The crash of Air France flight 447 from Rio to Paris last year is one of the most mysterious accidents in the history of aviation. After months of investigation, a clear picture has emerged of what went wrong. The reconstruction of the horrific final four minutes reveal continuing safety problems in civil aviation.
One tiny technical failure heralded the impending disaster. But the measurement error was so inconspicuous that the pilots in the cockpit of the Airbus A330 probably hardly noticed it.
Air France flight 447 had been in the air for three hours and 40 minutes since taking off from Rio de Janeiro on the evening of May 31, 2009. Strong turbulence had been shaking the plane for half an hour, and all but the hardiest frequent flyers were awake. Suddenly the gauge indicating the external temperature rose by several degrees, even though the plane was flying at an altitude of 11 kilometers (36,000 feet) and it hadn't got any warmer outside. The false reading was caused by thick ice crystals forming on the sensor on the outside of the plane. These crystals had the effect of insulating the detector. It now appears that this is when things started going disastrously wrong.
Flying through thunderclouds over the Atlantic, more and more ice was hurled at the aircraft. In the process, it knocked out other, far more important, sensors: the pencil-shaped airspeed gauges known as pitot tubes.
One alarm after another lit up the cockpit monitors. One after another, the autopilot, the automatic engine control system, and the flight computers shut themselves off. "It was like the plane was having a stroke," says Gérard Arnoux, the head of the French pilots union SPAF.
The final minutes of flight AF 447 had begun. Four minutes after the airspeed indicator failed, the plane plunged into the ocean, killing all 228 people on board.
Few airline crashes in recent years have subsequently unnerved passengers to quite the same extent. "How was it possible that an Airbus from such an apparently safe airline could simply disappear?" they wondered.
Passengers on the Rio-Paris route are still uneasy as they board their plane. After the accident, the flight number was changed to AF 445. Many frequent flyers have since opted for daytime flights across the Atlantic because pilots can recognize storm fronts more easily during the day.
Another large-scale search for the stricken plane's "black box" flight recorders is due to begin in the coming weeks. Once again some 2,000 square kilometers (800 square miles) of mountainous ocean floor will be swept, some of it by a submarine from from the northern German city of Kiel. "We shouldn't speculate about the causes of the accident until the search has been completed," says Jean-Paul Troadec, the director of the French air crash investigation agency BEA.
Other experts are less guarded in their comments. "We know pretty well why the accident happened," says union boss Arnoux.
'An Accident Like This Could Happen Again'
Over the course of several months of investigation, experts have gathered evidence that allows them to reconstruct with relative accuracy what happened on board during those last four minutes. It has also brought to light a safety flaw that affects all jet airplanes currently in service. "An accident like this could happen again at any time," Arnoux predicts.
Experts reconstructed dozens of incidents involving Airbus planes to try to piece together the puzzle of this particular disaster. Plane wreckage and body parts give crucial clues as to what brought the plane down. Crash investigators also conducted detailed analyses of the 24 automatic fault messages that the aircraft sent to Air France headquarters by satellite in the run-up to the accident. One particular message -- the very last one transmitted before impact -- could solve the mystery surrounding flight AF 447.
A half moon lit up the Atlantic Ocean on the night of May 31, offering reasonably favorable conditions for a flight through the dangerous intertropical convergence zone. That's where violent thunderstorms rage and columns of thick clouds bar the way like an aerial obstacle course. In addition to the on-board radar, the moon helps pilots identify dangerous cloud formations and take appropriate measures.
On the night of the tragedy, other planes diverted their flight paths and took a detour around the danger zone.
Why then did flight AF 447 head straight into the deadly storm system? Is it possible that the tragedy began even before the plane took off?
Galeão Airport, Rio de Janeiro, 6pm local time: Preparation for takeoff
Captain Marc Dubois, 58, goes through the flight plan of AF 447: He enters a starting weight of 232.757 tons into the on-board computer, 243 kilograms less than the maximum permissible weight for the A330. As well as the passengers' luggage, the ground crews load 10 tons of freight into the cargo bay. Dubois has more than 70 tons of kerosene pumped into the fuel tanks. That sounds a lot more than it actually is, because the plane consumes up to 100 kilograms of kerosene every minute. The fuel reserves don't give much leeway.
It's only by means of a trick that the captain can even reach Paris without going under the legally required minimum reserves of kerosene that must still be in the plane's tanks upon arrival in the French capital. A loophole allows him to enter Bordeaux -- which lies several hundred kilometers closer than Paris -- as the fictitious destination for his fuel calculations.
"Major deviation would therefore no longer have been possible anymore," says Gerhard Hüttig, an Airbus pilot and professor at the Berlin Technical University's Aerospace Institute. If worse came to worst, the pilot would have to stop and refuel in Bordeaux, or maybe even in Lisbon. "But pilots are very reluctant to do something like that," Hüttig adds. After all, it makes the flight more expensive, causes delays and is frowned upon by airline bosses.
