But there is another, worrying implication that the Telegraph can disclose for
the first time: that the errors committed by the pilot doing the flying were
not corrected by his more experienced colleagues because they did not know
he was behaving in a manner bound to induce a stall. And the reason for that
fatal lack of awareness lies partly in the design of the control stick – the
“side stick” – used in all Airbus cockpits.
Anything to do with Airbus is important. The company has sold 11,500 aircraft
to date, with 7,000 in the air. It commands half the world market in big
airliners, the other half belonging to its great American rival, Boeing.
Prior to the recovery of the recorders, the cause of the disaster could only
be inferred from a few salvaged pieces of wreckage and technical data beamed
automatically from the aircraft to the airline’s maintenance centre in
France. It appeared to be
a failure of the plane’s pitot (pronounced
pea-toe) tubes – small, forward-facing ducts that use airflow to measure
airspeed.
On entering the storm these had apparently frozen over, blanking
airspeed indicators and causing the autopilot to disengage. From then on the
crew failed to maintain sufficient speed,
resulting in a stall which, over
almost four minutes, sent
228 people plummeting to their deaths.
But why? Normally an A330 can fly itself, overriding unsafe commands. Even if
systems fail there is standard procedure to fall back on:
if you set engine
thrust to 85 per cent and pitch the nose five degrees above the horizontal,
the aircraft will more or less fly level. How was it that three pilots
trained by a safe and prestigious airline could so disastrously lose
control? Either there was something wrong with the plane, or with the crew.
Airbus and Air France, both with much to lose, were soon pointing accusing
fingers at each other.
In July last year the
French air crash investigation organisation, the Bureau
d’Enquêtes et d’Analyses (BEA), published its third interim report. For
Air
France the conclusion was crushing:
the crew had ignored repeated stall
alerts and kept trying to climb, instead of levelling off or descending to
pick up speed. The
A330 had become so slow that it simply ceased to fly. Its
reputation on the line, Air France came as close as it dared to repudiating
the finding.
The pilots, said the airline, had
“showed unfailing
professional attitude, remaining committed to their task to the very end”.
But the airline’s case seemed thin. All indications suggested the aircraft had
functioned just as it was designed.
The black box recordings showed that the
plane was responsive to the point of impact. The
case against the pilots
looked even worse when a transcript of the voice recorder was leaked. It
confirmed that
one of the pilots had pulled the stick back and kept it there
for almost the entirety of the emergency. With
its nose pointed too far
upwards, it was little wonder that the Airbus had eventually lost momentum
and stalled. But this analysis begs the question:
even if one pilot got
things badly wrong, why did his two colleagues fail to spot the problem? The
transcript of increasingly panicky conversations in the cockpit suggests
they did, but too late.
AF447 was four hours into its 11-hour overnight journey when it was
overwhelmed by disaster. Many passengers, including five Britons, would have
been trying to grab some sleep, only half aware of the turbulence buffeting
the A330.
There were eight children onboard, including Alexander Bjoroy, an
11-year-old boarder at Bristol’s Clifton College. Also travelling was
Christine Badre Schnabl and her five-year-old son, Philippe. She and her
husband had purposely chosen separate flights to Paris, possibly because of
their shared fear of air crashes. He had taken off earlier with the couple’s
three-year-old daughter.
Two hours in, Marc Dubois, the veteran captain, was heading for a routine
break. His deputy, David Robert, a seasoned flier with 6,500 flying hours
under his belt, was perfectly capable of coping with the tropical
thunderstorm AF447 was flying towards. Pierre-Cédric Bonin was at the
controls and, though the most junior pilot, he had clocked up a respectable
2,900 hours on commercial jets.
As the airliner entered the worst of the weather, Bonin told the cabin crew to
prepare for turbulence. Eight minutes later, everyone on board would be
dead. Bonin himself seems to have been spooked, calling attention to a
metallic smell and an eerie glow in the cockpit. Robert reassured him that
it was St Elmo’s fire, an electrical fluorescence not uncommon in equatorial
thunderstorms.
