Still climbingThe last minutes of AF447

Martin Sharman*

August 2011†

I can't speak and I can't breathe and no words are comin' out of meAnd I can't tell if I'm upside down or if I'm just goin' round and round

I trap myself in idioms with the battles raging in my headAnd I can't tell if I'm fallin' in or if I'm just climbin' up again

Hey man, yeah, yeah, yeah, yeah, yeah, yeahI'm wide awake man

Yeah, yeah, yeah, yeah, yeah, yeahI'm wide awake

Kenna – “Wide Awake”

† with minor revisions November 2011

*sharman@iname.comThe views expressed here are those of the author and may not under any circumstances be regarded as a position of the European Commission.

Vasquez T. (2009) Air France Flight 447: A detailed meteorological analysis.Accessed 10 Aug 2011 at http://www.weathergraphics.com/tim/af447/

Projected flight pathBlended with infrared satellite

analysis

AIR FRANCE FLIGHT 447

Still climbing

Cast of characters

Captain: Marc Dubois (10 988 flying hours, with 1 474 on type in an A330 – all of them in command, with 16 flights on type between France and South America)

Pilot Flying (right seat): 32-year-old Pierre-Cédric Bonin (2 936 flying hours of which 807 on type, 5 flights)

Pilot Not Flying (left seat): 37-year-old David Robert (6 547 total hours of which 4 479 on type, 39 flights)

Aircraft: Airbus Type 330-203, serial No 660, registration F-GZCP, 6 ½ years old, first flight 25 Feb 2005, operator Air France

Narrative

At midnight on 1st June 2009, AF447 from Rio de Janeiro to Paris was cruising at 35 000ft under autopilot and autothrust. The outside temperature was more than 40°C below freezing. Marc Dubois, the captain, suggested that Pierre-Cédric Bonin, the co-pilot who was sitting in the right seat, might want to rest. Bonin said he didn’t fell like sleeping. This small decision made a big difference to a large number of people, and most of all to the 216 passengers and 12 crew on the plane.

Half an hour later, he told the captain “there’s something straight ahead”, probably referring to heavy weather visible on the weather radar. Far ahead, the flight path was barred by a line of high oceanic cumulonimbus clouds. The moon had set, and the crew probably saw little or no lightning on the horizon, but the starlight would have been bright. Ahead of them, the summit of the distant clouds towered above the A330, and clouds of this kind would mean turbulence.

The air outside was cold, by groundling standards, but considerably warmer than usual at that altitude. Furthermore, the temperature only fell gradually in the higher air above them, with the result that it was less dense than normal, and hence less capable of supporting the aircraft. The pilots agreed that the unusually warm air above them would mean that they could not climb to 37 000ft in an attempt to fly over the weather.

Bonin contacted the ATLANTICO air traffic controller at 01:33 to report their current status, and to inform them that the flight would reach a mid-Atlantic waypoint called TASIL at 02:20Z1. He then tried, but like other flights that night, failed to raise Dakar air traffic control on the radio.

About ten minutes later the plane crossed the Equator, and at 01:45 flew into slight turbulence. Bonin dimmed the cockpit lighting and switched on the external aircraft lights “to see outside”, saying that they were about to “go into the layer” and regretting that they could not climb. As they entered the wall of cloud at 01:58 and the turbulence strengthened, he asked the captain whether they could request air traffic control for permission to climb to 36000ft. The captain demurred, saying they would wait a little. For about ten minutes they flew through the turbulence they had predicted inside the cloud. It is not clear why Dubois

1 This information, supplied by Brazil's Air Media Center, contradicts the BEA account, which claims that AF447 contacted ATLANTICO at 01:35 to report their position. The ATLANTICO controller called back 3 seconds later to ask when they would reach TASIL, but Bonin did not respond. Seven seconds later, they tried again, and again after 6 seconds. Bonin still did not respond. The discrepancy between the two accounts will presumably be resolved in BEA’s final report.The AMC also states that ATLANTICO phoned Dakar air traffic control to give them the relevant information, but the BEA reports that Dakar had to request these data at 01:48Z.

-2-

Still climbing

had decided to fly through the clouds since other flights that night, including IB-6024, LH-507 and AF-459, altered course to avoid them. It is possible that the first storm-cloud that they entered had masked the major storm behind it from their radar, and they simply did not know that ahead of them lurked a giant.

As the plane emerged from the first cloud, the turbulence eased. Dubois pointed out Saint-Elmo’s fire – a bright blue or violet glow on the wings of the aircraft – and said “it’s going to be turbulent” as he woke the second co-pilot, David Robert, at 01:55. Robert had presumably been sitting in the third occupant seat behind the two pilots.

Dubois said, “he’ll take my place”, meaning that Robert would replace him in the left seat. By tradition only the captain flies the plane from the left seat, so by implication Bonin was now designated Pilot Flying, but Dubois did not made it explicit. Nor did he make it clear whether this meant that Bonin was to be the Pilot In Charge.

Air France, like other airlines, identify the captain ("commandant de bord" or CdB) as the senior crew member, but unlike many others view the two other pilots as co-equal

Flying Officers of identical rank. Other airlines stipulate a hierarchy in which the more experienced Flying Officer becomes Pilot In Charge when the captain leaves the flight deck. The junior Flying Officer could still fly the plane, but unlike on AF447, there would be no ambiguity about who was in command.

Apart from the issue of command, the duty of the PF is to fly the plane, while the duty of the Pilot Not Flying is to monitor the status of the aircraft, deal with communications, and when appropriate, offer suggestions to the PF.

Sitting down in the left seat, Robert – who we might suppose would be at least unclear about his role and perhaps a little irritated – told his colleagues that he had been dozing. He may have said this to let them know that even though he had been in the cockpit, he had been asleep, and had not heard any discussion on the flight deck. It was now 01:59. For the next 2¼ minutes Bonin briefed his colleague, telling him that “that light turbulence you just felt, we’ll be getting more ahead. We’re in the layer – unfortunately we can’t go up much for the time being because the temperature drops less than expected, which means the REC MAX is a bit too low to try to reach 37”. By this he meant that the recommended maximum altitude was too low to allow them to climb out of the cloud. He told Robert “we weren’t able to log into to Dakar”.

Dubois now left the cockpit without briefing his crew. Bonin was not informed, for example, how much he could deviate from the flight plan if he needed to avoid turbulence or under what circumstances Robert should take control of the aircraft, or what kind of decisions would require that they wake the captain. This had already had the makings of a SNAFU.

The captain must be at the controls for takeoff and landing. To be reasonably alert during the landing after a long flight, he is required to rest during the flight. Since he decided to go for a rest at this moment, we can assume that he saw nothing on his screens that looked dangerous or for which he would have to be in command. Even now, it is possible that the setting on the weather radar, together with the particular characteristics of the storm ahead of them, concealed the nature and the strength of the system that they were about to fly into.

-3-

Still climbing

Immediately after Dubois left the flight deck, at 02:03 Bonin pointed out that “the inter-tropical convergence, there, we’re in it between SALPU and TASIL”. He was telling Robert that the first of the waypoints was to the south, and the next to the north, of the wandering line along which northeast and southeast trade winds converge in a zone of convectional updraft and heavy rainfall. This was Bonin's 6th flight on this route across the Atlantic, but Robert's 40th, so Bonin may not have been telling Robert anything he could not have worked out for himself. He made no comment.

Five minutes after the exchange, at 02:06, Bonin called the cabin staff to tell them “in a couple of minutes we’ll be flying into a zone where we think it’ll move about a bit more than now, so watch out back there.” He went on to say, “I’ll let you know when we get out of it.” It was the job of the Pilot Not Flying to make announcements to the flight attendants, not the Pilot Flying, but his remark suggests that the pilots expected nothing out of the ordinary. Had they anticipated strong turbulence, they would have warned the cabin crew that they would have to check the safety of the passengers and then prepare themselves to sit down and buckle up.

Immediately after his announcement, Bonin said “minus 42, we won’t use anti-icing, at least there’s that.” Just before they went into the cloud, he said, “you see, we’re really at the limit of the layer.” He went on to say something that was not intelligible on the voice recorder. This is unfortunate because if he thought that the summit of the cloud was only just above the altitude of the aircraft, it might go some way to explain his later actions.

As it entered the second bank of cloud at 02:08 the plane probably entered a strong updraft, lifting the aircraft. In response, the autopilot would have pitched the nose down and decreased the thrust of the engines, with the effect that the plane maintained both altitude and airspeed. As predicted, the plane began to bump in the turbulence. Robert told Bonin, “you could maybe turn a little left… I agree we’re on manual, hey? What I call in manual… er… no we’re in compute”, at which Bonin switched the lateral mode to magnetic heading and altered course 12° left, perhaps to avoid heavy weather visible on Robert’s radar.

At the heart of most aviation accidents nestle lack of situational awareness, inadequate communication and interpersonal skills, failures of leadership, and uncertain decision-making in the cockpit. What did Robert mean by "what I call in manual… er… no we’re in compute"? Already it would seem that Cockpit Resource Management was not one of the strengths of this crew. Nor, as we shall see, was problem solving.

At 02:09:46 the cockpit filled with the noise of the plane flying into a domain of ice crystals and perhaps graupel2. Turbulence strengthened, and Bonin slowed the aircraft to Mach 0.8, about 470 knots at this altitude, to reduce stress on the airframe and bumping for passengers. Despite this, turbulence kept increasing to the extent that passengers would have been pressed hard into their seats one second, and hoisted against their seatbelts the next. For most, sleep would have been out of the question. From now on the turbulence would have made it difficult for the pilots to read the instruments or checklists.

At 02:10:03 someone, probably Robert, switched the anti-ice for the engine nacelles to “on” and Bonin said, “Do you want it to be on ignition start?” He was asking whether to switch on constant ignition for the engines. This precaution would mean that if an engine were to cut out, it would instantaneously re-ignite.

