On June 1, 2009, the aviation world was shocked to learn of the disappearance of Air France flight 447 over the Atlantic Ocean during a flight from Rio de Janeiro to Paris. All 228 people aboard died, and it took until April of 2011 to recover the flight-data recorder from its watery grave. Until then, the main clues as to the cause of the crash of the fly-by-wire Airbus 330 were some telemetered data received during the final moments of the flight that indicated the airspeed instruments had been iced up and were giving false readings. While serious and potentially confusing to pilots, it seemed like an insufficient reason by itself to make a modern jet aircraft fall out of the sky.
We now have a much fuller picture of what happened that day, thanks to the diligent efforts of the French air-accident investigation agency and the publication of a book about the crash that contains a complete transcript of the words spoken in the cockpit and captured by the flight’s voice recorder. As it turns out, the frozen pitot tubes that sense airspeed were only one of a number of confusing factors that led to a fatal mistake on the part of one of the two co-pilots. So human error combined with mechanical problems, as it so often does in accidents of this kind.
An article in Popular Mechanics magazine presents the following story. The trouble began when around 2 AM local time, the plane entered a region of frequent thunderstorms near the equator. A large airliner such as the Airbus carried a complement of a captain and two co-pilots. Shortly after 2 AM, the captain left the cockpit in charge of the two co-pilots as he went to take a nap. Instead of taking evasive action to avoid a large line of thunderstorms in their path, the co-pilots decided to maintain their course. They shortly entered the thunderstorm area, where the pitot tubes iced up. At this point a critical transition in the operation of the airplane occurred.
The Airbus 330 is one of a new generation of fly-by-wire aircraft in which a computer is in the path between the pilots’ controls and the actual control surfaces of the plane. The normal flight mode is autopilot, in which the computer is basically flying the aircraft. But certain unusual conditions, such as the pitot tubes icing over, make the autopilot trip out and hand control of the plane over to the pilots. Because of several other distractions in the cockpit, it is not clear that the junior co-pilot realized this happened about 2:10 AM. The airplane was experiencing turbulence, ice crystals on the windshield, and strange electrical phenomena such as St. Elmo’s fire. While we will never know why co-pilot Bonin (the one with least experience) did what he did, the fact remains that at 2:10, he pulled the stick back and basically kept it there until it was too late to correct his mistake.
Even non-pilots such as myself know that if you try to make a plane climb too steeply, its airspeed falls. Eventually the airflow past the wings is insufficient to provide enough lift, and the plane “stalls.” In a stall, the plane becomes a piece of metal falling through the sky. The only remedy is to reorient the craft by pushing the stick forward to get air flowing past the wings in the right direction and recover enough lift to pull out of the resulting dive. But you need a lot of room to do this in. Once the plane stalled, it began to lose altitude rapidly—almost two miles a minute—and the stall began at an altitude of about seven miles.
If the captain had arrived from his nap earlier, or if the senior co-pilot had shoved his colleague out of the way and done the right thing with both sticks, the stall might have been recoverable. But the confusion that happened next was also abetted by the fly-by-wire situation.
In older aircraft, the two pilot sticks are mechanically coupled together, so only one message goes from the cockpit to the ailerons. If two pilots disagree on what to do with such a stick, they find themselves literally fighting a tug-of-war in the cockpit, and most reasonable people would react by at least talking about what to do next.
But even in the autopilot-off mode, the Airbus sticks could be moved independently, and the plane responds to the average of the two sticks’ motion. To my ears, this sounds like a software engineer’s solution to a human-factors problem. In the event, even though the senior pilot eventually did the right thing with his stick, the computer averaged it with Bonin’s all-way-back stick, and the stall continued.
The rest of the story is short and bitter. About 10,000 feet above the ocean, the captain returned. Cursing, he realized what was happening, but no power on earth could have saved them at that point. Two miles of air was not enough to stop tons of aluminum and human bodies from plunging into the ocean less than a minute later.
What can be learned from this tragedy? Pilots of fly-by-wire craft around the world now have a vivid bad example not to follow, for one thing. Also, I hope the software and hardware engineers working on the next Airbus rethink their strategy of independent sticks and averaging. While human-machine communication is important, this accident emphasizes the fact that interpersonal communication in a crisis is vital. That single additional channel of communication through a mechanical link between sticks might have been enough to avoid this accident.
Despite such avoidable tragedies, air travel is still one of the safest modes of transport. But it stays that way only by the constant vigilance, training, and competent execution of duty by thousands of pilots, engineers, maintenance people, traffic controllers, and others. Let’s hope that the Air France 447 disaster teaches a lesson that makes air travel even safer in the future.
Sources: The Popular Mechanics article which carried much of the cockpit transcript appeared online at http://www.popularmechanics.com/print-this/what-really-happened-aboard-air-france-447-6611877. I also referred to the Wikipedia article on the Airbus series. And I thank James Bunnell for drawing my attention to this article. I blogged on the Airbus crash on June 8, 2009, the week after it took place.
I am absolutely fascinated by air crash investigations! Mainly because I can see the potential for similar accidents in my own industry (coal fired power generation) in which operators can effectively leave the plant on autopilot for long periods, but need to react sensibly in times of crisis, and also because they are so thoroughly investigated and reported. They provide us with perfect examples of process safety and human factors. Most of James Reason's (swiss cheese model) examples were from the aircraft industry.
ReplyDelete