Air France flight 447: A disaster waiting in the wings
When an Air France jet came down in a gigantic storm over the Atlantic in June, killing all 228 on board, the Schnabl family was split in half. But new evidence suggests the tragedy could have been avoided
The Sunday Times Magazine, 15 November 2009
When Fernando Schnabl kissed his wife, Christine, and their five-year-old son, Philipe, goodbye in Rio de Janeiro on the evening of May 31 this year, he expected to see them the next morning in Paris. He never did. Four hours out of Rio, Air France flight 447, which Christine and Philipe were on, flew into a ferocious storm above the Atlantic. A series of signals warned that several electrical systems had broken down before the plane fell out of the sky at 10,000ft a minute.
So began one of the most catastrophic and troubling air disasters of modern times, a crash that killed 228 people from 32 nations. Five British people were killed. The wreckage and post-mortems on the 51 bodies recovered, which included Christine’s but not their son, Philipe’s (his body has never been found), suggest the plane struck the water on its belly at high speed and broke into hundreds of pieces on impact. Most of the passengers suffered broken pelvises and fractured femurs, classic signs of such a high-speed impact. They were not wearing their life vests, so the catastrophe had not been anticipated. Experts say it was all over in about three minutes.
“If there had been a rapid decompression early on, the passengers and the crew would have been unconscious within 10 seconds,” said one expert. “But if not, it’s entirely possible that they realised the plane was crashing and remained conscious until the very last moment of impact. It’s a terrible thing for their relatives to come to terms with.”
Fernando, travelling to Paris with Celine, his three-year-old daughter, on a different plane, which left a few hours after AF447, was unaware that tragedy had already overtaken his wife. By 11.45pm, when they took off from Galeao airport in Rio, everyone on the Air France flight had been dead for nearly two hours.
Christine and Fernando, a successful businessman in advertising, had been married for 10 years and were going on holiday to Europe with their children. It was an annual event, usually taking in a visit to Sweden, where Christine grew up. This was the first time they had not flown together. Using accumulated airline “points” would save money, but it meant travelling separately. When Fernando landed at Charles de Gaulle airport in Paris the next morning, he was looking forward to seeing his wife and son again. But, as the Brazilian TAM plane taxied towards its stand, a passenger in the next seat who had switched on his mobile phone turned to him and said that a flight from Rio was missing. “Then he said it was Air France and I was very scared,” Schnabl said.
“When the crew called my name and asked me to come forward, I knew something really bad had happened. The way they treated me with so much concern but not wanting to tell me anything left me with no hope at all.” Staff led Schnabl and his daughter to an airport lounge where other distraught relatives were gathered. Christine’s father met Schnabl there and they comforted each other.
Hampering the search was the fact that nobody knew the precise spot where the jet had crashed. It had left Brazilian airspace but had not yet radioed its position to Dakar in west Africa, the next reporting station on its long flight across the Atlantic, and was out of range of any radar. In the hours and days after the crash, officials at Air France began to study a series of error messages sent by the plane’s automatic communications system via satellite to the airline, which indicated to them that it had experienced “multiple technical failures” in its last minutes in the air.
A few minutes earlier, the pilot had sent a manual signal saying that the jet was flying through a storm and high winds. The flood of error messages that followed conjured up a harrowing image of two pilots, one experienced, the other less so, in a cockpit filled with a multitude of audio and visual alarms but losing important information on their flying displays, desperately fighting a losing battle to control the aircraft and keep it in the air as it was buffeted by a gigantic thunderstorm.
The messages showed a litany of failures. The systems measuring speed broke down, the autopilot and auto-throttle became disengaged, the flying controls stopped working normally, the instrument display screens went blank, and the flight-control computers failed. Vital chunks of the plane’s “brains” had shut down. These failures, combined with severe turbulence at night, meant the pilots found themselves having to fly the aircraft manually in appalling weather while relying on faulty information about what the plane was doing.
