(rain pattering) (plane engines roaring)
(plane crashing) (somber music) - [Petter] It took just over four minutes
for this aircraft to lose control and fall nearly 38,000 feet. That's roughly the same time
it takes to toast a piece of bread. What were the crucial details
that caused this accident? Stay tuned. The crew who were going
to operate Air France Flight 447 arrived in Rio de Janeiro
from Paris on the 28th of May, 2009. They were scheduled
for a three-day stop in Rio before the
return flight back to Paris. We know very little about
how they spent their time during this layover but
what is known is that the first officer who was later going
to be pilot flying of this flight had brought his wife
with him for the trip. Given that, it's unlikely
that at least he spent the whole day before the flight resting
and there were indications that this might also apply
to the other pilots. Flight 447 was scheduled
to depart at 8:00 in the evening, Rio time, that would
be 11 o'clock at night, Paris time. And that meant that the crew
would have to operate through the night on the way home with a scheduled landing time in Paris around midday on the 1st of June. This would mean that the pilots
would have to operate throughout the window of circadian low, a time of night during
which it's especially hard for the human body
and the mind to stay alert. Because of this and the fact
that the flight was scheduled to last 12 hours and 45 minutes,
the flight crew had been augmented with an extra pilot to allow
for scheduled rest during the flight back. This meant that there were three pilots
who were going to fly together: one captain and two first officers. The captain was 58 years old
and had a total flying experience of 11,000 hours,
1,700 of which was flown as a pilot-in-command
on the Airbus A330. The first officer was 32 years old. He was the least experienced
of the crew with 3,000 hours in total and 800 on the type. He had done his type rating
on the Airbus A330 and 340 in 2008, the year before the flight. The third pilot which I will refer to,
in this video, as the relief pilot was a 37-year-old first officer. He had a total time of 6,500 hours
but he was actually the most experienced on the type with 4,500 hours flown on it. He had flown very little
during the previous three months before the flight
because he was also working as a management pilot in Air France. Prior to operating the flight,
the pilots met up and reviewed the planning documentation including weather,
flight plans and NOTAMs. The weather was fine for the departure and in Paris but the enroute weather
looked a bit more complicated. Since the flight would be crossing
the equator, it would also be crossing an area over the Atlantic known
as the Intertropical Convergence Zone or the ITCZ. In this zone, the easterly trade winds from the northern and southern hemisphere will converge and can force
the humid air from the surface of the sea upwards. This can cause powerful thunderstorms that can reach as high as 60,000 feet which is much higher
than most aircraft can fly. This also means that the aircraft
who have to fly through this zone might be subject to flying between
and sometimes even through parts of these storm clouds. The storms who are formed
over water in the ITCZ can sometimes
contain smaller water content than the storms that form over land, making them harder to see
on the aircraft's weather radar so pilots needs to be very careful
when navigating around them since they could still be quite severe. The pilots likely discussed this risk
of encountering these type of storms and carried a bit of extra fuel
to give them the option of navigate around
these storms if needed. The pilots also briefed
their nine cabin crew about the possibility of turbulence
and the effect that that might have on their service. Before we leave the discussion
of the Intertropical Convergence Zone, we need to talk a little bit
about the types of precipitation that can be found inside
of these types of thunderstorms. Most people are familiar
with the heavy rain and sometimes, hail that typically come
out of these clouds but as you look higher up
through the clouds, things can become a bit more complicated. Because of the very strong currents inside of the cloud,
water droplets can be forced upwards into very cold air
and become super cooled. This means that
they're still in water form but as soon as they hit surface of some sort, they will instantly
freeze and create clear ice. Sometimes, these super cooled droplets can collide with snowflakes
and when that happens, a type of soft ice crystals
can be formed, which is not as hard as hail
but big enough to be heard when it hits the aircraft
if you fly through it. This type of precipitation doesn't create the type of heavy airframe icing
that supercooled rain does but it has significant volume
and can quickly clog up and overwhelm sensors
and probes on the aircraft, especially the pitot probes
which I will explain later. More than nine different occurrences
of this type of clogging happening to Air France flights
had been reported during 2008 and 2009. And these reports, together with how
to recognize and deal with the issues had been published in safety bulletins
circulated to all Air France pilots during the year
before the accident flight. The aircraft that the pilots
were going to operate was a reasonably new Airbus A330-203. It had been delivered to Air France
in 2005 and was in almost perfect working order on
the evening of the departure. Prior to arriving to the aircraft,
the pilots ordered 70.4 tons of fuel to be loaded and together
with their cabin crew, they walked out to the aircraft
and started preparing it for departure. Now it will be impossible to explain
what happened on this flight without also explaining a few details
about this Airbus but also a little bit about flying in general. Pilots need a way to accurately measure the amount of air
that is flowing over the wings because that's what really determines
the performance of the aircraft. To do this, they utilize a type of probe
known as a pitot tube or a pitot probe. These probes are often situated
along the front of the aircraft, below the cockpit and they look
a little bit like gun barrels. And they have a hole in the front where the air enters
and the total pressure is then measured inside of the tube. They are electrically heated
and the heating is automatic on the Airbus A330. But in order to accurately measure
the air speed, the static pressure must also be measured
so it can be deducted from the total pressure
from the pitot probes. This static pressure is measured
from a different device called a static port and that static pressure is then used both for calculating
the air speed and, crucially, also the altitude of the aircraft. These different pressures
are then sent to the aircraft computers, called Air Data Modules or ADMs. The ADMs will calculate
the correct true air speed but another thing
that will become hugely important in this story is that the static pressure
from the static port must be corrected depending on how fast
the aircraft is flying. That's because the air flows
over the aircraft surfaces, surrounding the static port
and will therefore create localized pressure differences