2 In clean air, tiny water droplets can remain liquid well below 0°C, but will instantly freeze onto any snow crystal they touch. By accreting droplets, snow crystals are transformed into fragile, shapeless pellets called graupel.

-4-

Still climbing

An instant later, at 02:10:05 the automatic pilot and automatic thrust cut off simultaneously and the “cavalry charge” disengagement alarm sounded3. The aircraft started to dip its right wing.

Immediately after the autopilot abandoned its task and the warnings sounded, Bonin said, “I have the controls”, thereby announcing the second beginning of the end. Standard operating procedure would mean that the senior of the pilots present should immediately make explicit which of them was in control of the aircraft and who would work through checklists appropriate to the situation. They were in a turbulent cloud at night; common sense, if not standard operating procedure, would mean that the senior flying officer, the vastly experienced Robert, should take control at this critical moment. But he was seated in the sacrosanct left seat, and he made no objection when Bonin took control. At least the PF had the instinct to inform the PNF of their relative status.

What had caused the software to throw up its hands was a discrepancy between the airspeed registered in the port and starboard Pitot tubes. Put simply, a Pitot is a tube that faces the incoming air, and allows it to fill a chamber. The more the air tries to pack into the chamber, the more the pressure goes up. By measuring the pressure in the chamber, the device estimates the velocity of the air trying to enter the tube. The plane was fitted with 3 Thales AA Pitot tubes, a design which was known to have a tendency to ice up under some conditions. Only the readings from the left tube are recorded on the “black box”. The computer had discarded the readings from one of the 3 earlier in the flight, and now the two remaining probes were disagreeing. One or both was probably clogged with ice. The software had no way of telling which.

Airspeed is important to things that fly, as anyone will know who has flown a kite or watched a seabird hovering, wings outstretched, near a cliff. Neither kite nor bird is moving relative to the ground. Groundspeed is immaterial to whether you fly or not; airspeed is what counts. But groundspeed is important to anyone who wants to get from A to B. To measure its progress over the surface of the planet, the A330 and all other modern planes use Global Positioning System instruments, but a GPS tells you exactly nothing about airspeed. Pitots do that. In this case the pilots would have sacrificed any number of GPS devices for a couple of reliable Pitots.

As the disengagement warning sounded the airspeed registered on the left of the aircraft fell abruptly by some 275 knots to 156 knots and then to a mere 52 knots – suggesting that before the warning sounded it had been registering about 335 knots, which was less than the true airspeed of the aircraft. The integrated standby instrument system, ISIS, showed not 156 but 139 knots, then climbed back to 223 knots. Although the instruments claimed that the aircraft had slowed abruptly from Mach 0.80 to 0.26, there was no corresponding sharp deceleration of the airframe.

At this point the aircraft was flying straight and level, with fully functional engines. It was now rolled 8½º right, but if the pilot had carefully corrected the roll, and held the plane in that configuration, it would leave the cumulonimbus into the clear air beyond in a couple of minutes. The ice in the Pitot tubes would quickly melt, and the autopilot would be able to assume its duties again. Standard operating procedure would be to make as few changes as possible and maintain track and altitude while they worked out what had gone wrong – and certainly, since they were flying at Mach 0.82, close to the speed of sound, make no sudden or extreme changes until they could re-engage the autopilot.

3 The 2nd interim report of the BEA states that a stall warning sounded, which seems to be corroborated by the traces provided in the 3rd interim report. The traces may, however, simply show that an audible alarm sounded.

-5-

Still climbing

Standard operating procedure would be for the designated PNF to inform the PF of the symptoms of the problem and the status of the aircraft, and for the PF to inform the PNF what he was doing to maintain the flight path. At the first available opportunity the PNF would inform air traffic control of the situation.

At 02:10:09 the left Pitot showed 52 knots, but the ISIS showed 270 knots for 4 seconds. Bonin said “Ignition start” and almost instantly, the synthetic voice warned “stall, stall”. The stall chirrup did not sound.

Five long seconds after the autopilot disconnected, the plane's automatic Aircraft Communication Addressing and Reporting System (ACARS) sent the first of the 24 cryptic and coded statements that would catalogue the unfolding drama.

WRN/WN0906010210 221002006 AUTO FLT AP OFF, it said4.

What it told the pilots, the air traffic controllers and Air France monitoring services was that the autopilot had disconnected by itself. Neither pilot would have found this message or subsequent ACARS messages easy to read in the bumpy, shuddering cockpit or, one imagines, to take in its message in the noise and sensory overload of the flight deck.

At 02:10:10 the left Pitot suddenly showed 215 knots (Mach 0.68). The synthetic voice stall warning immediately sounded, again without the chirrup. Robert hardly had time to say “what on Earth’s that?” before the warning sounded again, with the chirrup. “Stall, s…” The Pitot tube fell back to 55 knots while the ISIS estimate of airspeed dropped from 270 knots to 73. The Master Warning alarm pinged and began to flash. Neither pilot mentioned the stall warning, although it would have been standard operating procedure to identify the situation formally.

There are two ways in which a jet can stall. The first afflicts the engines, and the second, the wing or tailplane. An engine or compressor stall occurs at high power when the airflow into the jet is suddenly restricted, and instead of forcing the burning fuel into the exhaust allows it to blow back into the air intake. This disrupts the airflow over the compressor blades and prevents it from doing its job of compressing the incoming air, thus exacerbating the problem. AF447 suffered the second kind of stall. A wing's angle of attack is the angle between its forward motion through the air and a cord through the wing from leading to trailing edge. The wing provides lift while the angle of attack is small enough to allow the air to flow over it smoothly. As the angle of attack increases the airflow over parts of the upper surface of the wing may begin to separate from the wing's surface, with turbulent airflow establishing itself between the wing and the separated smooth flow. This turbulent flow, in which air close to the wing can even flow towards the leading edge, may be felt as buffeting. Further increases in the angle of attack allow the airflow over the wing to separate over larger and larger areas, decreasing the wing's capacity to provide lift and quickly increasing its drag. The wing stalls when it can no longer provide enough lift to keep the aircraft airborne.

The software was designed to issue stall warnings when airspeed was above 60 knots, and the angle of attack or windshear was high. From now on, whenever the calculated airspeed went above 60 knots and the windshear was measurable the software would sound the stall

4 The first three letters are short for "warning", but I have not been able to discover what information is carried by the WN block following the slash. "090601" is the date in yymmdd format, and "0210" is Zulu time to the nearest minute. After the gap "2210020" is an FAA code to indicate chapter 22, section 10, para 020, a paragraph that in this case concerns the autopilot. The "06" indicates the phase of the flight, which in this case was "cruise". ACARS messages are not sent instantaneously, and transmission / reception handshaking means that they are spaced at 5 seconds or more. Thus messages may be queued waiting for dispatch. Patching them into the events in the cockpit is an uncertain art. No ACARS message is sent if the status quo ante is re-established, so we only have one side of the conversation.

-6-

Still climbing

warning, for the good reason that the plane was in a stall. Whenever these conditions did not apply the stall warning would cut out, following the logic that you can’t stall on a runway, which is the best place to find speeds below 60 knots and unmeasurable windshear.

We can imagine that at this point, greatly disadvantaged by turbulence and the noise of the alarms, the Pilot Not Flying would be scanning his instruments to try to understand the nature and scope of the problem, telling the Pilot Flying when he found anything abnormal. Until they had arrived at a reasonable assessment of the situation, the prudent Pilot Flying would also be scanning altitude, pitch and power, and using frequent but delicate corrections to the behaviour and attitude of the plane try to re-establish a normal flight profile.

At 02:10:16, Robert said, “so we’ve lost the speeds”, telling Bonin why the autopilot had disengaged. Both pilots certainly understood the significance of losing the airspeed indicator at altitude. A loss of airspeed can cause the plane to stall in the thin air, as can an increase in speed which causes shockwaves to form on the wings as they approach the speed of sound. Although Robert informed Bonin that the airspeed indicator was faulty, he did it in a way that left much to interpretation and he made no comment on the status of the other instruments, leaving Bonin to infer that they were still apparently functional.

“Alternate law protections”, he continued, reminding Bonin that the flight control law changed from normal to alternate. The autopilot had now handed over to the pilot to provide input to the computers. While the computers were still flying the plane, and would still help to ensure the stability of the aircraft and damp any excessive yaw, in Alternate law they would no longer prevent excessive pitch or bank.

The pilot of an Airbus 330 does not control the aircraft with the familiar yoke of less advanced aircraft, but with joysticks rather like a sophisticated version of the ones used in video games. Since they are placed to the side of the pilot, in the arm of the seat that is nearest to the side of the cockpit, they are called sidesticks. The movements of the sidestick of one co-pilot are not reproduced in the other, and they provide no tactile (haptic) feedback that would simulate for the pilot what he would feel if he were using a yoke. The Pilot Not Flying would have to look right across the cockpit, and right across the other pilot, to see his colleague’s hand on the sidestick. The movement of the sidesticks is limited, so in the rough air they were experiencing, it would be difficult to guess what the other pilot was ordering the plane to do. The Pilot Flying is expected to tell the Pilot Not Flying what instructions he is giving.

The plane again began to dip its right wing and Bonin moved his sidestick to the left, while pulling it back, causing the aircraft to roll back to the left and begin to climb. For the next 30 seconds he tried to keep the wings level, while the turbulence lifted first one wing and then the other to about 8° above horizontal. Perhaps accidentally, he kept the nose of the plane up, slowly increasing its pitch until it reached 10° above the horizontal. In level flight, the nose is typically pitched about 3° up. Bonin did not tell Robert what he was doing.

At this moment ACARS transmitted WRN/WN0906010210 226201006 AUTO FLT REAC W/S DET FAULT, meaning that no information was available on angle of attack.

