Air France Flight 447

An overnight crossing of the Atlantic

Air France flight 447 left Rio de Janeiro for Paris on the evening of 31 May 2009. The Airbus A330-203, registered F-GZCP, carried 216 passengers and twelve crew members. Three of those crew members were pilots, allowing the captain to take a rest during the long overnight crossing. The departure and initial climb gave no indication of the accident that would follow. The aircraft settled into cruise at flight level 350, approximately 35,000 feet, with the autopilot and autothrust engaged.

The route crossed the equatorial Atlantic through the intertropical convergence zone, where large convective clouds are common. The crew had received information about a convective area ahead, and discussed weather radar returns, turbulence and the possibility of climbing. Temperature limited the altitude available to them at that stage. The BEA later found that the broad meteorological situation was not exceptional for June, although there were powerful cloud clusters along the route. The investigation did not describe an extraordinary storm overwhelming an otherwise functioning aircraft.

Shortly before 02:00 UTC, the relief copilot joined the cockpit. The two copilots discussed the conditions ahead while the captain attended their handover, then left to rest. One copilot remained the pilot flying in the right seat; the other monitored from the left. The aircraft was still at its assigned cruise altitude. Around 02:08, they turned approximately twelve degrees left, probably to avoid returns on the weather radar, and reduced the selected speed. They also turned on engine anti-icing. These were the last adjustments before the automatic systems disconnected.

The airspeed indications change

At 02:10:05 UTC, the autopilot disconnected, followed by the autothrust. The aircraft began rolling right. The pilot flying took manual control and made left and nose-up inputs. The left primary flight display showed a sudden fall in airspeed from about 275 knots to about sixty knots, and the standby instrument subsequently showed a similar problem. Those numbers did not describe the aircraft actually slowing by that amount in a few seconds. They reflected an inconsistency in the measured airspeeds.

The BEA concluded that the temporary inconsistency was likely caused by ice crystals obstructing the Pitot probes. These probes measure the pressure used to calculate airspeed. The report retains the word likely because the exact obstruction could not be observed directly. The computers detected inconsistent measurements, disconnected the automatic systems and changed the flight controls from normal law to alternate law. In that mode, the aircraft no longer had the angle-of-attack protection available in normal law.

The monitoring copilot identified the loss of speed information and the change in control law. However, neither copilot called for the unreliable-airspeed procedure. Instead, their attention moved among instrument indications, warning messages and the aircraft's changing attitude. The flight director bars disappeared and later returned. The investigation found that no ECAM failure message clearly told the pilots that the computers had detected inconsistent airspeeds. The crew had to interpret several changes while also taking over manual flight at high altitude.

The control surfaces continued responding to the pilots' commands. There was no finding that the aircraft had become physically uncontrollable at the moment the autopilot disconnected. The immediate challenge was to maintain a stable attitude and flight path while identifying which indications could be trusted.

A climb away from the cruise flight path

In the first seconds of manual flight, the pilot flying made rapid roll inputs and continued commanding nose-up movement. The pitch attitude increased to approximately eleven degrees in ten seconds. The aircraft began climbing above its original cruise altitude. The monitoring copilot noticed the climb and asked for a descent several times. Nose-down inputs then reduced the pitch and vertical speed, but the aircraft had already gained substantial height and lost actual airspeed.

At approximately 02:10:36, the left-side airspeed indication became valid again, showing 223 knots. It had been incorrect for twenty-nine seconds. The standby indication remained erroneous longer. The original upset did not require all airspeed information to remain unavailable throughout the event. By the time the measurements recovered, the aircraft's position within its flight envelope had changed.

Around 02:10:49, pitch was a little above six degrees, roll was controlled and the recorded angle of attack was slightly below five degrees. Two seconds later, the stall warning began sounding continuously. The pilot flying selected maximum takeoff or go-around thrust and made further nose-up inputs. The aircraft continued climbing, eventually reaching approximately 38,000 feet. Its angle of attack increased, and the horizontal stabilizer moved progressively into a strongly nose-up position.

The recovered airspeed indications were subsequently consistent, at about 185 knots, but nose-up commands continued. The aircraft was now leaving the range of conditions in which its wings could sustain the intended flight path. Increasing engine thrust did not resolve that condition. The BEA's chronology links the departure from the normal cruise path to the control inputs following the initial airspeed inconsistency.