A few moments later the outside air temperature plummeted,
the pitot tubes iced up and an alarm sounded briefly to warn that the
autopilot had disengaged. From this moment,
Bonin’s behaviour is strange.
 |
The sticks are on both sides they look like game controllers
|
The
flight recorder indicates that, without saying anything,
he pulled back
on the stick and, seemingly against all reason, kept the nose up, causing a
synthesised voice to warn, “Stall! Stall!” in English as the airspeed began
to drop dangerously. Robert took 20 or 30 seconds to figure out what was
happening before ordering Bonin to descend.
“It says we’re going up. It says
we’re going up, so descend.” Seconds later Robert again called out,
“Descend!” and for a few moments the plane recovered momentum and the stall
warning ceased. But Robert was now anxious enough to call for the captain to
return to the cockpit. Meanwhile,
Bonin’s instinct was again to pull back on
the control stick. He left it there despite the stall warning that blared
out some 75 times. Instead of moving the stick forward to pick up speed, he
continued to climb at almost the maximum rate. If he had simply set the
control to neutral or re-engaged the autopilot, all would have been well.
A minute after the autopilot disconnected, Bonin muttered something odd:
“I’m
in TOGA, huh?” TOGA stands for Take Off, Go Around. Bonin was apparently so
disorientated that he believed he was operating at low altitude, in a
similar situation to a pilot having to abort a landing approach before
circling for a second attempt. Standard procedure on
abandoning a landing is
to set engines to full power and tilt the aircraft upwards at 15 degrees.
But
Flight AF447 was not a few hundred feet above a runway. Within a minute
it had soared to 38,000 feet in air so thin that it could climb no more. As
forward thrust was lost, downward momentum was gathering. Instead of the
wings slicing neatly through the air, their increasing angle of attack meant
they were in effect damming it.
In the next 40 seconds AF447 fell 3,000
feet, losing more and more speed as the angle of attack increased to 40
degrees. The
wings were now like bulldozer blades against the sky.
Bonin
failed to grasp this fact, and though
angle of attack readings are sent to
onboard computers, there are no displays in modern jets to convey this
critical information to the crews. One of the provisional recommendations of
the BEA inquiry has been to challenge this absence.
Bonin’s insistent efforts to climb soon deprived even the computers of the
vital angle-of-attack information. A
n A330’s angle of attack is measured by
a fin projecting from the fuselage. When forward speed fell to 60 knots
there was insufficient airflow to make the mechanism work.
The computers,
which are programmed not to feed pilots misleading information, could no
longer make sense of the data they were receiving and blanked out some of
the instruments. Also, the stall warnings ceased. It was up to the pilots to
do some old-fashioned flying.
With no knowledge of airspeed or angle of attack, the safest thing at high
altitude is to descend gently to avoid a stall. This is what David urged
Bonin to do, but something bewildering happened when Bonin put the nose
down.
As the aircraft picked up speed, the input data became valid again and
the computers could now make sense of things. Once again they began to
shout: “Stall, stall, stall.”
Tragically, as Bonin did the right thing to
pick up speed, the aircraft seemed to tell him he was making matters worse.
If he had continued to descend the warnings would eventually have ceased.
But, panicked by the renewed stall alerts, he chose to resume his fatal
climb.
Yet if Bonin was now beyond his knowledge and experience, the key to
understanding the crash is Robert’s failure to grasp the mistake being made
by his colleague. It is here that Airbus’s cockpit design may be at fault.
Like all other aircraft in the modern Airbus range the A330 is controlled by
side sticks beside pilots’ seats, which resemble those on computer game
consoles. These side sticks are not connected to the aircraft control
surfaces by levers and pulleys, as in older aircraft.
Instead commands are
fed to computers, which in turn send signals to the engines and hydraulics.
This so-called fly-by-wire technology has huge advantages.
Doing away with
mechanical connections saves weight, and therefore fuel. There are
fewer
moving components to go wrong, the slender electronic wiring and computers
all have multiple back‑ups, and the onboard processors take much of the
workload off pilots. Better still,
they are programmed to compensate for
human error.
