French Investigating Agency Releases Final Report From 2009 Accident

The French aviation accident investigating agency BEA has released its final report in the accident of Air France Flight 447, which went down in the Atlantic Ocean June 1st, 2009, resulting in the fatal injury of all 228 people on board.

In the report, which was presented Thursday by Jean-Paul Troadec, Director of BEA, and Investigator-in-Charge Alain Bouillard, BEA said the blockage of the pitot probes by ice crystals in cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident.

From an operational perspective, the resulting loss of all airspeed information was an identified malfunction. After initial reactions involving basic airmanship skills, it was supposed to be diagnosed by pilots, and managed if necessary by precautionary inputs on the pitch attitude and thrust detailed in the associated procedure. The occurrence of the failure in the context of flight in cruise completely surprised the crew of flight AF 447. The apparent difficulties in handling the aeroplane in turbulence at high altitude resulted in over-handling in roll and a sharp nose-up input by the Pilot Flying (PF). The destabilisation that resulted from the climbing flight path and changes in pitch attitude and vertical speed therefore added to the incorrect airspeed indications and ECAM messages that did not help any diagnosis. The crew, whose work was becoming disrupted, likely never realised they were facing a "simple" loss of all three airspeed sources.

In the first minute after the autopilot disconnection, the failure of the attempt to understand the situation and the disruption of crew cooperation had a multiplying effect, inducing total loss of cognitive control of the situation. The behavioural assumptions underlying the classification of a loss of airspeed information as "major" were not validated in the context of this accident. Confirmation of this classification therefore requires additional work in terms of operational feedback in order to modify, where necessary, crew training, the ergonomics of the information made available to them, as well as the design of procedures. The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood they were in a stall situation and therefore never undertook any recovery manoeuvres. The combination of the warning system ergonomics, the conditions under which pilots are trained and exposed to stalls during their professional and recurrent training, did not result in reasonably reliable expected behaviour patterns.

At present, recognition of the stall warning, even when associated with buffet, assumes that the crew assigns a minimum degree of "legitimacy" to the alarm. This in turn assumes sufficient prior experience with stall conditions, at least some cognitive availability and understanding of the situation, as well as knowledge of the aeroplane (and its protection modes) and its flight physics. A review of pilot training did not provide convincing evidence that the associated skills had been correctly developed and maintained.

More generally, the dual failure of the expected procedural responses shows the limits of the current safety model. When action by the crew is expected, it is always assumed that they will have the capacity to initially control the flight path and to rapidly diagnose and identify the correct entry in the dictionary of procedures. A crew may encounter an unexpected situation causing a momentary but profound loss of understanding. If, in such cases, the assumed capacity to initially control and then to diagnose is lost, the safety model is in "common failure mode". In this occurrence, the inability to initially control the flight path also made it impossible to understand the situation and find the appropriate solution.

Thus, the accident resulted from the following series of events:

• Temporary inconsistency between the measured speeds, likely as a result of the obstruction of the Pitot probes by ice crystals that caused the autopilot
• disconnection and the reconfiguration to alternate law.
• Inappropriate control inputs that destabilised the flight path.
• The lack of any link, by the crew, between the loss of displayed airspeed information and the appropriate procedure.
• The late identification of the deviation from the flight path by the Pilot Not Flying (PNF) and insufficient correction applied by the PF.
• The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope.
• The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.

These events can be explained by a combination the lack of effective feedback mechanisms on the part of those involved that made it impossible to identify the repeated non-application of the IAS procedure and to remedy this. It was compounded by the lack of practical training in high altitude manual aeroplane handling and in the procedure for speed anomalies.

Task-sharing was weakened by incomprehension of the situation at the time of autopilot disconnection, along with poor management of the startle effect, resulting in a highly charged emotional factor for the two co-pilots, and the lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers. The crew did not take into account the stall warning, which could have been due to a failure to identify the aural warning, the appearance at the beginning of the event of brief warnings that could have been considered as spurious, and the absence of any visual information to confirm the approach-to-stall after the loss of the characteristic speeds. There was also possible confusion with an overspeed situation in which buffet is also considered a symptom, Flight Director indications that may have confirmed the crew’s view of its actions, even though they were inappropriate, and difficulty in identifying and understanding the implications of the reconfiguration to alternate law with no angle of attack protection.

In addition to the 16 recommendations already issued in interim reports, 25 new safety recommendations have now been issued by the BEA. They include:

• Improve crew knowledge of aeroplane systems and changes in their characteristics in degraded or unusual situations.
• Complete practical crew training and improve the assimilation of theoretical basics, including on performance and flight mechanics.
• Develop and maintain a crew resource management (CRM) capacity.
• Improve simulator fidelity for a realistic simulation of abnormal situations.
• Provide guidance to crews to help them recognize and manage unusual situations.
• Improve the analysis of the operational risks related to human factors, and change procedures and training content.
• Deployment of SAR services and localization of wreckage.
• Accelerate the implementation of reliable means of communication, including in inhospitable areas.
• Review the organisation of search and rescue operations in case of accidents at sea.

(Images provided by BEA)

FMI: www.bea.aero/en/enquetes/flight.af.447/point.presse.05juillet2012.en.php