Improve Troubleshooting Skills

In an age of technically-sophisticated aircraft with quadruple-redundant systems, how many pilots train for high altitude manual flying, leave alone handling emergencies simultaneously?

Few things can be as disconcerting to air travellers as an unexplained aviation disaster. That is why the crash of Air France Flight 447 on June 1, 2009, attracted so much attention. How could a large modern airliner being piloted by a competent crew practically disappear without a trace? More than two years on, many of the missing pieces of the puzzle have been retrieved from the depths of the Atlantic Ocean. In July, France’s Bureau d ‘Enquêtesetd’ Analyses (BEA) that is investigating the crash presented its third interim report, leaving only a final report for early next year. Has the mystery been solved?

Loss of Control

Air France Flight 447, an Airbus A330-203, was a scheduled flight that departed Rio de Janeiro at 10:29 p.m. on May 31, 2009, bound for Paris. A few hours later, it crashed into the Atlantic killing all 216 passengers and 12 crew onboard making it the deadliest accident in the history of Air France. The first sign of trouble appeared three hours and 40 minutes after take-off, while cruising at 35,000 feet over the Atlantic. The Captain, Marc Dubois, who had 11,000 flying hours to his credit, had left the cockpit for a well-deserved rest, a routine feature on long flights. His co-pilots, David Robert, with 6,500 hours experience and Pierre-Cédric Bonin with 2,900 hours, were in the cockpit. The weather was foul and the plane had to fly though areas infested with storm clouds. Minutes later, the aircraft encountered mild turbulence. The chilling account of events thereafter was reconstructed using the flight data recorder (FDR) and the cockpit voice recorder (CVR), recovered from the wreckage on the seabed off the Brazilian coast in May, following a long and arduous search.

The FDR shows that the autopilot and auto-thrust had suddenly disengaged probably because icing had blocked the pitot tubes resulting in speed sensor discrepancy. The jet also rolled to the right. Bonin, who was the pilot flying (PF), tried to regain control. He levelled the wings and in a simultaneous and possibly inadvertent motion of the A330’s sensitive side-stick (which provides no “feel” feedback), he pulled backwards into a 7,000 ft/min zoom climb to 38,000 feet. With the nose well above the horizon and airspeed still decaying, the stall warning sounded. This seems to have taken the PF by surprise, because the airspeed on his instrument probably showed an increase which can happen if the pitot tube gets blocked in a climb. The FDR indicates that he continued to hold the stick back for almost three minutes, while the huge plane was descending at more than 10,000 ft/min in a stalled condition, unknown to him. Also, if transport pilots hear the stall warning which indicates an approaching stall, rather than a fully-developed one, they are trained to increase power and “fly out of the stall” without losing altitude.

That may be what the PF intended. But in the absence of an angle of attack indicator in the cockpit, he could not have known that the plane was far too deeply stalled and at too high an altitude to recover using power alone. A stall warning is triggered by the angle of attack sensor. However, since the speed measurements at the time were lower than 60 knots, the electronic flight control system (EFCS) rejected the angle of attack values as invalid and the stall warning was silenced. The warning came on again around a dozen times during the descent, but since vital instruments like the airspeed indicator and the autopilot had malfunctioned, the PF seems to have been unable to mentally register the stalled condition and recover from it. Informed by the pilot not flying (PNF), the captain rushed into the cockpit. However, the recorded comments, according to the BEA report, showed “total incomprehension of the situation and they are heard saying several times that they don’t know what’s going on.” No emergency message was transmitted. The BEA report confirms that this crash, after a frightening 3½-minute plunge in stormy weather and near-total darkness, was another in a series involving “loss of control”, now the main cause of civil air accidents. According to the International Air Transport Association (IATA), at least 51 accidents have occurred over the past five years in which planes stalled in flight or got into unusual attitude from which pilots were unable to recover.

Although the narrative of Flight 447 has been reconstructed from the FDR and the CVR, it is unclear whether the pilots were looking at the same parameters in the cockpit. Some displays, perhaps even the EFCS, may have malfunctioned during the descent. This might explain why none of the pilots was able to diagnose the problem and recover. The stall warning may have added to the muddle by sounding only intermittently although the plane was stalled throughout the descent. And how could the pilots know which instruments were reliable and which were not? With all the malfunctions, warnings and error messages that they were being subjected to, the situation must have been thoroughly confusing.

Coffin Corner

Flying at high altitudes is vastly different from flying at low levels. At 35,000 feet, for instance, a fully-loaded Airbus A330 has hardly any margin for handling errors. Dropping airspeed by just 25 knots can lead to an aerodynamic stall. On the other hand, increasing speed by 25 knots might make the plane exceed its maximum permissible speed and run into compressibility effects. Climbing higher reduces the margin both ways, ultimately closing the gap between the speed for a low and highspeed stall. This point is informally but quite appropriately called the “coffin corner”. Particularly when flying in turbulence, it is possible to compromise the low speed margins and invite trouble. That is why flying on autopilot is mandatory above 24,000 feet.

The icing of the pitot tubes that led to the sudden failure of the airspeed indicator was not a minor issue. It meant a sudden reduction in safety margins and high workload for the crew. Prior to this, there were at least 53 instances in which flights had faced control problems on account of faulty airspeed indicators. Airbus itself reported 32 incidents between 2003 and 2009 that were attributable “to the possible destruction of at least two gauges by ice.” Among other symptoms listed by Air France were disconnection of the autopilot, a switch to “alternate law”, and the possible sounding of the stall warning. In the Airbus EFCS, the pilots cannot assert individual control outside a predefined envelope that guarantees the stability of the aircraft. As long as the autopilot and engine auto-thrust are engaged and the system operates in “normal law”, the pilot cannot over-speed, stall, overbank or overload the machine. This greatly enhances safety. But the hitch was revealed in this case when control was suddenly passed from the EFCS to the pilot in the middle of the emergency. The aircraft was now in the realm of alternate law where many of the A330’s protections disappear, leaving only low and high-speed stability, load-factor limitation and yaw damping. Since the PF maintained significant back pressure on the side-stick, the aircraft stalled when the critical angle of attack was exceeded.