As early investigations were taking place, Fernando contemplated the devastating effect of the crash on his family. Unable to face going home, he spent the next three months with Christine’s parents in Sweden. Christine was their only child and they were also trying to cope with their grief. The Schnabls were a brilliant couple in their thirties, he a young, sensitive Brazilian, she a beautiful, talented Swedish woman, fluent in four languages, who worked for a Norwegian organisation promoting the country’s business interests in South America. She had met Fernando on holiday and moved to Rio 10 years earlier to marry him. “I always thought she was too much for me, too beautiful,” Schnabl said. “It wasn’t even the middle of my life with Christine, just the beginning. She was the one with whom I decided to share everything — my success, my sadness, my frustrations. I lost my son, our first child, too. To talk about him is very hard. He was everything I could wish for in a boy.”
Fernando is preparing an album of pictures and cuttings that he will give Celine when she is old enough to understand. For now, he tells her that her mother and brother have gone to a “good place in the sky”. As heaven and sky in Portuguese are the same word, ceu, it is a concept the little girl can relate to. Others have been similarly devastated. Bianca Machado Cotta, a doctor, and Carlos Eduardo de Melo Macario, a lawyer, had married only the day before. After a wedding reception in a Rio nightclub, they caught a few hours’ sleep and boarded AF447 for their honeymoon in Paris.
Aisling Butler, 26, Jane Deasy, 27, and Eithne Walls, 29, doctors who had studied together at Trinity College, Dublin, had been on holiday in Brazil. Walls, a native of Belfast, had also danced in the famous show Riverdance. There were two British oil workers, Graham Gardner and Arthur Coakley, who left devastated families, and Alexander Bjoroy, 11, who was flying back to preparatory school in Bristol after spending his half-term holiday with his parents in Rio. The crash of the Airbus A330-200, registration number F-GZCP, is the worst disaster in the 75-year history of Air France. Five months on, it continues to haunt the airline and the aircraft’s manufacturer, Airbus, as well as the families. Without the all-important black-box flight data and voice recorders, now lost 5,000 metres down at the bottom of the Atlantic, it may never be possible to establish a clear cause for the crash. But The Sunday Times has been privy to disturbing evidence that it was an avoidable accident, although Air France and Airbus will dispute this.
We are seeing the beginnings of a vicious blame game that will be played out in the international courts. Many families have turned to Stewarts Law, a London firm of aviation legal experts, to make sense of the crash and secure compensation. There is at least €3 billion insurance cover for the accident, €1 billion of which, Stewarts Law suggested, should be put in a trust to be shared by the families of the dead. Sixteen families have filed a lawsuit in the US against Airbus and many aerospace suppliers, claiming the crashed A330 was “defective and unreasonably dangerous”. Last month, the firm and its expert witness, Captain John Mahon, a training captain and pilot experienced on Airbus and Boeing aircraft, conducted an independent technical investigation into the cause of the crash on behalf of the families. They shared the results with us.
When they recreated the flight in an Airbus simulator on the basis of known data from the flight’s fault messages, the results pointed to a preventable accident caused by four distinct errors: flight into bad weather; faulty air-sensor tubes; failure of the system that provides data for the flight-control system; and the pilots’ response to these problems and to the bad weather. James Healy-Pratt of Stewarts Law, the aviation-accident lawyer heading the team assisting the families, and himself a pilot, recently gave a presentation to a gathering of relatives in Paris.
“No one else has given them a chance to talk. What is upsetting is that if you take any one of these errors out, you haven’t got the tragedy. We believe AF447 was an avoidable accident,” he said. The pilots in the simulator were able to save the aircraft. But they knew the faults and how to respond. Not like the real thing, at 35,000ft over the Atlantic in a violent storm. Two scenarios were considered. In the first, the aircraft’s nose pitched up suddenly, as a result either of a sudden updraft or of pilot action. Pitching up reduces airspeed, and eventually the aircraft will stall and fall out of the sky. The pitots, a vital part of the system measuring airspeed, had failed and would have been registering increasing airspeed while speed was in fact falling. The pilots’ response to increased airspeed would have been to pitch the nose further up, making the problem worse. The simulator showed that it would have taken only six seconds for the A330 to stall, at which point the real aircraft would have plummeted out of the sky.