depending on the speed. These corrections are done automatically
by the ADM computers and because air speed and altitude are critical values,
there are three different independent sets of probes and computers
fitted to the aircraft. Now because of the problems
that Air France and other operators had reported of ice crystals clogging up the pitot probes, Airbus had started to look into the problem. A newer type of pitot probe
had been found to be more effective in preventing these problems
and a maintenance bulletin had been issued suggesting
an upgrade to these newer probes. Air France had just started upgrading their first Airbus A330
about one month prior to the departure of Flight 447. And the accident aircraft
was actually scheduled to have its probes changed
on its arrival to Paris after the flight. But why was the change of these pitot probes
just a suggested action? Why wasn't it mandatory? Well, that's because the temporary loss of air speed due to this issue
was both very rare, it only lasted for a maximum
of a couple of minutes and there was a defined procedure which the pilots were supposed
to follow in case it happened. In Air France, this procedure was known
as IAS douteuse but I will refer to it in this story as unreliable air speed. Because this problem had been reported
several times, it had been included in the recurrent training scenario for all Air France Crews
during 2008 and 2009. The training had included
air speed unreliable exercises but only at low altitude. That's because that was seen
as more safety critical because of the closeness
to the terrain but the performance of the aircraft was also much better
than it would be at high altitude. Air speed unreliable
can be very tricky to diagnose because the failure
will look different depending on what caused it and how severe it is. During the exercises
that Air France crews had practiced, the autopilot did not disconnect
and there were no warnings sounding in the cockpit when the failure occurred. Now the air speed unreliable procedure
included the use of memory items, meaning safety critical items
that needed to be done straight away from memory of the pilots. But using them was optional depending on the situation and that
had been interpreted as only needed if the aircraft was close to the ground. Also important for this story
is that none of the pilots of Flight 447 had received any recent training on how to deal with an
approach to stall and recovery, especially at high altitude. The latest stall training
that they had actually received was done during their type rating on the Airbus A320 which they
had all done years earlier. And that initial training
that they had done was all done at low altitude
in which heavy emphasis was put on the use of thrust
to recover the aircraft and power it out of the stall,
achieving it with minimum altitude loss. Decreasing the pitch was
a secondary action to take. Now this idea that the engines
will have enough power to pull an aircraft out of an extreme high angle of attack is also going to become very important. Once the 216 passengers
had finished boarding and the crew were ready, the pilots asked
for pushback and started moving away from their gate at time 22:09 UTC,
only nine minutes behind schedule. The first officer was pilot flying
and all three pilots were present in the cockpit as they were taxiing out. At time 22:29, the aircraft started
rolling down the runway in Rio de Janeiro and performed a completely normal takeoff. They climbed away along
their cleared departure route which led them up through
a northeasterly course, following the coastline of Brazil. At some point,
after passing 20,000 feet climbing, the relief pilot left the cockpit
to start his scheduled rest period which would last about three hours. He went back
into the crew rest compartment which consisted of two bunk beds
just behind the cockpit and we don't know exactly
when he left the cockpit because the cockpit voice recordings from the cockpit voice recorder doesn't start until
just after midnight, UTC time. In any case, the two remaining pilots
received clearance to climb to their initial cruise altitude
of flight level 350 or 35,000 feet and once they were established in cruise,
they were talking to controllers from Brasilia FIR and then later,
they switched over to Recife Control. And it was Recife Control
who were going to be the last ones to have radar contact with the flight because in that control area,
they were largely still flying over land but once they passed into the next FIR,
Atlantico, they would move away from radar coverage
and instead be following oceanic traffic separation procedures. Now flights over oceanic areas
requires special training procedures and aircraft equipment. Since the curvature of the earth
makes VHF radio communication impossible, aircraft are equipped
with something called HF radios. These radios use layers in the ionosphere to bounce the signals off from and can therefore reach
much further distances. As the aircraft passed an RNAV point
called INTOL, the pilots checked in with Atlantico Control
on one of the two HF frequencies that they had been given. The pilots then tried to log in
to a new system that was being tested at the time in the area called ADS-C. This system would use automatic reports
sent by the aircraft itself via satellite to update the position
of the aircraft to ATC, thus showing where it was
even if they didn't have radar coverage. Another cool thing that
this new system could do was that it would immediately send a report if an aircraft deviated
from the course or altitude that it had assigned. But, unfortunately,
due to a formatting error in the flight plan that had been filed the pilots were unable
to log into this new system and therefore, as soon as the aircraft
left conventional radar coverage, it would not be able
to be accurately tracked anymore, something that would come
to have grave consequences. The Airbus A330 is a fly-by-wire aircraft and that means that the inputs
that the pilots makes on their side stick and rudders will be
electronically-interpreted by a computer and then sent to the hydraulic flight
control actuators for execution. This type of controls comes
with many benefits, for example, it makes the aircraft substantially lighter but mainly, it allows the aircraft
to monitor certain safety parameters and make sure that those
parameters aren't exceeded. Parameters like excessive bank
and pitch angles are monitored as well as safeguarding
the maximum and minimum speeds and a whole load
of other parameters as well. Now detractors of the system
say that this lets the aircraft have the final word of the pilots
but that's not completely true. Only maneuvers which are really extreme and ultimately dangerous
are blocked by the system but the fly-by-wire system
do require that the pilots who operates them really understand
how they work and when those protections actually work and don't. This is true for all aircraft
obviously but it's especially true here. And why is that? Well, in order for these protections
to properly work, the computers who monitor them needs
to be absolutely sure that they are using
correct parameters to start with. If that is not the case,
the computers will back off and take away those protections,
