspeed, a rapidly increasing angle of attack, and critically decaying controllability. Pitch attitude increased and approached 18°, vertical speed ranged from near zero to 750 ft/min up then back to zero, and altitude peaked at 37,924. Roll began to destabilize again and large lateral inputs were made. The stall warning was on during this entire period.

  Phase 4: The remaining 3 minutes 14 seconds of the flight starting at 02:11:14. The descent from the peak altitude began. Mostly nose-up inputs were made, often with full back stick, the pitch attitude oscillated, and the airplane became deeply stalled as angles of attack quickly reached and remained above 30°, reaching as high as 60°. All the while the airplane banked both left and to over 40° to the right. Controllability was extremely compromised as the PF struggled to keep the airplane right-side up. He used full left and right stick inputs to counteract the extreme rolling motion of the airplane. Along with the rolling motion, the airplane yawed back and forth as it oscillated in pitch, roll, and yaw like a falling maple leaf. The yaw damper automatically counteracted each yaw motion with rudder commands within its limited authority. It was possibly the only thing keeping the airplane from entering a spin. Extreme vertical speeds of over 15,0000 ft/min were encountered as the airplane literally fell out of the sky. The stall warning sounded for the first 30 seconds of this phase and was intermittent thereafter.

  Recovery Possibilities

  Above all, this is a stall accident. Initial prevention of the stall was possible. This is proven by a number of other flights with the same malfunction that maintained control, often with little effort. All indications show that the pitch up that resulted in the loss of airspeed and excessive angles of attack were pilot induced. With each successive phase, prevention or recovery from the stall required more deliberate action.

  In phase 1, simply correcting the pitch attitude back to level flight would have been enough to restore normal flight. Sufficient airspeed remained in order to maintain altitude. Recovery would have required releasing aft stick input and pushing forward to pitch the nose down to the normal cruise pitch attitude. Due to the fly-by-wire flight control laws, the airplane would not pitch down on its own if the sidestick were to simply be released. The pitch attitude and extreme climb would remain unless positive corrective action was taken.

  The right and left rolling motion increased the difficulty of recovery. What may have been initially set off by the outside environment, was prolonged by excessive pilot inputs and the nearly double-the-normal roll rates available due to Alternate 2 control law. Roll attitudes never exceeded 11°, yet full or near-full sidestick deflection to each side was used several times to counter rolling motions.

  The struggle to regain control over the roll may have contributed to the inattention given to pitch, which resulted in a vertical speed of 6,900 feet per minute at the end of phase 1.

  In phase 2, sidestick inputs oscillated in both pitch and roll, with some correlation between pulling back with left stick input and pushing forward with right stick input. On average, more nose down inputs were made by the pilot flying and as a result, both the pitch attitude and vertical speed reduced. As the rolling motion came under control, pitch oscillations also stabilized at a pitch attitude of about 6° nose up. But that attitude was insufficient to complete the recovery and the airplane continued to climb and lose energy, though it remained below the stall angle of attack. Recovery would have required continued nose down inputs to lower the nose more and a return to the previous cruise altitude or below in order to regain airspeed needed to maintain level flight.

  In phase 3 the airspeed had become dangerously low and the pitch attitude and angle of attack increased while the altitude changed little. The stall warning sounded continuously and the airplane reached the stall angle of attack. At this point a recovery would have required a more aggressive pitch down maneuver, first to recover from the stall and then a fairly steep descent of perhaps 5,000 feet to regain airspeed. The pull up to level off would then need to be gentle to prevent a secondary stall during the level-off maneuver.

  Once the airplane entered phase 4 it is unknown if a recovery was possible. The BEA’s final report on the accident says that by the time the captain returned to the cockpit (30 seconds into phase 4) that it was, "already too late, given the airplane’s conditions at that time, to recover control of it.” Airbus test pilots that I spoke to had only reached a 14° angle of attack at altitude, and would not speculate on the recovery possibilities beyond that. For most of phase 4, the angle of attack for AF447 was between 30° and 60°.

  The effectiveness of the flight controls was severely compromised by the poor airflow around them. The ailerons, at the trailing edge of the fully stalled surface, had no effect on correcting the bank, even at prolonged full deflection.

