In trying to determine the cause, it’s almost instinctive to focus on the pilot at the controls, since it was his inputs which led to the nose high pitch and stall.  Indeed, in all of the other cruise incidents where mis-matched speeds caused some combination of auto-pilot/auto thrust shutdown along with an alternate law operating environment, the flight crews managed the situation, either proceeding in level flight or engaging in a shallow descent.  The longest continuous period for the loss of valid air speed was 200 seconds in any of the recorded prior incidents.

But, regulators and airlines were aware of 32 prior cases where pitot tubes had been blocked and at least 13 previous incidents where flight crews were confronted with unreliable air speeds at cruise altitude under unfavorable weather circumstances.  At what point does an organization become chiefly responsible for recognizing that an anomaly with severe life-safety implications is neither rare nor unexpected?  When that realization occurs, what is the proper response to ensure readiness?

Since there seemed to be no easily available technologic solution to the problem other than changing to various types of pitot tubes, the requirement to fully prepare flight crews for continued occurrences was essential.  This raises the issue of what constitutes preparation.  BEA, the regulator, has pointed out that the AF-447 co-pilots were generally untrained in manual operation of the aircraft at cruise altitude and that they similarly had not been trained in dealing with unreliable air speeds at higher altitudes, either.

It’s both instructive and useful here to paraphrase the Air France action steps to address a problem:

-  If an anomaly is noted, inform the rest of the crew immediately

-  Officer-in-charge secures a stable environment (secure the aircraft flight path) and defines task-sharing

- Solve the problem using the following sequence:

a. confirm the problem

b. apply known procedures

c. assess the situation

d. make a decision on continuing

e. communicate decision

Significantly, it is deemed essential to verbalize the fact that a potential problem may exist and to then seek a stable environment while it is sorted out.

Among many changes made in the aftermath of AF-447 are two that stand out where communication and teamwork are concerned:

When a relief pilot is designated by the Captain they sit in the left hand seat and are the pilot not flying.

When a decision must be made, the copilot gives their opinion FIRST before the Captain, presumably to ensure honest and effective feedback.

AF-447 affords critical lessons in:

-  how organizations manage readily apparent risk,

-  employing decisive but measured action in a real-time emergency,

- the requirement for effective communication during problem-solving.

Today is the fourth in a five-part series exploring the loss of Air France Flight 447 and the lessons firefighters can learn about effective teamwork, communication and decision making in a high risk environment.

Air Speed and Pitot Tubes

The A-330’s computerized flight systems are critically reliant on reliable air speed data.  This information is gleaned from “pitot tubes”,  bullet-shaped devices that extend outside of the aircraft near the nose which are crucial in measuring air speed.  There are three on the A-330 for system redundancy and to provide data for a backup standby instrument system.

Blocked pitot tubes can render air speed calculations unreliable.  They have been the cause of previous incidents with other types of aircraft and airlines.  On the Airbus, blocked tubes would create a scenario where the air speeds were unreliable or absent and where normally available systems and protections would be eliminated because of the invalid speeds.  Despite the Airbus trademark systems of redundancy, critical functions would be lost and for that period, the survival of the flight would be based on the ability of the flight crew to maintain the aircraft in its safe flight envelope.

It is now posited that AF-447 flew into an area of ice crystals, and despite the fact that the pitot system was heated to prevent clogging, the crystals blocked the tubes and subsequently interfered with flight system operation.

There is a documented history of pitot tube blockage resulting in unreliable or inaccurate air speeds on the A-330.  Prior instances had been reported or documented and unreliable air speed indications are a frequent enough occurrence to require training for coping with them.  That training would center on flight with unreliable air speeds and controlling the aircraft manually at high altitudes.

Organizational/Human Factors

As the Captain reentered the cockpit, a catastrophe was unfolding:  the aircraft was falling at a rate of 9,000 feet per minute and the speed was dropping below 100 knots.  Neither copilot summarized the situation making his attempt at assessment even more impossible.  The nose of the aircraft was pitched up and the angle was increasing.  He had sesconds to diagnonse the problem and solve it.

When the Captain had originally left the cockpit for his rest break he had confirmed that the right-seat copilot was qualified to replace him as a relief pilot.  After his departure, this “acting captain” continued to fly the airplane.  The question arises as to whether this was the best use of resources.  In emergency environments is it better to have the commander removed from the point-of-contact so that he/she can attempt to gain a full picture and prescribe effective action?

