By Nick Ross, Neil Tweedie
7:30AM BST 28 Apr 2012
In the early hours of June 1 2009, Air France Flight 447 from Rio de Janeiro to Paris went missing, along with 216 passengers and 12 crew. The Airbus A330-200 disappeared mid-ocean, beyond radar coverage and in darkness. It took a shocked and bewildered Air France six hours to concede its loss and for several agonising days there was no trace. It was an utter mystery. No other airliner had vanished so completely in modern times. Even when wreckage was discovered the tragedy was no less perplexing. The aircraft had flown through a thunderstorm, but there was no distress signal, and the jet was state-of-the-art, a type that had never before been involved in a fatal accident. What had caused it to fall out of the sky?
The official report by French accident investigators is due in a month and seems likely to echo provisional verdicts suggesting human error. There is no doubt that at least one of AF447’s pilots made a fatal and sustained mistake, and the airline must bear responsibility for the actions of its crew. It will be a grievous blow for Air France, perhaps more damaging than the Concorde disaster of July 2000.
But there is another, worrying implication that the Telegraph can disclose for the first time: that the errors committed by the pilot doing the flying were not corrected by his more experienced colleagues because they did not know he was behaving in a manner bound to induce a stall. And the reason for that fatal lack of awareness lies partly in the design of the control stick – the “side stick” – used in all Airbus cockpits.
Anything to do with Airbus is important. The company has sold 11,500 aircraft to date, with 7,000 in the air. It commands half the world market in big airliners, the other half belonging to its great American rival, Boeing.
The mystery of AF447 has taken three years to resolve, involving immensely costly mid-Atlantic searches covering 17,000 square kilometres of often uncharted sea bed to depths of 4,700 metres. So remote was the place the airliner went down, in equatorial waters between Brazil and Africa, that it was five days before debris and the first bodies were recovered. Finally, almost two years later, robot submarines located the aircraft’s flight recorders, a near-miraculous feat that revitalised the biggest crash inquiry since Lockerbie.
Prior to the recovery of the recorders, the cause of the disaster could only be inferred from a few salvaged pieces of wreckage and technical data beamed automatically from the aircraft to the airline’s maintenance centre in France. It appeared to be a failure of the plane’s pitot (pronounced pea-toe) tubes – small, forward-facing ducts that use airflow to measure airspeed. On entering the storm these had apparently frozen over, blanking airspeed indicators and causing the autopilot to disengage. From then on the crew failed to maintain sufficient speed, resulting in a stall which, over almost four minutes, sent 228 people plummeting to their deaths.
But why? Normally an A330 can fly itself, overriding unsafe commands. Even if systems fail there is standard procedure to fall back on: if you set engine thrust to 85 per cent and pitch the nose five degrees above the horizontal, the aircraft will more or less fly level. How was it that three pilots trained by a safe and prestigious airline could so disastrously lose control? Either there was something wrong with the plane, or with the crew. Airbus and Air France, both with much to lose, were soon pointing accusing fingers at each other.
In July last year the French air crash investigation organisation, the Bureau d’Enquêtes et d’Analyses (BEA), published its third interim report. For Air France the conclusion was crushing: the crew had ignored repeated stall alerts and kept trying to climb, instead of levelling off or descending to pick up speed. The A330 had become so slow that it simply ceased to fly. Its reputation on the line, Air France came as close as it dared to repudiating the finding. The pilots, said the airline, had “showed unfailing professional attitude, remaining committed to their task to the very end”.
But the airline’s case seemed thin. All indications suggested the aircraft had functioned just as it was designed. The black box recordings showed that the plane was responsive to the point of impact. The case against the pilots looked even worse when a transcript of the voice recorder was leaked. It confirmed that one of the pilots had pulled the stick back and kept it there for almost the entirety of the emergency. With its nose pointed too far upwards, it was little wonder that the Airbus had eventually lost momentum and stalled. But this analysis begs the question: even if one pilot got things badly wrong, why did his two colleagues fail to spot the problem? The transcript of increasingly panicky conversations in the cockpit suggests they did, but too late.
