“The crash that shouldn’t have happened”: the big picture behind Air France 447.
Retired pilot, union representative and investigator Gérard Arnoux wrote a book on the causes of the first modern air disaster, that of Air France 447 on June 2009. As to be expected, he takes the side of the pilots and criticizes some important features of the aircraft as well as mistakes by the ruling bodies in aviation.
A long curriculum in French aviation
“A collective failure of the major players of airline transportation, followed by a deliberate falsification and an investigation aimed at blaming the pilots”, that’s the intro of “Rio-Paris is not responding,” and it sets the tone of this investigation of “a referential accident which has become a case study for global aviation safety.”
Arnoux focuses on a series of errors and mistakes made by Airbus, the French Directorate for Civil Aviation (DGAC), Air France and the French Bureau for Aviation Accident Investigation (BEA).
Now retired as a commercial pilot, Arnoux earned his stripes in the 70’s as a bush pilot, before becoming a captain at the French regional airline Air Inter. When this airline was absorbed by Air France, he became a Captain at the French national airline in 1989. During his career, Arnoux not only developed friendships with old school captains like Marc Dubois (who perished on that fateful night of June 1, 2009), he also saw the rise of the European plane manufacturer Airbus and how automation began to make its way into the cockpit. Actually, the Airbus Captain has both the experience of the older generation of pilots, like the crews at Air Inter which had standard Angle of Attack Indicators on their planes (and for which Arnoux makes a strong case), as well as that of the younger generation of pilots who rely more on automation and flight directors.
The deferral of the authorities to replace the faulty Thales probes
One of the most obvious mistakes on the Airbus 330 was permitting the use of Thales AA pitot probes, even though they tended to experience high altitude crystal icing. Before June 2009, there had been several incidents — some of them almost fatal — involving those speed sensors, for instance in two occasions with an Airbus 330–200 of Air Caraïbes Atlantique in 2008.
This information is not new, but having somebody from the inside — both pilot and investigator — is always good for interesting details like the fact that “the certification standards for pitot probes until 2009, did not take in account high altitude icing and all parties knew this, except … for the pilots.”
Arnoux makes the correct assumption that without the failure of the flawed speed sensors on Flight 447, there would not have been an accident. He pinpoints this as the first hole in the dam, the famous first layer of Swiss cheese where the whole safety system started to fall apart.
The author is also quite critical of the French BEA’s 2012 report because it downplays the problems of the dysfunctional speed sensors as the primary cause of the crash. “The BEA sought to minimize the role played by the pitot tubes in the accident of AF447 because it did not act earlier as it should have, undertaking an investigation into those flawed sensors, as it was supposed to do according to the law or as its German counterpart (BFU) did, raising an alarm about high altitude icing in 1999. Especially after the dramatic rise in cases in 2008, an investigation (into the icing of Thales pitot probes) would have been appropriate.”
In this book, the BEA is also criticized for its decision-making after the crash and especially in trying to locate the wreck in the wrong place. Arnoux has dedicated a whole chapter (Chapter III) to the different search operations. The wreckage of AF447 was finally ound in 2012 following several frustrated search operations, after the US company Woods Hole stepped in, using the same sonar equipped Autonomous Underwater Vehicles (AUV’s) the company used to locate the underwater wreck of the Titanic.
Looking in the wrong place
According to Dick Limeburner of Woods Hole, interviewed by co-author Roger Rapoport, “It is hard to understand why they (the BEA) did not use a sonar or a AUV in the first search and rescue operation, in the zone of 10 nautical miles starting from the last trajectory of the plane (indicated by the FMS). The search party did use a sonar for the second operation in the summer of 2009…”
According to Limeburner, during the second search operation, which was led by the French vessel “Le Pourquoi pas?” (lit: “the why not?”), the BEA used a sonar to search a much bigger zone, namely 300 square nautical miles but further south and southeast of the last known position.”
“I am convinced that if they would have done the same thing from the last known position [during the first search], they would have found it,” says Limeburner.
With regard to the second, third and fourth search operations, Arnoux is baffled that the BEA focused so far from the last known position. “The French agency justified its decision by arguing that they were taking into account the speed of the aircraft since the accident took place 5 minutes after the first problems were reported to maintenance. As such, they believed it would be located within 75 kilometers from the last known position, leaving a surface of 17,000 square kilometers,” says Arnoux.
For Arnoux this was a gross error. Actually the pilot union over which he presided (Syndicat des Pilotes d’Air France or SPAF) issued a press release in early 2010, cited by German magazine Der Spiegel, in which the union declared that “it was evident this plane had suffered a stall and that is should be searched within the vicinity of a maximum 20 kilometers around the last known position.”
The fourth search operation was successful and the plane wreck was located at exactly 6.5 nautical miles (10 kms) north of the last known position. That is very close to what Arnoux and SPAF had predicted. However, three years had gone by, enormous amounts of money had been spent and victims’ families had been anxiously awaiting news every day.
Lack of international cooperation
Obviously, it´s always easier to criticize after the fact. In truth, the BEA and the French government desperately tried to locate the wreck, whatever mistakes were made in the process.
Another critique of the search and rescue operations is that there was no fluid cooperation between the countries involved and Arnoux offers insight on that too. Brazil and France, the two nations directly involved in the crash, sought to take the initiative regarding the rescue and tried to monopolize the search instead of accepting help from other nations.