simply because the computers aren't really sure what's going on. These computers receive their inputs
from a lot of different sources like the pitot probes,
the static ports, the inertial reference units,
angle of attack vanes and so on. They combine all of this data
into three Air Data Reference Units who together form the
Air Data Inertial Reference System. As long as all three or, at least,
two of these ADRs agree with each other, the aircraft control computers are happy and it can continue to operate
in what's called Normal Law. Normal Law means that all protections
are available and that the aircraft is basically impossible to stall
or put into an upset situation. But if two or more ADRs
starts sending strange information, a couple of things will quickly happen. First of all, these inconsistencies
might affect the autoflight system like the autopilot that controls the aircraft, the autothrottle governing the engines and the flight directors
who are showing the pilots how to fly. That's quite logical,
if you think about it. The aircraft will not try to navigate
or control the aircraft if it's not sure about what's going on. It will leave that up
to the pilots to figure it out. And following up on that same logic,
the aircraft control computers will degrade from Normal Law
into either Alternate Law 1 or Alternate Law 2, depending
on the severity of the issues. The difference between Normal Law
and Alternate Law 2 which will soon become relevant in this flight
is that the protections that the aircraft normally have
regarding maximum angle of attack or stall protection
will no longer be available. This will be shown by the removal
of warning indicators like the barber's pole
on the primary flight display as well as yellow crosses
where the limitations would normally be shown. The other difference is that
the roll control of the aircraft changes. In Normal Law and Alternate Law 1,
the roll inputs on the side stick will command a specific
roll rate from the aircraft. If the pilot inputs a specific roll rate
to be kept, the aircraft will give that and gust disturbances
will be compensated for. It will basically be very stable
and easy to handle. But in Alternate Law 2,
the side stick will give direct commands to the ailerons and spoilers
rather than commanding a specific roll rate. This means no bank protections
or stability control. This will also make the aircraft
more roll sensitive especially at higher altitudes where there's less aerodynamic damping
due to the thinner air. Another major difference
between a conventional aircraft and an Airbus fly-by-wire aircraft
is the pitch trim system. If you're flying manually
in a conventional aircraft, the yoke controls
the flight controls directly and the trim has to be done
deliberately by the pilots. In an Airbus, the side stick input
will ask the control computers for a specific roll rate horizontally
and a pitch or a g-loading vertically. When the pilot sets a specific pitch,
the elevators will initiate the pitch and the massive horizontal stabilizer
will then move automatically to continue maintaining that pitch
without any pilot input. This also means that
there is no big tactile feedback from the stick if the aircraft
is entering into a strange trim position due to low speed for example,
which would be the case on another aircraft like the 737
for example, that I'm flying. In Normal Law, that's not an issue
because the aircraft also guards the aircraft from getting close to an angle of attack
high enough to stall it but that's not the case in Alternate Law. Now these differences
are really important for any pilots to know about but even more crucially,
they need to understand them and they need to be able
to retrieve this knowledge when things are starting to go wrong. Now before we get into
the actual accident sequence of this video, I just wanna share
this short message from my sponsor who makes it possible
for me to create these videos. This is really quite cool! Are you looking for ways to save
a little money on your next holiday or online shopping spree? Well, did you know that you can get
cheaper flight tickets, hotel reservations or even car services
by connecting to a VPN in a different country? By shopping online
with today's sponsor, NordVPN, you can find the best deals
in the world no matter where you're shopping from
because it turns out that prices actually change on,
for example, booking.com when connected from a different country. I have no idea why that is
but thanks to NordVPN, you can potentially save
some serious bucks by trying it out. Nord have over 5,500
ultrafast servers in 59 different countries
so there's plenty to choose from. So whether you want to watch
your favorite content from other countries, protect your personal information or save money with a VPN
via regional discounts, NordVPN have you covered. Start browsing the internet freely
and safely today and right now, if you go to NordVPN.com/pilot,
you get an awesome exclusive deal. And you don't really have anything
to lose because Nord always gives you a full 30-day money-back guarantee. Thank you NordVPN.
Now back to the video. As Flight 447 now proceeded
along their route, they received a message from their company,
advising them about reported thunderstorm
activity further ahead. The first officer changed the scale
on his navigation display and started talking about some buildups that he could see ahead of them. The pilots then started discussing
ways to possibly avoid the turbulence that these clouds would bring. And the first officer indicated
that he was quite worried about the storm clouds
that he could see now getting closer. At time 01:46, the first officer dimmed the cockpit lights in order
to see better outside and confirmed that the aircraft
was now entering into a cloud layer. It was pitch black outside
with the moon situated behind them and light turbulence
now started rocking the aircraft. The crew discussed if it would be possible to climb higher as it looked
like they were just skimming the tops of the clouds at flight level 350. But when the first officer
checked the maximum altitude they could climb to,
it was indicated as flight level 370 and they both decided
that it wouldn't be a good idea to sit at maximum altitude
if the turbulence would get worse. Now, this is probably a good opportunity to discuss another thing
that will become important very soon. As an aircraft climbs higher, the air will become thinner
and thinner outside. And because of that, depending
on the weight of the aircraft as well as the outside temperature
and some other factors, the aircraft will be limited from continuing
to climb as the engines just won't be able to produce
enough excess thrust to do it. This also means that the engines
do not have much excess thrust to deal with any non-normals up there and because of that,
we pilots need to be very careful and quite conservative with how
the aircraft is operated. The only way that an aircraft can climb higher than
its indicated max altitude, would be to exchange kinetic energy, their speed, for potential energy, altitude. But doing so, would dramatically
increase the angle of attack. At higher altitudes,
the critical angle of attack, meaning the angle where the aircraft will stall if it's exceeded, is also less