  John Foster, an engineer at the Vehicle Dynamics Branch at NASA Langley Research Center, says that transport category airplanes with this configuration (non T-tail), typically exhibit good nose down pitch response from any AOA. Indeed, the pitch controls were quite effective in creating the very high angle of attack situation. The flight recordings indicate that there was some flig
ht control responsiveness in pitch when forward stick input was applied, even at very high angles of attack. Unfortunately, those commands were not held long enough. More nose-down control inputs and steeper nose down attitudes would have been needed in order to have any chance of recovery.

  An additional factor in a required pitch-down maneuver would be the ability to pitch down enough with the stabilizer trim in the full nose-up position, as it was for AF447 from about 15 seconds into phase 4. In one of my own attempts to duplicate the situation in an A330 flight simulator, after the stall was fully developed, sufficient nose down pitch down could not be maintained by forward sidestick displacement alone. The nose did pitch down initially, but as airspeed increased, the full nose-up trim setting overpowered the nose-down elevator and the nose pitched back up. Even reducing the thrust to idle and increasing the bank angle had minimal effect. I can tell you, it was not a good feeling to be pushing full forward on the sidestick and have the nose pitching up regardless. Only manually reducing the trim setting enabled me to reestablish enough pitch control to recover from the stalled condition. This recovery consumed over 10,000 feed of altitude.

  I am the first to admit that this attempt was well beyond the simulator's defined operating envelope and validated flight data. However, I don't find it to be unreasonable. It highlights the extra efforts that may have been required to perform a recovery once into phase 4. I had the added benefits of being in a non-stressful situation, knowing that the trim was full nose up, and watching the flight control display page when I thought of manually moving the stab trim. Of course, the crew of AF447 enjoyed none of those benefits.

  Stall Warning

  One item often cited in the opinion columns is the inconsistent operation of the stall warning.

  The stall warning is a synthetic voice that says, “STALL, STALL, STALL”. It is in English even though the crew spoke French. The voice is accompanied by a cricket sound and a red master warning light in front of each pilot. Unlike the stick-shaker stall warning found in many other transport aircraft, the Airbus stall warning does not affect the sidestick’s input or feel. It is notable that the warning is auditory only, except for the illumination of general purpose master warning light. Pilots subject to auditory exclusion due to a highly stressful situation, may tune it out.

  It is true that the stall warning did not always operate when the airplane was above the stall warning angle of attack. However, other than to select full (TOGA) power when the stall warning sounded at the beginning of phase 4, I find no indication that the crew acknowledged or acted to the stall warning in any other way when it was working. Most notable was the lack of any nose-down input in response to it. In fact, First Officer Robert, the most experienced A330 pilot among the crew, is heard saying, “what’s that?” one second after the stall warning sounded for the first time, and later after another stall warning. We cannot be sure that he was referring to the stall warning, but the two first officers never mentioned the stall in their efforts to understand what was happening to the airplane. After the captain returned to the cockpit the stall warning was silent most of the time, possibly hindering his analysis of the problem, even though the airplane remained well above the stall angle of attack.

  The angle of attack sensor is a weather-vane like device on the side of the airplane. There are three of them. They measure the angle of the airflow relative to the airplane fuselage and therefore the wings. Each sensor feeds its angle of attack information to an associated air data computer which then makes the data available to the flight control and warning systems.

  Why was the stall warning intermittent even when the angle of attack was critically high? The warning is inhibited whenever the indicated airspeed is less than 60 knots. The design logic is that the airflow must be sufficient to ensure a valid measurement by the angle of attack sensors, especially to prevent spurious warnings such as alarms due to gusty winds and unusual vane angles while on the ground. When the airspeeds values from all three air data computers are less than than 60 knots the angle of attack readings are therefore considered invalid.

  The airplane’s actual airspeed was never below 60 knots. However, there were two reasons that the indicated airspeed was below 60 knots, thereby rendering the angle of attack values invalid and inhibiting the stall warning.

  The first is the outright blockage of the pitot tubes by ice crystals. This inhibited the stall warning for only about 7 seconds. The pitot tubes were blocked for about 30 seconds for the left side and 40 seconds for the standby (the right side instruments are not recorded), but during most of that time the angle of attack was not high enough to trigger the warning anyway.

  The second reason occurred in phase 4 where the angle of attack was so high that the pitot-static system could not effectively measure the forward airspeed.