AF447 was four hours into its 11-hour overnight journey when it was overwhelmed by disaster. Many passengers, including five Britons, would have been trying to grab some sleep, only half aware of the turbulence buffeting the A330. There were eight children onboard, including Alexander Bjoroy, an 11-year-old boarder at Bristol’s Clifton College. Also travelling was Christine Badre Schnabl and her five-year-old son, Philippe. She and her husband had purposely chosen separate flights to Paris, possibly because of their shared fear of air crashes. He had taken off earlier with the couple’s three-year-old daughter.
Two hours in, Marc Dubois, the veteran captain, was heading for a routine break. His deputy, David Robert, a seasoned flier with 6,500 flying hours under his belt, was perfectly capable of coping with the tropical thunderstorm AF447 was flying towards. Pierre-Cédric Bonin was at the controls and, though the most junior pilot, he had clocked up a respectable 2,900 hours on commercial jets.
As the airliner entered the worst of the weather, Bonin told the cabin crew to prepare for turbulence. Eight minutes later, everyone on board would be dead. Bonin himself seems to have been spooked, calling attention to a metallic smell and an eerie glow in the cockpit. Robert reassured him that it was St Elmo’s fire, an electrical fluorescence not uncommon in equatorial thunderstorms. A few moments later the outside air temperature plummeted, the pitot tubes iced up and an alarm sounded briefly to warn that the autopilot had disengaged. From this moment, Bonin’s behaviour is strange. The flight recorder indicates that, without saying anything, he pulled back on the stick and, seemingly against all reason, kept the nose up, causing a synthesised voice to warn, “Stall! Stall!” in English as the airspeed began to drop dangerously. Robert took 20 or 30 seconds to figure out what was happening before ordering Bonin to descend. “It says we’re going up. It says we’re going up, so descend.” Seconds later Robert again called out, “Descend!” and for a few moments the plane recovered momentum and the stall warning ceased. But Robert was now anxious enough to call for the captain to return to the cockpit. Meanwhile, Bonin’s instinct was again to pull back on the control stick. He left it there despite the stall warning that blared out some 75 times. Instead of moving the stick forward to pick up speed, he continued to climb at almost the maximum rate. If he had simply set the control to neutral or re-engaged the autopilot, all would have been well.
A minute after the autopilot disconnected, Bonin muttered something odd: “I’m in TOGA, huh?” TOGA stands for Take Off, Go Around. Bonin was apparently so disorientated that he believed he was operating at low altitude, in a similar situation to a pilot having to abort a landing approach before circling for a second attempt. Standard procedure on abandoning a landing is to set engines to full power and tilt the aircraft upwards at 15 degrees. But Flight AF447 was not a few hundred feet above a runway. Within a minute it had soared to 38,000 feet in air so thin that it could climb no more. As forward thrust was lost, downward momentum was gathering. Instead of the wings slicing neatly through the air, their increasing angle of attack meant they were in effect damming it. In the next 40 seconds AF447 fell 3,000 feet, losing more and more speed as the angle of attack increased to 40 degrees. The wings were now like bulldozer blades against the sky. Bonin failed to grasp this fact, and though angle of attack readings are sent to onboard computers, there are no displays in modern jets to convey this critical information to the crews. One of the provisional recommendations of the BEA inquiry has been to challenge this absence.
Bonin’s insistent efforts to climb soon deprived even the computers of the vital angle-of-attack information. An A330’s angle of attack is measured by a fin projecting from the fuselage. When forward speed fell to 60 knots there was insufficient airflow to make the mechanism work. The computers, which are programmed not to feed pilots misleading information, could no longer make sense of the data they were receiving and blanked out some of the instruments. Also, the stall warnings ceased. It was up to the pilots to do some old-fashioned flying.
With no knowledge of airspeed or angle of attack, the safest thing at high altitude is to descend gently to avoid a stall. This is what David urged Bonin to do, but something bewildering happened when Bonin put the nose down. As the aircraft picked up speed, the input data became valid again and the computers could now make sense of things. Once again they began to shout: “Stall, stall, stall.” Tragically, as Bonin did the right thing to pick up speed, the aircraft seemed to tell him he was making matters worse. If he had continued to descend the warnings would eventually have ceased. But, panicked by the renewed stall alerts, he chose to resume his fatal climb.