due to aerodynamic effects from flying closer to the speed of sound. So in short, the aircraft will stall earlier and will have less available
thrust at high altitudes. It will also be more sensitive
and harder to hand fly due to less air providing aerodynamic damping. After the aircraft had entered
into the clouds, the captain started commenting on the
appearance of St. Elmo's Fire. This is a sure sign
of a building electrical charge close to an aircraft,
a further indication that they were getting
close to storm clouds. Around this time, the captain pressed
a button on the overhead panel, which activated the call bell
in the crew bunk behind the cockpit. This was the sign to the relief pilot
that it was time for him to return to the cockpit and take over
for the captain so the captain could go back to the bunk
and get some rest. The relief pilot knocked
on the cockpit wall in response to show that he had heard the bell. Now the Air France
standard operating procedures at the time stipulated
that the first officer in the right seat who was pilot flying would take on
the role of pilot-in-command when the captain left for rest
unless something else had been agreed. And in this case, this was exactly
what happened and when the relief pilot arrived to the cockpit at time 01:59,
the captain left his chair and listened into the briefing that the first officer gave
to the relief pilot. This briefing included
the anticipated turbulence that they were currently flying in cloud and that they couldn't climb
any higher at the moment. The captain didn't leave
any specific instructions about how the two first officers
should deal with the thunderstorms ahead. Instead he left
the cockpit to start his rest. Now we can only speculate to why he didn't give
more clear instructions. Like I mentioned before,
all three pilots were used to this type of weather
and had flown this route many times. So it is likely that he found
the two first officers more than capable of dealing with it. When the captain left,
the Air France procedures meant that the much more senior relief pilot, now took on the role of pilot monitoring in the left seat and the first officer
continued as pilot flying and, effectively, pilot-in-command. The two pilots now started discussing
the weather situation up ahead. And the first officer mentioned
the Intertropical Convergence Zone. But at this stage, there was no discussion about trying to avoid
the cells by changing course. Instead, the first officer asked
the relief pilot if he had been able to sleep anything and the relief pilot
said that he had just dozed off a bit. The relief pilot then asked
the first officer if he felt okay. This discussion could be interpreted
as the two pilots possibly feeling a bit fatigued at this point. The captain had also made
some similar remarks earlier. The relief pilot also left his pilot chair in the aft position
and didn't move it forward into the piloting position
when he sat down. That would likely have given him
a more relaxed position where he could put his feet up
but it wouldn't be ideal if he suddenly needed
to fly the aircraft which he soon would need to do. At time 02:06:05,
the first officer contacted the cabin crew to advise them
that they would likely encounter some light turbulence soon
and to tell them to be careful. It was now around four minutes
since the captain had left the cockpit. And in another four minutes,
the emergency sequence would begin. The relief pilot now started
looking closer at his navigation display and he reached down
and changed the gain on his weather radar to Max. This made the weather radar
more sensitive and highlighted the weather ahead of them. He then asked the first officer
if he maybe wanted to go a bit to the left, indicating some discomfort
with what it was seeing in front of them. The first officer asked what he meant
and he then pointed out the return on the screen in front of them
and asked again if they could turn left. The first officer agreed
and turned the heading bug about 12 degrees to the left. This was a quite small correction
given the amount of weather they had in front of them
but it meant that they now left their flight plan route
and they didn't try to radio in this change
to air traffic control. At time 02:08:17,
the cockpit voice recorder picked up a change
in the background noise in the cockpit. This noise sounded
like rain hitting the cockpit. At the same time, the first officer
noticed that the temperature was going up and he asked if the relief pilot
had done something with the air conditioning. He then asked, "What's that smell?" The relief pilot recognized
the smell as ozone and calmed his colleague down
by explaining what ozone was. These comments as well as
the precipitation heard outside the aircraft were all signs
of the type of weather phenomenon the aircraft was now flying into. The change in temperature
and humidity felt in the cockpit was likely another sign of huge amount
of water or ice being suddenly sucked into the engines, partially overwhelming
the air conditioning system. 20 seconds later, the background noise
intensified and changed into the sound of ice crystals now hitting the cockpit. The turbulence intensified
and the first office reduced the commanded speed from Mach 0.82 to 0.8 which was the
turbulence penetration speed. This caused the autothrottle
to reduce the thrust back to 84% N1. Up until this point, the aircraft
had been performing flawlessly and the two pilots were relaxed and just monitoring
the autopilot doing its job. We don't know for sure what caused it
but it is very likely that the ice crystals who were now pelting the aircraft outside started to overwhelm the heating elements of the pitot probes who were
providing crucial information to the three air data modules. At time 02:10:05, the autopilot
and autothrottle suddenly disconnected with the associated
Cavalry Charge warning in the cockpit. At the same moment,
a heavy gust of wind caused the aircraft to start
banking sharply to the right. The first officer called out,
"I have controls!" and reached for his side stick. Now this sudden onset
of warnings and aircraft behavior would have likely caused
a severe startle to both pilots and the confusion
would have set in almost immediately. But at this point, the aircraft
was still flying reasonably level with only this right bank developing. As the aircraft continued banking right, the indicated air speed
on the captain's primary flight display as well as on the standby indicator, suddenly dropped
from 275 knots to 60 knots, a clearly erroneous indication. We don't know for sure
what the first officer's instruments showed as they weren't recorded
on the flight data recorder but they likely also fell
with a similar amount. Remember what I told you
about how the altimeter system compensated the pressure
for higher Mach numbers? Well, because the speed was now indicated as much lower, the altimeter system recalculated its altitude
and suddenly showed a drop of 300 feet as well
as negative vertical speed. The first officer who had been suddenly
thrown into hand-flying the aircraft now reacted instinctively
by giving left aileron and pitching up to correct his altitude. This was the start of the sequence of events that would
ultimately doom this flight. Since all three ADRs