The side sticks are also wonderfully clever. Once a command is given, say a
10-degree left turn,
the pilot can let the stick go and concentrate on other
issues while the
10-degree turn is perfectly maintained. According to
Stephen King of the British Airline Pilots’ Association, it’s an admired and
popular design.
“Most Airbus pilots I know love it because of the reliable
automation that allows you to manage situations and not be so fatigued by
the mechanics of flying.”
But the fact that the second pilot’s stick stays in neutral whatever the input
to the other is not a good thing. As King concedes:
“It’s not immediately
apparent to one pilot what the other may be doing with the control stick,
unless he makes a big effort to look across to the other side of the flight
deck, which is not easy. In any case, the side stick is held back for only a
few seconds, so you have to see the action being taken.”
Thus it was that even
when Bonin had the A330’s nose pointed upward during the
fatal stall, his colleagues failed to comprehend what was going on. It seems
clear from the transcripts that Robert assumed the plane was flying level or
even descending. Robert himself was panicking:
“We still have the engines!
What the hell is happening? I don’t understand what’s happening.” Ninety
seconds after the emergency began the captain was back in the cockpit
demanding:
“What the hell are you doing?” To which both pilots responded:
“We’ve lost control of the plane!”
Dubois took the seat behind his colleagues and for a while was as perplexed as
they were. It was pitch black outside, warning lights were flashing and some
of the screens were blank. The men in front partially blocked his view and
evidently he did not take much notice of a horizon indicator, which must
have shown the plane was still being held nose up.
The Airbus was soon
falling through the night at 11,000 feet per minute, twice as fast as its
forward travel. Only 45 seconds before impact Bonin blurted out that he had
been trying to climb throughout the emergency, giving his colleagues the
first indication of what had been going wrong. There is one final, dramatic
exchange:
02:13:40 (Robert) “Climb… climb… climb… climb…”
02:13:40 (Bonin) “But I’ve had the stick back the whole time!”
02:13:42 (Dubois) “No, no, no… Don’t climb… no, no.”
02:13:43 (Robert) “Descend… Give me the controls… Give me the controls!”
Robert takes control and finally lowers the nose, but at that moment a new
hazard warning sounds, telling them the surface of the sea is fast
approaching. Robert realizes the ghastly truth – that he hasn’t enough
height to dive to pick up speed. The flight is doomed.
02:14:23 (Robert) “Damn it, we’re going to crash… This can’t be happening!”
02:14:25 (Bonin) “But what’s going on?”
The captain, now acutely aware of the aircraft’s pitch, has the final word:
02:14:27 (Dubois) “Ten degrees of pitch…”
There the recording ends.
Mercifully, data recordings and impact damage on debris confirm the Airbus was
still more or less level when it hit the sea. Some of the passengers might
have dozed throughout the descent; others may have attributed it to violent
buffeting. Those in window seats would have seen only darkness. There is
reason to hope that there was not too much panic on board, but this is small
consolation.
It seems surprising that Airbus has conceived a system preventing one pilot
from easily assessing the actions of the colleague beside him. And yet that
is how their latest generations of aircraft are designed. The reason is
that, for the vast majority of the time, side sticks are superb.
“People are
aware that they don’t know what is being done on the other side stick, but
most of the time the crews fly in full automation; they are not even
touching the stick,” says Captain King. “We hand-fly the aeroplane ever less
now because automation is reliable and efficient, and because fatigue is an
issue. [The side stick] is not an issue that comes up – very rarely does the
other pilot’s input cause you concern.”
Boeing has always begged to differ, persisting with conventional controls on
its fly-by-wire aircraft, including the new 787 Dreamliner, introduced into
service this year. Boeing’s cluttering and old-fashioned levers still have
to be pushed and turned like the old mechanical ones, even though they only
send electronic impulses to computers. They need to be held in place for a
climb or a turn to be accomplished, which some pilots think is archaic and
distracting. Some say
Boeing is so conservative because most
American pilots
graduate from flying schools where column-steering is the norm, whereas
European airlines train more crew from scratch, allowing a quicker
transition to side stick control.