Probably in reaction to this, Bonin told Robert “We don't have a good... we don't have a good indication of...” and 3 seconds later, at 02:10:17 Robert replied “We've lost the – the – the speeds then... engine thrust A T:R engine lever thrust…” as Bonin spoke over him, completing his own sentence, “... of speed.” At this point they had both apparently decided that their instruments – or at least those that were supposed to indicate airspeed – were telling them nonsense. The Pitot tube was recording 80 knots and the ISIS 92 knots.

-7-

Still climbing

This was not the first time an Airbus aircrew had found themselves dealing with unreliable indication of airspeed. Airbus has issued guidance for the situation, which requires the pilots to decide whether the safety of the flight is jeopardised, and if it is not, while keeping the flight straight and level, use the unreliable speeds checklist and work out whether any remaining airspeed indicator seems to be valid. This guidance might suggest that the pilots should at least communicate. First, as PNF, Robert should have stated "Unreliable airspeed!" to identify the situation formally, helping to trigger the correct responses of problem solving and decision making. Next, they should have exchanged views on what the speed indicators were telling them, and then, decided what to do about it. Robert should also have informed Bonin that the instruments were telling him that the aircraft was 10° nose up.

Could it have been that Robert could not see that the aircraft was pitching up because the instrument was malfunctioning? If some of the displays had dropped out or were repeatedly resetting, the pilots would not necessarily see what the flight recorder was recording. But if this were the case, would not one of the pilots have identified the situation? And even if the pilots said nothing, ACARS would have reported the fault; we may be reasonably certain that apart from the airspeed indicator, the instruments were working correctly.

At 02:10:18, Bonin pulled the sidestick hard back and held it there for most of the next 15 seconds. He did not increase thrust. This is certainly the most puzzling part of the entire disaster. There was no discussion between the pilots, no announcement to the passengers, and nothing on flight recorder to give us a hint about what prompted this odd decision. He and the captain had earlier agreed that they couldn’t climb out of the turbulence because the air was too thin at higher altitude.

Airbus recommends that if instrument failure lead to the loss of airspeed data at altitudes above 10 000ft, and if the safety of the aircraft is at risk, the pilot should pitch up 5º, set thrust to the "climb" or CLB setting, and climb. Most pilots find this instruction contrary to good sense, and prefer to maintain pitch and thrust while troubleshooting. Perhaps Bonin had decided that the aircraft was in jeopardy and remembered the bit about pointing upwards, but now by how much, or the bit about increasing thrust. As a result he was trading airspeed for unnecessary additional altitude.

Could the climb have been at least partly accidental? The A330 is more sensitive to manual controls at altitude than it is near the ground, which is where most pilots get their experience of flying manually. The lack of sensory feedback from the sidestick makes it difficult to judge the position of the stick. Bonin was a glider pilot. A glider pilot learns quickly to feel the aircraft through his hands and feet, where the feedback becomes an instinctive part of the art of keeping the aircraft doing what you want it to. In turbulent air, with all the abrupt and erratic bumping that implies, Bonin may simply not have realised how hard he was pulling back, and kept waiting unconsciously for the plane to talk to him.

An Airbus sidestick has another characteristic in which it differs from most joysticks and aircraft controls. The pilot uses the sidestick to instruct the software what he wants the plane to do – for example pitch the nose up 5º. Having given the instruction, the pilot allows the sidestick to return to the neutral position, as the aircraft executes the order.

The plane responded to Bonin's stick by pitching the nose up at between 11° and 13° and by climbing at up to 6700ft per minute – twice the climb rate for take-off. The change from a slow climb to a rapid one engendered considerable g forces in addition to those caused by turbulence. For about 10 seconds the passengers would have felt more than 1½ times as heavy as normal as the plane clawed its way upwards. Conceivably, however, they might have attributed this to a strong and persistent updraft rather than a steep upward rotation and

-8-

Still climbing

climb. Their discomfort would have been increased by the rolling, as the plane alternately dipped its right wing by up to 8° and its left wing by up to 5°.

As part of its effort to execute the orders given by Bonin's sidestick the software altered the angle between the horizontal stabilizer, or tailplane, and the longitudinal axis of the aircraft. In the initial moments of the climb the stabilizer reached its maximum of -13°. In this position, air flowing over the stabilizer pushed the tail of the plane hard down, forcing the nose up. The software never subsequently ordered the stabilizer to trim back, and it remained at -13° for the remainder of the flight.

In keeping with the custom of the cockpit, neither pilot mentioned these important changes in flight geometry; not the nose-up pitch, not the increased altitude, not the stabilizer trim. Nothing. It is possible that neither pilot noticed, preoccupied as they seemed to have been with erratic airspeed indicators. The position of the horizontal stabilizer position would significantly change the way the plane handled, making it more responsive to nose up commands and less to nose down.

WRN/WN0906010210 279100506 F/CTL ALTN LAW said ACARS, telling both the pilots and air traffic control that the plane's fly-by-wire systems had switched into Alternate law.

Seeing this, Robert reported “Alternate law protections”, reminding Bonin that pitch and bank were no longer limited by the software, and as Bodin increased N1 (a measure of the engine thrust) to 104%, Robert went on, “Wait we're losing...” then apparently without any connection, “Wing anti-ice”, switching the device on as he spoke. He may possibly have thought that the apparent loss of speed, and the increasing buffeting, was caused by ice on the wings. The plane was climbing at 6 900 ft per minute.

At 02:10:27 Robert warned Bonin, “Watch your speed, Watch your speed” to which Bonin responded “Okay, okay okay je redescends”, by which he probably meant “OK, I’m slowing down”, but could have meant “I'm going back down” to a lower altitude. Robert replied, “stabilize”, meaning perhaps “keep it there”. Bonin said “Yeah”, but Robert then told him “go back down!” From all appearances, the pilots were not communicating well, and neither was making their assumptions or intentions clear to the other. It was not even clear whether Robert, asking Bonin to watch his speed, was talking about vertical speed or airspeed. Nor was either pilot announcing airspeeds, vertical speeds, pitch or altitude, as one might expect.

WRN/WN0906010210 228300206 FLAG ON CAPT PFD SPD LIMIT meant that the airspeed displays in front of the pilots had gone blank. The pilots would have realised that this meant that neither Flight Augmentation Computer could interpret what the sensors were telling it and could provide no useful data to the Flight Management Guidance Envelope Computer. If, at this point, the Pitot tubes were in agreement that the airspeed was below 60 knots, the flight path vectors would also have gone blank.

Seconds after that exchange, Robert informed Bonin, “According to the three you're going up, so go back down”. He was presumably referring to the three vertical speed indicators. Bonin replied, “All right.” The nose was pitched 10º to 12º up and the plane was climbing at 5 600ft per minute. The airspeed was by now up to 105 knots as measured by the Pitot tube, and 115 knots on the ISIS.

Clearly the pilots knew that at least some instruments were still functional.

The Pitot tube speed abruptly increased to 223 knots at 02:10:34. Almost certainly this signalled the recovery of the device, which would then give plausible readings for the following minute, during which time the airspeed displays were back up on the screens in front of the pilots. Two seconds after it recovered, as the plane reached 37 124 ft, Robert said

-9-

Still climbing

“You're at... go back down!” to which Bonin responded “we’ve started, we're going down”. Robert had apparently realised that the plane was now far higher than its authorised 35 000 ft, and dangerously so, given the temperature and density of the air at that height. He wanted Bonin to pitch the nose back down and get back to a sensible altitude. Bonin's verbal response was to agree, but his body language – his hand on the stick – said something else.

At 2:10:34 the ACARS reported #0210/+2.98-30.59. The aircraft was almost 3º north of the Equator, and 31º west of Greenwich.

WRN/WN0906010210 228301206 FLAG ON F/O PFD SPD LIMIT; once again, the airspeed displays had gone blank.

At 02:10:39 Robert said, “I'm putting you in… in ATT…” but the remainder of his sentence is indistinct. He was informing Bonin that the Air Data Inertial Reference Unit (ADIRU), which normally supplies attitude, flight path vector, ground speed and positional data was now set to provide only attitude and heading.

Three seconds later, Bonin ventured, “We're in – yeah we're in climb.” They were indeed – the plane was still climbing under full thrust at 1 900ft per minute.

It is not at all easy to understand what Bonin was thinking at this moment. What was going on in his head is certainly the key to everything that follows. His earlier actions suggest that he thought that they had been in a dive, or close to it. But his instruments were showing that he was gaining altitude. How would he square this with diving? Did he doubt what the altimeter and rate of climb were telling him? Had he thought that they were on the verge of a stall, his training would have led to only one course of action. At altitude, the rule is invariant. In a stall, put the nose down. But in a dive, pull up.

WRN/WN0906010210 223002506 AUTO FLT A/THR OFF told the pilots that the autothrottle had disconnected. Bonin decreased the engines' thrust to 85% causing the vertical speed to decrease from 1 500 to 1 100ft per minute. The Pitot tube showed 216 knots, but the ISIS showed half that, 121 knots. The plane's nose was pitched 5½° up as it climbed through 37 512ft.

The aircraft was still under control at this point, but would not remain so.

At 02:10:49 Robert said something that according to the BEA report was "not relevant to the conduct of the flight", and ended his remark with "Uh, where is he?" (It is conceivable that he said "where is it?" but it seems much more probable that he was wondering why the captain had not returned to the cockpit.) Either just before or just after, he made the first of several attempts to recall the captain to the cockpit. I assume that he did this by asking the cabin staff over the intercom to get the captain to return. He had been away for less than 10 minutes – perhaps just the time to go to the toilet, get to his designated seat and settle down to sleep.

The plane was still climbing, but by now at an altitude where the air was too thin to allow it to climb much more. The nose was between 4° and 6° up as the pilot kept pulling back on the stick, causing the altitude to increase at 750ft per minute. The hype about the A330 was that it could not stall, but nobody before had tried to take it as high as it would go and then pull back persistently on the stick while in Alternate law. As he pulled back, he moved the stick to left and right trying to keep the wings horizontal as the plane rolled from 12° right to 10° left. The aircraft was flying at 0.68 times the speed of sound – around 390 knots.

