Clouds, Computers And Composites: The New Crisis In Civil Aviation

The recent loss of Air France Flight 447, an Airbus A330-200, has raised many doubts among the flying public and even some aviation professionals about the safety of the newest generation of passenger airplanes. These new airliners have composite materials replacing metal for many structural elements and control surfaces, and they are reliant on computer-controlled flight and navigation systems.

The impetus for developing this new generation of airliners is the need to improve fuel economy so as to maintain the profitability of the passenger air transport industry. Between 1986 and 2001, the world price of crude oil remained steady at near $22 a barrel. From 2002 to 2008, the world price of crude oil rose steadily from $25 to $95 a barrel (the prices quoted are rough averages, and in 2007 dollars). Modern airliners that are lighter and stronger than their older-generation all-metal size equivalents can carry more payload with less fuel consumption, and this translates to economic sustainability.

The quest for a more efficient airliner began with the first example of the type, Igor Sikorsky’s S-22 of 1913, the Ilya Muromets, a four engine biplane with an enclosed cabin for 16 passengers. Russia’s military needs in WW1 swallowed up the commercial potential of the S-22, and the production was shifted to bombers. The post-war rebirth of commercial aviation began with the Farman twin engine biplane transport of 1919, the F-60 Goliath, seating 14 passengers. Since then the quest for “better, faster and cheaper” passenger aviation has never stopped.

In 1972, Airbus introduced its A300, the first twin turbofan widebody air transport. The Boeing Commercial Airplanes company introduced its first widebody twin turbofan airliner, the 767, in 1981. Airbus chooses to be an airplane manufacturer that leads the industry in the application of engineered materials (composites) and computer-controlled aviation. Boeing is an airplane manufacturer that seeks to maintain its reputation for robust, reliable and increasingly efficient designs, which it gained early in its history with airplanes like the revolutionary 247 of 1933, the first truly modern airliner (all-aluminum monoplane of semi-monocoque construction with cantilever wings, wing flaps, retracting landing gear, trim tabs, autopilot, and deicing boots for the wings and tailplane).

Airbus and Boeing are today’s main competitors for new airplane orders worldwide. As noted earlier, it is the cost of fuel that drives the economics of commercial air transport, and in turn the replacement of older aircraft with newer models. The competing demands of safety, reliability, strength, carrying capacity, volumetric efficiency, speed and fuel economy drive airplane designers toward a convergence of characteristics, so that today both Airbus and Boeing airliners look, sound and feel largely the same to most passengers.

Each iteration of a manufacturer’s model type will have a higher proportion of weight-saving composite material, and a more extensive array of electronic and computer systems. How and where composites and computers are used by Airbus and Boeing may be quite different between their competing models of comparable type, but inevitably both manufacturers increase their use of both composites and computers, to remain competitive. The Airbus A330 and A340 series of airplanes, introduced in 1992 and 1993, and their classmate the Boeing 777, introduced in 1995, will be replaced by the Boeing 787 Dreamliner, set for introduction in 2010, and the Airbus A350, set for introduction in 2013. Both the 787 Dreamliner and the A350 are nearly all-composite airplanes. The 787 Dreamliner is 80% composite by volume, and by weight it is: 50% composite, 20% aluminum, 15% titanium, 10% steel and 5% other. By weight, the A350 is: 53% composite, 19% aluminum and aluminum-lithium, 14% titanium, 6% steel and 8% other.

The challenge facing the civil aviation industries today is to answer the questions raised by the mysterious loss of Air France Flight 447, and to convince the public that any problems that may be uncovered about the use of composites and computers in AF447 will be fully understood and solved before building and flying all-composite airliners with even more complicated computerized control systems.

So, it is no wonder that Boeing Chief Executive Jim McNerney defended electronic flight control technology and the Airbus A330, in an interview prior to the Paris Air Show: “The causes of the [AF447] accident are unknown, and I don’t think there is any link with a serious fault with the aircraft…the A330 is a reliable and proven aircraft.”1

The AF447 crisis in civil aviation may be similar to that of the two de Havilland Comet crashes of 1954. The Comet, introduced in 1949, was the world’s first passenger jet transport. During both January and April of 1954, de Havilland Comet airplanes broke apart at altitude while flying in clear weather over water. After the second crash, the fleet was grounded, many pieces were recovered from the seabed to assemble partial reconstructions, and many tests were conducted on another intact airframe. The cause of spontaneous disintegration was eventually found to be metal fatigue in the aluminum alloy used for the skin, by the cumulative effect of many cycles of cabin pressurization and de-pressurization.

The changes in design, materials and manufacturing techniques needed to solve the problems of the de Havilland Comets of 1949-1954 were used to produce an improved Comet, which returned de Havilland to passenger aviation in 1958. However, those same lessons had already been divined by Boeing to produce the 707, their first commercial jet transport, which was also introduced in 1958 and immediately went on to dominate passenger air transport through the 1960s.

If the air transport industries fail to fully resolve the AF447 mystery, then a portion of the public will assign an apprehensive image to the coming generation of composite computer-controlled air transports, a psychology we could think of as “’54 Comet dread,” as opposed to “’60s 7-0-7 optimism.”

AF447 In The Clouds

In the early pre-dawn hours (~2:15 UTC) of 1 June 2009, Air France Flight 447 from Rio de Janeiro to Paris fell out of the sky into the Atlantic Ocean near the equator about midway between Brazil and Senegal, with the loss of all 228 people aboard. The aircraft was one of the most modern, a dual engine Airbus A330-200.

(UTC is Coordinated Universal Time, which replaced Greenwich Mean Time in 1964 and is defined for the time zone straddling much of 0 degrees longitude. There are 24 time zones each generally of 15 degrees longitude, but there are numerous deviations of time zone boundaries.)2

The accident occurred after the airplane had flown over 90% of its planned northeast-directed transect of 227 km through the width at mid length of a mesoscale convection system (MCS), a cluster of storms 800 km long east to west, and 160 km wide north to south.3

The last radio message from the crew of AF447 was a routine notification at 1:33 UTC that the flight at 35,000 feet (10,671 m) along oceanic high altitude route UN873 had reached waypoint INTOL, near the outer boundary of airspace monitored by radar from Brazil. The pilots of AF447 expected to reach waypoint TASIL, near the edge of airspace radar-monitored from Senegal, in 50 minutes (by 2:23 UTC), a distance of 663 km between waypoints. A mid Atlantic gap of at least 500 km exists between the limits of Brazilian and Senegalese air traffic radar surveillance.4

Between about 1:46 UTC to 1:56 UTC, AF447 flew through the western fringe of the top of a storm that reached to between 35,000 feet (10.67 km) and 40,000 feet (12.2 km). It seems AF447 had shifted somewhat to the left, or westward, from its planned flightpath in order to avoid the brunt of this storm, and in anticipation of weaving between storm cells ahead. Thunderstorms in the tropics are usually very localized, of short duration, and produce abundant rainfall. They can develop so quickly that a Paris-bound flight 4 hours out from Rio de Janeiro might encounter an active storm cell over a patch of ocean that had been cloudless prior to takeoff. This is why airplane weather radar had been developed, to alert pilots of weather threats ahead, and to guide their weaving between active storm cells when they became unavoidably embedded in weather systems with numerous storms. After crossing about 42 km of clear airspace, AF447 entered the main MCS thunderstorm cluster, at about 1:59 UTC.

A sequence of satellite images of the MCS cluster show the large 800 km by 160 km (roughly) cloud mass with its variegated edge, drifting, evolving and fragmenting during that day. These images show the merged shape seen from above of the laterally spreading “anvil” tops of the many individual storm cells in the cluster. The updrafts in these cells had sufficient energy to push moisture up to between 40,000 feet (12.2 km) to 56,000 feet (17.1 km). Moisture that rises into the base of MCS clouds, perhaps near 3281 feet (1 km) at 20 C (68 F), can be chilled by strong updrafts to arrive at -40 C (-40 F) at the 10.67 km cruising altitude of AF447, and continue rising and chilling to as low a temperature as -80 C (-112 F) at 17 km elevation. This storm cluster was typical, not unusual, for the location and time of year.

AF447 proceeded northeast through the MCS cluster, guided by its weather (moisture, rain, hale) radar along a corridor of mild radar reflectivity (and of anticipated least relative ‘storminess’), about equidistant between a strong cell to the west and the strongest cell of the moment, which was about 30 km east. About 8 minutes after entering the MCS system (2:07 UTC), AF447 began penetrating what was probably the most energetic part of the storm cluster along its flightpath.