The official reports remark on the evident lack of “synergy” between the two pilots in the cockpit during the emergency.  When the unreliable speeds occurred the pilots were aware of it but failed to call out the procedure to deal with the problem.  This raises a potentially serious organizational issue.  The pilots had been trained for the Unreliable Indicated Air Speed Emergency Maneuver but only at lower flight levels which called for adopting a pitch attitude of 10-15 degrees.  Documentation describing the speed problems with the A-330/340 fleet had been sent to flight crews.  For events where loss of life is the outcome of improper action is it essential to train realistically?  Does the dissemination of written material without follow-up or skills testing meet the readiness test?

The BEA report also states that the lack of training for manual flight at high altitudes “likely contributed to the inappropriate pilot inputs and surveillance.”  During much of the emergency the pilots failed to call out speed, pitch, altitude or vertical speed.  The pilot not flying was apparently observing available aircraft performance data and repeatedly requested that the nose be lowered. The flying pilot would make a pitch-down input but the majority of inputs continued to be pitch-up.

Sixty-two seconds after the beginning of the event, all three speed indications became valid again, showing 183 knots.  Thereafter, they fell dramatically, coinciding with a rapid loss of altitude as the aircraft fell to the ocean surface.

Tomorrow- FF Safety: Air France Flight 447 Disaster: Conclusion (Part Five)

Once airborne, AF-447, very close to its maximum take-off weight, flew north for some distance, inland of Recife before proceeding out over the Atlantic.  They climbed to their assigned flight level of 350 (35,000 ft.) The flight crew conversed with air traffic controllers at various points.  There were three flight crew on board because of the duration of the flight so that they might rest, as needed.  Their qualifications allowed for someone with proper command authority to always be in the cockpit if the Captain was taking a break.

The aircraft was flying on autopilot and the Captain had left the cockpit for a rest. Shortly after midnight and about two hours into the flight, the crew made a slight course adjustment to the left, probably to avoid weather spotted on the radar. Two minutes later the distinctive “Cavalry Charge” aural alarm sounded and the autopilot disengaged.  The flying pilot said, “I have the controls.” It’s likely that the aircraft was flying in some turbulence and once off autopilot the aircraft rolled to the right causing the pilot to make pitch and roll corrections.  The stall warning sounded twice and the left flight display showed an airspeed drop from 275 knots to 60, though that was probably not an accurate speed indication.  The standby instrument system showed the same marked decrease.

The pilots noted that the various speed indicators were providing different readings.  This occurrence caused the auto thrust system to also disengage while remaining at the previous thrust setting.  At the same time, the loss of valid speed indications caused the flight systems to revert to an “alternate law” mode where some protections, notably those preventing the pilot from “over-flying” the aircraft, were lost.  The aircraft was now under manual control at 35,000 ft. without a valid speed indication, in at least moderate turbulence.

Reports note that aircraft flying at both high speed and high altitude are especially vulnerable to stall conditions.  AF-447 was at mach .82 (about 550MPH) and 35,000 feet when the emergency commenced.  Even modest increases in the angle of attack would create a condition known as buffeting (turbulence felt in the pilot’s seat) which is a precursor to a stall.  Cruising at Mach .8, the differential between the normal angle of attack and the angle required to initiate stall warning is only 1.5 degrees.

After the flying pilot’s initial actions, the aircraft was now nose up, climbing at a rate of 7,000 feet per minute and he continued to make inputs for roll and pitch.  The non-flying pilot was attempting to reach the Captain so that he could return to the cockpit.

Forty-six seconds after autopilot disconnect the stall warning sounded for the third time as the angle of attack reached six degrees.  “Take Off-Go Around”, a high thrust setting, was selected and the flying pilot continued to make pitch-up inputs.  Seconds later the speed reading stabilized at 185 knots but the angle of attack continued to increase to 16 degrees.

One minute and forty seconds into the emergency, the Captain reentered the cockpit.  The aircraft was out-of-control, stalled and dropping at 10,000 feet per minute. Theoretically, he was tasked with instantaneously understanding the immensely complex situation he encountered and determining which immediate actions to take.  At that moment the aircraft was “pitch-up” with an angle of attack of more than 40 degrees.

Each time the speed indications became inaccurate the stall warnings would cease even though the aircraft was, in fact, stalling.  (The flying pilot was holding the airplane nose high without a stall warning because of invalid speed readings.)  When he pitched the aircraft nose down and the speed indications once again matched and became valid, the stall warning would again sound.  The aircraft was rolling violently, up to 40 degrees, left and right.