The second scenario — the less likely one, given that the plane hit the water intact — was the reverse. A sudden downdraft would have pitched the nose down and made the aircraft accelerate. Because of the pitot failure, the instruments would have displayed decreasing airspeed when in fact the plane was accelerating. The pilots’ response would have been to pitch the nose down, aggravating the problem until, some 15 seconds later, the plane reached speeds at which it started to break up.
How could this loss of control occur? To understand more, we need to look at the nature of this Airbus, the most complex airliner in the world, and the pilots’ response to the challenging situation they found themselves in. The A330 is one of the most widely flown passenger airliners made. The large-capacity jet is designed to fly more than 11m hours in its lifespan. The particular plane on which the Schnabls lost their lives had racked up only 18,800 flying hours in the four years since Air France took delivery. In April, it was passed as “totally airworthy”, Air France said.
Many airlines use the $150m Airbus as the ultimate workhorse, flying millions of long-haul passengers across the Atlantic every year. The 660 A330s in service worldwide have flown tens of millions of miles and enjoyed an impeccable safety record; this was the first fatal crash on a commercial flight since its maiden flight in 1992.
Airbus was the first to develop fully fly-by-wire airliners that manage everything digitally, rather than manually. The aim is to eliminate human error, the most common cause of air accidents. It has done that very effectively, but the inevitable result is to remove pilots from direct control. “The aircraft is too clever for its own good,” said one experienced aviator. “If something goes wrong, as well as dealing with the situation, the pilot has the stress of working out what the computers are doing. In an emergency, you’re lucky if there’s enough time to do all this.”
In a 2005 report on the safety of technically advanced aircraft, Bruce Landsberg, president of the AOPA Air Safety Foundation (a charity set up by aircraft owners and pilots), noted: “The most common statement in the advanced avionics cockpit, according to airline and corporate pilots, is, ‘What’s it doing now?’ This refers to the avionics doing something that the crew didn’t expect.”So it was already well known that technically advanced aircraft brought their own challenges. Flight AF447 has also shown that even the best computer systems can fail. And this raises a critical question: could the crew possibly have had the capacity to deal with the high-altitude chain of events the pilots of flight AF447 experienced?
Inadequacies in Airbus training were highlighted recently by Captain Jacques Drappier, the Airbus vice-president for training. He warned that Airbuses may be being flown by pilots with insufficient training. Long-haul pilots, he said, were typically logging 800-900 flying hours a year, but this might include “less than three hours of stick time”, most of it spent manually flying an airliner on its final approach and landing. “We put people into our training today who have forgotten how to fly, basically,” he said. “This is an issue that needs to be addressed by the industry.” AF447 was nevertheless in excellent hands. Captain Marc Dubois, 58, had been flying jets for Air France for 20 years and had 11,000 hours’ flying with the airline, 1,700 of them on A330s. After taking off from Rio at 5.03pm, Dubois set the Airbus on a northeasterly course, heading up the coast of Brazil and out over the Atlantic. There is a suggestion that with the plane at its cruising altitude of 35,000ft he took “flight-rest”, leaving the experienced first officer, David Robert, 37,in charge in the co-pilot’s seat.
Robert was assisted by the junior first officer, Pierre-Cédric Bonin, 32, whose wife, Isabelle, was a passenger on the flight. Bonin qualified to fly the Airbus A330 in June 2008 and so was relatively inexperienced. With Dubois in the crew’s rest area, he now found himself in the seat usually occupied by the captain. The aircraft has dual display panels, but as the various systems failed, they went blank and the only set of instruments able to be restored was the one in front of him. Those before the more experienced Robert had shut down. AF447 made its last radar contact as normal at 8.33pm Brazil time, with the island of Fernando de Noronha, 221 miles off the mainland. Until then, the flight had proceeded as normal, though disaster was now only 40 minutes away.