were now showing unreliabe data, the aircraft reverted into Alternate Law which meant that the
angle of attack protections were lost as well as the overspeed
and bank protections. Now like I mentioned before,
the roll control now also became about twice as sensitive,
meaning that the first officer had to really concentrate
in order to get the aircraft to stop banking
and return to level flight. He started over-correcting
and the movements he made with the side stick started
causing more oscillations going from right to left
and then back again. It is very possible that most
of the first officer's attention went to this part of the handling
at this point but remember, he had also started pitching up. That pitch was now increasing,
leading into a very high rate of climb. Almost instantaneously,
as the auopilot disconnected and all of the different warnings started, a brief stall warning
could also be heard in the cockpit. When the warning sounded,
the relief pilot called out, "What is that?" likely because
of the quick nature of the warning but it could also potentially
indicate the confusion about its meaning. The flight directors were not disconnected by the crew as the procedure for air speed unreliable instructed
them to do but the command bars disappeared anyway
due to lack of reliable data. 11 seconds into the sequence, the pitch of the aircraft
had reached 11 degrees nose up and the first officer
was making max left and right side stick input,
still over-correcting. He also now called, "We haven't got... We haven't got a good display!" Likely referring
to the lack of speed info. The relief pilot who was supposed
to handle the ECAM warnings and the non-normal checklist,
called out, "We've lost the speeds! And, "Alternate Law protection law." He then continued to read out
the ECAM messages but in a manner that was hard
to understand and very rushed. Here, it would have
been absolutely crucial to clearly point out
that the aircraft was in Alternate Law,
meaning that it would handle differently and that certain protections were lost. He mentioned that the autothrust
was lost and the first officer responded by asking, "Engine lever?" Showing some confusion
about what the relief pilot was saying. Since the autothrottle had disconnected
when the failure occurred, the thrust had gone into a mode
called engine thrust locked which basically meant
that it was keeping its previously selected value of 84%. ECAM instructed the crew
to move the thrust lever manually to resume thrust control
but instead, the first officer pushed the autothrottle disconnect button and left the thrust lever where it was
which was in the climb detent. And because of that,
the thrust now started to increase into climb thrust. All of what I've said so far
happened in the first 18 seconds of this emergency. There were 10 different
ECAM messages showing up, each of them causing
a chime in the cockpit. On top of this, the Master Warning
and the Master Caution Light was illuminated in front of the pilots
as well as a constant C chord chime, indicating that the aircraft
had left its cleared altitude. This would have been
a very confusing and stressful environment for the pilots. And the fact that unreliable air speed
was not indicated on the ECAM, this was something
that the pilots needed to figure out themselves,
that might have been the reason why they didn't start executing
that procedure at that point. At time 02:10:26,
the aircraft pitch up attitude had reached 12 degrees nose up. The aircraft was now climbing
with a hair-raising 6,900 feet per minute, more than seven times higher
than their normal rate would be as it passed 36,000 feet. Maintaining a rate this high meant
that the aircraft was now rapidly exchanging speed for altitude. Suddenly, the flight director bars
reappeared in front of the first officer but instead of being engaged
in the altitude hold mode that they were before,
they're now engaged in vertical speed mode
since they activated in the middle of a climb. This meant that the flight directors
were now starting to show the pilots the pitch needed to maintain
their current 6,000 feet per minute climb. That would definitely
not have been helpful in this situation when the first officer was likely becoming
more and more overloaded by noise and workload. And it was precisely because of this
that the unreliable air speed memory items included turning off the flight directors. The relief pilot now looked away
from the ECAM display which he had stopped reading anyway
and reached to switch on the Wing Anti-Ice and that's when he noticed the high pitch that
the aircraft was keeping. He called out, "Watch your speed!" Possibly referring to the vertical speed since the speed indication
still hadn't returned. The first officer replied,
Uh, okay, I'm going back down," and started pitching forward
but not nearly enough. This only reduced the climb rate
but the aircraft continued to climb. The relief pilot continued
to call out that he needed to stabilize, "Go back down!" And, "According to all three,
you are going up so go back down," to which the first officer
responded, "Okay." The pitch now momentarily reduced
to about 10 degrees pitch up which still gave a climb rate
about 4,000 feet per minute. They now climbed through
their calculated max altitude of 37,000 feet and at time 02:10;36,
the flight directors disappeared again but the air speed came back
on the left side indicating the correct speed of 223 knots. That meant that up until this point,
the aircraft had lost about 50 knots of precious air speed
and the speed was still reducing. The flight directors again flashed up
for about a second, disappeared and then came back again,
commanding a climb of about 1,400 feet per minute
which was what the aircraft was doing at that time. At time 02:10:47, the first officer
inexplicably now reduced the thrust back to around 85% N1. And this is likely a sign
of his increasing loss of situational awareness
and disorientation. The relief pilot pushed
the call button to try and get the captain
back into the cockpit again. He pressed it several times,
asking, "Where is he?" He also reached over
and switched the Air Data Selector
and the Attitude Heading Selector to First Officer on 3. These are switches designed
to change the data input for the displays and they were not items
covered in any checklist. He likely switched these in an attempt
to try and restore the instrument that he felt were missing
for the first officer. Three seconds later,
the stall warning went off in the cockpit and sounded continuously for the next 45 seconds. The fact that this warning
was now sounding continuously was not verbalized or even discussed by any of the pilots. Instead the first officer reacted
by pulling back on the controls increasing the pitch attitude
to 16 degrees nose up, similar to what you would have on takeoff. This pitch up command now also meant that the stabilizer
at the back of the aircraft started moving
into the max nose-up position, making a potential recovery even harder. The aircraft now no longer
had enough energy to keep the requested climb rate. Instead it started to slowly level off,
rocking from side to side which the first officer desperately tried
to counteract with the side stick. They were now rapidly closing in
