Understanding Air France 447

by Palmer, Bill

  When Robert took the controls, he did push forward on the sidestick, and the elevator moved out of full up where it had been for all of the previous 30 seconds, and most of the prior two minutes. The pitch attitude changed from about 10° nose up to slightly below nose level. However, this was not enough to recover from the stall. While the angle of attack remained incredibly high, it did reduce slightly. A few seconds later, Bonin pulled back on his sidestick again, counteracting the control inputs made by the Robert and the nose rose again, up to about 20°.

  Would this have occurred in a Boeing with conventional yoke controls? It already has.

  Northwest Airlines flight 6231 December 1, 1974. A Boeing 727.28 This accident was due to pitot icing also, though in this case the crew had neglected to turn on the pitot heat. As the airplane climbed increasingly higher airspeed was falsely indicated. The airplane stalled at about 24,000 feet and spun in at a vertical speed of 16,000 feet per minute. The instrument failure, pilot reactions, and resultant flight path are remarkably similar to AF447.

  Birgenair Flight 301, February 6, 1996.29 A Boeing 757. In this case it is believed that the captain’s pitot tube was clogged (possibly by wasp nesting) and indicated increasingly higher airspeed as the aircraft climbed. Conflicting stall and over-speed warnings confused the captain who pitched the aircraft up, resulting in a stall and subsequent left engine flameout, whereby the airplane spun and crashed.

  Aeroperú Flight 603, October 2, 1996.30 A Boeing 757. This accident was due to plugged static ports that resulted in erroneous altitude and airspeed information. As a consequence of the pilots' inability to precisely monitor the aircraft's airspeed and vertical speed, they experienced multiple stalls, resulting in rapid loss of altitude with no corresponding change on the altimeter.

  In all three cases the pilots focused on indicated airspeed and neglected the normal pitch an power relationship for their phase of flight. In the Birgenair case, the first officer’s airspeed indicator was still working!

  Those are just the flights that crashed. Other incidents that did not go so far as disaster have occurred due to airspeed errors with pilots not recognizing the mismatch between pitch, power, and performance.

  If a red flag pops up on the airspeed indicator it is much easier to deal with then when the airspeed becomes erroneous over time. The pilot must have a base knowledge of what the normal parameters are, so that when things are not quite right, even with the autopilot on, the airspeed error can be recognized.

  Chapter 8: Aftermath

  At 02:14:28, quarter past midnight local time, the A330 crashed into the water at a 45° angle, 16° nose up in a 5° left bank with a forward ground speed and vertical speed both at 107 knots (123 mph, 10,900 ft/min). All 228 people were killed.

  In the scale of things, 107 knots at landing may not seem high. It is less than the airplane’s normal landing speed, and almost 20 knots less than the speed of the USAirways 1549 “miracle on the Hudson” flight at its touchdown.31 However, it was the vertical speed on impact that destroyed the airplane. To put the numbers in perspective, the USAirways flight touched down with a vertical speed of 750 feet per minute. You would attain that vertical speed if you fell from a height of 29 inches; like stepping off of your bed.

  Air France 447 hit the water with a vertical speed of 10,900 feet per minute. To attain this speed you would need to dive off a 500 foot (46 story) building, and that doesn’t consider air resistance. Everyone on board was instantly killed with crushing injuries. The aluminum and composite airplane shattered on impact. Most of the airplane was on the bottom in small pieces, spread across an area a third of a mile long and 600 feet wide. Only the most rigid structures remained in large pieces. The complete debris field was considerably larger.

  The Vertical Stabilizer

  Among the first pieces of debris found floating was the vertical stabilizer. Many have contended for some time that the vertical stabilizer and rudder broke off in flight. The evidence cited was that these components were found floating, and apart from other floating debris. It was reminiscent of the American Airlines flight 587 accident in November of 2001, where an Airbus A-300’s vertical stabilizer came off in flight.

  Keep in mind that nothing of AF447 was found until June 6th, 2009, five days after the accident. Most of the airplane came to rest about 12,000 feet below the surface.

  Certainly some items were broken off on impact, e.g., the vertical stabilizer and rudder. Others were likely shed as the severely broken up aircraft descended the 2 1/4 mile column of water, floating to the surface as the parts separated from one another and descended, all subject to the currents at each depth plus the time delay. It is no wonder that there was a wide dispersal pattern. If this debris dispersal pattern been on land, it would force a different conclusion, because the pieces would not have been moving for five days before they were discovered.

  Furthermore, the currents in that area are not well known, and unfortunately search and rescue aircraft did not drop drift buoys upon arrival in the area. Drift buoys would have allowed searchers to track them by satellite to ascertain the currents, so that when pieces were found, the drift could be analyzed to determine a probable impact point.32 Deployment of drift buoys by search and rescue aircraft is one of the recommendations of the investigation.

  The vertical stabilizer itself shows evidence of damage in the vertical plane from forces that exceeded 36 g’s. Symmetrical compression damage indicates that the destructive force was vertical, not lateral. Cracks and fractures in the structure itself, as well as the rudder/stabilizer attachment hinges bear this out. The center and aft attachment points took parts of the airplane structure with it. The forward attachment point was missing.