Airliners rely heavily on the weather radar bolted on the nose of the plane to avoid thunderstorms, but once in them they have no choice but to fly through them, as AF447 did. At 35,000ft and heavily laden, it was flying close to what pilots call “coffin corner”, at the limit of its capabilities, where the margins for error are much smaller. The combination of weight and thinner air at high altitude means that engines are operating at maximum power and can stall easily. Pilots routinely fly near or in the “corner” because at high altitude they get more mileage out of their fuel. This is safe so long as the weather is benign and the jet’s sensors, avionics and computers work properly — not the case with flight AF447. It had certainly sent a message saying there was bad weather ahead. Unlike other aircraft, which diverted round the storm, having picked it up on their weather radar, AF447 flew on, even though at 35,000ft at night the crew would have seen flashes of lightning illuminating the towering walls of cumulonimbus storm clouds 60 or 70 miles ahead.
Weather radar is a good safety device but not all pilots understand its intricacies. A particularly heavy first layer of storm “cells” could have masked others behind it. We know now from satellite imagery captured at the time of the crash that there were more cells behind the first line. Once through the first layer, the plane may have found itself boxed in by more storms with no alternative but to plough on. We know from the wreckage that turbulence did not tear AF447 apart, as was initially suggested; it hit the water pretty much intact. These planes are also designed to withstand lightning strikes — numerous safety features protect the electrical systems — although lightning cannot be ruled out here.
But as the aircraft flew into the eye of the storm, the pitots failed. The A330 has three of these small but critical tubes. About 8in long, they are fitted to the underbelly, to measure airspeed. The exact part they played in the crash cannot be known without the black boxes. But from the error messages AF447 transmitted in the minutes before it crashed, it is known that at about 2am GMT, as the Airbus flew into the storm, the pitots malfunctioned and gave faulty speed readings. They were either waterlogged by heavy rain or frozen up, and their failure triggered events that doomed the plane. Pitot problems are not unusual, and pilots are trained to deal with them. In isolation they are not necessarily critical, but in the case of AF477, they were part of a chain of errors.
All Air France’s A330s were fitted by Airbus with AA-type pitots made by the French company Thales. These were known at least two years before the crash to be less reliable than other types in severe weather. But neither the companies nor the European Air Safety Authority considered the problem serious enough to affect airworthiness. By the end of March 2009, two months before the crash, Air France had recorded nine incidents involving faulty pitots and speed readings, eight on A340 long-haul jets and one on an A330. By the time of the crash, the airline had decided to update all pitots as soon as Thales could supply replacements. It was starting to change them on its entire A330 fleet on the day of the crash;11 days later, they had all been replaced.
Were the dangers posed by the pitots underestimated until it was too late? Michael Barr, who teaches aviation safety at the University of Southern California, said it seemed Airbus had recognised the problem needed fixing but did not make it a priority — until the crash. “What they hoped was that the perfect storm wouldn’t come before they got it fixed,” he said. “They were in the process of doing that when this plane hit that perfect storm over the ocean.” Meanwhile, Air France has to face the fact that the pilots had not been trained in how to manage a high-altitude pitot-tube malfunction of the type they experienced. Another factor was the failure of a vital part of the Airbus’s “brains”, its Air Data Inertial Reference Unit (Adiru). The three Adirus on an Airbus collect raw data on essential flight parameters such as airspeed, altitude and angle of attack, and feed them to the flying-control computers. The computers are meant to filter out bad data and have built-in systems so that, no matter what the pilots do, the aircraft can’t exceed its structural and performance limitations. We know two of AF447’s Adirus failed and that there were faults in its computers.