At 2:10 UTC, the first of a series of automated signals was sent by AF447’s onboard computerized maintenance system, via satellite, to Air France computers in Paris logging maintenance information. The series of automated messages had a combined time span of 1 minute and occurred until 2:14 UTC; 5 failure reports and 19 warnings were transmitted. The earliest automated messages reported on the failure of the Pitot Tube sensors, which measure the airspeed of the airliner and provide an estimate of altitude based on the static pressure of the atmosphere. Subsequent messages in the initial burst indicated that the auto-pilot (automatic ‘steering’) and auto-thrust (automatic ‘gas pedal’) systems had been disengaged, the collision avoidance system (to detect other nearby airliners) had a fault, that the flight control computers (three for redundancy) had shifted to an “alternate” mode where they made fewer automatic adjustments to the airplane’s control surfaces, and placed fewer limits on the range of manual inputs by the pilots that would be implemented as motions of the control surfaces (ailerons, rudder and the many types of flaps).5

From 2:11 UTC to 2:14 UTC, messages indicated the failure of the gyroscopes (air data inertial reference system, ADIRU, used to provide the artificial horizon orienting the sense of ‘up,’ ‘down,’ and ‘level,’ essential during nighttime) and resulting faults in the instrument panel displays (screens and electronic images instead of mechanical dial gauges); there was disagreement between systems that interpreted air data (such as for airspeed and angle of attack of the wings into the airflow); that a fault had occurred in the flight control computer system (that transmits commands to the hydraulic actuators that physically move control surfaces); that a fault had occurred in the computer system that captures and processes pressure and electrical outputs from air and motion sensors that supply data; and finally, a “cabin vertical speed warning” indicating a rapid loss of cabin air pressure, due to either a rapid descent or a breaching of the cabin shell.

AF447 may have entered its period of most severe jolting, buffeting and external cooling near 2:07 UTC, when it began crossing the core of the MCS cluster between its most active cells. Some as yet unknown excessive structural strain — perhaps exacerbated by material embrittlement or loss of plasticity and cohesion due to excessive cooling, such as by micro-strains induced by the expansion of trapped moisture freezing inside composite materials — may have been delivered by turbulence and initiated the subsequent fragmentation of the aircraft.

Pressure sensor icing sustained during at least the three minutes prior to 2:10 UTC seems to have initiated the cascade of air data (speed, pressure, altitude and attitude) processing and instrumentation failures, and contributed to the growing uncertainty of the decision-making electronic processing for the navigation and flight control systems.

Pilots rank their priorities during flight, especially in emergencies, as: “aviate, navigate, communicate.” The pilots of AF447 would be working first to keep their airplane at a proper speed: fast enough to stay aloft at the given elevation and weight of the airplane, and not too fast to damage the structure because of excessive pressure differences produced by airflows near the speed of sound, and by excessive structural stresses induced by the alternating jolts of updrafts and downdrafts in turbulent air spaces. Given that the aircraft remains aloft and is not being rattled to pieces, the next priority is to point it in a safe direction, for example away from active thunderstorm cells, and along the best route to a safe landing. The third priority is to communicate the status of the flight to air traffic controllers, a useful task as long as it is not a distraction from essential aviating.

Troubleshooting a torrent of error messages from a computerized flight control system to then compose a radio report for air traffic controllers is not a sensible allocation of attention during an emergency to control an airliner in a storm. We can understand why the crew of AF447 might not send any radio messages during their 3 minutes (and possibly as much as 11 minutes) of weaving between the storm cells and riding the waves of turbulence, before the first automated alarm of trouble was transmitted at 2:10 UTC. At this point, AF447 had crossed 154 km of the MCS cluster, the last 42 km of which were probably the roughest. During the next 4 minutes, when the automated messages were sent, the flight probably travelled 56 km. At 2:14 UTC, AF447 was about 2 to 3 minutes (28 km to 42 km, at 14 km/minute) from exiting the northern edge of the MCS cloud system, and it sent its last transmission.

AF447 Into The Sea

The search for AF447 began at 2:23 UTC. Brazilian air traffic controllers called their Senegalese counterparts when they failed to receive the expected confirmation that AF447 had announced itself to Senegal by radio, as required upon entry to a new airspace. The Brazilian Air Force dispatched search planes, a Spanish maritime patrol plane searched southwest from the Cape Verde Islands, and the search effort quickly expanded in the following days to include Brazilian naval vessels, cargo ships within the search area, French military planes and ships, and satellites.6

Fernando de Noronha is an archipelago of 21 islands 354 km (220 miles) northeast from the eastern tip of Brazil. AF447 flew past (~1:18 UTC) and to the west of Fernando de Noronha on route to waypoint INTOL at 565 km (351 miles) from the coast. At about 2:44 UTC, the pilots of a TAM Airlines flight from Europe to Brazil reported observing “orange dots” on the surface of the ocean — burning wreckage? — when they were approximately 1300 km (808 miles) from Fernando de Noronha. This would put them about 515 km (320 miles) northeast of the last known position of AF447, 30 minutes after its last transmission.

If AF447 broke apart at 2:14 UTC, some wreckage might fall as far as 130 km from this location (an estimate based on the debris scatter from China Airlines Flight 611, a Boeing 747 that broke apart at 35,000 feet in 2002). Powered flight by AF447 beyond 2:14 UTC was unlikely since there were no subsequent automated messages (presumably, all power generation, controlled motion and thrust had ceased). If the “orange dots” were burning AF447 wreckage, then the TAM pilots had the ability to see glows no less than 380 km ahead of them. So, the “orange dots” sighting is probably unrelated.

The Brazilian Air Force spotted floating debris 650 km (404 miles) northeast of Fernando de Noronha on 2 June, the next day a Brazilian Navy patrol boat arrived in the area. On 6 June, bodies and debris from AF447 were recovered. On 8 June, the vertical stabilizer and rudder of the Airbus A330-200 was found and recovered.7

By 26 June, when the search for human remains ended, 51 bodies and 600 pieces of debris had been recovered from two debris fields about 80 km (50 miles) apart on the surface of the ocean. The finds were concentrated along a 150 km track almost due north from the last known position of AF447; debris (but apparently not bodies) was scattered as far as 50 km east and west of this track. The tendency of flat pieces of debris to glide haphazardly as uncontrolled airfoils would scatter them much further from the last heading of the airplane than more compact objects, which developed no aerodynamic lift.8

Autopsies revealed the victims to have fractured limbs and hips, no seawater in their lungs, no signs of burning or charring, and some had little or no clothing. The presumptions are that AF447 broke up at altitude without a fuel explosion causing a cabin fire, that the victims were ejected from the wreckage at high altitude, which sucked out their breath and quickly made them unconscious, that the high speed air blast tore off their clothing, and that their bodies were not fragmented on hitting the sea because they fell more slowly individually than if they had been attached to a much heavier mass like a wrecked fuselage.

An explosion and fire in the lower fuselage (below the floor of the passenger cabin, in the center fuel tank or the cargo holds) cannot be ruled out because the passengers would be shielded from such a blast and fire, and the airplane still disintegrate in flight. Recovery of a sufficient number of parts from the lower fuselage will resolve the question of fire (no evidence yet). The recovery of parts has so far been restricted to those that float, so a great deal of plastic and composite material, and not so much metal.9

The official investigators are anxious to find the cockpit voice recorder and the flight data recorder (the “black boxes” which are actually orange), which lie somewhere on the bottom of the Atlantic Ocean. To help locate them, each is equipped with a sonic emitter (“pinger”) with a range of 2 km. The sea floor is between 2.5 km and 4 km deep below the suspected crash site, and is quite mountainous since it is close to the Mid-Atlantic Ridge (the boundary from which tectonic plates originate and spread eastward and westward). The recorder cases can withstand pressure down to a depth of 6 km, and the pingers are designed to operate for at least 30 days, after which their signals fade.

Questions And Speculations

The sequence of known events for AF447 has been laid out in the sections above. The distances and UTC times quoted are either from news accounts or my simple calculations, which do not account for factors such as the curvature of the Earth and headwinds, which pilots, navigators and meteorologists use to arrive at precise numbers. Unless Airbus can make a more detailed analysis of AF447’s automated messages, and until more parts of the airplane are recovered and analyzed, especially the voice and data recorders, we are left without more facts. So, now we ask 5 questions and speculate.

Question 1. AF447 flew into a line of thunderstorms and was destroyed. Is this a case of pilot error?

The ranking for safety of nine modes of transportation on the basis of deaths per billion journeys (the basis of insurance rates) is: bus (4.3), rail (20), van (20), car (40), foot (40), water (90), air (117), bicycle (170), motorcycle (1640).10

The primary causes for the complete loss of commercial jet aircraft in accidents during 1996 through 2005 were found to be the: flight crew (55%), airplane (17%), weather (13%), miscellaneous other (7%), air traffic control (5%), maintenance (3%).11

Airline travelers demand rapid transit across vast distances with the punctuality of well-run train services. They also crave comfort, meal services and entertainment during their trips. Personal safety and incident-free travel are usually taken for granted, but highly prized when thought about. And, passengers want it all cheap. Everything about passenger airplane design and airline operations is focused on producing this type of experience for the flying public. An accident like that of AF447 is simply an unpleasant reminder that nature may not always be as conveniently benign as we had assumed and planned for in the design of our passenger airplanes and the operations of our air travel industry. Our margins may be too thin because we are in too much of a hurry, and too cheap.