Yet if Bonin was now beyond his knowledge and experience, the key to understanding the crash is Robert’s failure to grasp the mistake being made by his colleague. It is here that Airbus’s cockpit design may be at fault.
Like all other aircraft in the modern Airbus range the A330 is controlled by side sticks beside pilots’ seats, which resemble those on computer game consoles. These side sticks are not connected to the aircraft control surfaces by levers and pulleys, as in older aircraft. Instead commands are fed to computers, which in turn send signals to the engines and hydraulics. This so-called fly-by-wire technology has huge advantages. Doing away with mechanical connections saves weight, and therefore fuel. There are fewer moving components to go wrong, the slender electronic wiring and computers all have multiple back‑ups, and the onboard processors take much of the workload off pilots. Better still, they are programmed to compensate for human error.
The side sticks are also wonderfully clever. Once a command is given, say a 10-degree left turn, the pilot can let the stick go and concentrate on other issues while the 10-degree turn is perfectly maintained. According to Stephen King of the British Airline Pilots’ Association, it’s an admired and popular design. “Most Airbus pilots I know love it because of the reliable automation that allows you to manage situations and not be so fatigued by the mechanics of flying.”
But the fact that the second pilot’s stick stays in neutral whatever the input to the other is not a good thing. As King concedes: “It’s not immediately apparent to one pilot what the other may be doing with the control stick, unless he makes a big effort to look across to the other side of the flight deck, which is not easy. In any case, the side stick is held back for only a few seconds, so you have to see the action being taken.”
Thus it was that even when Bonin had the A330’s nose pointed upward during the fatal stall, his colleagues failed to comprehend what was going on. It seems clear from the transcripts that Robert assumed the plane was flying level or even descending. Robert himself was panicking: “We still have the engines! What the hell is happening? I don’t understand what’s happening.” Ninety seconds after the emergency began the captain was back in the cockpit demanding: “What the hell are you doing?” To which both pilots responded: “We’ve lost control of the plane!”
Dubois took the seat behind his colleagues and for a while was as perplexed as they were. It was pitch black outside, warning lights were flashing and some of the screens were blank. The men in front partially blocked his view and evidently he did not take much notice of a horizon indicator, which must have shown the plane was still being held nose up. The Airbus was soon falling through the night at 11,000 feet per minute, twice as fast as its forward travel. Only 45 seconds before impact Bonin blurted out that he had been trying to climb throughout the emergency, giving his colleagues the first indication of what had been going wrong. There is one final, dramatic exchange:
02:13:40 (Robert) “Climb… climb… climb… climb…”
02:13:40 (Bonin) “But I’ve had the stick back the whole time!”
02:13:42 (Dubois) “No, no, no… Don’t climb… no, no.”
02:13:43 (Robert) “Descend… Give me the controls… Give me the controls!”
Robert takes control and finally lowers the nose, but at that moment a new hazard warning sounds, telling them the surface of the sea is fast approaching. Robert realises the ghastly truth – that he hasn’t enough height to dive to pick up speed. The flight is doomed.
02:14:23 (Robert) “Damn it, we’re going to crash… This can’t be happening!”
02:14:25 (Bonin) “But what’s going on?”
The captain, now acutely aware of the aircraft’s pitch, has the final word:
02:14:27 (Dubois) “Ten degrees of pitch…”
There the recording ends.
Mercifully, data recordings and impact damage on debris confirm the Airbus was still more or less level when it hit the sea. Some of the passengers might have dozed throughout the descent; others may have attributed it to violent buffeting. Those in window seats would have seen only darkness. There is reason to hope that there was not too much panic on board, but this is small consolation.
It seems surprising that Airbus has conceived a system preventing one pilot from easily assessing the actions of the colleague beside him. And yet that is how their latest generations of aircraft are designed. The reason is that, for the vast majority of the time, side sticks are superb. “People are aware that they don’t know what is being done on the other side stick, but most of the time the crews fly in full automation; they are not even touching the stick,” says Captain King. “We hand-fly the aeroplane ever less now because automation is reliable and efficient, and because fatigue is an issue. [The side stick] is not an issue that comes up – very rarely does the other pilot’s input cause you concern.”