The pilots would have been dealing with a stream of warnings. Even if they had time to interpret them, they could not have known whether to trust the aircraft’s instruments. Meanwhile, the faulty flying-control computers may have been overriding pilots’ commands on the basis of erroneous data provided by the Adirus. An incident in 2008 involving a Qantas A330 over Australia is sobering. An Adiru malfunctioned, sending wrong information to the flight computer, which acted on the false data instead of deferring to the data supplied by the two working Adirus, and pitched the plane into two terrifying nosedives. Many passengers were injured and the plane made an emergency landing. Airbus has dismissed comparisons. But information on the AF447’s systems transmitted just before the crash shows a number of similarities. The difference is that the Qantas pilots were able to recover their aircraft from nosedives, while AF447’s lost control.
This brings us to perhaps the final contributing factor: human error. “This was an aircraft that literally fell out of the sky,” said Healy-Pratt, “either because the pilots stalled or they oversped it and couldn’t get control.” That is not to say that the pilots should be blamed for the disaster. Healy-Pratt noted that “they were flying in bad weather, they had unreliable airspeed and they had Adiru problems. Our view is that they were given a very high workload they probably couldn’t cope with”. With no single factor as the cause, the question that bereaved families and the airline industry are grappling with is how to apportion responsibility. This month bereaved families gathered in Rio for a memorial service. All are still struggling to come to terms with their loss and are in a horrible limbo. They want to know what caused the crash and bring those responsible to account. The official French investigation, by the Bureau d’Enquêtes et d’Analyses, will take another year to complete. Its job, in any case, is not to apportion blame. The courts in France have opened a criminal investigation that could lead to manslaughter charges, but that will be an arduous legal trek.
Air France’s insurers have hired lawyers round the world at a cost of $40-$45m to settle as many compensation claims as they can as quickly as possible. In Healy-Pratt’s experience of aviation disasters, 80% of the families he has dealt with are not solely interested in the money. But he believes maximising compensation could help prevent future crashes. It would force aviation insurers to charge Air France more, and the industry would in turn be forced to change its practices. There is another way this crash could lead to greater safety. Unlocking the mystery of the crash would not be a problem if AF447 had been live-streaming flight data back to a central control as it flew. The technology exists for jets to live-stream data, but airlines have been deterred by the satellite communications costs of $3m a year. Many experts believe it is time to reconsider the matter.
In Rio, Fernando Schnabl is trying to rebuild his life. “I know official investigators don’t want to give any final findings,” he said. Without a proper explanation as to why his wife and son died, he has no hook on which to hang his grief. “It’s hard to think about compensation because it cannot bring them back. But I want to know why, and I do not want other families to have to go through what we are suffering.”
The five Britons who lost their lives:
Alexander Bjoroy, 11
One of seven children on the flight, Alexander was returning to Clifton College prep school in Bristol after spending half-term with his parents and sister. He had lived all over the world with his father, Robin, an oil worker from Norway, and his mother, Jane, from south Wales. He loved travel and sport and was learning to surf in Brazil.
Graham Gardner, 52
Gardner, from Inverclyde, was flying home to join his wife, Joyce, in Scotland. Friends since childhood, they had married in 2001. The master of a pipe-laying and construction vessel for the oil industry, he had worked in Rio for four years and spent alternate months in Brazil and Scotland. His body was one of the few recovered.
Eithne Walls, 29
A doctor and former star in the famous show Riverdance, Walls was born in Ballygowan, Northern Ireland. She died with her friends Jane Deasy and Aisling Butler as they returned from a holiday in Brazil. The trio had met while studying medicine at Trinity College, Dublin, and were inseparable friends.
Neil Warrior, 49
A PR director for Mazda, Warrior, who was single and lived in Cologne, was on his way back from a holiday in South America. ‘He was a perfect English gentleman,’ said Graeme Fudge, a colleague, ‘well liked, well respected and a very good operator.’
Arthur Coakley, 61
A structural engineerin the oil industry, Coakley, from Whitby, North Yorkshire, had been on a business trip to Brazil. He spoke on the telephone to Patricia, his wife of 34 years, just before boarding. His one ambition was to sail the ocean with his family. His body was also recovered.