Passenger airplanes are designed to withstand forces comparable to about 2 to 2.5 times their maximum loaded weight (2 to 2.5 times their total mass times the constant of gravitational acceleration, g = 9.81 meters per second-squared). We could design passenger airplanes that are essentially unbreakable, like the F-35 fighter now under development, which can be stressed to 8 or 9 g, and uses composite materials for its wing and nacelle skins. However, ‘unbreakable’ passenger airplanes would be much smaller and slower than the 200-500 seat turbofan-propelled transports we are used to. They would be more like the Lockheed P-3 Orion that has been used as a “hurricane hunter,” flying through violent storms to gather meteorological data. The P-3 Orion (1962-1990) is a maritime patrol plane developed from the Lockheed Electra passenger airplane (1957-1961), which could carry about 120 people. The four engine turboprop P-3 Orion has an operational limit of 3 g, but the plane was shown to survive a 7 g stall recovery in 2008; see the photo of the wing.12

Compare the photo of the overstressed P-3 Orion wing to photos of a recovered spoiler (wing flap) from the AF447 airplane.13

We could restrict air travel to times and routes of guaranteed clear weather, but then direct flights between Brazil and Europe would be impossible because planes would be barred from crossing the approximately 700 km wide Intertropical Convergence Zone (ITCZ), a permanent band of thunderstorms that circles the globe near the equator. Flights are often grounded or diverted to alternate destinations when dangerous weather develops, but neither the flying public nor the airline operators are eager to expand this practice to the point of avoiding any possibility of contact with rain, snow, ice, lightning, turbulent air and birds.

So, on the basis of accepted practice, the Captain of AF447, Marc Dubois, did not make an error to set off on his fateful flight. It remains to be determined if he and his two assisting pilots made the right decisions in maneuvering the airplane through the atmospheric conditions they encountered, and in responding to the technical problems that erupted.

There are three possibilities of root causes here: human error, systemic error, or natural catastrophe. If the pilots made mistakes, then the information on the voice cockpit recorder and the flight data recorder will probably reveal them (if the recorders can be found). If the piloting was flawless, then the accident could be a systemic failure, a result of inadequacies in: airplane performance, design, maintenance, certification (the performance and safety standards we choose to adhere to, through government regulation), and the operational practices of the air travel industry.

The third possibility, that an unusual and rogue natural force overwhelmed AF447 and could not have been anticipated, lets humanity off the hook. The current best guess for an AF447 natural catastrophe is wind shear, a large and abrupt change in wind velocity experienced in crossing an invisible plane through the atmosphere. But this excuse is weak. Wind shear produced by the updrafts and downdrafts in thunderstorms is now monitored by onboard Pulse-Doppler weather radar. Clear air turbulence (CAT) is a form of cloudless wind shear that is difficult to avoid because it cannot be detected visually nor with radar (a laser range-finding and reflectivity-measuring system called Doppler LIDAR is needed). CAT is created near the four high-altitude jet streams that ring the earth, in the wind shadows of mountain peaks, and as the wake turbulence of large airplanes. AF447 was far from all of these.

The Captain of AF447 was 58 and had 21 years of piloting for Air France. He had undoubtedly flown Airbus planes between Rio de Janeiro and Paris many times. On the 31st of May, he probably saw nothing unusual in the weather predicted along his route (see Figure 4 in Reference 3, and the associated maps of higher elevation winds). He expected the usual thunderstorms near the equator and would be sure to monitor his weather radar during flight, to adjust his course as needed to evade active storm cells that might develop along his intended track.

The northern hemisphere’s trade winds move southwest, and the southern hemisphere’s trade winds move northwest; they converge in the Intertropical Convergence Zone (ITCZ). The converged masses of heavily laden moist air then rise to great height (17 km) before diverging into a northward flow north of the equator, and southward flow south of the equator. These high-altitude flows toward higher latitudes sink to low elevation at 30 degrees north and south latitude, and then skim along the surface of the Earth westward and toward the equator, as the trade winds. These toroidal patterns of atmospheric circulation are called Hadley Cells. The ocean regions of the ITCZ were called “the doldrums” by early European mariners because of the typical absence of surface winds. The tropical heat and vertical trend of atmospheric circulation within the ITCZ continuously spawns thunderstorms, and these can group into squall lines or clusters now called mesoscale convection systems (MCS). The updrafts in these storms can reach 17 km, well past the usual 10-11 km cruising altitude of airliners. Pilots experienced at transoceanic flight, like those of AF447, would understand the nature of the air spaces they intended to cross, and plan accordingly.

At least 12 other airplanes passed through the area of AF447’s disappearance during the period from 3 hours before, to perhaps 1 hour after 2:15 UTC. It is likely most were Airbus airplanes since the carriers were Air France (four, besides AF447), Air TAM (three), Air Iberia (two), Lufthansa (two) and British Airways (one). One Air France plane left São Paulo bound for Paris on 31 May 2009 at 22:10 UTC after AF447 left Rio de Janeiro at 22:03 UTC that same day, so they must have been as close to each other on the same route as allowed by regulations for safe separation. Several of the other planes passed AF447’s last known position within 30 minutes of the disappearance. None reported anything unusual (one passenger on a flight 40 minutes behind AF447 recalled a half hour of turbulence near the equator).

The effects causing AF447 to fall from flight were extremely localized and short-lived.

Question 2. Pitot Tubes measure airspeed, but on AF447 they failed due to icing. Did a loss of speed data cause the flight control computers to issue bad commands, which led to a loss of control in bad weather?

A Pitot probe is a small tube facing into the airflow from the nose of an airplane; it’s purpose is to sense ram pressure, which is interpreted for speed. Obviously, the speed sensor fails if the tube becomes plugged. It has to be maintained and cleared of insect nests, insects impacted during flight through swarms, and dirt; it has to drain off rainwater without distorting the pressure reading; and it has to be equipped with a heater to melt impacted ice.

A number of Airbus planes have had problems with Pitot probes that failed due to icing, and the entire A330 and A340 series have been undergoing retrofits. The AF447 Airbus A330-200 did not yet have the improved Pitot tubes, but since its loss Air France has speeded the retrofitting of its Airbus fleet, and all carriers are now quite focused to complete this task. There have been many recent articles in the news and in pilot forums like, about the Pitot tube problems on Airbus planes.

The Airbus A330 uses three Pitot tubes, and its air data computers select the reading from any two that agree. None agreed on AF447 (at 2:10 UTC) so the flight control system informed the pilots that speed data was unreliable — absent — and it shifted flight control from the fully automatic mode to an alternate mode, which is comparable to the amount of computerized flight control on a Boeing 777.

Airbus pilots have a back-up procedure for estimating speed on the basis of other instruments (angle of attack and engine power) in case their airspeed indicators fail. This procedure is simplified to about three simple control settings (for thrust), for low, medium and high altitude; and which are to be committed to memory for use in emergencies.14

The computerized flight control system does not blindly use inconsistent data to compute bad commands to control surface actuators. Instead, it flags the discrepancy and turns control over to the pilots, and the pilots have their back-up procedure for flight with unreliable speed data. The loss of speed data alone is not sufficient to cause the loss of flight control.

Question 3. Did a loss of speed data cause the AF447 pilots to overspeed the airplane to the point of structural damage, because they believed they were preventing a stall?

An airplane must move fast enough to generate the aerodynamic lift force that holds its weight aloft. The stall speed is the minimum for flight. Stall speed increases with altitude because the atmosphere becomes thinner. The stall speed for the AF447 Airbus A330-200 at 35,000 feet was 759 kph (472 mph).

Airliners are designed to fly at high subsonic speeds because supersonic travel requires much higher fuel consumption. They have swept wings that remain behind the curved pressure wave the airliner’s nose plows before it, and which becomes a shock wave when the airplane moves at or above the speed of sound.

Consider a straight-wing airplane moving at sonic to low supersonic speed. The outer parts of the wings will extend ahead of the curved bow wave, and produce additional shock waves. Because neither flight speed nor incoming air density and temperature are perfectly uniform, shock waves will oscillate about some mean position relative to the airplane, causing fluctuations in the distribution of pressure force on the aircraft surface. Also, shock waves that cross the surfaces of wings will cause the flow to separate, destroying the lift. Shock waves create drag, and more shock waves create more drag. Maintaining high speed against high drag requires large engines with high fuel consumption. Supersonic airplanes are equipped with very powerful engines to accelerate them quickly from the subsonic to supersonic regime.