The end truly began at 02:10:51 as the synthetic voice called “Stall, stall” and the piercing chirrup of the stall alarm filled the cockpit. Despite the noise caused by the turbulence and the icestorm, this alarm might have been audible to the business class passengers on the other side of the cockpit bulkhead and door, and hence, perhaps, to the captain. Bodin, as Pilot

-10-

Still climbing

Flying, should have asked Robert, as Pilot Not Flying for his assessment of the warning, or Robert should have offered it unasked, but neither pilot mentioned it. Indeed for 10 seconds as the strident chirrup continued to sound, nobody said anything at all.

Except the ACARS, which had more bad news. WRN/WN0906010210 344300506 NAV TCAS FAULT meant that the information available to the flight system concerning the altitude was no longer credible. The Traffic Collision Avoidance System is designed to prevent aircraft from flying too close to one another, and part of the trick is to be certain that the software knows what height the plane is flying at. To do this, it keeps predicting altitude from the flight parameters and, as a sanity check, compares it with the measured altitude. If measured and predicted are incompatible, TCAS transmits this ACARS message to tell the pilots and air traffic control that it is no longer operational. In this case, the software may have been unable to make sense of the flight parameters.

The pilots were aware that some of their instruments were giving erratic and erroneous readings, but not necessarily which ones were still functioning correctly. In less than a minute, they had seen 8 ACARS messages, only one of which was innocuous, the airspeed indicators had become unreliable and airspeed screens had blanked twice, the autopilot had quit and the systems were in Alternate law, autothrust had been lost, and TCAS had failed. They were still in cloud, illuminated from within by the aircraft's powerful landing lights. They had no external visual references to give them a sense of orientation. Buffeting by turbulence engendered by the cloud would have masked any stall-induced buffeting, and now communication was made difficult by the insistent stall chirrup. This was an experiment in sensory overload and deprivation at the same time.

Furthermore, Robert had no feasible way to know what instructions Bodin was giving to the aircraft – he couldn't keep staring at his hand on the sidestick, since he had enough to do to try to make sense of the instruments on the panels in front of him. Ever since the Master Warning alarm had gone off, Robert had been recommending that Bonin decrease altitude, and Bonin had been agreeing with him orally but keeping the nose pitched up, in which he was helped by the horizontal stabilizer. Robert may well have concluded that not only were the instruments wrong, but the control system was also misbehaving. Everything shares the same computers.

The plane was at high altitude and claimed to be on the verge of stalling. This suggested that the angle of attack was too high, and that the computer was objecting to the excessive pitch of the aircraft, now 6°. The normal procedure would be to ease forward on the sidestick to try to decrease the pitch until the plane was nose down, and simultaneously gently reduce thrust. These actions would be intended to slowly decrease the angle of attack to the point where the wings were once again generating lift, after which the thrust could be gradually increased and the by-now diving plane eased gently (don't want to tear the wings off) back into level flight. This manoeuvre might scare the passengers but would not be dangerous, with 37 596 feet of empty air between the plane and the Atlantic.

Instead, Bonin pulled back on the stick until it was 2/3 of the distance to the stop, causing the plane to increase its nose-up pitch from 6° to 13°, while moving the sidestick left and right to control the slight tendency to roll. Glider pilots are taught that the first sign of an incipient stall has nothing to do with the aeroplane, but with the pilot: too much back stick. For some reason, people pull back when piloting under stress, and under stress, they may not realise that they are pulling back. The range of movement of the A330 sidestick is small. A relatively short contraction of the pilot’s fist and arm could pull it back to the stop. Could Bonin’s insistence on pulling the A330's nose up have been because he had forgotten one of the first lessons he learned in a glider? As questions go this is, of course, entirely rhetorical.

-11-

Still climbing

Then, 4 seconds after the stall warning began, Bonin said "TOGA" and pushed the thrust levers fully forward to "take-off / go-around". This position, indicated by a specific stop, or detent, at the full extent of the travel of the levers, is used on takeoff to ensure the most effective combination of thrust and pitch, while in an aborted landing it is the most effective way quickly to increase thrust to the greatest that the engine can deliver under present conditions. The combined action of pulling up while simultaneously pouring on thrust suggests that he may have thought the plane was in a strong downdraft. Otherwise it is difficult to understand what he thought was happening. If you’re diving you don’t try to dive faster, but if you’re in a stall, you don’t increase the angle of attack. Even a strong downdraft wouldn’t take the plane to sea level. Whatever he thought was happening, he was doing the wrong thing.

Six seconds after the TOGA setting, the engines' thrust reached 103%. Under this energetic regime the plane began to climb at a rate of 2272ft per minute.

WRN/WN0906010210 228300106 FLAG ON CAPT PFD FD told the pilots that the software was no longer maintaining pitch and bank to keep the plane on its flight path under the current power setting. With that, the flight director bars disappeared from Robert's displays, which now showed red flags. As the jets spooled up, Robert told Bonin, "Above all, try to touch the controls as little as possible in… in lateral, hey!" Bonin, and not the flight system, was now responsible for pitch and bank, and Robert would have been worried that a heavy-handed lateral movement would risk pushing a wing from nearly stalled to completely stalled, and provoke a spin.

Bonin did not reply, but three seconds later, at 02:11:03, he said "I'm in TOGA, yeah?" The plane had begun to wallow, repeatedly pitching between 10½º and 18º nose-up and rolling from 5º right to 9º left, a sickening rock and roll with a period of 5 seconds. It had stalled.

Airbus didn’t build the A330 to be recoverable from a stall. It built it and its software to prevent it from stalling. In Normal law it is, by all accounts, effectively very difficult to stall. Furthermore, Airbus pilots are trained to see stalls coming and avoid them. In Alternate law at high altitude and in a cloud, you can, we now know, stall it. Airbus pilots are not trained to recover a stalled plane. It is possible that had they realised at this point that the plane had stalled, and done everything they should have to recover it, they would still have ended in the Atlantic.

At 02:11:06 Robert said something "not relevant to the conduct of the flight" followed by "Is he coming or not?" Perhaps here, as on the previous occasion when he had wondered why the captain was not there, he had said something like "putain!" or "bordel!", or "what's he doing, taking a crap?" Whatever Robert said, there was no reply, and for a quarter of a minute nobody spoke. The ISIS showed their speed increasing from 129 knots to 183 knots, and 02:11:10 the plane reached its apogee at 37 924ft.

Neither pilot had access to information on the angle of attack, which was buried deep in the drill-down menus of their instruments. Had they seen that information they would have watched it increase over the next 25 seconds from 7½ to 18½º, an absolute indication of stall. They certainly saw their airspeed decrease from 207 knots to 161 knots and they may have noticed that at the end of that fateful 25 seconds the altimeter was telling them that the nose-up plane, under full thrust, was falling at 3 904ft per minute.

WRN/WN0906010210 228301106 FLAG ON F/O PFD FD said that the flight director bars have been removed from Bodin's flight displays, too.

Clearly puzzled by the behaviour of the plane, Robert finally said "But the engines are working – what's going on?" followed by something "not relevant to the conduct of the

-12-

Still climbing

flight". In the midst of all this appalling evidence of a high-speed, high-altitude stall, Robert did not say "I think we've stalled".

The ACARS did, however. WRN/WN0906010210 272302006 F/CTL RUD TRV LIM FAULT said that the software was unable to calculate what limit to put on the movement of the rudder. Normally the system calculates the greatest deflection that is safe at the current airspeed. Airspeed having become unavailable, the rudder limiter failed, and the values that were valid at the moment of failure would restrict rudder movement from that moment until the pilot extended the wing slats.

By this time the stall warning had been sounding for 20 seconds and for at least 10 seconds various instruments had been showing clear evidence that the plane had indeed stalled.

Neither pilot mentioned that evidence, however, and Bonin kept the stick between neutral and quarter back for the next 15 seconds, pushing it forward briefly twice. Over that period the nose sank slowly from 16º to 13º but the right wing dipped 26º, the speed dropped to 133 knots and the rate of sink increased to 6 800ft per minute. They did not need to be able to see the angle of attack, which increased to 30º in this period, to work out that they were now in a stall from which in all probability, neither pilot would have been able to recover. But they did not seem to put 2 and 2 together even at this stage. Perhaps they did not even consider that an A330 could stall, perhaps they were concentrating too much on their airspeed, or perhaps they did not trust any of their instruments any more.

ACARS broadcast a message intended for Air France concerning the backup Electronic Flight Control System: WRN/WN0906010210 279045506 MAINTENANCE STATUS EFCS 2. This message was not visible to the pilots, and was apparently triggered by one or all of the previous warning messages. Its meaning has not yet been published and it is probably more to do with housekeeping than anything relevant to the story.

Whether or not they trusted their instruments, one thing was blindingly obvious. At 02:11:32 Bonin told Robert something "not relevant to the conduct of the flight" followed by "I no longer have control of the plane; I've got no control at all of the plane". Given the circumstances, I would imagine that the missing text was irrelevant but colourful language.

His next action would not have made matters worse. He pulled the stick back and to the left until it hit the stops, and held it there for the next half-minute. The nose pitched up to 15º, then sank to 9º below the horizontal – the first time it had been there for some time – before wandering back up until the plane was roughly level. Although the sidestick was hauled over to the left the plane rolled in the other direction, the right wing dipping between 16º and a vertiginous 40º.

Although Bonin's action could not have made the situation worse – because it was already terminally bad – it does perhaps suggest that neither pilot really believed their instruments. They are flying a plane that cannot stall, so evidence of a stall must mean that the instruments are faulty. In other words, both pilots probably thought that the disengagement of the autopilot had somehow led to a collapse of the computer systems controlling the displays. Neither grasped the truth – that the instruments said that they were falling out of the sky because that was exactly what was happening. They had no useful sensory input from outside apart from buffeting, much of which was contributed by the cumulonimbus in which they were stalled, and noise, to which Bonin would soon refer.

