Imagine that you have bought a new car. It’s sleek and loaded with state-of-the-art technology. There is just one drawback. It comes with a caution that under certain and statistically very unlikely circumstances the brakes will fail. Because of this, the manufacturer urges you to take special training so that, in the event that you find yourself cruising at 60 mph without brakes you can regain control. Otherwise…don’t blame us, you have been warned.
That’s not unlike the situation described by French investigators at the Bureau d’Enquetes et d’Analyses (BEA) in their third and final report issued in Paris today on the crash of Air France Flight 447 in 2009. They persist in focusing the blame on the pilots, who mishandled the plane in an emergency, rather than on a cascade of serious technical failures that they say created the emergency.
The pilots are dead and can’t answer. Whereas those who designed, manufactured, and installed apparently flawed equipment, failing to remove it when they appear to have been faced with firm evidence that its malfunction could have lethal results, may all be partly responsible for the tragedy—and have so far escaped liability. (The BEA report found some fault with Airbus, the builder of the A330. Next week in Paris, French prosecutors will announce the results of a judicial inquiry in which manslaughter charges could be filed.)
Transoceanic flights like Flight 447, which was flying from Brazil to France, are now so commonplace and safe that, at the start, the fact that one could disappear over the south Atlantic without a trace was as alarming as it seemed mysterious. It was an extraordinary achievement to find, two years later and on the fourth attempt, the wreck of the Airbus A330 lying on a sandy plain nearly 13,000 feet under the sea. The flight data recorder and the cockpit voice recorder survived intact, and told their tale.
They described a terrifying experience in which all 228 people aboard perished. In less than five minutes the plane had fallen 38,000 feet, hitting the water at a velocity of nearly 11,000 feet a minute, enough to compress the cargo hold upwards through the cabin floor.
Today’s final report reaffirms that the pilots, having lost the systems that normally fly the plane automatically, were unable to gain control. The plane nosed up into a high-speed stall, where the wings no longer provide lift, and never recovered from the stall.
The copilots who were in charge before the captain got back to the flight deck had had no training in manually regaining control in this type of emergency—investigators insist that had Air France prepared them with a training program the situation should have been recoverable. (Today the investigators confused this issue by telling families of the victims, in advance of the press briefing, that only a “highly-trained military pilot” could have regained control. Challenged later on this by a reporter, they then said this applied only to the final dive, not to the onset of the stall, which should have been manageable.)
Air France also said today it was already training crews how to handle similar emergencies and to recover from stalls. But the BEA report is critical of current training methods which, it says “do not test the capacity to react to the unexpected.” It calls for higher standards in the selection and training of the instructors themselves.
The events that doomed Flight 447 began with the failure of an instrument that has been around for 100 years—almost as long as the history of flight—and which, in the case of the Airbus A330, cost around $3,500.
The instrument is a pitot (pronounced peetoe) tube. It measures air speed—not ground speed, but the speed of the airplane at altitude. Every A330 has three pitot tubes positioned around the nose, beneath the cockpit. Accurate indications of air speed are crucial to the stability of the airplane—at cruise height of 35,000 feet relatively small variations in air speed, either too slow or too fast, can lead to an aerodynamic stall, as they did in the case of Flight 447.
For at least two years before the Flight 447 disaster officials at the European Aviation Safety Agency, EASA, knew there were serious problems with the model of pitot tube installed on many Air France A330s, made by the French aerospace conglomerate Thales. EASA had reports of a “significant number of events” involving the Thales tubes which left the airplanes “with a large reduction in safety margins, Aviation Weekly reported in 2009.
The Thales tubes were failing in specific conditions that foreshadowed what happened to Flight 447—at cruise height while passing through weather in which ice crystals formed, according to last year’s BEA report. (Seventy-five percent of the A330 fleet is equipped with pitot tubes made by the American company Goodrich, and these have not had the same icing problems, according to the BEA report.)
From previous events reported by aircrews of several international airlines, all the evidence suggested that sudden flash freezing, involving ice crystals, overcame the heaters in the Thales pitot tubes and sent speed measurements haywire. When fed anomalous data from the tubes, the Airbus computers that flew the airplane, via the autopilot and auto engine throttles, were programmed to shut down, leaving the pilots to fly out of the emergency the old-fashioned way: manually. In the case of Flight 447 this happened under circumstances that challenged the pilots’ spatial awareness—at night and when the airplane was flying through storm turbulence.