The maximum speed for a subsonic airliner is set by the criterion of ensuring no localized sonic flows nor shocks. For example, flow scooting around the joint of a wing and the fuselage, or some bulge on the skin, might be locally faster than the average aircraft speed. That average must be kept below the point where the fastest localized flows are sonic. Besides ensuring a smooth attached flow over the skin of the airplane, the absence of shock waves ensures there are no abrupt changes in pressure from point to point along the airframe. Such jagged and fluctuating distributions of aerodynamic force would produce large stresses and torques on airframes, and require they be much more robust. Robust equals heavier equals smaller equals less payload equals more fuel consumption equals unprofitable civil air transport like the now-retired Concorde. The upper speed limit for AF447, at 35,000 feet in clear weather, was 913 kph (567 mph).

The speed of sound depends entirely on the temperature of the air, and as this cools with elevation (below the stratosphere where most civil aviation occurs), the speed of Mach 1 decreases with height. Since stall speed increases with height, an altitude is reached beyond which a given airplane cannot fly. This is called the “coffin corner.” A pilot cruising near this altitude has only a narrow window of safe speed. This pilot must be alert to stay ahead of a stall while not speeding too quickly and subjecting the airplane to large fluctuating forces pounding and ultimately breaking it. AF447’s speed window at 10.67 km altitude was 759-913 kph (472-567 mph, Mach 0.72-0.86).

AF447’s nominal cruising speed of 871 kph (Mach 0.82) was relative to headwinds of about 28 kph, so its speed relative to the earth (ground speed) was 843 kph (524 mph).

If AF447 had only lost its speed data the pilots would used their back-up speed scale (BUSS), described earlier, and the flight would have continued. There had to be additional problems to rob the pilots of the readings on which the BUSS relied, or to distract them from aviating. Additional problems could be natural: the ‘act of god’ catastrophic updraft or turbulence that went undetected by all and disappeared with AF447; the problems could be multiple and simultaneous aircraft systems failures; and the additional problem could be the pilots’ own mistake in becoming absorbed in trying to interpret the cascade of error messages and to reboot their computer systems, and so lose sight of their drifting airspeed until it was too late.

The mystery at this point is that nature does not seem to have been unusually unkind at that time and place, it is hard to believe the airplane would have multiple systems failures and suffer a catastrophic disintegration without some overwhelming external force being applied, and it is hard to believe the flight crew was anything other than highly competent, experienced, prepared and alert.

Question 4. Can lightning more easily penetrate the composite panels of the Airbus A330-200, and this effect initiate the problems of AF447: by causing an electrical fault disrupting computer systems, or sparking a fire or fuel explosion?

The first 20 years of aviation were dominated by composite airplanes, which were made of resin-painted canvas-covered wood frames, a construction method used earlier for canvas-covered canoes. Metal airplanes were built to meet the demands of higher speeds, larger load capacity and greater reliability. Aside from its aerodynamic and mechanical functions of producing lift, reducing drag, and containing cabin pressure, the surface of a metal airplane has the electromagnetic function of acting as a Faraday Cage, shielding the interior (passengers and crew, cargo, fuel system, electronics and control systems) from any external electromagnetic threats, such as lightning.

Electromagnet waves and arcs (like lightning) will easily penetrate composite panels unless they contain layers of metal foil or metallic fibers, which are connected to grounding points so as to short-circuit and bleed away incident electric currents. Composite panels designed for airplane skins must incorporate such metallic lamina to shield the aircraft from lightning, and to ensure that no external electromagnetic emissions can penetrate to sensitive electronic systems within the airplane and interfere with their operation (electrical noise shielding). Engineers are aware of these requirements and have standards (and regulations) to guide their design efforts.

The electronics and computer systems in airliners today are so complex and sensitive that the electromagnetic shielding has to be a critical part of the design of the airframe. Ideally, a new design is tested against real electromagnetic waves and electric arcs, and not just “virtually” with computer simulations, to verify the Faraday Cage performance of the structure. Since the average airliner experiences about one lightning strike a year, reality eventually weeds out the bad designs.

The fact of the automatic messages from AF447 shows that electrical power was available until at least 2:14 UTC that day, there were no indications of interruptions or surges.

Also, there was no indication that lightning occurred near AF447’s last known position during the time of its disappearance (based on NASA surveillance). Storms in equatorial oceanic regions exhibit an unusual lack of lightning, a fact motivating current meteorological research. See (3) for sources on this topic.

So, it seems lightning is a very unlikely contributing factor to the disappearance of AF447.

Question 5. Do composites degrade more easily and quickly than aluminum and steel, and are composite airplanes more fragile that all-metal airplanes?

The contemporary use of composite materials for aircraft structures is very new, and there is less than twenty years experience with them in the field. From the very studies that were used to devise these engineered materials, scientists learned about their weaknesses as well. Composites are fibrous or mesh layers (lamina) bonded together by a resin or cement matrix. Shock and cyclic stresses can lead to failure of the material by separation of layers — delamination.

Cyclic stresses can be from pressurization and de-pressurization, or cycles of temperature extremes that cause stresses by thermal expansion and contraction, or severe vibration and repetitive torquing. A composite panel may develop an interior separation that remains unnoticed for some time before the complete failure of the panel. The integrity of composite airliner panels must to be checked periodically, by visual inspection and acoustic probing (which might be tapping to hear a ‘funny’ sound).

In 2002, airplane mechanics working for the Federal Express delivery service discovered that the hydraulic fluid used in the actuators of an Airbus plane had dissolved some of the composite material of the rudder, causing a separation from control rods, and difficulties during flight. In 2005, a rudder removed for inspection revealed extensive delamination between its outer layer and its inner core; traces of hydraulic fluid were found between these layers in the area of separation.

These and other incidents of composite material-related rudder malfunctions on Airbus planes cast doubt on the ascription of pilot error as the cause of the American Airlines Flight 587 accident of 12 November 2001. An Airbus A300-600 just airborne and climbing crossed into the wake turbulence of a nearby Boeing 747; the first officer made aggressive rudder motions to keep the Airbus plane upright, and the rudder snapped off followed by the vertical fin, leading to a horrific crash into a residential neighborhood of Queens, New York City. What if the strength of the rudder and its joints to its actuators and axle had been seriously degraded earlier?

William John Cox has reviewed many incidents and accidents with Airbus planes in which the composite-material vertical stabilizer and rudder was a key factor. The strength of his doubts about composite rudders is reflected by the title of his article, “Should the Airbus Be Grounded?”15

The overall technical question that has to be answered about composite materials used in aviation is: what causes them to degrade during their service life, and how long is that service life? We can break down the overall question to types of sources of both sporadic and cyclic stress: aerodynamic (pressure), mechanical (vibration, torque, impact, shock), thermal (heated expansion and cooled contraction), chemical (surface reactions with gases and liquids found in aviation, the effect on bulk integrity by the absorption of moisture, gases, volatile organic compounds), electrical (corona and arc discharge effects on surface integrity) and radiative (ultraviolet light embrittlement).

There is no technical reason why composite-material aviation structures should be less safe than their metal counterparts. But, it may be that an equivalent degree of safety would require that composite panels, shells and structures be replaced more often than metal pieces, because the composites may degrade more quickly under the combined actions of the pressurization and deep cooling cycles of flight, the corrosive and embrittling effects of ozone and ultraviolet light, the dissolving and delaminating effects of hydraulic fluids and volatile organic compounds (fuel and solvent vapors), and the fracturing by impact with hail and other hard airborne grit.

The loss of AF447 underscores the need to answer these questions.

An Imagined Final Sequence

Assume AF447 flies into a patch of especially dense and especially cold fog whose supercooled droplets freeze on contact to rime ice, which clings tenaciously; 12 other flights miss as intense a fog freeze. Supercooled fog droplets are small and have low reflectivity to radar, pilots have to tilt their radar antennas down and turn up the gain to see the rain and hail at lower elevations ahead to infer a high concentration of ice crystals and supercooled fog above, assuming there is little horizontal wind shear so the high ice and fog have not moved laterally from their formative updraft and rainout downdraft. But, this can happen as the cloud’s anvil, so perhaps fog freeze is unavoidable if the flight is weaving between storm cells. Rime ice sticks on contact, accumulating into a solid mass with many air pockets. Twenty four steps of an imaginative sequence follow.

1. Gradual icing reduces the inlet areas of all 3 Pitot probes, uniformly. The angle-of-attack (AOA) sensor is a weathervane attached to a horizontal shaft at the side of the aircraft near its nose. The AOA measures the angle between the airflow and the longitudinal axis of the airplane. Assume the AOA vane also ices, swiveling gradually to higher angle. Both effects cause a gradual speed-up on auto-thrust (the airplane version of cruise control).