Finally, at 02:11:38, six seconds after Bonin admitted his loss of control, and a full minute too late, Robert decided that enough was enough, saying "Command on the left" to indicate that he was now flying the plane from the captain's seat. Summarily and without further warning he pushed his thumb down on the priority button on the sidestick. This switched the by-now-

-13-

Still climbing

nominal control of the plane to his side. Like Bonin, he pulled the sidestick left until it hit the stop. Given his earlier comment about avoiding heavy lateral movements to the controls, he may still have been afraid that if the right wing were to remain so low, the plane could easily go into a spin. He almost certainly did not realise that Bonin had been holding the stick hard left for quite some time by then. It is possible that Bonin did not realise that Robert had taken command; in any event, he did not acknowledge it.

The angle of attack was now 33º, the Pitot tube was recording 106 knots, and the plane had fallen nearly 2000ft, passing through 36 068ft on its way down.

At 02:11:40 either Robert relinquished control or Bonin took back control. Neither said anything about who might now be in command of the aircraft. Perhaps Bonin had realised that he had lost the command but thought that it was a symptom of an increasingly dysfunctional flight system. What he did say, however, was "I get the impression… speed".

At this point the airflow over the nose of the plane was significantly different from normal. Relative to the pilots, the flow was no longer from straight ahead, but angled up under the chin of the aircraft. The noise of the rushing air was probably considerably louder than under normal flight conditions, and together with the abnormal buffeting, might well have given Bonin the impression of great speed. The plane was also increasingly skidding from left to right, which may have amplified the sensation.

Bonin then moved the thrust control levers from TOGA to MCT, or the maximum thrust certified for continuous use. The difference between TOGA and MCT was in practice tiny; the engines' thrust was now 102%.

At 02:11:42 ACARS send a second "maintenance" message, this one concerning the primary EFCS: WRN/WN0906010210 279045006 MAINTENANCE STATUS EFCS 1, again directing it not to the pilots but to Air France and air traffic control.

At the same moment the door of the cockpit opened and Captain Dubois came back in. The A330 cockpit door can be opened from the central pedestal between the pilots, so no third person need have been on the flight deck to open it. Dubois had been away from the flight deck for 10 minutes. Less than a minute had elapsed since Robert had asked him to come back. The stall chirrup had been sounding for 50 seconds. As he entered he said, "Hey, what are you…?" to which Robert replied "What's happening? I don't know… I don't know what's going on." 5

It seems pretty clear that despite the stall warning, Robert genuinely did not realise, or refused to believe, that the plane had stalled. But that does not excuse him from failing to brief the captain on what had happened to get them into their predicament, or what the symptoms were. He left Dubois to work everything out on his own – an impossible task given that he lacked all the important information, of which perhaps the foremost elements were first, that the aircraft had lost airspeed by climbing steeply, and second, why Robert and Bonin were ignoring the stall warning. He had nothing to go on – except, of course, what the instruments and stall warning were telling him.

But there is a deeper and more important question. For what reason did Robert call Dubois back if not for him to take over the controls of the aircraft? Surely it was not so that Dubois to sit in the third occupant seat, observe, and make avuncular comments, but that is apparently exactly what he did. The plane was in Alternate law and behaving inexplicably, and it

5 According to aerobuzz.fr, Jean-Pierre Otelli claims in his book "Erreurs de Pilotage" that Robert said "we've totally lost control of the plane… we don't understand… we've tried everything…" (on a totalement perdu le contrôle de l’avion… On comprend rien… On a tout tenté…). This is not reproduced in the official BEA transcript.

-14-

Still climbing

seemed as if at least some instruments were erratic, some still perhaps even blank. The least experienced pilot – by far – was allowed to go on flying. What’s wrong with this picture? Arguably, all three were in the wrong seat, but without question, one of them was.

As Dubois came in the angle of attack had just exceeded 40º but by 02:11:45, as the plane fell through 3 5372ft, with its nose 15° above the horizontal and the right wing dipped 32° down, the three windshear instruments registering the angle of attack failed and as a result, the stall warning chirrup finally stopped. The instrument that had been calculating the rate of sink gave up and passed its responsibility to another as the value, some 10 000 ft per minute, exceeded its capabilities.

Up to this moment all the ACARS messages had been warnings. Now it announced a fault. FLR/FR0906010210 34111506 EFCS2 1,EFCS1,AFS,,,,,PROBE-PITOT 1X2 / 2X3 / 1X3 (9DA),HARD The Pitot tubes agreed that they had registered a drop of more than 30 knots in a second. The HARD meant that the fault was not transient, but persistent.

At 02:11:47 Robert took back control from Bonin without a word being spoken about who was in command of the aircraft. As he did so, he reduced thrust to idle. A few seconds later he said "Alors tiens prends… prends ça". This is at best difficult to interpret. Two phatics are followed by "take… take that". It is unlikely that he was referring to the latest ACARS message, because he was now flying the plane and would not be trying to read a juddering message. It is possible that he was addressing the aircraft, because "prends ça", like its English counterpart "take that", can be a rhetorical device meaning something like "see how you like that, then", having cut the thrust to zero.

If you are in a stall, the thrust of the engines, mounted below the wings, tends to lift the nose. This maintains a high angle of attack and can make it difficult to re-establish smooth airflow over the wing. Setting the throttles to idle should help to lower the nose, and together with stick forward, reduce the angle of attack and get the plane flying again, albeit in a dive.

Had they indeed been rushing headlong into the night, the sudden reduction in thrust would have resulted in a sharp deceleration of the airframe. Nothing of the sort happened. If anything should have convinced them that they were in a stall, this was it. Instead the loss of thrust, as Robert expected, affected the pitch, which in the space of 15 seconds fell from 16° nose-up to about 12° nose down. Had this been allowed to continue, the plane might have been able to recover from the stall.

ACARS now sent a second fault message FLR/FR0906010210 27933406 EFCS1 X2,EFCS2X,,,,,,FCPC2 (2CE2) together with a warning /WRG:ADIRU1 BUS ADR1-2 TO FCPC2,HARD. The warning message said that the primary flight control computer 2 no longer considered valid the data arriving in bus 2 from Air Data Reference 1 (the module that calculates airspeed), but the fault message added that the other primary flight control computers had not detected the problem in the following 3 seconds. It would be a minor miracle if the PNF, whoever that was, had been able to read this, let alone work out what it meant.

Perhaps as a consequence of the changing pitch one of the three windshear instruments came briefly back on line, registering 41º and immediately triggering the synthetic voice stall warning and a brief burst of chirrup. By now the altimeter was unwinding at an unbelievable 14 800 ft per minute. Two seconds later the other two windshear instruments came back on line, registering 40º, and Robert’s tentative but correct input was rewarded by a stall warning.

The rate of descent was 15 300ft per minute when, at 02:11:58, Bonin told Dubois “My problem is that I’ve no vertical speed indicator any more”. In claiming that the instrument had failed, and thereby denying what it was telling him, he was inadvertently driving another

-15-

Still climbing

nail into the coffins of 288 people. Dubois replied, “understood”. That understanding, arrived at just 16 seconds after he entered the cockpit, may have doomed the plane, but it would probably have taken far more training than any of them possessed to save the situation at this point. Bonin concluded, “I’ve no data at all.” He may have been referring simply to the vertical speed but he may also have been expressing a more general dismay at the failure of the instruments. Or, possibly, he may have been working out why none of this was his fault, but Robert confirmed “we have no valid data”.

WRN/WN0906010211 341200106 FLAG ON CAPT PFD FPV gives a partial cause for their dismay, since it says that the Flight Path Vector has blanked on Robert's screen, to be replaced with a red flag. The flight path vector is a simple way of showing where the aircraft is going relative to the horizon and the direction in which the aircraft is pointed. Thus if the plane is yawing left and flying nose-up but sinking, the flight path vector would show as a "bird" below and to the left of the central cross-hairs on the screen. But it is not true that they had no valid data, or ACARS would have told air traffic control so. They just weren't sure which data were valid.

Six seconds later, Bonin told the others, “I have the impression that we're flying incredibly fast, yeah?.. what do you think ?” So saying, he activated the air brakes. Nothing beats finding consensus on the flight deck before taking drastic action. “No!” shouted Robert, “whatever you do, don’t deploy them!” just as an angle-of-attack sensor came back on line and the synthetic voice called “stall, stall”. From his previous comments and this impulsive action, it seems that Bonin was suffering from confirmation bias, ignoring any evidence contrary to his belief that they were in a high-speed dive and in danger of overspeed. The BEA report does not say whether the spoilers were subsequently retracted.

Robert seems not to have been so convinced that they were flying at high speed, for at 02:12:10 he pushed the thrust levers to the “climb” détente, causing the engines to go from 58% to 105% thrust in about 10 seconds. For a moment one of the angle-of-attack sensors had a valid reading – still of 40 – and the by-now familiar synthetic voice stall warning called “stall, stall” and the chirrup sounded briefly.

WRN/WN0906010211 341201106 FLAG ON F/O PFD FPV. The Flight Path Vector had blanked on Bonin's screen, too.

Three seconds later, he asked Dubois, “What do you think? What do you think? What should we do?” After a brief pause, Dubois replied “Well, I don’t know…”. He had been in the cockpit for little more than 30 seconds, and had just been told by both pilots that none of the instruments were reliable. He might also have been trying to understand what had convinced his two pilot officers that the plane was not in a stall – and who knows, perhaps he was in denial himself at the enormity of the catastrophe. He went on, “…that’s dropping.”