The author quotes Paul Allen of the US Coast Guard, the French BEA denied an offer of assistance from the US Coast Guard. Apparently, the Brazilian Marines did the same, and valuable time was lost. “It looked like it were a trophy hunt for the best search party. National pride was at stake, a determining factor,” said Paul Allen. In fact, the help that the US Coast Guard had offered included a Hercules C130 to drop Self-locating datum marker buoys (SLDMB’s) at the last known position. These buoys mark the sea currents and make it much easier for search operations to track the possible location of the wreck. Since the Brazilians and the French refused this offer, the search operation started with a five-day delay — on June 6 when the first debris and victims were spotted by the cargo vessel Ursula. “From that point, the current had to be calculated backwards, which is quite speculative, and precious time was lost,” Arnoux concludes. However there was cooperation between France and the US Navy, who provided the first search operations with a towed pinger locater (TPL)
Failures in training
The most interesting part of “Le Rio-Paris ne répond plus” comes from the inside information Arnoux has as an Airbus and Air France pilot.
There has been a lot of criticism of the AF447 pilots, especially co-pilot Pierre-Cédric Bonin, on how they handled the plane after the disconnection of the autopilot, but this is very hard for a non-pilot to grasp. Nobody can get in the heads of the pilots, and more importantly, nobody knows exactly what information the co-pilot had on the screen (the FDR only records the data of the captain’s instrument panel). And furthermore, we don’t truly know what the pilots were trained for and what they were not.
In addition, no pilot at a major airline was getting trained for how to get out of a high-altitude stall. Only after the crash of Air France Rio-Paris in 2009 did airline companies begin to offer training on high altitude stalls in simulators. Arnoux cites his colleague pilot and investigator Shem Malmquist who wrote the book “Angle of Attack” in 2017 on the same subject: “We don’t have real data on how big aircraft with swept-wings behave. This has nothing to do with the behavior of a small plane, where most pilots learn stall recuperation. On these aircraft, stall recovery is much easier; those aircraft will mostly escape the stall on its own as long as the pilot does not pull the yoke. Many pilots thought that the same principle applied to the big airliners, independent of the altitude. Because stalls on commercial aircraft are still a very rare phenomenon.”
Malmquist himself became the first author to actually recreate the event of a stall on a correctly modeled simulator, in a FAA test facility in Atlantic City. “On February 2016, his journey began in the left seat, flying at 35,000 feet at Mach 0.82, or 82% of the speed of sound. The simulator operator programmed in the failure of all three pitot systems. Airspeed indications disappeared, and that was immediately followed by an autopilot disconnect and numerous alerts. … At a predetermined point, when Malmquist was commanded to recover from the stall and he pushed full forward on the side stick, the plane kept rolling left and right. Finally, the nose began to drop. As the stall continued, the airplane plunged into a steep dive, with the nose dipping nearly 20º below the horizon… After an excruciating nearly 10,000-foot fall, the plane accelerated to a point where it was safe for Malmquist to recover from the dive and pull up. Even though he expected this crisis and was an experienced instructor for large transport jet airplanes, the stall recovery maneuver was slow and treacherous. Recovery from an actual stall in a real aircraft under those conditions would be far more challenging.”
The conclusion from Arnoux seems to be that by 2009 not only wasn’t there any stall recovery training in place for large commercial aircraft, but it generally seemed almost impossible to recover from a stall at high altitude. This makes it so much more important to prevent a stall and to make pilots aware of the signals leading to it.
A dedicated Angle of Attack instrument
This leads us to the flawed stall alarm on the Airbus 330, which switched on and off, giving the pilots the impression that it was a spurious fault. In moments of high workload and multiple failures (“It seems that nowadays with fully integrated systems, there are no longer stand-alone (isolated) faults,” to cite the Argentinean Aviation Safety specialist Mariano Magariños), Arnoux believes it is imperative that pilots are not overwhelmed by information — especially contradictory information. And this information comes in a hierarchical way, which is often not the case for malfunctions displayed on the ECAM-screen.
In that respect Arnoux cites an April 2019 report of the Australian Transport Safety Bureau (ATSB) regarding a serious incident in September 2015 with a Virgin Australia Airbus 320 near Perth. Multiple alerts were generated including erroneous airspeed because of the simultaneous blockage of the pitot probes with water.
“Due to the limited space in the alert message area, the NAV ADR DISAGREE alert was initially pushed off the screen by engine related alerts that were programmed to have a higher priority.” This confused the pilots who later dismissed a real stall alarm as spurious.
According to the ATSB, although the aircraft manufacturer updated the aircraft’s software, there is an underlying problem that on “on modern aircraft with multiple interacting systems, there can be many layers between the source information and the flight crew. In such systems where there is erroneous information from a source, it is important that alerts and procedures be designed to ensure that the flight crew can correctly diagnose the source of the erroneous information,” according to the ATSB. “Unless it is absolutely clear that it is erroneous, pilots should appropriately respond to stall warning alerts.”
Apart from an analysis of everything that went wrong on the fateful day of June 1, 2009, Arnoux also provides a list of recommendations for avoiding these sorts of accidents. One of his strong suggestions is the inclusion of Angle of Attack indicators on every commercial aircraft. In fact, Arnoux says, on an Airbus this an optional feature and most airlines, except for American Airlines, did not opt for this cheap and original instrument. “This touches the heart of the dogmatism of aircraft constructors that recklessly leave the pilots outside of the safety circle in favor of automation. The computers use the angle of attack to activate the protections, but the pilots are unaware of it, until some of these protections are untimely triggered.” This angle of attack instrument should be mandatory according to Arnoux, who concludes, “As a result, nothing positive came out of the Air France crash, at least nothing that might have helped prevent the Boeing 737 MAX crashes.”
“Le Rio-Paris ne répond plus: AF447, le crash qui n’aurait pas dû arriver,” by Gérard Arnoux, l’Harmattan, Paris, 2019.
Tom Dieusaert wrote “Computer Crashes, when airplane systems fail” (2017) The updated version with the Boeing 737-MAX story is coming out in April.