2. Pitot icing blockage becomes severe and non-uniform; a 50 kph discrepancy between probes is recorded.

3. The Pitot system fails at 2:10 UTC, auto-pilot and auto-thrust go to the “alternate” mode, which is comparable to the combination of automatic and manual control used on the Boeing 777. The rudder is no longer limited to only 5 degrees of deflection because the flight control programming presumes the pilots would need the freedom of greater motion to perform recovery maneuvers. The shift to alternate mode is not a failure of the automated system, but the response programmed for the situation.

4. The speed window (“coffin corner”) at 35,000 feet is 757-913 kph (Mach 0.72-0.86). The pilots had set auto-thrust to maintain a speed near 881 kph (Mach 0.83). They are fooled into thinking their present speed is about 834-850 kph because of the last presumably good speed readings they observed prior to the warnings of 2:10 UTC. They assume the current power settings are for this speed, when actually the speed has crept up to 913-929 kph without notice.

5. Arriving at excessive speed causes 1.3 g shaking, which is self-induced but they interpret as atmospheric turbulence. If they were really cruising at 881 kph (Mach 0.83) and had encountered turbulence, then they should have reduced their speed to 819 kph (Mach 0.77). Assuming this is their situation, they try reducing speed by using the ‘no airspeed data’ flying procedure. They throttle back a bit, guessing at a 16-32 kph reduction based on the combination of the AOA sensor (which is iced and showing too high an angle) and the power setting. They assume the power setting accounts for a higher headwind than is the case (because it seems high), and they want to be assured of avoiding a stall, so they actually only reduce power to slow down by 16 kph to 897-913 kph (a good thing, too!), imagining they are now flying at 819-834 kph.

6. The AOA system fails at 2:11 UTC. Either the vane stalk is frozen into position, or the 1.3+ g shaking from excessive speed has caused too many erratic and wide swings of the vane, and it has faced broadside into the flow and become heavily balled up in ice. So, speed guessing is now nearing impossible. They are at about 897-913 kph when they should be 819 kph, assuming turbulence; and there may actually be some real turbulence as well. The majority of the “turbulence” they are experiencing is really the buffeting effect of excessive speed caused by the erratic shock and pressure jumps along the fuselage, wings, tailplanes, vertical stabilizer and rudder during transonic cruise. At 2:12 UTC, air data discrepancies are flagged; perhaps icing and transonic flow (shock wave effects) prevent other measurements such as of total air temperature.

7. Swept-wing transports have a tendency to swing back and forth in a lateral rolling motion called a Dutch Roll. A combined yaw and roll make the nose point left and the right wing dip (or go into the opposite combination), which is countered by the ailerons to level the wings, and the rudder to steer back on track. But, the lag in response swings the plane past straight and level into a nose pointing right and the left wing down attitude. The Dutch Roll is an oscillation between control inputs and lateral swings. Part of the automatic flight control system is a yaw damper, a slight shifting of the rudder back and forth as needed to keep the airplane straight and level.

At 2:13 UTC, AF447 was flying at excessive speed, the surrounding atmosphere may have exacerbated flight instability by being turbulent, and the flight control system no longer limited rudder deflection to 5 degrees. Yaw damping became ineffective. Because of the 1.3+ g shaking and the shock-induced flow disruptions of transonic cruise, the responses to the deflections of the ailerons and rudder became erratic, and an amplifying Dutch Roll oscillation sets in.

8. A big tail swing right is countered by a rightward rudder deflection of greater then 5 degrees, and the combined moment (torque) to the right and the air resistance against the vertical fin (to the left) puts a greater then 2.5 g load on the vertical stabilizer, and snaps the entire fin-plus-rudder assembly off to the left.

9. The loss of the vertical stabilizer releases resistance to the rightward moment, and an instant angular acceleration of 3.5 to 5 g, or more, swings the tail rightward.

10. The rear pressure bulkhead in the fuselage has a pressure force directed rearward, from the pressurized cabin and cargo hold toward the unpressurized tailcone. During a rightward tail swing, this force points to the back and rightward. At the same time, the rightward moment acting on the tailcone puts a lateral force on it, which is to the left and increasingly back during the rightward swing. With the tail wagged right, the rear bulkhead is tilted forward on right side, backward on left side, and the resultant force on it is more or less straight back. This causes a rotation of the bulkhead so as to open its seam on the right side of the fuselage, breaching the pressure seal and allowing the cabin to de-pressurizes rapidly.

11. An automatic signal sent at 2:14 UTC announces cabin de-pressurization.

12. The unimpeded rightward tail swing sweeps the right wing square into the airstream while the airplane is near its maximum speed, about 881-913 kph (Mach 0.83-0.86). This swings the right wing leading edge forward at a higher relative speed than Mach 1, so it moves forward of the leading shock.

13. The shock extends along the middle chord of right wing, now angled more squarely into the flow, and causes flow separation behind it, with a complete loss of lift; shock stall.

14. The plane’s nose is yawed left in a rightward tail swing, the right side losses lift force while left keeps it, and the result is a sudden strong moment causing a rotation (perhaps 5 g) about the plane’s longitudinal axis: left side/wing up, right side/wing down.

15. The excessive right twist of the fuselage causes engine pylons to fail. Engine number 1 (left side) breaks off — cutting electrical power — rotating in an upward swing right, smashing into the bottom of the left wing near the wing root and trailing edge, and then smashing into and through the left side of the fuselage just past the left wing root.

16. Engine number 2 (right side) swings up and right to twist bottom-up through the right wing leading edge, outboard of the engine location, and the outer wing then snaps off by rotating about the rip, with a tip upward motion. Air blast through its underside blows off upper surface spoilers like the one recovered by the Brazilian Navy.

17. The tailplanes probably snap off at the same time as the engines.

18. The reduction in mass on the right side, relative to the left, gives a boost (less inertia and drag) to the rightward roll underway.

19. The rear section of fuselage twists off from its remaining right side connection with a leftward swing, and the tailcone section separates from it, tearing off from the right to left side of its pressure bulkhead seam.

20. The interior of the fuselage originally behind the wings experiences an air blast through its forward open section toward the tail end; many panels and weakly attached objects are blown out.

21. The still intact assembly of forward fuselage plus right wing stub plus left wing continues to roll completely over while also yawing back and forth, for several cycles. The wing experiences lift forces that make the entire body spin, like a maple seed pod, whose single airfoil causes it to gyrate during a swinging descent.

22. The angular force at the left wingtip and at the cockpit end of the fuselage are greatest, so the fuselage snaps apart aft of the cockpit and also ahead of the left wing root, while an outboard length of left wing also snaps off.

23. The sections of the airplane that fall are: the vertical stabilizer with its rudder (recovered by the Brazilian Navy), the tailcone (with or without tailplanes), the rear cabin section (probably further ruptured during descent by air blast), the engines, the right wing outboard of the number 2 engine location; then after a bit of ‘maple seed’ auto-rotating helicopter flight as a unit: the cockpit section of the forward fuselage, another length of the forward fuselage, an outer length of left wing and the wing root section of the fuselage with the remaining wing stubs.

24. The four sections of the cabin (the tailcone is a fifth fuselage section) guessed here might experience further air blast rupture and content ejection as they descend; and the large structural remnants hitting the water would then suffer collision fragmentation.

What’s Next?

Perhaps some day we will know the real sequence of events and apply its lessons to improve our aircraft, or modify our air transport habits.

To move beyond imagination we need more facts. If the voice and flight data recorders are ever recovered (lost under the ocean over a month at this point), then investigators will learn much more. The public may learn more soon because the French Investigation and Analysis Bureau (BEA) is set to issue an initial technical report on the 2nd of July.

  1. Boeing Backs Airbus on AF447. []
  2. Map of Time Zones. []
  3. Tim Vasquez, “Air France Flight 447, A Detailed Meteorological Analysis.” []
  4. Map, From INTOL To TASIL. []
  5. Air France Flight 447, Wikipedia. []
  6. Simon Hradecky, “Crash: Air France A332 over Atlantic on Jun 1st 2009, aircraft impacted ocean,” The Aviation Herald. []
  7. AF447 Airbus A330-200 Vertical Stabilizer And Rudder, Wikipedia. []
  8. BEA’s AF447 “Sea Search Operations,” (link “sea search operations” produces PDF file with maps). []
  9. Brazilian Air Force, Information On AF447, see “fotos.” []
  10. Air Safety, Wikipedia. []
  11. Aviation accidents and incidents, Wikipedia. []
  12. P-3 Orion At 7 g. []
  13. AF A332 Crash (F-GZCP) Part 16, ‘Recovered Spoiler‘:

    Reply 204, Pihero,
    Reply 205, KingFriday013,
    Reply 242, Guillermo. []

  14. Joelle Barthe, procedure for Airbus flight without airspeed data. []
  15. William John Cox, “Should the Airbus Be Grounded?“ []
Manuel Garcia, Jr. is an occasional writer who is always independent. His e-mail address is: Read other articles by Manuel, or visit Manuel's website.