The words were barely out of his mouth when at 02:12:16, without warning, Bonin took back command and the synthetic voice stated “Priority right”. Neither Bonin nor Robert commented, but Bonin may have just had a thought. His first action was to push the stick 1/3 forward, causing the plane to respond by lowering its pitch from just over 3º to just under 2º. “There! That’s good, there… we should get back to level wings… no it wants to…”

Dubois responded “Wings level ... the artificial horizon, the emergency backup horizon…”. Robert picked up the idea, “the horizon…” and Bonin moved the sidestick from left to right and back again, to try to counter the roll from 12º left to 17º right in 7 seconds. He then pulled back on the stick, then pushed the stick hard forward for about a second, and then pulled back again, causing the nose of the plane to pitch up to 7º. At 02:12:26 one of the windshear detectors registered 44º for a moment and just before the inevitable stall warning,

-16-

Still climbing

Robert asked “the speed?” and then went on, “You're going up... go down! go down! go down! go down!”

What can we make of this exhortation? The plane was flying with some of the grace and loft of a brick. If there was one instrument that was consistent, even if the pilots doubted that it was reliable, it was the altimeter. Another, which they had unfortunately discarded as useless, was the vertical speed indicator. Neither of these devices was giving any indication that the plane was “going up”. Nor was the registered airspeed, which had been consistent and slowly dropping for nearly 2 minutes. What was going up was the pitch. Could Robert have been making hand motions to show that what he wanted was for the nose to go down, go down, go down? This, after all, was what he had been asking Bonin for what, by now, must have seemed a lifetime. If so, it might have clarified things had he used less ambiguous language, saying "get the nose down!" It's more concise in French: "Piques!" and you can still use your hands to show what you mean. Instead, everyone was using "descendre" – which in slang, ironically, can be used to mean "kill" or "massacre".

Bonin replied at 02:12:30, “Am I going down?” to which Robert immediately and rather unhelpfully replied “Go down!” and Dubois answered more usefully, “No you're going up, there”. The nose was pitched 5º above the horizontal, and increasing, and the engines thrusting for all they were worth. Bonin acknowledged “There I'm going up ok so let's go down” and pushed the stick a quarter forwards. The plane responded immediately by decreasing its pitch from 8º above to 2º below the horizontal.

Hardly had Bonin told the others, suiting action to words, “OK, we’re in TOGA” when the windshear sensor registered 39º and the synthetic voice stall warning called “stall! Stall!” As the other two sensors came back on line, the chirrup started.

Given the meteorological conditions in the cold air outside, the control surfaces might have begun to accumulate clear ice, but it is unlikely that this made any difference to the outcome.

At 02:12:42 as the plane plummeted past 20 412ft, Bonin asked, “what’s the altitude?” to which, after a couple of seconds’ delay, Dubois answered with something "not relevant to the conduct of the flight" – another expletive deleted, perhaps – then, “It's not possible…” because by then the aircraft was at 20 028ft and the altitude was unwinding at some 270 meters every second. In all his 11 000 flying hours, Dubois had certainly never seen an altimeter on which not just the units but the tens were an unreadable blur. Just 1½ minutes earlier the plane had been 18°000ft higher. After another 2 seconds, Bonin repeated his question, “what’s the altitude?” During this exchange Bonin moved his sidestick back and forth from about 1/3 forward to 1/3 back, and the pitch changed from 6° up to 7° down. The airspeed from the Pitot dropped from 153 knots to off-scale low, then climbed back up to 127 knots.

At 02:12:45 Robert asked, “What do you mean, altitude?” just as he said this, the windshear instrument dropped off line, and the stall warning ceased. Bonin replied “yeah, yeah, yeah – I'm going down now, aren't I?”, which earned an honest, “Oh, yes, you're going down” from Robert. The sidestick was still hard against the left stop.

It is impossible to imagine the state of mind of the captain. Nose up, in TOGA, the altimeter unwinding in a blur, and the stall warning sounding – and yet neither of his co-pilots had suggested that they might have somehow stalled the aircraft. Besides, how could they possibly have done so? How, in a few minutes, could you take a perfectly normal flight in one of the most advanced aircraft in the world, and stall it? What in the world was going on? Why was the airframe shuddering so much? Both of his co-pilots had told him that none of the data was valid, so what did all these insane readings tell him?

-17-

Still climbing

To add to the confusion an windshear instrument came back, measuring 41°, and the familiar synthetic voice of the stall warning called "Stall, Stall!" and the chirrup began again.

WRN/WN0906010212 341040006 NAV ADR DISAGREE. The 2 remaining sources of airspeed data disagree with one another.

All of the data were invalid? No. A few seconds after the confused Three Stooges-like exchange on the altitude, Dubois noticed one instrument that worried him. "Hey you... you're in ... get – get the wings level!" Robert noticed the same thing, "Get the wings horizontal!" to which Bonin responded "That's what I'm trying to do!" He was. The sidestick was hard against the left stop. To no avail, though, as the right wing dropped from 12° below the horizontal to 41° below at about 3° a second. This is not how A330s are supposed to fly, so Dubois insisted, "Get the wings horizontal!"

Bonin, perhaps gasping with effort, replied at 02:12:59, "I'm giving full stick to... to control roll…" (He used the word "gauchissement" which some non-French speakers have translated as though it had something to do with "gauche", meaning "left". It doesn't. The verb "gauchir" means to twist or to corkscrew, and in aviation terms, to roll.) Roll seems to have been the one instrument they all believed. All three pilots seem preoccupied by horizontal, perhaps to the exclusion of other more important issues, like the other two axes.

What Bonin did not say was that he was also pulling back on the stick; he, at least, was focused on the vertical. The nose of the plane rose from 7½° below the horizon to 6.0° below; he would continue to hold the stick half-back for the next 40 seconds. The speed recorded on the Pitot tube fell from 127 knots to 56 knots. The software detected that the airspeed was below 60 knots and silenced the stall alarm.

FLR/FR0906010211 34220006 ISIS 1,,,,,,,ISIS(22FN-10FC) SPEED OR MACH FUNCTION,HARD This fault occurred as the difference between total and static air pressure fell to a value inconsistent with flight. "HARD" meant that this condition lasted for 2 seconds or more.

Dubois said "The rudder". In response, Bonin positioned the rudder bar ¼ left and then ¼ right, maintaining it there for 4 seconds. He pushed the sidestick full right, then full left. The plane slowly righted itself from 15° right to 3° left. He moved the sidestick right, then hard left, positioning the rudder-bar slightly to the right.

Under his continued pitch-up urging, by 02:13:10 nose was 13° above the horizon, but over the next 5 seconds it fell to 11° nose-up. Neither airspeed nor angles of attack instruments were giving valid readings. The plane was now probably falling at a 45 angle, dropping a meter for every meter it moved forwards. Bonin moved his sidestick from side to side, from ¾ left to ½ right, but mostly trying to lift the right wing by moving the stick left. Whether under his urging or for some external reason, the plane rolled from 17° right to 10° left and back.

FLR/FR0906010211 34123406 IR2 1,EFCS1X,IR1,IR3,,,,ADIRU2 (1FP2),HARD The Inertial Reference Unit 2 had decided that none of the sources of information on barometric altitude, barometric vertical speed and airspeed were reliable.

At about 02:13:20 Robert began to move his sidestick back and forth, left and right, but 4 seconds later he stopped.

At 02:13:23 the synthetic voice said, “Dual input”.

-18-

Still climbing

Two seconds later, Bonin asked “What is... how come we keep going down so fast?" to which Robert replied, after a short pause, “Try to see what you can do with your controls up there. The primaries etc.”

At 02:13:32, Bonin said something unintelligible, perhaps “We’re just about to get…”, ending with “…to level 100”. The altimeter had just gone through 10 000ft. Four seconds later, he said “9000 feet”.

At 02:13:38 Dubois urged, “Easy with the rudder, there.” Robert was more emphatic: “Climb! Climb! Climb! Climb!” Was he addressing his co-pilot, or the aircraft? Whoever he was talking to, his actions belied his words, because once again he took his sidestick and pulled it ¼ back, then ½ forward, and then mainly held it forward, apparently trying to get the nose down and gain airspeed. Bonin was meanwhile holding the stick hard back, letting it go back to neutral twice. The nose of the plane, from 12° up sank to 4° down, then wallowed back to 15° up.

At 02:13:40 Bonin said “But I’ve been pulling the stick full back for a while…”

His sentence was interrupted by the synthetic voice: “Dual input” followed by Dubois, who contradicted Robert, saying, presumably with some urgency, “No, no, no, don't climb!” This response suggests two things. First, he, like Robert, had not realised that Bonin had been trying to pull the nose up more or less since Dubois had entered the cockpit. Second, he may have come to the obvious conclusion. The problem now was that they were, as they say, upside down in a cloud, fuck all on the clock, and still climbing. Only they weren’t. Either upside down or climbing, that is.

Robert concurred, changing his view of a second or so ago – “So go down, then!”

He must have seized the controls again, because at 02:13:43 the synthetic voice recorded “Dual input!” and two seconds later he told Bonin, “So give the me controls! I have the controls!” But Bonin was no walkover. At 02:13:45, “Dual input!” and although Bonin ceded, saying “Go on, you have the controls. We're still in TOGA, OK?” he did not let go of the sidestick, prompting the synthetic voice to say again at 02:13:47, “Dual input!”

WRN/WN0906010213 279002506 F/CTL PRIM 1 FAULT. This was the worst news yet, but the chances are good that none of the pilots was paying the ACARS much attention at this point. What it said was that the Primary Flight Controls Computer 1 had crashed. But worse was to come.

WRN/WN0906010213 279004006 F/CTL SEC 1 FAULT. The Secondary Flight Controls Computer 1 had crashed as well.

Robert pulled the thrust back to CLB and pulled the sidestick hard the left. As the plane rolled from 23° to the right to 10° left, Bonin also pushed his stick to the left – mostly. The windshear sensors registered a valid angle (falling from 39° to 37° and then climbing to 43°) and the synthetic voice claimed “Stall! Stall!” and the chirrup started sounding again. The Pitot tube registered 53 knots rising to 89 knots before falling back to 30 knots.