A sustained stall that the crew did not identify

The captain returned around 02:11:42, approximately a minute and a half after the autopilot disconnected. By then the aircraft was descending rapidly. Its angle of attack exceeded forty degrees, and its vertical speed was about 10,000 feet per minute downward. The nose was still above the horizon. A nose-up aircraft can descend steeply when its wings are stalled; aircraft attitude and flight direction are different measurements.

The stall warning had sounded continuously for fifty-four seconds before stopping as the recorded speeds became invalid. The warning logic treated angle-of-attack measurements as invalid when measured speeds fell below sixty knots. Consequently, the absence of the warning did not establish that the stall had ended. Later, when nose-down inputs reduced the angle of attack and the speeds became valid again, the warning resumed. Its return coincided with a change towards more valid information, rather than proving that the preceding silence had represented normal flight.

The BEA found that none of the pilots formally diagnosed the stall. They did not make explicit reference to the continuous stall warning or aerodynamic buffet. Control inputs and changes in engine thrust continued, but no sustained recovery manoeuvre followed. At times the two copilots exchanged control priority without a clear callout, and later simultaneous sidestick inputs were recorded. The captain had entered an already developed emergency and had to understand it from the indications and the copilots' descriptions.

The report describes a loss of comprehension under surprise and workload, complicated by warning behaviour, flight director indications and inadequate preparation for manual handling and unreliable airspeed at high altitude. Those conditions help explain the response; they do not alter the recorded finding that the stall remained unrecognised.

The final descent and impact

The aircraft remained in a stalled descent through the remainder of the flight. The engines operated normally and responded to the crew's commands, but the aircraft's angle of attack stayed very high. In the later recorded period, whenever that parameter was valid, it remained above thirty-five degrees. The flight crew's actions did not bring the aircraft back into a sustainable flight condition.

At 02:13:32, the pilot flying referred to the approaching altitude of 10,000 feet. Shortly afterwards, the recorder captured simultaneous sidestick inputs, followed by a transfer of control. The aircraft continued descending. From 02:14:17, the ground proximity warning system issued sink-rate and pull-up alerts. These warnings came during the last seconds of the recording, long after the original airspeed indications had first become inconsistent.

The recorders stopped at 02:14:28. The final recorded vertical speed was approximately 10,912 feet per minute downward. The aircraft's pitch attitude was 16.2 degrees nose-up, with a small left bank. All 228 people on board died when the aircraft struck the Atlantic. No emergency radio message was transmitted by the crew.

The sequence lasted approximately four minutes and twenty-three seconds from autopilot disconnection to the end of the recording. Within that short interval, a temporary loss of reliable measured airspeed had been followed by an uncontrolled climb, departure from the flight envelope and a sustained stall. Engine operation continued, while the crew never achieved the reduction in angle of attack necessary to recover the stalled wings.

Reconstructing an accident far from shore

The location and depth of the accident initially restricted what investigators could establish. Floating wreckage was found five days after the crash, but the principal wreckage remained on the seabed. The BEA records its discovery on 2 April 2011 at a depth of approximately 3,900 metres, near the last transmitted position. Recovery of the flight recorders allowed the investigation to move from the aircraft's transmitted messages and recovered material to a detailed account of cockpit activity and flight parameters.

The final report published in July 2012 identified a succession of events, beginning with the temporary inconsistency in airspeed measurements and continuing through inappropriate control inputs, failure to connect the recognised loss of speed indications with the appropriate procedure, late recognition of flight-path deviation and failure to identify and recover from the stall. The report also examined training, operational feedback, cockpit presentation and task sharing. It did not present the accident as the consequence of one isolated technical failure.

The BEA issued recommendations covering pilot training, certification, cockpit ergonomics, flight recorders, operational feedback and search-and-rescue arrangements. Those recommendations describe the investigation's proposed safety response at the time. They are not, by themselves, evidence that every proposed measure was subsequently implemented. The established account is more precise: the initial airspeed disturbance was temporary, the aircraft responded to control commands, and the developing aerodynamic stall was never correctly diagnosed.