After takeoff, Dubois quickly takes the plane up to a cruising altitude of 35,000 feet (10.6 kilometers), an altitude known as "flight level 350." According to his kerosene calculations, he has to climb far further, to above 11 kilometers, where the thin air reduces his fuel consumption.
It's not known whether he actually reached this altitude. Three hours after leaving Rio, Captain Dubois contacted Brazilian air traffic control for the last time. "Flight level 350," he reported. It was to be his last communication with the outside world.
Part 2: Minute One: The Sensors Fail
It's hard to imagine a more precarious situation, even for pilots with nerves of steel: Flying through a violent thunderstorm that shakes the entire plane as the master warning lamp starts blinking on the instrument panel in front of you. An earsplitting alarm rings out, and a whole series of error messages suddenly flash up on the flight motor.
The crew immediately recognized that the three airspeed indicators all gave different readings. "A situation like that goes well a hundred times and badly once," says Arnoux, who flies an Airbus A320 himself.
The responsible pilot now had very little time to choose the correct flight angle and the correct engine thrust. This is the only way he could be certain to keep flying on a stable course and maintain steady airflow across the wings if he didn't know the plane's actual speed. The co-pilot must therefore look up the two safe values in a table in the relevant handbook -- at least that's the theory.
"In practice, the plane is shaken about so badly that you have difficulty finding the right page in the handbook, let alone being able to decipher what it says," says Arnoux. "In situations like that, mistakes are impossible to rule out."
Danger of Icing Up
Aerospace experts have long known how dangerous it can be if the airspeed indicators fail because the pitot tubes ice up. In 1998, for example, a Lufthansa Airbus circling over Frankfurt Airport lost its airspeed indicator, and a potential tragedy was only averted when the ice melted as the plane descended. At the time, German air accident investigators at the German Federal Bureau of Aircraft Accident Investigation (BFU) in Braunschweig demanded that the specifications of the pitot tubes be changed to enable "unrestricted flight in severely icy conditions."
As early as 2005, the French aerospace company Thales, which manufactures the pitot tubes used on flight AF 447, set up a project group called Adeline to search for new technical solutions to the problem. According to a Thales document, loss of the airspeed indicators "could cause aircraft crashes, especially in cases in which the sensors ice up."
Aircraft manufacturer Airbus was well aware of the shortcomings of the Thales pitot tubes. An internal list kept by the airline manufacturer shows there were nine incidents involving them between May and October 2008 alone.
More than two months before the Air France crash, the issue had been raised at a meeting between Airbus and the European Aviation Safety Agency. However, the EASA decided against banning the particularly error-prone pitot tubes made by Thales.
In fact, the problem with the airspeed indicators lies far deeper. To this day, the relevant licensing bodies still only test pitot tubes down to temperatures of minus 40 degrees Celsius (minus 40 degrees Fahrenheit) and an altitude of about 9,000 meters (30,000 feet). These completely antiquated specifications date back to 1947 -- before the introduction of jet planes.
What's more, most of the incidents of recent years, including that involving the ill-fated flight AF 447, occurred at altitudes above 10,000 meters (33,000 feet).
Part 3: Minute Two: Loss of Control
Did the pilots on flight AF 447 know about the airspeed indicator failures experienced by colleagues on nine other aircraft belonging to their own airline? Air France had indeed distributed a note about this to all its pilots, albeit as part of several hundred pages of information that pilots find in their inbox every week. One thing is certain: The pilots on flight AF 447 had never trained in a flight simulator for a high-altitude breakdown of the airspeed indicator.
The situation in the cockpit was made even more difficult by the fact that the flight computer of the A330 put itself into a kind of emergency program. The plane's digital brain usually supervises all activity by its pilots -- at least, as long as its sensors provide reliable data. Without a speed reading, the computer more or -less throws in the towel, which doesn't make things easier for the pilots.
"The controls suddenly feel completely different to the pilot," says flight expert Hüttig. The sheer complexity of the Airbus' systems makes it difficult to control in critical phases of the flight. It would be easier for pilots if they could simply switch the computer off in critical situations, as is possible on Boeing planes.
Pitot tubes sometimes also fail on Boeing aircraft. When SPIEGEL contacted the American Federal Aviation Administration, the body which oversees civilian flight in the US, the FAA confirmed that there had been eight such incidents on a Boeing 777, three on a 767, and one each on a 757 and a Jumbo. Boeing is currently conducting a study on the safety effects of "high-altitude pitot icing on all models in its product line," says FAA spokeswoman Alison Duquette. The FAA did not, however, identify "any safety issues arising" during these incidents.