Boeing has always begged to differ, persisting with conventional controls on its fly-by-wire aircraft, including the new 787 Dreamliner, introduced into service this year. Boeing’s cluttering and old-fashioned levers still have to be pushed and turned like the old mechanical ones, even though they only send electronic impulses to computers. They need to be held in place for a climb or a turn to be accomplished, which some pilots think is archaic and distracting. Some say Boeing is so conservative because most American pilots graduate from flying schools where column-steering is the norm, whereas European airlines train more crew from scratch, allowing a quicker transition to side stick control.
Whatever the cultural differences, there is a perceived safety issue, too. The American manufacturer was concerned about side sticks’ lack of visual and physical feedback. Indeed, it is hard to believe AF447 would have fallen from the sky if it had been a Boeing. Had a traditional yoke been installed on Flight AF447, Robert would surely have realised that his junior colleague had the lever pulled back and mostly kept it there. When Dubois returned to the cockpit he would have seen that Bonin was pulling up the nose.
There is another clever gizmo on the Airbus intended to make life simpler for the pilots but that could confound them if they are distracted and overloaded. Computers can automatically adjust the engine thrust to maintain whatever speed is selected by the crew. This means pilots do not need to keep fine-tuning the throttles on the cockpit’s centre console to control the power. But a curious feature of “autothrust” is that it bypasses the manual levers entirely – they simply do not move. This means pilots cannot sense the power setting by touching or glancing at the throttle levers. Instead, they have to check their computer screens. Again Boeing have adopted a different philosophy. They told the Telegraph: “We have heard again and again from airline pilots that the absence of motion with the Airbus flight deck is rather unsettling to them.” In Boeing’s system the manual handles move, even in automatic mode.
All the indications are that the final crash report will confirm the initial findings and call for better training and procedures. With the exception of Air France, which has a vested interest in avoiding culpability, no one has publicly challenged the Airbus cockpit design. And while Air France has modified the pitots on its fleet, it has said nothing about side sticks.
It is extremely unlikely that there will ever be another disaster quite like AF447. Crews have already had the lessons drummed into them and routine refresher courses on simulators have been upgraded to replicate AF447 high-level stalls. Airbus has an excellent safety record, at least as good as Boeing, and the A330 is an extremely trustworthy aircraft. Flying is easily the least dangerous way to travel, far safer than a car. But while more of us take to the air each year, a single crash is enough to damage confidence.
Critics of side sticks may now argue that Airbus should return to the drawing board. A feature designed to make things better for pilots has unintentionally made it harder for them to monitor colleagues in stressful situations. Yet there is no sign that the inquiry will call for changes to the sticks and Airbus remains confident about the safety of its technology. It will resist what it regards as a retrograde step to return to faux-mechanical controls. The company is unable to speak openly during the investigation, but a source close to the manufacturer says: “The ergonomic systems were absolutely not contrived by engineers and imposed on the pilot community. They were developed by pilots from many airlines, working closely with the engineers. What’s more, it has all been tested and certified by the European Aviation Safety Agency and regulators in the United States, and approved by lots of airlines.”
As Captain King points out, a belief in automation and the elegantly simple side sticks in particular, is integral to the Airbus design philosophy: “You would have to build in artificial feedback – that would be a huge modification.”
A defender of Airbus puts it thus: “When you drive you don’t look at the pedals to judge your speed, you look at the speedometer. It’s the same when flying: you don’t look at the stick, you look at the instruments.”
There is a problem with that analogy. Drivers manoeuvre by looking out of the window, physically steering and sensing pressure on the pedals. The speedometer is usually the only instrument a motorist needs to monitor. An airline pilot flying in zero visibility depends upon instruments for direction, pitch, altitude, angle of climb or descent, turn, yaw and thrust; and has to keep an eye on several dozen settings and lights. Flying a big airliner manually is a demanding task, especially if warnings are blaring and anxiety is growing.
Multimillion-euro lawsuits could follow any admission of liability and it is certainly preferable from Airbus’s point of view that Air France should shoulder the blame for the night when AF447 plunged into the void.
However, no one would suggest that, when it comes to the aircraft we all rely on every day, commercial considerations should come anything but a distant second to safety.
|