  Consider that the airplane’s vertical speed was over 10,900 feet per minute, or 123 mph in the vertical plane. Imagine what happens when a steel car is driven into a solid object (as the water would be in this case) in excess of 100 mph. It is no mystery that the aluminum and honeycomb tail should break off on impact with this tremendous force. The debris field on the ocean bottom reveals that the vertical stabilizer did not simply break off. The entire aircraft was severely broken up on impact, the vertical stabilizer being one of the largest pieces remaining. On the ocean bottom the main debris field covered a 600 x 1,800 foot area. Other parts scattered farther. A 20-foot section of the fuselage wall with 11 windows was found a mile and a quarter away. The few parts of the wings that were found indicate that the wings were completely torn apart on impact.

  The vertical stabilizer is a mostly hollow, aluminum, honeycomb, and composite structure, with no heavy internal components other than three hydraulic actuators. It is no wonder that it would float.

  This is in stark contrast to the American flight 587 accident, in which the vertical stabilizer separated from the aircraft in flight after departure from New York’s JFK airport, and the airplane subsequently lost control. In this accident the tail was ripped from the airplane due to excessive side-to-side forces resulting from the first officer's "unnecessary and excessive" rudder inputs.33 Tests reveal that the rudder input exceeded twice the design load limit. No fault was found with the structural integrity of the parts, though that did not stop people from blaming it on the composite structure.

  The damage to the vertical stabilizer in that accident was quite different to that of AF447. Failure was due to excessive lateral loads, not vertical. The only thing in common between the two was that they were both Airbus vertical stabilizers that became separated from the rest of the fuselage, one in flight and one on impact.

  The AF447 flight recorder tracings also provide evidence that the rudder and vertical stabilizer were intact until impact with the water. In the following parameter tracings you can see the direct correlation between the rudder commands, rudder position, and the resulting roll and drift angles of the airplane.

  For a large portion of the flight segment the first officer’s sidestick is moving left to right with corresponding changes in roll
and drift angle. But during the periods of time where the sidestick command and aileron positions were constant, the roll and drift angles correlate to the rudder commands and position. This could not happen if the rudder was not there.

  In the image above, I have drawn a vertical green line during a period of time when the sidestick input was constant, but the rudder commands and recorded position were in motion. You can see that there is a direct correlation between the rudder parameters and the resulting changes in the drift and roll angles.

  Additionally, if the vertical stabilizer and rudder had separated from the fuselage in flight there would not be rudder position parameters to record.

  I believe that it is possible that the yaw damper helped keep the airplane from spinning in, as two other pitot related accidents in Boeing aircraft had done (Northwest Airlines flight 6231, and Birgenair Flight 301).

  Post-Crash Communications

  Not having heard from Air France 447 from the time they were to have entered his airspace, the Dakar controller asked the Atlantico controller for further information on the flight, because he had no flight plan data. Atlantico supplied the data and the Dakar controller created a flight plan based on previously given estimates. But Dakar had neither radar nor ADS contact with the airplane and thus the flight remained virtual in his system.

  At 02:47 (33 minutes after the crash) the Dakar controller coordinated with the next sector, Sal, with an estimate for POMAT (the boundary between Dakar and Sal control areas). Unknown to them, the flight had crashed 33 minutes prior. Dakar informed Sal that AF447 had not established contact with him.

  Over an hour later, at 03:54, the Sal controller called Dakar to confirm the estimate for POMAT, which had been 10 minutes prior, and surmised that the estimate was for later. The Dakar controller said he would try to contact the flight.

  At 04:07 the Sal controller was again in contact with Dakar again asking about AF447. He noted that he had established radar contact with AF459, who was 30 minutes in trail of AF447, but had not seen AF447.

  At 04:11 Dakar asked AF459 to contact AF447. 11 minutes later AF459 passed the POMAT waypoint and reported that they had not been successful in contacting AF447, but had sent a message to Air France so that the airline could attempt contact.

  Air France’s Operations Control Center (OCC) attempted to send an ACARS message to the flight, but it was rejected.

  There were a series of phone contacts between the Atlantico, Dakar, and Sal controllers attempting to confirm exactly where AF447 had been and at what time.

  At 05:01 Dakar, still trying to figure out where the flight was, contacted the CANARIES controller in the area north of his, asking if he was in contact with AF447. He replied that he had no information.

  Between 05:11 and 05:26 Air France continued to try to contact the flight over a dozen times via ACARS and SATCOM calls. Within that time the Air France maintenance deputy shift supervisor requested information on the automatic error messages that had been received from the flight. It was noted that the problem seem to be located in the pitot tubes, and there had been messages concerning the flight controls. The maintenance officer noted that he had seem similar messages before from airplanes passing through storms, but there were no communication errors reported.

  At 05:23, over three hours after AF447 had crashed, Atlantico-Recife ARCC (Aeronautical Rescue Control Center) registered the disappearance of the AF 447 and triggered the Search and Rescue (SAR) process which consisted initially of gathering information.