Whatever the cultural differences, there is a perceived safety issue, too.
The
American manufacturer was concerned about side sticks’ lack of visual and
physical feedback. Indeed, it is hard to believe AF447 would have fallen
from the sky if it had been a Boeing.
Had a traditional yoke been installed
on Flight AF447, Robert would surely have realised that his junior colleague
had the lever pulled back and mostly kept it there. When Dubois returned to
the cockpit he would have seen that Bonin was pulling up the nose.
There is another clever gizmo on the Airbus intended to make life simpler for
the pilots but that could confound them if they are distracted and
overloaded.
Computers can automatically adjust the engine thrust to maintain
whatever speed is selected by the crew. This means pilots do not need to
keep fine-tuning the throttles on the cockpit’s centre console to control
the power.
But a curious feature of “autothrust” is that it bypasses the
manual levers entirely – they simply do not move. This means pilots cannot
sense the power setting by touching or glancing at the throttle levers.
Instead, they have to check their computer screens. Again
Boeing have
adopted a different philosophy. They told the Telegraph: “We have heard
again and again from airline pilots that the absence of motion with the
Airbus flight deck is rather unsettling to them.” In Boeing’s system the
manual handles move, even in automatic mode.
All the indications are that the final crash report will confirm the initial
findings and call for better training and procedures. With the exception of
Air France, which has a vested interest in avoiding culpability,
no one has
publicly challenged the Airbus cockpit design. And while
Air France has
modified the pitots on its fleet, it has said nothing about side sticks.
It is extremely unlikely that there will ever be another disaster quite like
AF447.
Crews have already had the lessons drummed into them and routine
refresher courses on simulators have been upgraded to replicate AF447
high-level stalls. Airbus has an excellent safety record, at least as good
as Boeing, and
the A330 is an extremely trustworthy aircraft. Flying is
easily the least dangerous way to travel, far safer than a car. But while
more of us take to the air each year,
a single crash is enough to damage
confidence.
Critics of side sticks may now argue that Airbus should return to the drawing
board.
A feature designed to make things better for pilots has
unintentionally made it harder for them to monitor colleagues in stressful
situations. Yet there is no sign that the inquiry will call for changes to
the sticks and Airbus remains confident about the safety of its technology.
It will resist what it regards as a retrograde step to return to
faux-mechanical controls. The company is unable to speak openly during the
investigation, but a source close to the manufacturer says:
“The ergonomic
systems were absolutely not contrived by engineers and imposed on the pilot
community. They were developed by pilots from many airlines, working closely
with the engineers. What’s more, it has all been tested and certified by the
European Aviation Safety Agency and regulators in the United States, and
approved by lots of airlines.”
As Captain King points out,
a belief in automation and the elegantly simple
side sticks in particular, is
integral to the Airbus design philosophy:
“You
would have to build in artificial feedback – that would be a huge
modification.”
A defender of Airbus puts it thus:
“When you drive you don’t look at the
pedals to judge your speed, you look at the speedometer. It’s the same when
flying: you don’t look at the stick, you look at the instruments.”
There is a problem with that analogy. Drivers manoeuvre by looking out of the
window, physically steering and sensing pressure on the pedals. The
speedometer is usually the only instrument a motorist needs to monitor.
An
airline pilot flying in zero visibility depends upon instruments for
direction, pitch, altitude, angle of climb or descent, turn, yaw and thrust;
and has to keep an eye on several dozen settings and lights. Flying a big
airliner manually is a demanding task, especially if warnings are blaring
and anxiety is growing.
Multimillion-euro lawsuits could follow any admission of liability and it is
certainly preferable from Airbus’s point of view that
Air France should
shoulder the blame for the night when AF447 plunged into the void.
However, no one would suggest that, when it comes to the aircraft we all rely
on every day,
commercial considerations should come anything but a distant
second to safety.