Data and voice recording ceased at 2 hours, 14 minutes and 28 seconds into the flight.  The aircraft was falling at 10,912 feet per minute, still nose high and with a ground speed of 107 knots.

Tomorrow- FF Safety: AF447: Investigation (Part Four)

Today is the second of a five-part series exploring the loss of Air France Flight 447 and the lessons firefighters can learn about effective teamwork, communication and decision making in a high risk environment.

In the days immediately after the disappearance of AF-447, bodies and lighter pieces of the aircraft were located on the ocean surface in a swath east of where the airliner was presumed to have gone down. With so little physical evidence as to cause, finding the Flight Data Recorder (FDR) and the Cockpit Voice Recorder (CVR),  as well as heavier parts of the aircraft was crucial.  Unfortunately, not only was the exact final flight track not known but the ocean floor in the area of the crash was mountainous, rugged and extremely deep.  One of the greatest searches on record was about to begin as the combined naval resources of Brazil, France, the US and other countries converged on the area in an ultimately unsuccessful attempt to find the wreckage before the beacon signals from the FDR and CVR failed.

Water depths in the defined search area ranged from about 2500 feet deep to more than 13,000 and the zone extended some 40 nautical miles from the aircraft’s last known position.  (AF-447 had made a slight left hand course correction minutes before the emergency commenced.) The French Navy supplied a Frigate, a nuclear submarine, and a command ship.  The US Navy provided “pinger” hydrophones which were towed over the sea bed at a slow rate of speed.  Other highly specialized deep-water submersibles and support vessels were also pressed into service.

Remarkably, the wreckage was eventually located on a plain about 13,000 feet below the surface and west of the filed flight plan.  The debris field was fairly dense, though several pieces were found well outside of it.  Damage was uniform in that it showed terrific compressive forces from the bottom up throughout much of the length of the aircraft.  Galley carts, overhead luggage bins, even the wing box were crushed.

The debris field was carefully mapped and photographed using the deep-dive submersibles, some equipped with side-scanning sonar.  Amazingly, both the FDR and CVR were recovered long after their beacons had ceased to function.  When retrieved and examined they yielded crucial information about just what happened that night.

 Read Part One: http://turnoutblog.com/?p=414

Tomorrow- FF Safety: Air France Flight 447  Cockpit (Part Three)

Today is the beginning of a five-part series exploring the loss of Air France Flight 447 and the lessons firefighters can learn about effective teamwork, communication and decision making in a high risk environment.

On May 31^st, 2009, at about 22:30, Air France flight 447 departed Rio De Janeiro, Brazil, on a scheduled flight to Paris, France.  On board were 216 passengers and a crew of twelve, including a captain and two co-pilots.

The aircraft was an Airbus A-330-200, a wide-body jet with extended range capability.  AF-447’s flight path would take them gradually northeast out over the Atlantic, up the west coast of Africa and near the Canary islands before landfall on the European Continent.

The news on June 1^st was dominated by the reports of the disappearance of AF-447 without a trace.  The flight had reached cruise altitude and vanished with no communication from the flight deck.  The only evidence in support of a problem was a flurry of satellite-relayed automated messages sent from the aircraft’s highly computerized control center reporting the loss of key functions on-board.

Press reports centered on the notion that the A-330 encountered severe weather activity and associated turbulence, broke up as a result, and plunged to the sea.  In the ensuing days, rescue aircraft and surface ships reached the last known flight track and discovered a floating debris field and a number of bodies.

Two and one-half  years later the examination of the AF-447 evidence, including extensive study of the recorders, debris and simulations points to a far more complex explanation than a run in with a thunderstorm.  Embedded in the conclusions are extremely valuable lessons for anyone working in an environment where time sensitive, critical decision making is required.

The A-330 series are among the most sophisticated passenger aircraft in the world.  They are “fly-by-wire” where the crew inputs commands using a joystick.  The commands are translated into electrical impulses that pass through a series of flight computers causing control surfaces to be actuated.  The hallmark of the design is redundancy where the various systems are integrated as well as the ability to prevent the aircraft from being operated outside specified parameters under “normal” conditions.  This operating environment is called “normal law” and would figure prominently in the AF-447 incident.  In normal law, no matter what commands the flying pilot inputs, the aircraft will not exceed safe parameters.

Tomorrow- FF Safety: Air France 447 Disaster: Epic Search (Part Two)