Could it therefore be that the flight computer, which is hard to manage in emergencies, actually contributed to the loss of control by the Airbus pilots? Air-safety experts Hüttig and Arnoux are demanding an immediate investigation into how the Airbus system reacts to a failure of its airspeed sensors.
Unexpected Reaction
In early March, the BFU in Germany is due to publish the findings of its investigation into the near-crash of a Lufthansa A320 two years ago at Fuhlsbüttel Airport in Hamburg, a report that will undoubtedly prove uncomfortable reading for Airbus. In that incident, an unexpected reaction by the flight computer caused the jet's left wing to scrape along the runway while landing. The BFU is due to issue 12 safety recommendations, some of which concern Airbus' computer programs.
So far, it's unclear who was controlling the Air France plane in its final minutes. Was it the experienced flight captain, Dubois, or one of his two first officers? Typically, a captain retreats to his cabin to rest a while after takeoff. Indeed, there's corroborative evidence to suggest that the captain was not sitting in the cockpit at the time of the crash: His body was recovered from the Atlantic, whereas those of his two copilots sank to the bottom of the ocean still attached to their seats. This would suggest that Dubois was not wearing a seatbelt.
In contrast to many other airlines, it is standard practice at Air France for the less experienced of the two copilots to take the captain's seat when the latter is not there. The experienced copilot remains in his seat on the right-hand side of the cockpit. Under normal circumstances, that is not a problem, but in emergencies it can increase the likelihood of a crash.
As a consequence, it was probably the plane's third pilot, Pierre-Cédric Bonin, a dashing amateur yachtsman, who steered the aircraft to its doom. Bonin's wife was also on board, while their two children were at home with their grandfather.
Part 4: Minute Three: Freefall
Not long after the airspeed indicator failed, the plane went out of control and stalled. Presumably the airflow over the wings failed to provide lift. Arnoux, from the pilots' union, estimates that the plane fell toward the sea at about 42 meters per second (95 mph) -- almost the same speed as a freefalling parachutist.
Arnoux's version of events is based in part on the timing of a transmitted error message about the equalization of pressure between the cabin and the outside of the plane, which usually happens at 2,000 meters (7,000 feet) above sea level. Had the airplane nosedived, this alarm would have been triggered earlier. "It takes almost exactly four minutes to freefall from cruising altitude to sea level," Arnoux says.
According to this scenario, the pilots would have been forced to watch helplessly as their plane lost its lift. That theory is supported by the fact that the airplane remained intact to the very end. Given all the turbulence, it is therefore possible that the passengers remained oblivious to what was happening. After all, the oxygen masks that have been recovered had not dropped down from the ceiling because of a loss of pressure. What's more, the stewardesses weren't sitting on their emergency seats, and the lifejackets remained untouched. "There is no evidence whatsoever that the passengers in the cabin had been prepared for an emergency landing," says BEA boss Jean-Paul Troadec.
Two seemingly insignificant lines from the warning reports transmitted by the aircraft show how desperately the pilots fought to keep control. They read "F/CTL PRIM 1 FAULT" and "F/CTL SEC 1 FAULT".
This somewhat cryptic shorthand suggest the pilots tried desperately to restart the flight computer. "It's like trying to turn your car engine off and then on again while driving along the motorway at night at 180 kilometers an hour (110mph)," says Arnoux.
The attempt to resuscitate the on-board computer proved unsuccessful. For the last 600 meters (2,000 feet) before impact, the pilots' efforts would have been accompanied by the chilling calls of an automated male voice: "Terrain! Terrain! Pull up! Pull up!"
Part 5: Minute Four: Impact
More than 200 tons of metal, plastic, kerosene and human bodies smashed into the sea. The sheer force of the impact is described in the forensic report, which lists in graphic detail how lungs were torn apart and bones were shredded end to end. Some of the passengers were sliced in half by their seatbelt.
Much of the debris that has been recovered is no larger than a square meter (10 square feet). The shear-lines run at a conspicuous angle. This shows that the plane did not plunge vertically into the sea, but rather hit the water like a flat hand, with the nose of the aircraft pointing upwards at a five-degree angle. Of particular interest is the large tailfin that was recovered from the ocean by the Brazilian navy. This was ripped from its anchoring and catapulted forwards. From this, it can be deduced that the A330 was brought to a halt with a force more than 36 times that of normal gravity: 36g.
Although Airbus continues to play down the significance of the pitot tubes in the crash of its A330, the company's engineers have since developed new technologies that will detect the breakdown of airspeed sensors even before takeoff. Airbus registered a patent for this technology in the US on Dec. 3, 2009. In the words of the patent application, errors in speed measurements "can have catastrophic consequences."
For several years now, Airbus has offered its customers a special safety program - called "Buss" -- at a cost of €300,000 per aircraft. If the airspeed indicator fails, this software shows pilots the angle at which they must point the plane.
Up to now, Air France has chosen not to invest in this optional extra for its fleet.