At 02:14:03 the stall alarm stopped. The nose was 14° up when Dubois said, “Watch it, you're pitching up!” “I'm pitching up?” asked Robert. “Well, you should,” said Bonin, “we're at 4000 feet!” Robert pulled back on the stick, sometimes hard back, sometimes letting it go back to neutral. The nose of the plane pitched up to 15°, then to 18°, wallowed back down until it was pointing 3.5° down and then back up to 16° up.

At 02:14:09 someone, perhaps Robert, took the thrust down from CLB to IDLE for a couple of seconds, then pushed it back up to 21°. The engines spooled down to 55% in 8 seconds.

-19-

Still climbing

ACARS had not been idle. WRN/WN0906010214 341036006 MAINTENANCE STATUS ADR 2. The ground crew would have some work to do.

At 02:14:17, just 2140 feet above the ocean, the synthetic voice called “Sink rate!” and then “Pull up! Pull up! Pull up!” Bonin, who had let go of his sidestick, pulled it hard back to the stop. And half over to the left, for good measure.

Dubois called out, “Go on, pull!” and someone pushed the thrust back up to TOGA as Robert exclaimed “Come on, pull! Pull! Pull!”. The Pitot tube recorded the effect of the increased thrust; the airspeed climbed from 30 knots to 60 knots before falling back to 32 knots.

Nobody seems to know what the penultimate ACARS message meant. FLR/FR0906010213 22833406 AFS 1,,,,,,,FMGEC1(1CA1),INTERMITTENT, it said.

At 02:14:21, Bonin took back control of the plummeting aircraft, without telling anyone. The windshear sensor came back on line with the predictable result – “Stall! Stall!” then Robert moved the stick left and right, keeping it mostly to the right of neutral. The plane rolled from 9° right to 18° left. The synthetic voice urged “Pull up! Pull up! Pull up! Pull up!”

WRN/WN0906010214 213100206 ADVISORY CABIN VERTICAL SPEED. Somewhere a computer was still operating. Its software had noticed that the air pressure in the passenger cabin had been increasing for more than 5 seconds at a rate that suggested a vertical speed of 1800ft per minute or more. To add to their extreme discomfort on this disagreeable flight, passengers' ears were popping.

At 02:14:26 Dubois had the last word6. “…degrees of trim!” Perhaps he said “more than 10 degrees of trim”, but it doesn’t much matter. Had he noticed the stabilizer trim and finally realized the terrible truth? Again, it doesn't matter. Robert had his sidestick hard against the right stop and Bonin was pulling hard back on his as the plane smashed belly-first into the water.

At 02:14:28.4 the data stream ended. Coincidentally, as the airframe and its contents hit the water, its forward speed (55.05ms-1) matched its vertical speed (55.43ms-1) almost exactly. Its impact velocity of 78.12ms-1 would have carried it some way into the water. Water, however, is both incompressible and massive, while airframes are neither. Bits that travelled 20m into the ocean before they came to a halt would suffer about 15g of deceleration. Any component that only went half as far would feel twice the deceleration. The vertical stabilizer was subject to 36g or more, suggesting that the rest of the tail of the aircraft travelled no more than 8 or 10m into the water as it came to rest. The tail fin twisted to the left as it broke away.

Heavy tropical rain hissed on the spreading kerosene and hammered on the few bits of wreckage that floated. The froth on the dark waves was soon gone, and the bubbles slowly trickled to nothing.

6 Otelli reports that just before Dubois spoke, Robert said “fuck, we're going to crash… it's not possible!” (Putain, on va taper… C’est pas vrai! ) and Bonin summed up his final few minutes: “but what's going on? ” (Mais qu’est-ce qui se passe?). These remarks are not reproduced in the official BEA transcript.

-20-

Epilogue

Predictably, given the forces involved, the wreckage is fragmented, with few bits larger than a square metre. Robert's seatbelt was buckled, but the shoulder harness was not. Bonin's seatbelts were not fastened. None of the belts were buckled on any of the cabin crew's seats that have been recovered. Dubois' body was found in the initial stages of the search, but neither Robert's nor Bonin's were.

The Brazilian authorities carried out the autopsy of the passengers behind closed doors. They have not released the results except to say that most of the skeletal remains showed multiple fractures, with almost all the passengers suffering broken ribs and pelvic bones and compressed and fractured vertebrae. The fractures suggested that the passengers were seated as the plane impacted the water. The bodies were too decayed to establish whether any died by drowning.

Pierre-Cédric Bonin's wife Isabelle was a passenger on the plane.

Lessons

What do we learn from this disaster?

Pitot tubes

The proximal cause of the accident was loss of the standby Pitot tube and the subsequent the lack of correspondence between the 2 functioning Pitot tubes, part number C16195AA. This inconsistency was almost certainly caused by them icing up, a problem that had been recognised by 2007, and perhaps long before. Well before the AF447 accident, the manufacturer, Thales, had recommended that airlines replace the AA tubes by their upgrade, part number C16195BA, even though this BA version was not modified with the intent to resolve the problem of icing but to drain better in heavy rain. Given that the Thalys AA had failed at least 17 times on an A330 or A340, and wind-tunnel tests provided evidence that the probes were susceptible to icing, Airbus concurred, and in 2007 suggested that airlines replace the AA pitots by the newer BA. It maintained, however that the AA probes exceeded regulatory requirements.

Air France was now in a quandary, since its A330s had originally been fitted with Goodrich 0851GR probes, which had proved less than reliable. In 2001 the French DGAC mandated that Goodrich 0851GR probes should be replaced by Goodrich 0851HL or Thales probes. Air France chose to replace them with Thales probes.

Now, reluctant to switch back to Goodrich, Air France nevertheless decided that whenever an AA pitot gave problems on its A330s, they would replace it with an AB pitot. In April 2009 flight trials confirmed the wind-tunnel evidence of the problems with the AA tubes, and Air France modified its earlier decision and decided instead to replace the probes at the first opportunity, not waiting for them to fail.

*sharman@iname.comThe views expressed here are those of the author and may not under any circumstances be regarded as a position of the European Commission.

Still climbing

Ironically, on the day of the crash, Air France had begun to replace Thales pitot tubes on all its A330s, and by 12th June none of its A320s, A330s or A340s still used them. Since the crash Airbus has advised airlines to replace at least 2 of the 3 Thales probes on their A330/A340s with Pitots constructed by Goodrich, whose tubes apparently exhibit lower failure rates in simulations.

The European Aviation Safety Agency intends to make replacement of the AA tubes mandatory, and may also require operators to keep no more than 1 BA tube – which costs about €3500 – on any one plane. Which costs €200 million.

Verdict: Air France comes out of this better than Airbus, which comes out badly indeed. But it seems pretty clear that Goodrich tubes are not magic bullets.

Memory Items

The speed discrepancy between the pitot tubes caused the autopilot to switch to Alternate law. This gave the pilots the responsibility for keeping the plane from stalling or overspeeding when they had no good indication of how fast they were going.

Airbus has published procedures and guidelines for unreliable speed, together with associated "memory items". These guidelines state that if the safety of the aircraft is not affected, the correct procedure is to level off and begin troubleshooting to discover the cause and extent of the problem. This is also the correct procedure if the aircraft is above the Minimum Safe Altitude even if the safe conduct of the flight is impacted. If, on the other hand, the safety of the aircraft is affected, and the plane is above Flight Level 100 (10000ft), the PF should engage CLB thrust and

pitch up 5º.

The crew should then try to determine if one of the airspeed indicators is clearly faulty, while another seems reliable. In this case they should use the reliable indicator until the unreliable speed indications stop. If they cannot work out which one is faulty, or if both seem faulty, they should fly using pitch and thrust.

Verdict: Airbus gives sensible guidance, but neither Bonin nor Robert followed it.

Software

The people who specified and designed the flight software thought about what might trigger a stall warning as the aircraft began to stall, but failed to consider what would go on once the aircraft had stalled. In particular, they overlooked the possibility that airspeed indicators might show speeds more commonly seen when on the runway, with very high incidence or windshear angles, and that this might happen either because the Pitot tubes had failed, or because the plane was far into a bad stall. They designed the software so that such low measurements would cause the angle of attack data to be treated as if they were invalid. They also overlooked the possibility that the windshear indicators might not work when the angle of attack really was above 40º. Admittedly, this extreme angle of attack has very little to do

-22-

Still climbing

with "flight", and the mandate of the designers was presumably to create an energy-efficient system that allowed the aircraft to keep flying safely and predictably. Even if they had considered it, they might not have thought it was worth spending design and coding effort on, since software to help you get out of a stall would probably be hugely complex and hard to validate. Nevertheless, when automatic systems fail, they should do so obviously. It is not hard to think of ways of distinguishing between being on the runway and being in a stall with unreliable airspeeds and high or unreliable angles of attack.

This feature of the software certainly added to the confusion of the pilots, and may have been instrumental in their failure to recover the stall when it might still have been possible. Every time they pitched the nose down far enough for airspeeds or angle of attack to register, the stall alarm sounded; pulling back caused it to stop.

What added significantly more confusion was that the software, when passing from the "stalled" status to a "no data" status, did not change the nature of the alarm, but simply switched the alarm off. Can synthetic voices sing "nearer my god to thee"?

The horizontal stabilizer remained deflected at 13º through the entire stall. This may not have played a major part in the accident, in that stabilizers work when the wing is functional but not when it is stalled, but it might have tended to raise the nose of the plane whenever it had sufficient airspeed to generate lift over the tailplane.

Verdict: the team responsible for specifying the functionality of the flight software share a considerable part of the responsibility for the accident.

Further remark: On 13 known occasions an Airbus has suffered erratic data on airspeed (for up to 3 min 20 sec). In all cases the plane was flying through turbulent unstable air with strong updrafts between 34 and 39000ft. In all cases the radar detected no dense cells, but ice crystals are far less reflective to radar than liquid water, and in all cases the outside temperature rose from 10 to 20ºC just before the trouble began. In all cases the autopilot disengaged and in 12 cases the software switched to Alternate law and flight director indicators were lost, only to reappear later. In 10 cases the autothrust disconnected and thrust was locked, and in half of those cases the lock lasted for a minute or more. It should be possible to design software that warns the pilots when it detects ambient conditions likely to cause problems with icing. It might perhaps even override the switch from Normal to Alternate while keeping the plane on thrust and pitch for 2 or 3 minutes or until the airspeed sensors are in agreement and in the range of probable values.

