2009 Air France Crash Due Partly To Airbus Design Decisions

France’s Bureau of Investigation and Analysis today released its final report on the 2009 crash of an Airbus A330 jetliner that claimed over 200 lives. The report correctly cited a malfunctioning air-speed indicator and inappropriate pilot responses as the primary causes of the crash. However, as I noted in a December 12 commentary, design features of the Airbus plane may have contributed to a loss of situational awareness in the cockpit. My commentary is reprinted below, describing the potential impact of design decisions made on the A330.
—————

Published: December 12, 2011

2009 Air France Crash Raises Doubts About Airbus Design Decisions

Last week, Airbus rival Boeing won a long-sought victory against the European plane maker company when the U.S. Trade Representative disclosed plans to impose huge trade penalties to compensate for the damage done by illegal subsidies. The World Trade Organization has ruled that Airbus deprived Boeing of hundreds of billions of dollars in sales by leveraging such subsidies to launch competing aircraft that no purely commercial company could have afforded to finance. Media coverage of the two commercial-transport rivals is likely to be dominated this week by analysis of what the imposition of up to $10 billion in penalties each year will mean for transatlantic trade relations.

However, that is not the only challenge Airbus is facing. Ever since an Airbus A330 operated by Air France mysteriously disappeared in the South Atlantic two years ago, evidence has been mounting that a series of design choices made by the company contributed to causing the accident. The crash killed all 216 passengers and a crew of 12 aboard Air France Flight 447, which was flying from Rio de Janeiro to Paris on June 1, 2009 when it suddenly fell into the sea. Subsequent investigations into why the plane was lost have focused on pilot errors, since all on-board systems were operating as designed when the A330 widebody descended 38,000 feet at high speed and disintegrated upon hitting the ocean.

But as famed U.S. Airways pilot C.B. (Sully) Sullenberger has observed, “The Air France 447 crash was a seminal accident. We need to look at it from a systems approach, a human/technology system that has to work together…If you look at the human factors alone, then you’re missing half or two-thirds of the total system failure.” Sullenberger should know, having saved all 155 people on board his own plane six months before the Air France crash when multiple bird strikes shut down the engines. Sullenberger managed to glide his disabled craft into a gentle landing on the Hudson River, averting what might otherwise have been a horrible tragedy. So how did Air France pilots manage to produce the opposite result the following June, dropping a perfectly flyable plane into the storm-tossed South Atlantic?

Pilot error definitely played a part. A combination of bad luck and inadequate training led to near chaos in the A330’s cockpit, with a junior pilot doing precisely the wrong thing needed to pull the plane out of a stall. Rather than increasing speed to a rate where the engines could sustain thrust by pointing the plane downward, the junior co-pilot in control continuously pulled the nose up, precluding recovery from the stall. The lead pilot, who was absent from the cockpit when the emergency began, never took over, leaving two less experienced co-pilots in control of the plane. Their inability to grasp what was happening to the plane, explained clearly by Jeff Wise in the current issue of Popular Mechanics, led to the loss of all on board.

What is becoming increasingly apparent to investigators as the review of information from the retrieved flight-data and cockpit-voice recorders proceeds, though, is that design features of the Airbus A330 caused the confusion in the first place and then undermined the ability of pilots to control the plane. First of all, the emergency began when airspeed indicators on the aircraft’s exterior iced up, causing inaccurate readings. The plane’s autopilot then disengaged, forcing pilots who had not been trained to manually control the A330 at cruising speed and altitude to operate the plane. The loss of airspeed data due to icing had occurred previously on A330s and Airbus had recommended remedial action, but the aircraft maker left it to the discretion of operators as to whether they should act on the advice. The A330 being used on Flight 447 had not been modified. After the crash, Airbus urged operators to install new airspeed equipment from a different maker.

It appears the two co-pilots in the cockpit did not realize that once the autopilot disengaged they would have much more latitude in flying the plane. Unwise actions that would have been prevented by the flight-control computer when the autopilot was engaged now became possible. The junior co-pilot at the controls, probably confused by the airspeed data he was observing, decided to slow the plane. In fact, he pulled his side-stick all the way back, pushing the plane’s nose up, and kept it in that position for crucial minutes as the plane slowed to a crawl. At this point, a second design problem appears. Unlike Boeing planes that move flight controls in tandem for both cockpit seats, the A330 has asymmetrical controls. As Jeff Wise points out in Popular Mechanics, that meant the more senior co-pilot probably didn’t realize what his companion was doing.

And then there is the third problem: the plane’s stall-warning alarm began sounding, indicating airspeed was too slow to sustain thrust, but shut off when conditions grew too extreme for indications to be reliable. In other words, the stall warning was designed to sound when conditions become dangerous, and then shut off when they become extremely dangerous. Thus, if the two co-pilots took action to recover from an extremely dangerous situation, the silent stall alarm would suddenly begin chirping as the plane’s circumstances improved. For pilots who had little or no training in dealing with such conditions, that must have been very confusing. By the time accurate airspeed indications were restored due to de-icing measures, the two co-pilots were utterly confused and increasingly paralyzed with fear.

Clearly, the lead pilot made a mistake by departing the cockpit and leaving the inexperienced junior co-pilot in control. He probably thought that cruising at 38,000 feet would be a safe opportunity to give the younger man some flying experience. However, because of design decisions made by Airbus, that seemingly safe environment degenerated into a state where (1) neither co-pilot at the controls knew what the plane’s actual speed was, (2) one co-pilot with more experience did not grasp what the other co-pilot with less experience was doing to the controls, and (3) the stall warning system drifted back and forth across a threshold that resulted in alarms sounding when conditions were improving, and then shutting down when they worsened. No doubt about it, human error was a big part of the reason why Air France Flight 447 crashed. But design features of the A330 caused the cockpit confusion in the first place, and then impeded timely recovery.