7 comments on this article so far ...

Comments RSS feed

  1. Michael Kenny said on July 3rd, 2009 at 11:28am #

    It will be amusing to see what Mr Garcia’s point finally is! So far, he’s said nothing in as many words as possible! And, of course, there is no “crisis” in civil aviation! As for the composite materials argument, which he “pirated” from another author, that has now been torpedoed by the accident report, which reveals that the plane was intact when it hit the water. If you put that together with the recent spectacular ditching of a plane in the Hudson River without disintegration of the aircraft on impact, it seems that composite materials may well make planes more, and not less, solid! As for Boeing, did it really deserve to be painted as a backward firm, clinging to past glories and shying away from innovation? I’ve travelled on practically every type of Boeing aircraft and they strike me as perfectly good aircraft. (Is all this just a stunt to smear Boeing?)

    Finally, a further air crash has occurred since Mr Garcia’s first article. 125 people killed off the Comores. Yet, nobody is in the slightest bit worked up about them and certainly not Manuel Garcia (Junior!). 225 nice, white, French people are a “crisis in civil aviation”. 125 black (and Muslim!) people die and nobody gives a damn!

  2. Truman Prawd said on July 3rd, 2009 at 4:28pm #

    Michael Kenny said it all.

    Let me just add an anecdote from personal experience: In the seventies, my brother used to drive a small Fiat of the 12-series. In those days, Italian cars were renowned for rusting away fast in the wet and salty Dutch sea-climate. So brother had a lot to fix, especially body work – which he did with composites.
    When finally he had to bring this car to the scrapyard, large parts of its body were composites, not metal any longer. We took a sledgehammer and put both materials to the test. The metal dented and tore; the composites withstood our attacks with only some superfiial cracking in the paint job and the outer layers. We learned that lesson well! And so did European airplane and car manufacturers.

    Then, may I be so bold as to ask Mr. Garcia to improve his language and spelling? The flight was AF 447, not AF447; if ever you went on an airliner, you’d know that. Heated expansion and cooled contraction is gobbledygook: sounds impressive but is nonsense. So please, inform yourself well and write correctly.

    Which leads to a second question: What makes Mr. Garcia so knowleadgeable about this whole matter when the French are still conducting their inquest ?

    Cordially yours,

  3. Jeff White said on July 3rd, 2009 at 8:41pm #

    Unlike Michael Kenny, I don’t believe for one minute that the plane was intact when it hit the water. That kind of impact shatters the aircraft and the passengers alike into small pieces (compare Swissair 111, Sept. 2, 1998). It is also not consistent with the finding of dozens of relatively intact bodies and large pieces of airframe, as reported over the past few weeks.

    I smell cover-up.

  4. Manuel García, Jr. said on July 4th, 2009 at 9:44pm #

    MG, Jr. Comments to DV, 3 July 2009:

    James Ridgeway posted my e-mail to him commenting on the BEA report issued on 2 July. You can read it here (I included the web link to the BEA report):

    Comments on “Air France 447 Report”

    Since my article was finished, I’ve found interesting comments by pilots on situations similar to those in the beginning of my imaginative sequence. See this thread:

    Pitot Icing, Spillover, Flutter, FBW and Sailplanes,

    The first letter (7 June 2009), by LeoM was most enlightening. See the video he references (also noted here) exhibiting “flutter,” and imagine this occurring on an over-speeding wide-body jet:

    The last (15th) message on this page (26 June 2009) is quoted further below, and was also posted as Reply 72 on 2 July, by Airzim, at:

    AF A332 Crash (F-GZCP) Part 20

    The message is from Fxramper, who also describes his “A333 Faulty Air Speed Indicator” instrumentation problem, briefly, here (26 June 2009):

    NW #008, A333 Faulty Air Speed Indicator

    Fxramper’s message (quoted by LeoM and Airzim) follows after a short list of symbols, provided for your convenience.

    nm = nautical miles = 1.151 statute miles = 1.852 km
    HKG = Hong Kong (airport)
    NRT = Narita, Japan (airport)
    TAT = total air temperature (temperature of moving air when brought to a stop)
    kts = knots = nautical miles per hour = 1.151 mph = 1.852 kilometers/hour
    FL390 = flight level 39,000 feet
    FL410 = flight level 41,000 feet

    MESSAGE [posted 26 June 2009]:

    Well, I’m sure you have all heard of the Air France accident. I fly the same plane, the A330.

    Yesterday while coming up from Hong Kong to Tokyo, a 1700nm 4hr. flight, we experienced the same problems Air France had while flying thru bad weather. I have a link to the failures that occurred on AF 447. My list is almost the same.

    The problem I suspect is the pitot tubes ice over and you loose your airspeed indication along with the auto pilot, auto throttles and rudder limit protection. The rudder limit protection keeps you from over stressing the rudder at high speed.

    Synopsis; Tuesday [June] 23, 2009 10am enroute HKG to NRT. Entering Nara Japan airspace.

    FL390 mostly clear with occasional isolated areas of rain, clouds tops about FL410. Outside air temperature was -50C TAT -21C (your not supposed to get liquid water at these temps). We did.

    As we were following other aircraft along our route. We approached a large area of rain below us. Tilting the weather radar down we could see the heavy rain below, displayed in red. At our altitude the radar indicated green or light precipitation, most likely ice crystals we thought.

    Entering the cloud tops we experienced just light to moderate turbulence. (The winds were around 30kts at altitude.) After about 15 sec. we encountered moderate rain. We thought it odd to have rain streaming up the windshield at this altitude and the sound of the plane getting pelted like an aluminum garage door. It got very warm and humid in the cockpit all of a sudden. Five seconds later the Captain’s, First Officer’s, and standby airspeed indicators rolled back to 60kts. The auto pilot and auto throttles disengaged. The Master Warning and Master Caution flashed, and the sounds of chirps and clicks letting us know these things were happening. Jerry Staab, the Capt. hand flew the plane on the shortest vector out of the rain. The airspeed indicators briefly came back but failed again. The failure lasted for THREE minutes. We flew the recommended 83% N1 power setting. When the airspeed indicators came back. we were within 5 knots of our desired speed. Everything returned to normal except for the computer logic controlling the plane. (We were in alternate law for the rest of the flight.)

    We had good conditions for the failure; daylight, we were rested, relatively small area, and light turbulence. I think it could have been much worse. Jerry did a great job flying and staying cool. We did our procedures, called dispatch and maintenance on the SAT COM and landed in Narita. That’s it.

    [END of MESSAGE]

    As regards the scenario I published, the key part is the beginning, not the end. The core to the mystery of AF447 is how the airplane entered into circumstances of impaired instrumentation and control. In my view it is fog freeze. Also, I think there had to be multiple sensor failures, plugged Pitot probes alone is not enough (I spent many hours in a wind tunnel lab taking Pitot probe data; read my thesis for the results).

    I see the FBW computer programming being flummoxed by multiple sensor mis-readings (basically, a failure of programming to anticipate multiple incorrect channels, a point discussed by LeoM). Once we imagine the airplane flying without speed and attitude indicators, we could equally well envision an over-speeding flutter and structural failure scenario, as a stalling scenario. The BEA conclusion of a belly-flop by an intact airplane suggests a stall at altitude, and unsuccessful stall recovery attempt. What got the airplane into the stall?

    Maybe Airbus is getting a bum rap on its composite tails, and maybe composite and structural strength did not fail until final impact on AF447 (I’m not convinced, but let’s consider the argument). Perhaps the real questions AF447 raises about Airbus airplanes are:

    Why does the speed and attitude sensor array experience multiple failures in fogs of supercooled droplets, which we can anticipate in the anvils of cumulonimbus clouds?

    Do the fly-by-wire computer systems of Airbus airplanes respond to and recover from concurrent sensor faults in a prompt manner, to a clearly understood and reliable operational mode?

    If not, time for a re-design.

    William Cox pointed me to Hans van der Zanden, who writes critically about composites in airplane construction; see;

    I received a number of interesting letters from people who know about aviation technology, so I’ll share two excerpts that seemed well focused.

    The AA587 crash in 2001 in NYC was attributed to the co-pilot moving the rudder too aggressively (past 5 degrees), with the result that it experienced too much load and broke off. I think it’s been pretty well established that many planes, but certainly composite-tailed ones, could use sturdier vertical and horizontal tail fins.

    Mark Adams sent me interesting comments on tail fins, quoted here:

    [On AF447] Since they found the vertical fin and rudder 30 miles away from the main debris field, I think it points more to the tail coming off first like the AA flight 587 Airbus 300 that crashed in New York in Nov. 2001. That was caused by the vertical fin’s spar attachment failures.

