Risk register · entry
Q3 · EngineeredAir France Flight 447
Three iced sensors handed the jet back to the crew, who held the nose up all the way down.
Tightly coupled systems where one small fault cascades and takes down the whole machine.
Why this room
The event sits in q3 because a small, transient fault in one sensor class propagated through a tightly coupled flight-control and crew-interface architecture into total loss of the aircraft. Obstruction of the Pitot probes by ice crystals lasted under a minute, but it invalidated airspeed, which automatically disconnected the autopilot and autothrust and reconfigured the flight controls from normal law to alternate law, removing the envelope protections the crew had been trained to rely on, while simultaneously producing an ECAM cascade and a stall warning that later cut out because the airspeed data had become invalid. The coupling is the mechanism: the sensor fault, the control-law reconfiguration, the warning logic and the crew's diagnostic model were not independent layers but a single chain, and the aircraft was handed back to the crew at the moment its instruments were least trustworthy.
The record
- All 228 people on board were killed: 12 crew (3 flight crew, 9 cabin crew) and 216 passengers, on 1 June 2009, aboard Airbus A330-203 registration F-GZCP.certain
- The stall warning sounded continuously for 54 seconds and then stopped because all recorded airspeeds had become invalid; at that point the aircraft was at about 35,000 ft, the angle of attack exceeded 40 degrees, and the vertical speed was about -10,000 ft/min.certain
- The autopilot and autothrust disconnected at 2 h 10 min 05 and the recordings stopped at 2 h 14 min 28, giving about four minutes and twenty seconds from the loss of airspeed to impact; the last recorded vertical speed was -10,912 ft/min with a pitch attitude of 16.2 degrees nose-up.certain
- The BEA studied seventeen earlier events that occurred in conditions similar to AF447; in almost all of them, crews who heard the stall warning considered it surprising and irrelevant.certain
- The first batch of replacement Thales C16195BA Pitot probes arrived at Air France on 26 May 2009, six days before F-GZCP crashed; the accident aircraft was still fitted with the original C16195AA probes.certain
Sources
The book
This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.
Join the waiting list