The basic principle of the pitot tube, invented when airplanes were built of spruce and canvas and were barely able to top 100 mph, was that a forward-facing open tube captured the air flowing around the airplane and, via simple mechanisms, the air speed appeared before a pilot as a moving needle on a dial. This principle remained the same over decades as the instrument, along with airplanes, became more and more sophisticated. It seemed very reliable.
In fact, all pitot tubes in use on airliners today have to meet a certification standard established at the onset of the jet age, in the 1960s.
Captain Louis Jobard is an Air France pilot who speaks for one of the two airline pilots’ unions in France, the Syndicat National des Pilotes de Ligne, or SNPL. He has closely followed the record of the Thales pitot tubes, and insists that the safety standards written for pitot tubes in first-generation jets in the 1960s did not anticipate the conditions encountered by modern jets flying faster, higher, and for longer over transoceanic routes.
“Changing the certification for the tubes is still under discussion, three years after the accident” he told me. “The authorities have not done their job.”
In fact, in 2008, while EASA, Air France, and Airbus were all arguing between themselves and undecided on how to respond to the growing number of reported incidents that EASA had judged to be “hazardous,” a small independent carrier operating between France and the Caribbean, Air Caraibes, acted on its own initiative after serious icing events on two of its A330s, and replaced the older Thales pitot tubes with a revised version also manufactured by Thales. (Even though this revised version has not shown the same icing problems, it is still regarded as inferior to the Goodrich design by many experts.)
Ironically, on the very day that Flight 447 disappeared, June 1, 2009, Air France began removing the suspect model Thales tubes from its A330s and replacing them with the revised version – that change had not been made on the A330 operating as Flight 447 from Rio to Paris. All the Air France Airbuses were refitted by June 12.
A little more than two months after the disaster, EASA issued a directive mandating that all existing older Thales probes immediately be replaced, and in August 2009 the FAA followed suit, with an Airworthiness Directive affecting all U.S.-registered Airbuses.
Today’s BEA report didn’t not find fault with Thales, and the company was in compliance with legal standards, however out of date those standards seem to be. European and U.S. safety standards are now supposed to move in lockstep. EASA and the FAA are jointly responsible for any changes made to the certification of pitot tubes. Alison Duquette, a spokesperson for the FAA, told me this week that “EASA is keeping the FAA informed. We are not in a position to comment on timing.”
In response to the BEA report, EASA said it was proposing new standards for flight in icing conditions, and is taking part in research on high altitude icing. Requests for comment to Thales and Airbus were not answered.
Perhaps the most elusive part of the tragedy of Flight 447 is what exactly was it in the storm system that developed that night over the South Atlantic that decided the fate of 228 people?
Immediately after the disaster, Tim Vasquez, an expert in forecasting weather for airline routes, found high-definition satellite images of that storm system and, combining them with other weather data, constructed a vivid picture of the storm cells that had been cooking up for hours that night across the route between South America and Europe. He posted them on his website, along with some recondite weather-buff discussion and analysis.
The storm was typical of those found at the time of year in the intertropical convergence zone, where Atlantic trade winds meet equatorial systems. On the night of June 1, 2009, other flights ahead and behind Flight 477 had noted the formidable line of storms and turbulence, as did the crew of Flight 447 in the minutes before their computers quit.
Vasquez, who updated his research in response to data recovered from the flight recorders of Flight 447, ruled out lightning as a cause. One of his graphics shows that at the heart of the storm the roiling clouds rose to 20,000 feet above the flight path. He concluded that turbulence, and possibly icing, “created the initial problem that led to a failure cascade.”
It was highly likely that sudden contrasts in high altitude temperatures, generated by the proximity of warm updrafts and cold downdrafts generated by the convection of air masses, created in one small piece of the sky and for a very short time the icing conditions that lay in wait for Flight 447, according to Vasquez.
But why did icing suddenly appear four or five years ago as a threat to flights through this and other storm-prone regions? Captain Jobard—along with others who have tried to explain this riddle—wondered whether global warming might be a factor. “It seems,” he told me, “that there is an increase in these kinds of storms.”
But Tim Vasquez does not agree. “I think we may be experiencing a climate shift” he says, “but this would not have any measurable effect on small scale processes like thunderstorms. Airliners all over the world go through a wide range of ice and water regimes every day, and there would be nothing new in what Flight 447 experienced.”