    There was an interesting comment by a retired Boeing composite engineer about the difference in design between the Airbus vertical and horizontal fin attachments. He stated that the Airbus attaches their fins like the aluminum fins on earlier Boeing passenger jets (707, 727, 737, 747, 767 and 777) in that they attach at the fuselage outer skin. This engineer stated that the spars of the 787 vertical and horizontal fins go into the interior of the fuselage and attach there. This is a much stronger design. It would be like comparing the tail fins on German built Zeppelins to the German-designed but US-built [by Goodyear] USS Macon and the Akron. Goodyear decided to attach the fins at the fuselage rather than to each other inside and to the fuselage. That led to the loss of the airships. [The Macon and Akron were two dirigibles that crashed — in Ohio (?) and off the Carolinas (?) coast — during storms in the 1930s, yet German-built Zeppelins used to cross the Atlantic on regularly scheduled flights.] [Thanks, Mark.]

    Gordon Arnaut, pilot, and technology journalist, writes about aviation composites:

    As mentioned by William John Cox in his superb piece, there is much to suspect about the composite structures. Too many have failed. There was also the Air Transat flight which lost its rudder after departing Cuba, but managed to turn around and get on the ground without incident.

    Then there is the Airbus that crashed in the Mediterranean last year, I believe, (XL Air or something like that) with just the flight crew and other technical staff on board. Here too the tail was found floating intact.

    I also found some comments from guys who have disassembled Airbuses and they say that the fittings, hinges and attach points on those composite pieces are made of composites too. The problem with that is that composite parts, although very strong in tension and quite stiff also, have an Achilles heel — their attach points.

    If you take a composite part and drill a hole through it and attach it to another piece of the structure with a bolt or a rivet, that joint is going to fail well before the fastener reaches its strength limit. Why? Because the plastic acts like a quasi-fluid over time and the material under the bolt head will either crush or creep.

    Composites are a plastic, which by definition is a material that is malleable. They do not take point load concentrations normal to the surface very well. They also do not handle bearing loads well. So it came as a surprise to me to hear how the composite control surfaces like ailerons and rudders on the Airbuses have composite hinges and fittings. I have not seen this before — typically fittings are constructed by embedding metal bearing surfaces into the composites in order to distribute compression loads over a bigger area.

    This brings me back to the AA flight 587 which lost its fin, supposedly due to aggressive pilot rudder input. Well a couple of thoughts here. First, Cox sheds some interesting light on this. He quotes several pilots who say the very fast alternating rudder inputs, as recorded on the flight data recorder, would be humanly impossible. They also say this pilot was not known for aggressive control inputs — as some are.

    So I have to question this NTSB conclusion. Also I downloaded the NTSB report on that crash and looked at the drawing of the tail structure. The report states that the composite lugs on the fin, which are simply tabs with a hole in them, through which the bolt attaches, failed, but the mating lugs on the fuselage, which were made of aluminum, were intact. The titanium bolts were also intact.

    Also I noted that the composite fin is simply bolted to the top of the fuselage at a single plane, rather than having the fin spars extend down into the fuselage and attaching at several points. Apparently this is how Boeing is making its new 787 (although the aluminum-tail Boeings also attach at a single plane like the Airbus; but then aluminum does not have the attachment shortcomings of composites).

    Now here is my main beef about the move to composites. The new composite airframes are not actually lighter by any significant amount than aluminum airframes. The fuel savings, if any, would be miniscule. So why go to composites? The answer is money.

    The new composite planes are much more expensive than aluminum planes. This allows the airframe manufacturers to make more money. It also allows them to offload a lot of the R&D expenditures to their suppliers, the Japanese and Italians in the case of Boeing. Boeing is actually only assembling the pieces. They are manufacturing practically nothing.

    This is the very epitome of the outsourcing model which is how companies at the top of the food chain make the most money. Think of this as corporate colonialism.

    I know a lot of pilots and engineers in the industry who think that this move to composites is totally unnecessary and is being handled in a headlong manner. It took decades for aluminum airframes to become a mature technology and there were a lot of crashes and lives lost along the way. The same thing is going to happen with composites.

    [Thanks, Gordon]

    Finally, a word to those who keep score. The purpose of a good hypothesis is to spur thinking that leads to more insight. When the hypothesis is correct, we pat ourselves on the back, and feel like Joe DiMaggio crossing home plate in triumph. Each hypothesis is like the swing of the bat in baseball, another chance to move the game in your favor — the game in this case being the solution of an aviation mystery. So it is more important to have many ideas from which to winnow out the good ones. After all, Joe DiMaggio hit 0.325, but we remember him as an extraordinarily successful player, not a 67.5% loser. I remain quite pleased with my analysis of AF447, because I learned a great deal in order to produce it (like the rudiments of reading weather maps, and about numerous concepts used in piloting), and because I think it can help focus critical thinking about that flight. I’ll use the same degree of critical thinking to evaluate any other hypothesis, like that published by the BEA on July 2nd.

    On a personal level, I find it a great thrill to work out technical problems, and to see how well I do — my batting average — when compared to reality. It is also satisfying to be able to explain things to others in plain language, because it means you achieved a sufficient understanding of your own, from which to draw clear descriptions.

    In terms of the “political” implications of this story (of AF447 and the BEA report), I think it all boils down to Gordon Arnaut’s summation:

    “The real causes of these kinds of disasters are capitalism 101. Make money the overarching objective of every business activity and this is what happens.”

  5. Manuel García, Jr. said on July 5th, 2009 at 2:03am #

    The direct link to the MG-to-Ridgeway letter mentioned in comment #4 is:

    The text of that letter is (2 July 2009):

    I notice two things about the AF447 BEA investigation ( news stories today:
    1) the plane held together till the bitter end, including the tail, and
    2) Airbus planes are completely safe, keep flying folks:

    [Quoting the Washington Post]
    Despite the lingering mystery about what led to the plane’s sudden plunge, [Alain Bouillard, who is heading a probe by the French Investigation and Analysis Bureau] said he saw no reason at this point to ground the twin-engine Airbus A330 or for passengers not to board such aircraft with confidence. “As far as I am concerned, there is no problem flying these aircraft,” he told reporters.

    So, the plane hits in one piece at one spot, and the tail is found six days later about 50 km south of most the rest of the debris field, which stretches about 150 km north, with the bodies pretty much along a line, and bits of wreckage flung out 50 km each way laterally from that track. China Airlines Flight 611, a 747, broke up at 35,000 in 2002 — a badly repaired rear pressure bulkhead gave way, explosive decompression — a breakup first into four pieces (estimated from radar) and ultimate scatter over 130 km; and AF447 pinpoints in one spot and has equivalent scatter? Maybe the ocean currents did spread out the AF447 debris that far; but some data on the currents and perhaps some computer models of the dispersal would sure make that argument more convincing to those of us not experts at marine drifts.

    Regardless of any technical analysis (and the BEA people are closer to the data and specimens than I can ever be, and they have access to specialists, which I am not) it seems pretty obvious that if more Airbus planes had fallen out of the sky because their composite tails fell and/or broke off, then the world would be screaming to ground the entire fleet immediately. And Boeing’s increasingly delayed Dreamliner would start looking like a Plumbob Zeppelin. So, AF447 has to hold together because it is holding ‘everything’ together. There was already a crisis in civil aviation before AF447 died, because of high fuel prices and the economic crash — ticket sales were down, airplane orders (at the Paris Air Show) were absent, and the buyer’s market has people demanding and getting bargain tickets. What government agency is going to sink it’s civil air transport sector over one or two little crashes?

    There is big fear out there about the management of the public mind, and the fearful withdrawal of its pocketbook. Back in 1958 Queen Elizabeth II even went abroad on the new de Havilland Comet to instill confidence back into the British aero industry. But, that was after the Comets had been grounded for over three years while the problem was solved. The prospect of over twelve quarters of no cash flow is not a viable option today. Who says there is no human sacrifice in our society? Instead of war captives spread out on stone altars to have their hearts ripped out on state holidays, we send bundles of people off on low-odds sudden termination lotteries in jumbo plastic airplanes, or death-wad and toxin-laced junk food mass feedings and drug trials. Our capitalist society is like a casino where you’re forced to play a slot machine, and if the long odds come up against you then it blows up in your face. The concept is deemed OK (by those raking in the chips) because the odds of bad stuff are “low.” Russian Roulette with 8 million empty chambers in the barrel is OK, so just pay up and keep pulling the trigger.