Cockpit ergonomy

The design of the flight controls seems to have included some unhelpful features. The sidestick of the Airbus has no haptic feedback, so the pilot gets no information about the aircraft's behaviour through his hand. Video game manufacturers know that such feedback increases your feeling of being there, which is perhaps not a bad thing when you're flying a plane. The displays available to the PNF do not include anything that reports the PF's stick input, and the PNF cannot feel, by putting his hand on his sidestick, what the PF is doing with his controls. This may not matter in normal circumstances but in an emergency the PNF is cut off from important and useful information. Angle of attack information is buried rather far down under a series of unrelated screens, making it essentially inaccessible in an emergency. Even if is not helpful in most circumstances, if you need it, you probably need it right now.

Verdict: hmm. I'm not a pilot, but it would seem that Airbus has designed this plane to be easy to fly in non-extreme conditions.

-23-

Still climbing

Training

The reputation of Air France for pilot training or for safety was not improved by the report on the A340 crash-landing in Toronto. Air France says that 90% of the recommendations of that report have been implemented, but the crash of AF447 is not reassuring. The pilots found themselves high in a cumulonimbus at night with unreliable airspeeds and in Alternate law – a situation which has occurred a significant number of times before, but for which they had not been trained. After Dubois came back onto the flightdeck they were in a conformation of authority for which they also had no training.

From what I've been able to find on the web, Air France, like almost every commercial airline, seems to do little to train their pilots for high-altitude high-Mach stalls. Training is apparently focused on what to do as the plane approaches a stall, and less on what to do once it has stalled – and most of this training is at low altitude, involving somewhat scripted responses to approaches to stalls on landing.

Part of the problem is that it's difficult to build a simulator that behaves like the plane in a stall. Different planes stall and recover differently, so to find out how a new plane behaves in a stall, you'd have to go out and stall it, and try various things to see if you can recover it, and write the simulator software accordingly. Normal flight simulation software deals with laminar flow and well-quantified equations of lift and drag, with constrained values of windshear, angle of attack, yaw and pitch. These equations are worthless when it comes to modelling what happens in a stall in which the plane is suffering separation of airflow over aerofoils and control surfaces, some of it shock-induced; turbulent compression and decompression of air volumes near the plane; rapidly changing and unconstrained windshear, pitch, yaw and angles of attack; and all accompanied by buffeting and erratic g forces. And, of course, unreliable and rapidly changing measures of airspeed and angle of attack to add a little cayenne to the curry. Software to model a stalled aircraft reliably would be orders of magnitude more complex, more expensive, and difficult to validate than software that models a flying plane.

Military pilots are trained to deal with stalls on real aircraft. Airlines are understandably reluctant to take trainees up in a great big expensive plane and have them stall it at high Mach and high altitude and try to recover. High altitude means thinner, more compressible air, and lower values for the aispeed at which sonic shock waves form and cause airflow to separate from the wing, so training lower in the atmosphere does not prepare pilots for the behaviour of the stalled plane at higher altitudes. Civilian airliners aren't supposed to stall - but they do, and loss of control in flight is now a more common cause of crashes than controlled flight into terrain. So airliners would certainly like to train their pilots to recover from stalls - but (at least as far as I've been able to discover) they find themselves forced to train them only to avoid stalls.

Verdict: Air France failed to train its pilots in techniques that would almost certainly have prevented this accident.

Cockpit Resource Management

It is obvious that the final BEA report will go into the CRM of this crew in great detail, and its interim reports have already pointed out many indications of poor CRM that Air France will need to address in its training.

The captain left the flight deck without instructing his co-pilots on their roles, or on the operation of the aircraft. After he left, the co-pilots did not clarify their roles, and teamwork was largely absent. Once Alternate law kicked in, the least experienced pilot was left at the controls. After the captain returned, he was not briefed and he failed to replace Bonin at the

-24-

Still climbing

controls or to take control in any way. The pilots used sloppy and unprofessional language containing considerable ambiguity. Neither pilot followed industry standards by calling out intentions to change, or changes observed, in airspeed, pitch or vertical speed. Neither pilot mentioned the stall warning or formally identified the stall, and the captain also failed to do so after his return to the flight deck. Each co-pilot took control from the other without formal handover, but this scarcely matters since it was by then too late to save the aircraft.

Crucially, none of the three pilots ever attempted to state salient facts and try to draw explicit conclusions or hypotheses about the status of the aircraft that would allow them to work out what to do.

Air France has stated that “the crew, made up of three skilled pilots, demonstrated a totally professional attitude and were committed to carrying out their task to the very end.” It would be interesting to hear how Air France defines a professional attitude.

Verdict: Air France failed to emphasise sufficiently the importance of systematically applying best practice in CRM.

Pilot psychology

Bonin was the least-experienced, and quite possibly the least skilled of the three pilots. In the face of what was initially a rather straightforward set of information, he seems to have been quick to reach wrong conclusions, and to have done so repeatedly as the information became more confusing. He does not seem to have realised, or perhaps been able to accept, that he had made a catastrophic series of mistakes. He probably thought that he was a rather good pilot; most car drivers believe they are better than average.

Robert, on the other hand, who was certainly the most experienced of the three, only tried to take control when it was far too late. He certainly must have found the situation inexplicable, since he must have understood that Bonin was trying to keep the nose of the plane down, not persistently pulling it up. But had he clearly taken control at the outset – on the grounds that the safety of the aircraft was more important than any possible lesson that the less experienced pilot might learn – he would have been in possession of fact, not supposition. Could he have underrated his capacities as a pilot and deferred to his colleague, or assumed that Bonin was at least as competent as him? If so this would be a classical and tragic example of the Dunning–Kruger effect.

Dubois had every right to believe that his co-pilots knew more than him about the unfolding events. He did not know that they had, as far as we can tell, either rejected most of that knowledge, or gained misleading knowledge, and that his ignorance was in some sense an advantage. Had he immediately taken control, he might conceivably have acted instinctively in a way that would have helped. Instead he chose to remain a concerned bystander, merely observing an unfolding disaster.

Pilot error

There is no need to catalogue the many errors made by the pilots, and especially by Bonin. Like many "pilot error" accidents, however, the cause of the crash was not just pilot error. This accident happened because of a fatal concordance of errors of thinking, design, training, and judgment, not only in the moments before impact, but long before the plane left the runway.

ReferencesAerobuzz.fr (2011) J.P.Otelli dénonce les erreurs de pilotage du vol AF447 Rio-Paris Accessed on 9 Nov 2011 at http://www.aerobuzz.fr/spip.php?article2188

-25-

Still climbing

AIRBUS (1999) A330 Flight deck and systems briefing for pilots Accessed on 10 Aug 2011 at http://www.smartcockpit.com/data/pdfs/plane/airbus/A330/misc/A330_Flight_Deck_and_Systems_Briefing_For_Pilots.pdf

Airfleets.fr (2011) Accessed on 10 August at http://www.airfleets.fr/ficheapp/plane-a330-660.htm

Airliners.net (2011) Accessed on 10 August at http://www.airliners.net/aviation-forums/general_aviation/read.main/5212138/#menu1 and at http://www.airliners.net/search/photo.search?keywords=F-GZCP

Apollo (undated) Airbus fly-by-wire. How it really works. Accessed on 10 Aug at http://www.apollosoftware.com/products/flybywire/flybywire_english.pdf

Barthe J. (2007) AF447 - Unreliable Speed. Accessed on 10 Aug 2011 at http://aviationtroubleshooting.blogspot.com/2009/06/af447-unreliable-speed-by-joelle-barthe.html

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2009) Rapport d’étape: Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France vol AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2009) Interim report on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2009) Rapport d’étape n° 2: Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France vol AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2009) Interim Report n°2 on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2011) Rapport d’étape n° 3: Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France vol AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (2011) Interim Report n°3 On the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris. Accessed on 10 Aug 2011 at http://www.bea.aero/fr/enquetes/vol.af.447/oet.04juin09.php

Dutchops.com (2009) Airbus A320 Primary Flight Controls Accessed on 10 August at http://www.dutchops.com/Portfolio_Marcel/Articles/Flight%20Controls/A320_Flight_Controls/A320_Primary_Flight_Controls.html

Eurocockpit (2009) AF447: la saga des tubes Pitot durerait depuis 15 ans. Accessed on 10 Aug 2011 at http://www.eurocockpit.com/archives/indiv/E009451.php on 10 Aug 2011

Federal Aviation Administration (2008) Joint Aircraft System/Component Code Table And Definitions Accessed on 10 August at http://av-info.faa.gov/sdrx/documents/JASC_Code.pdf

-26-

Still climbing

Gerstein M.S. (2008) Flirting with Disaster: Why Accidents Are Rarely Accidental. Union Square. ISBN-10: 1402761082

Hradecky S. (2009) Crash: Air France A332 over Atlantic on Jun 1st 2009, aircraft impacted ocean. The Aviation Herald. Accessed on 10 August at http://avherald.com/h?article=41a81ef1/0037

Kaminski-Morrow D. (2011) AF447: After two long years, six short minutes. Accessed on 10 August at http://www.flightglobal.com/blogs/flight-international/2011/05/af447-after-two-long-years-six.html

Kullanarak F. (undated) F/O's Primary Flight Display Flags (PFD) Accessed on 10 August at http://ozten.net/aviation/A321/320/fwd/pfd2.html

Vasquez T. (2009) Air France Flight 447: A detailed meteorological analysis. Accessed on 10 Aug 2011 at http://www.weathergraphics.com/tim/af447/ on 10 Aug 2011

-27-