  At 05:30 the Air France OCC dispatcher called the CANARIAS controller, from whom he could not obtain any further information on AF447. The CANARIAS controller said that he could only contact the Sal center and had no contact with the Atlantico center. The controller added that given the time, he should have had AF447 in radar contact but that the flight was not in his air space or in Sal’s. The CANARIAS controller and the dispatcher agreed to try and contact the Atlantico center and to keep each other informed.

  At 05:37 the OCC maintenance shift supervisor and the maintenance center officer were anxious about the last ACARS message at 02:14 mentioning cabin vertical speed and the lack of radio contact with any control center.

  At 06:35, after several exchanges between controllers, the Madrid controller confirmed to the Brest controller that flight AF447 was in the Casablanca FIR and would enter the Lisbon FIR within 15 minutes. This information was immediately transmitted to Cinq Mars la Pile ARCC and to Air France OCC.

  Shortly thereafter The OCC told the Brest controller that the Casablanca center was in contact with the crew of flight AF 4595. This information was retransmitted to the Madrid and Lisbon controllers.

  Three phases of alerts are supposed to happen when contact with an aircraft is lost:

  INCERFA (uncertainty phase), when no communication has been received from the crew within a period of 30 minutes after a communication should have been received.

  ALERFA (alert phase), when subsequent attempts to contact the crew or inquiries to other relevant sources have failed to reveal any information about the aircraft.

  DETRESFA (distress phase), when further inquiries have failed to provide any information, or when the fuel on board is considered to be exhausted.

  But there had been some confusion about what agency was expected to trigger the appropriate alerts.

  At 06:57, the OCC shift supervisor informed the CNOA (the French military body in charge of the aerial resources assigned to the French RCC) that Casablanca was not in contact with flight 447 after all. The CNOA asked if an uncertainty phase had been set off by a control center and if foreign search and rescue organizations had been alerted. The OCC answered that for the moment it was the control centers who were questioning the situation among themselves.

  Between the hours of 05:30 and 08:00 numerous calls between the various air traffic control centers and Air France were made. There was no protocol between the various control centers to be able to make inquiries directly about the presence of an airplane. There were only protocols between adjacent control centers. At one point, the Atlantico-Recife ARCC asked the Air France station manager at Rio if he had the numbers of the Casablanca and Lisbon control centers. He did not.

  At 07:26, the Brest and Bordeaux center controllers (in France) were surprised that following so many exchanges between the various centers, no critical INCERFA / ALERFA / DETRESFA type phase had been triggered.

  At 07:55, the Madrid duty officer and Madrid ARCC were surprised that everyone was requesting information on this flight but that no-one had yet triggered the INCERFA or ALERFA phases. The air traffic controller questioned whether it was for him to trigger these phases. The Madrid ARCC pointed out to him that if radar and radio contact was lost a DETRESFA phase would have to be triggered directly.

  At 08:00 (9am in Paris), Air France set up a crisis group.

  At 11:04 the first Brazilian plane took off to begin search and rescue (SAR) operations.

  From the last contact with AF447, it took three and a half hours before the SAR process was put into effect, and nine hours to launch the first search aircraft.

  The failure of the ADS logon prevented the immediate alerting of ATC of the flight’s diversion from the normal path and altitude, and delayed the awareness that the airplane was in any kind of trouble for almost three hours. The absence of position data that could have been transmitted by ADS-C contributed to the hours it took to fully realize the flight was missing, the five days it took to locate the floating debris, and the nearly two year delay in locating the sunken wreckage.

  Due to the confusion and poor communications among the various agencies, the BEA recommended that ICAO ensure the implementation of SAR coordination plans or regional protocols covering all of the maritime or remote areas for which international coordination would be required in the application of SAR procedures, including in the South Atlantic area.

  A more detailed chronology of the communications between the various agencies can be f
ound in Appendix 4 of the Final Report, (SAR Communications) found at: http://www.bea.aero/docspa/2009/f-cp090601.en/PDF/annexe.04.en.pdf

  ACARS Messages

  When the aircraft was first lost, one of the only clues as to what happened was a series of maintenance messages automatically downlinked from the airplane in the final minutes of the flight to the Air France maintenance department.

  Virtually all airliners use a system commonly referred to as ACARS. ACARS (Aircraft Communications Addressing and Reporting System) allows for message transfers between the airplane and airline, and some Air Traffic Control functions through the system as well (clearances, ATIS, etc.). The worldwide communications infrastructure is run by several companies the provide the ground radio stations, contract for communications satellites, and other communications services. On the A330, the aircraft’s communications system can switch between air-to-ground VHF radio and SATCOM in order to be able to send and receive messages anywhere in the world. The system is used for a variety of purposes including sending text messages between the crew and company (e.g., dispatchers, arrival stations, etc), and automatically reporting takeoff and landing times, position reports, requesting weather, clearances, etc. Though voice radio relays and Satellite phone are normally available, most routine en route communications between the airplane and the airline are accomplished through ACARS.

  In addition to the overt messaging between the crew and airline, a fair amount of other messaging takes place behind the scenes that is totally transparent to the crew. This may include such things as sending periodic engine data readings for maintenance monitoring of engine condition, reports of events such as pushback, takeoff, and touchdown times; and reporting of known maintenance events.