on a fully-developed stall. Now a stall happens when the aircraft wing has moved beyond
its critical angle of attack, meaning that it effectively stops
being able to create lift and instead, the aircraft
will start to fall. A stall can happen at any attitude. The only thing that determines
when it happens is the angle of attack. And the angle of attack is the angle
between the wing chord line and the oncoming airflow. Both pilots had received initial training on how to deal with
an approach to stall and recovery during their type ratings years ago
but they would have never experienced the feeling of a fully developed stall
in a real aircraft. The fact that the Airbus only has an audio warning,
not a visual stall indication in front of the pilots
or a stick shaker might also have played a part in explaining
why the warning wasn't reacted to because one of the first things
that disappears when a human is under stress is their hearing. At time 02:10:57, the aircraft
reached its stall angle of attack and violent buffeting
started to shake the aircraft. This type of buffeting
is of a much higher frequency than turbulence is
and it feels very different. So the first officer
now added full TOGA thrust but at this altitude, above the aircraft's
maximum performance altitude, the engines were not able
to produce enough thrust to even keep the speed,
much less accelerate it. The relief pilot called out, "Above all, try to touch
the lateral controls as little as possible!" Showing some insight into the issues
with flying in Alternate Law but this fell on deaf ears
as the first officer continued to make max left and right inputs. The relief pilot also said,
"Is he coming or not?", referring to the captain. The first officer now
called out, "I'm in TOGA", referring to the fact that
he had added thrust which he might have thought would be enough
to solve the situation. The aircraft still climbed
a few hundred feet more until it reached its maximum
recorded altitude of 37,924 feet and then it started falling down
towards the sea below. Now you might ask yourselves why didn't the relief pilot
just take controls? He was asking for corrections
that didn't happen. Well, we will never know
the answer to that but it likely lies in the fact that this
all happened quite fast. It only took about one minute
to reach this point. Also the fact that he couldn't see
or feel the input his colleague was making on the side stick
since those aren't connected to each other in the Airbus,
made it hard to monitor what his colleague was actually doing. At time 02:11:07,
the last bit of ice inside of the pitot tubes
have been cleared by the heating elements
and both the standby and left air speed indicator
now started working again. The speed indicated was 183 knots,
meaning that they had lost around 90 knots of air speed. The aircraft now entered
into an increasingly rapid descent with the stall warning
sounding continuously. The relief pilot called out,
"But we've got the engines. What's happening?" And then, "Do you
understand what's happening?" But he got no reply. The aircraft started banking
over towards the right which prompted the first officer
to give continuous left side stick but with very little effect. The first officer also continued
his pitch up command with the side stick and would
be doing that continuously for the next 40 seconds. Now for all of those out there
who cannot believe how it was possible for the first officer to react this way, there are a few things
that are worth thinking about. The first is that the human brain
does not perform well under stress and we tend to revert to our training when that happens. And that brings me to my second point which is how the Airbus functions
when it's flown in Normal Law. You see the best possible
climb performance you can get from the aircraft
is achieved through applying continuous back pressure and TOGA thrust. That's what's used during a wind shear
or a terrain escape maneuver, for example, since the aircraft
will not allow it to stall. It will only pitch to maintain
close to its maximum angle of attack whilst using max thrust,
giving the best possible performance. But that only works in Normal Law. If you apply that logic, the actions of the
overstressed first officer becomes maybe
a little bit more understandable. At time 02:11:32, the first officer
called out that he didn't have control of the aircraft anymore,
no control at all. The relief pilot responded by saying, "Controls to the left!" And pressed the takeover button
to take controls but he never verbalized that takeover formally. He then made two brief inputs
to the left of his own controls before the first officer
took back the controls again and continued with his own inputs, aft and left, none of which was working. At this point, the aircraft descent rate had increased to around
10,000 feet per minute and the angle of attack
was close to 40 degrees, meaning that the aircraft
was now more falling than flying. Because it was maintaining
such an incredibly high angle of attack, the air was now hitting
the aircraft from below at a 40 to 60-degree angle. This would have caused
a very strange wind noise in the cockpit but also, crucially, the angle
that the air was hitting the pitot tubes and the static ports with was now so extreme that the pressure
became almost equal on both. This meant that the speed indication
once again disappeared as the computer interpreted
those conditions as being completely impossible and unreliable. So the reason that the crew
now once again found themselves without valid speed indication
had nothing to do with ice from this point on. It was only due to
their extreme aircraft situation. Once the speed value
dropped below 60 knots, the onboard computers told
the stall warning system to disregard the angle
of attack vanes outside because such a speed
could only be encountered on the ground. This made the stall warning
stop in the cockpit and as the calculated speed
fell below 30 knots, the speed indication was replaced by speed flags
on the pilot display. At this point, the first officer
also said something that gives a bit of an insight to why
he was acting the way he did. He said, "I have the impression
that we have the speed." It's unclear what he was basing
this feeling on but it could be just his senses together with the increase in wind noise from outside
and possibly the buffeting that he was feeling. In any case, the silencing
of the stall warning coincided with the captain returning
to the cockpit at time 02:11:42. That was about one minute and a half
after the autopilot disconnected and less than one minute
after he was called back. He was faced with
a completely unrealistic scene. There was no stall warning at this point
for the reason that I just explained but the aircraft was descending
with an incredible vertical speed and they were just passing 35,000 feet,
the same altitude they had maintained when he left the cockpit. The pitch attitude was varying
between 15 degrees nose up and nine degrees nose down and he could see 10
different ECAM warnings, Master Warning lights
together with severe buffeting which was shaking the aircraft. The captain asked, "What are you doing?" To which the relief pilot desperately
answered, "What's happening? Well, I don't know.