  In the center of the graphic below the brown and purple lines indicate the actual angle of attack, and the green line represents the stall warning angle of attack. The period of 02:10:10 to 02:10:20 corresponds to when the PF aggressively pitched up after the autopilot disconnected, causing the angle of attack to momentarily exceed the stall warning threshold. The blue area indicates the time period where the stall warning should normally have sounded, but was inhibited due to low indicated airspeed as a result of the clogged pitots.

  As the airplane climbed in phase 1 and 2, the actual airspeed and Mach number decreased. Along with a lowering of the Mach number came an increase angle of attack threshold for the stall and stall warning (the slower Mach number allowed for a higher angle of attack without stalling). Even though the angle of attack continued to increase throughout phase 2, the stall angle of attack also increased, preventing a stall from occurring. The airplane remained slightly below the stall warning angle of attack until phase 3, when the angle of attack rapidly increased.

  At the beginning of phase three (02:10:52) the stall warning activated and sounded continuously for the next 53 seconds. The PF pulled back on the sidestick and pushed the thrust levers full forward to the TOGA position (02:10:56).

  The stall buffet was felt, as recorded on the flight data recorder, and heard as a vibration noise in the cockpit. This buffet is a more rapid shaking of the airplane than turbulence. In the absence of the stall warning, the buffet itself should have acted as a stall indication to the crew.

  As the aircraft’s descent rate increased, the g load fell below 1g and a sense of falling would have been felt, like the initial feeling after pushing the down button on a fast elevator. As vertical speed continued to accelerate downward, the g load dropped further and larger nose-up inputs were made, probably to counteract the seat-of-the-pants feeling. Due to the combination of the flight control laws degrading to Alternate 2 and the loss of airspeed data, there were no protections or positive pitch stabilities to make the airplane pitch down on its own. Instead, the airplane attempted to follow the pilot’s orders for an increase in g load, as commanded by the sidestick position, and pitched the nose up further.

  The airplane’s angle of attack continued to rise as the nose of the airplane porpoised between about 10° and 18° nose up.

  During phase three, the sidestick was held on average about half way back, telling the flight control computers to pitch up in order to provide a g load above 1.0. The airplane increased both the elevator and stabilizer deflection in order to comply with this demand.

  At 02:11:10 the airplane’s altitude peaked at 37,924 feet. The angle of attack was at 12° and increasing, and the g load was only at .75g’s.

  In phase 4 the angle of attack reached extreme levels and the stall warning became intermittent.

  At 02:11:32 First Officer Bonin said, “I don’t have control of the airplane any more now.” His sidestick was full left, and remained so for 47 seconds. The airplane’s bank angle increased to the right. This is possibly because the downwardly deflected aileron on the right wing caused its angle of attack to be greater than the left.

  At 02:11:38, with the airplane descendi
ng through 36,000 feet, First Officer Robert moved his sidestick full left in an attempt to correct the bank angle which was approaching 30° to the right. He said, “controls to the left.” It is not clear if Robert was commanding Bonin to let him fly the airplane or simply move the controls to the left to counteract the steep right bank. Regardless, Robert pushed his takeover push button, momentarily disabling Bonin’s sidestick. But Bonin neither acknowledged the takeover nor released the controls. Instead he then pushed his own takeover push-button, disabling Robert’s sidestick while he continued to hold full left sidestick. Then also moved his sidestick full back.

  The elevator moved to full nose up to comply with Bonin’s order. The stabilizer moved automatically to reduce the need for elevator deflection over time, and due to the constant up elevator demand, the stabilizer drove to the full nose-up position.

  At 2:11:41 the stall warning was sounding when First Officer Robert again said, “what is that?”

  Bonin replied “I have the impression we have the speed.” Most interpret this to mean that he believed the airplane was going too fast, or that he had regained any lost airspeed - and therefore the stall warning was false. In fact, the exact opposite was true.

  At 02:11:45 the angle of attack passed 45° and the stall warning silenced. The indicated airspeed dropped to 40 knots and the angle of attack information was therefore declared invalid. The low airspeed indication was not due to another pitot clogging problem, instead it was because the angle of attack was so excessive that it made the pitot-static system unable to measure the airspeed. At this extreme and oblique angle of attack, the air pressure sensed by the pitot tube was almost equal to air pressure impacting the static port at nearly the same angle. This cancelled out the ability of the air data system to sense sufficient difference in pressure between the two ports that register airspeed.