    I hope they find the recorders, because I have a belief they will clear the pilots (the presumption of good piloting is a purely emotional attitude on my part), and because I think it would be enormously helpful to aeronautical engineers to finally decipher the instrument failures and sequence of forces that occurred on AF447. The price for this lesson was unwillingly paid by 228 people. I fear that not finding the recorders will become politically convenient, and suspect that the blame game has now completely taken over: anyone with a perceived liability regarding AF447 is in Red Alert CYA mode, and many with a loss or perceived potential for gain are weaving court filings (some no doubt quite justified). The French and the Brazilians already had a finger-pointing tiff early in the search, about what was or wasn’t real AF447 wreckage, and what might or might not have happened as regards in-flight breakup. The BEA report of 2 July points to air traffic sluggishness in Brazil and more so in Senegal as delaying the start of search-and-rescue. In seems unlikely that starting the search planes six hours earlier would have made any difference; the wreckage of AF447 would have sunk in minutes, and since there seems to have been no fire, there would be no ocean-surface fuel-burning to see. Despite the news reports (officially leaks) of autopsy findings in Brazil, and the participation of French medical forensic observers, the BEA complains it has not received the official autopsy results from Brazil. Probably true, but why?, is it all PR jockeying for world news media, CYA, and finger-pointing?

    The BEA’s conclusion about an intact impact may be correct, but I will find it more convincing when they present step-by-step reasoning that ties all known facts (or proves individual facts spurious) into a sequence that produces their conclusion. That, and making their data public so independent analysts can replicate their findings, would be a first payment of honorable compensation to the dead. The principal of the rest of that debt would be to re-engineer the air transport fleet to prevent the technical failures that occurred on AF447. To do that we have to know what they were.

    Manuel Garcia, Jr.

  6. Manuel García, Jr. said on July 5th, 2009 at 11:02am #

    Lee Gaillard has an interesting article on composites:

    Manuel García, Jr.

  7. Manuel García, Jr. said on July 22nd, 2009 at 10:41pm #

    Four Points on AF447, 22 July 2009, MG, Jr.

    For MG, Jr. reaction to BEA report of 2 July, see after

    , comments #4, #5, #6. This present note will be added as comment #7; and also to the comments at

    , where W.J. Cox and others seem to have a lively discussion on AF447, composites in aviation, and FBW complexities.

    Point #1: Incident of 23 June 2009.

    As noted in my comment #4 at DV, a similar incident occurred on 23 June 2009. Another Airbus A320 flying between Hong Kong and Tokyo ran into supercooled droplets and lost speed indications and autopilot, and saw the same series of computer and instrument faults as AF447 — and the same sequence of error messages except for the final one. Interestingly, my “imaginative sequence” (in my AF447 article) begins with a fog of supercooled droplets plugging up the Pitot tubes with rime ice (I didn’t know about the 23 June incident until after 2 July).

    This incident is now being investigated by the NTSB, and is included in the list of incidents described in the following article (which though detailed, I suspect has a Franco-hostile slant from an Anglo source):

    The Airbus 330 – An accident Waiting To Happen
    By David Rose (last updated on 19 July 2009)

    [hype for the above:]
    “With its human-proof computer systems, it is the most technically advanced aircraft in the world. So why has the Airbus 330’s gleaming new fleet been so dogged by technical problems… and disturbing evidence of flawed cabling been so comprehensively ignored?”

    I included the copilot’s original e-mail about the 23 June incident in my DV comment #4.

    It seems that the FBW (fly by wire) computer system(s) — and most probably the programming more than the hardware — may become confused when multiple sensors have erratic behavior or fail to produce data; and such a multiple point failure can be initiated by “fog freeze.” I would hope Airbus is now doing new expanded systems tests, to explore the susceptibility of their FBW architecture to such multi-point failures (and Boeing too!).

    Point #2: AF447 fuselage crushed from the bottom up.

    The BEA concluded that AF447 fell intact and upright onto the ocean surface, and was crushed from below. This blow then subsequently broke apart the airplane.

    I am not yet convinced of this — and I DO NOT make any conspiratorial statements accusing the BEA and French corporations of an intentional “coverup.” I confine my arguments to the physical evidence, as I can see it second-hand through news reports and photographs published on the internet.

    I am sure the AF447 tragedy is a great shock to the French aerospace and air travel industries, and that it is psychologically difficult for them to frame hypotheses of what may have happened, by beginning with the assumptions that the FBW electronics went into a scrambled or chaotic mode under the circumstances of AF447’s flight (and the conditions of the atmosphere), the tail fell off at altitude and the plane subsequently became uncontrollable and broke up in flight.

    Clearly, if these assumptions were shown to be likely, then given the sequence of earlier incidents with Airbus planes, a grounding of the fleet would be called for. Purely as a matter of dollars and cents (or francs and sous; or euros) the aviation industries (and governments) find it preferable to accept the costs of victim compensation (including pain and suffering, but avoiding punitive damages) to idling (multi-national) aviation industries.

    I do not deny that there is potential for a conspiracy, but I think it unfair at this point to assume one is underway. I am inclined to believe that aviation people, and especially the French aviation community, are in a state of shock, and mourning, and the denial that accompanies that. This is no different than the state of British aviation in 1953-1954, when the de Havilland Comets were falling out of the sky, before they finally grounded the fleet and embarked on a long, difficult and extensive investigation and research project to find the cause. The situation is a test, a “crisis,” which challenges national pride, technical abilities, and economic ambitions. I am waiting to see how the challenge is addressed, and my basis for evaluating that will be my estimation of how the physical evidence is analyzed.

    Did AF447 land upright and intact on the ocean surface? The suggestion is that the bottom portions of the airplane, from a wide variety of locations, seem to be crushed from below (photo documentation would help to substantiate this claim). However, I do not see bottom-crushing as being exclusively explained by intact “belly flopping.” Consider the following.

    An airliner’s fuselage is typically a cylinder whose upper half is the passenger cabin and whose lower half is allocated to cargo and baggage holds, equipment spaces (air conditioning units, landing gear holds, pumps and electric power equipment), the central fuel tank (between the wing roots) and electronic, hydraulic and gas (oxygen) systems. The upper half of the fuselage has a lower mass density and more open space than the lower half of the fuselage. Sighting down a cross section of the fuselage, one can see that the center of mass for each cross section will be approximately amidships near the bottom. We could imagine all the mass distributed within the fuselage to be equivalent, during the dynamics of flight, to a heavy pole of concentrated mass running longitudinally along the fuselage along the axis of the cross sectional center of masses.

    If we take an asymmetrically weighted cylinder, as just described, and toss it up, it is more likely to land onto its more heavily weighted hemisphere. This is, after all, the principle behind “loaded” dice. So, I am inclined to believe that an airliner fuselage, tumbling in an un-powered and uncontrolled fall from great height, is more likely to land on its bottom, whether it is intact or in pieces.

    Therefore, I think it premature to conclude that bottom-crushing alone indicates an intact belly-flop, for AF447. Perhaps if there were much more debris recovered, and it also showed bottom-crushing, then one could be more certain; but there is so little recovered of this airplane.

    Point #3; Tail broke off forward or backward?

    The BEA states the tail of AF447 broke off with a forward jolt and leftward twist. The photos of the tail show a fairly clean break along its forward portion, near the root, and a jagged break at the bottom of the rudder, angled up toward the rear. A portion of the clevis (yoke-like structure through which a pin or bolt penetrates and thus holds in attachment another planar structure or lug) remained attached to the tail of AF447. This clevis is missing its rear half, so one could see a forward force yanking the tail off, and ripping the clevis off its bolt, leaving the back portion with the pin and fuselage. The damage to the bottom of the rudder would then be seen as happening later during the fall of the tail.

    The ‘back force’ interpretation would be that the tail attachment points were first snapped by a sideways force (while trying to counter a side-swing?), and the tail then rotated backward, crushing the bottom outer corner of the rudder as it did so; when the rotation had moved the unbroken forward half of the clevis to the top of its holding pin, then it could lift off since the back half of the clevis, which would now have been under the horizontal pin, was not there to restrain the liftoff of the tail.

    Perhaps when more analysis is done of the wreckage, and more photos and documentation is made available about that, I might see the persuasiveness of the BEA’s present statements.

    Point #4: Pilot chatter from

    From “Part 20” at:

    Reply 121 (Theredbaron From Mexico), 3 July 2009:

    The report states that the AC [aircraft] fell flat and forward into the ocean, and the fin was found in the middle in the debris field, ok.

    If they KNOW the plane was complete before impact and where it fell, they must have a pretty close area to search for the FDR and Voice recorder. Anything in the report to explain that? Heck they even have a very small area to look for.

    I have been to 2 emergency landings and I cannot fathom why if they were falling from FL370 [37,000 feet] rapidly or slowly, flat spinning or not, recovering from a stall or whatever you want to put it, there were no bodies with the life vest on, there were minutes till this was over, I don’t think that NOBODY in that plane prepared for the worst.

    [thank you Red Baron From Mexico]

    Clearly, either the passengers had no time to prepare for a water landing (in-flight break up?) or the conditions during their descent (panic?, violent dizzying motion?) made it impossible for everybody to don life vests. Also recall, the crew seats were found stowed in their upright positions: the flight attendants were not seated, nor strapped in, nor wearing life vests. I have the impression of catastrophic suddenness: a great earthquake, Vesuvius’ pyroclastic flow, TWA800.