I don't know what's happening." The first officer also chimed in, "We're losing control
of the aircraft here!" And the relief pilot added,
"We've lost all control of the airplane." We don't understand anything.
We've tried everything. The first officer now reduced the engines to idle
and given their position below the wings, this
and some actual pitch down commands, finally caused the aircraft to pitch down to about 11 degrees
below the horizon. The first officer said, "I have a problem. It's that I don't have vertical speed. I have no more displays." And the relief pilot said,
"We have no valid indications." The vertical speed indication might have been indicating
full down at this point or it could indeed be missing
as the computer rendered any value above 20,000 feet per minute as invalid. But the fact that they were
now finally pitching down caused the speed to start increasing and the angle of attack
to decrease slightly. But in a cruel twist of fate,
because the speed now started increasing, the stall warning system again noticed that it had valid indications
and started sounding, giving the perverse effect
of indicating a stall when the nose was pitching down but disappearing again when it was pitched back up. This must have been
extremely confusing for the pilots but fully in line with the aircraft system
design at the time, because no aircraft was ever thought to even get close
to that kind of situation that they now found themselves in. The first officer now said,
"I have the impression that we have some crazy speed. What do you think?" He then reached over and deployed
the speed brake but was immediately told to stow it again by his colleagues. Now this further indicates
that the first officer indeed thought that the aircraft was in an overspeed
and not in the fully developed stall that they actually were. As the pilots were now trying
to troubleshoot, the aircraft was descending with
between 10 to 15 000 feet per minute with the nose oscillating
between eight degrees nose down and 15 degrees nose up. Each time it pitched down,
the stall warning would activate and when it pitched up again,
it would silence. The bank angle varied
between 20 and 40 degrees to the right and it's likely that it was mostly the yaw damper which
was controlling rudder who kept the aircraft
from going into a spin. At time 02:12:10, the thrust
was again moved into the climb detent and 20 seconds later,
the aircraft stopped banking to the right and instead
started oscillating left and right which the first officer continued
to try and correct with his side stick. The relief pilot asked the captain,
"What do you think? What do we need to do?" But the captain who had not
been informed about the nature of the initial failure
nor about the rapid climb in the beginning of the emergency was completely perplexed. He just answered,
"There, I don't know. There it's going down." Clearly, just trying to orient himself
of what he was seeing on the different instruments. In the following seconds,
there are a lot of confused call-outs from all three pilots. The first officer who was still in control was asking things like,
"Am I going down now?" To which the relief pilot responded,
"Go down," and the captain, "No! You climb there!" Most likely referring
to his pitch attitude, not to what the aircraft
was actually doing. At some point here,
the first officer actually positions the side stick fully forward
for a few seconds. This causes a pitch down
and the speed to start increasing and with that, the stall warning came back and the first officer confirms
the engines to be in TOGA. This is again an indication
of this being his go-to response for the stall warning. He then asked,
"What do we have on alti? Referring to the altimeter reading,
which was about 20,000 feet at this point. Now this is a bit strange
since he should be seeing his altitude in front of him
but, unfortunately, we cannot be sure if the first officer had
any valid instruments at all in front of him
since the flight data recorder didn't capture it. Later examinations
of the different failure modes in the computers seems
to indicate that he did have it. The captain muttered, "It's impossible," showing that he still couldn't figure out what was going on. During the following seconds,
the pilots kept discussing the attitude of the aircraft and how to get the wings horizontal. The confusion is obvious
and excruciating to listen to. The first officer explained that he is at the limit
with the roll controls. And the captain then suggested
that he could use a bit of left rudder to try to stop the right bank. This actually seemed to help momentarily as the aircraft rolled over
slightly to the left but soon continued banking right again. The aircraft ascended
through 10,000 feet and the first officer called out,
"We're there! We're there! We're passing level 100! At this point it was likely
very little the pilots could have done to save this aircraft
but the relief pilot now called out, "Wait! Me! I have controls." And then started making left inputs but the first officer
never let go of his control. So the warning-
- Dual input! - Was now heard multiple times
for the coming seconds. - [Warning] Dual input. - The first officer called out,
"How come we're continuing to go down?" And as he was saying this,
the relief pilot instructed the captain to try and reset
the flight control computers which he did but the captain also said that it
wouldn't make any difference. The relief pilot then started calling out, "Climb! Climb! Climb!" To which the first officer responded, "But I've been at
max nose up for a while." That last remark likely finally made
the captain understand what was going on and he called out, "No, no, no! Don't climb!" The relief pilot said, "So go down!" And pushed his side stick forward
but the first officer was still holding his side stick backwards
causing a new dual input warning. And since the two inputs
were now averaged, nothing happened. The relief pilot called out,
"So give me the controls. Controls to me! Controls to me!" First officer responded,
"Go ahead! You have the controls! We're still in TOGA." The nose was now
lowered seven degrees below the horizon
and the speed indication came back together
with another stall warning. Seven seconds later,
despite having given the controls to the relief pilot,
the first officer again started pulling back on the controls
causing another dual input alert. - Dual input.
- The thrust levers was also momentarily pulled back to idle and then moved forward again,
likely to try and achieve any type of change to the situation. The captain called out from jump seat, "Watch out! You're pitching up there! But it now seems
like the relief pilot had changed his mind about strategy because he called out,
"I'm pitching up! I'm pitching up!! And when the captain continued
to warn about doing that, he responded, "Well, we need to do it. We're at 4,000 feet." The next thing that could be heard
on the cockpit voice recorder was the GPWS system calling out... - Sink rate. Pull up!
- As the aircraft fell through 2,500 feet. This caused the captain
to also change his mind and he called out, "Go on! Pull!" As the first officer chimed in,
Let's go! Pull up! Pull up! Pull up!" Both pilots now pulled maximum back on their side stick causing
the nose to pitch up to 16 degrees above the horizon. The speed at this point
was 107 knots forward but an equal heart-wrenching
107 knots downwards. At time 02:14:22, the first officer,
again pushed his takeover button and kept it pressed,
this locked out the control from the relief pilot. The synthetic cockpit voice recorder
called out... - Priority right.
- The first officer now pulled in panic back and called out,
"Damn! We're going to crash!" Followed by, "This can't be true!" And, "What's happening?" The captain barked out an order,
"10 degrees pitch up!" while the stall and GPWS warnings
were blaring in the background. - [GPWS Warning] Pull up! Pull up! Pull up! - The relief pilot now tried,
for the last time, to pitch forward but since the first officer
was holding the takeover button, his inputs had no effect. Even if they would have,
this was far too late to do anything about the situation.
- Pull up! - At time 02:14:28, the Airbus 330
crashed into the Atlantic Ocean at a 45-degree angle
and a vertical speed of 10,900 feet per minute. The forces exerted on the airframe
was equivalent to someone being dropped from the 46th floor
of a building straight into the ground. It immediately shattered the aircraft
into thousands of pieces and all 228 people on board were immediately lost. (somber chime) Completely unaware of the horrific fate
of the aircraft, the four control centers that were planned to be in contact with the flight, soon started
contacting each other to verify if anyone had heard anything from the aircraft. It soon became clear
that there had been no sign from the flight since time 01:35 and the crew hadn't checked in
at the various position checkpoints that they should have. Since the problem with HF radio contact was not uncommon in this part
of the Atlantic Ocean, no one took any particular notice
of this for the first few hours. There continued to be several calls
made between the different ATC centers verifying if anything had been heard. And other aircraft flying on the same route
were asked to try and contact the flight but with no success. The same went for trying to contact them via SatCom, which is
a type of satellite telephone as well as EICAS messages
sent from Air France. Three hours after the accident,
the flight was first registered as missing and a further three hours later,
the first emergency message was sent out by Madrid in Spain and as well as from
Senegalese ATC control centers. This triggered the first search
and rescue planes to be sent out towards the last known
location of the aircraft. On the 2nd of June, 2009,
two days after the accident, the first floating debris
was spotted on the ocean surface and three days later, the first debris
of victims were recovered from the sea. This was the beginning
of a two-year long search and rescue effort that included
charting the entire underwater terrain in the area where the aircraft
was thought to have gone down. The search was divided
into several campaigns with the last one starting
in March of 2011. And on the 2nd of April that year,
the wreckage was finally located on a relatively flat area at the sea floor at a depth of about 12,800 feet and six and a half miles away
from its last EICAS transmitted position. This meant that thousands of pieces
could be recovered including both the cockpit voice recorder
and the flight data recorder which were, miraculously, in good condition. The fact that both recorders
were found was what finally led to the final report and the details
that I've just told you. So what conclusions
did the final report bring? Why did this horrible
accident actually happen? Well, the fact was that no component
on the aircraft actually failed but the pitot tubes
and their heating elements were temporarily overwhelmed
by external factors that were likely outside of what they
had been certified for. This then led to a loss
of reliable air speed and that, in turn, caused
a cascade of temporary system degradations, warnings
and autopilot disconnections that caused a severe startle
to the operating crew. The crew was expected
to apply the procedure for unreliable air speed but never did so. Instead the initial pitch up
reaction by the pilot flying led to a continuously
worsening energy situation which was discovered
late by the pilot monitoring. The subsequent corrections
were too small, leading to the aircraft exiting the flight performance envelope
and entering into a sustained stall. This fact was not understood
by the pilot, most likely because of lack of training but possibly also
because they might have thought that the warning was erroneous
since it didn't match their mental model of what was going on. In any case, these stall conditions
was never discussed or verbalized by the pilots during the whole sequence. The lack of identification
of that stall meant that the crew never initiated any
countermeasures against it. This accident sent shock waves
through the aviation industry and led to several safety recommendations including the formation
of a formal upset prevention and recovery technique training module for all pilots out there. That included the effects of high altitude flying
and stall recoveries. It also led to new memory items
for flights with unreliable air speed which are now focused
on disconnecting automatics and setting correct pitch
and power immediately to keep the aircraft flying safe
before starting any troubleshooting. The investigation also recommended
the insertion of a camera in the cockpit to show all instrument indications
as well as several other recommendations around the pitot probes, black boxes, the Airbus stall warning system
as well as search and rescue improvements. Several other recommendations were also made but the most
important lessons that we, pilots, need to take away from this accident
are that we really need to understand the aircraft that we're flying. That means understanding
all of the systems, what happens if those systems are degraded
and also how the aircraft might react differently
when flying at high altitude versus at low altitude. And lastly, never forget
to continue to fly the aircraft. If a startle happens, remember
that pitch and power will keep you safe. Keep the aircraft flying. And only after that, try to figure out
what has actually happened. As long as the aircraft is flying, there will be plenty
of time to troubleshoot. As always, this story was based
on the accident final report but due to its complexity
and the many human factors involved, I have also used several other sources
and I want to specially mention, Understanding Air France 447
by Bill Palmer which was instrumental in broadening my system's
understanding of the Airbus 330. I highly recommend it. Now check out this video next
or binge on this playlist. Consider subscribing to the channel
if you think that I've earned it and if you wanna support
the work that we do here, then consider becoming part
of my awesome Patreon crew or buy yourself some merch. Have an absolutely fantastic day wherever you are
and I'll see you next time. Bye-bye.
