The recent loss of Air France Flight 447, an Airbus A330-200, has raised many doubts among the flying public and even some aviation professionals about the safety of the newest generation of passenger airplanes. These new airliners have composite materials replacing metal for many structural elements and control surfaces, and they are reliant on computer-controlled flight and navigation systems.
The impetus for developing this new generation of airliners is the need to improve fuel economy so as to maintain the profitability of the passenger air transport industry. Between 1986 and 2001, the world price of crude oil remained steady at near $22 a barrel. From 2002 to 2008, the world price of crude oil rose steadily from $25 to $95 a barrel (the prices quoted are rough averages, and in 2007 dollars). Modern airliners that are lighter and stronger than their older-generation all-metal size equivalents can carry more payload with less fuel consumption, and this translates to economic sustainability.
The quest for a more efficient airliner began with the first example of the type, Igor Sikorsky’s S-22 of 1913, the Ilya Muromets, a four engine biplane with an enclosed cabin for 16 passengers. Russia’s military needs in WW1 swallowed up the commercial potential of the S-22, and the production was shifted to bombers. The post-war rebirth of commercial aviation began with the Farman twin engine biplane transport of 1919, the F-60 Goliath, seating 14 passengers. Since then the quest for “better, faster and cheaper” passenger aviation has never stopped.
In 1972, Airbus introduced its A300, the first twin turbofan widebody air transport. The Boeing Commercial Airplanes company introduced its first widebody twin turbofan airliner, the 767, in 1981. Airbus chooses to be an airplane manufacturer that leads the industry in the application of engineered materials (composites) and computer-controlled aviation. Boeing is an airplane manufacturer that seeks to maintain its reputation for robust, reliable and increasingly efficient designs, which it gained early in its history with airplanes like the revolutionary 247 of 1933, the first truly modern airliner (all-aluminum monoplane of semi-monocoque construction with cantilever wings, wing flaps, retracting landing gear, trim tabs, autopilot, and deicing boots for the wings and tailplane).
Airbus and Boeing are today’s main competitors for new airplane orders worldwide. As noted earlier, it is the cost of fuel that drives the economics of commercial air transport, and in turn the replacement of older aircraft with newer models. The competing demands of safety, reliability, strength, carrying capacity, volumetric efficiency, speed and fuel economy drive airplane designers toward a convergence of characteristics, so that today both Airbus and Boeing airliners look, sound and feel largely the same to most passengers.
Each iteration of a manufacturer’s model type will have a higher proportion of weight-saving composite material, and a more extensive array of electronic and computer systems. How and where composites and computers are used by Airbus and Boeing may be quite different between their competing models of comparable type, but inevitably both manufacturers increase their use of both composites and computers, to remain competitive. The Airbus A330 and A340 series of airplanes, introduced in 1992 and 1993, and their classmate the Boeing 777, introduced in 1995, will be replaced by the Boeing 787 Dreamliner, set for introduction in 2010, and the Airbus A350, set for introduction in 2013. Both the 787 Dreamliner and the A350 are nearly all-composite airplanes. The 787 Dreamliner is 80% composite by volume, and by weight it is: 50% composite, 20% aluminum, 15% titanium, 10% steel and 5% other. By weight, the A350 is: 53% composite, 19% aluminum and aluminum-lithium, 14% titanium, 6% steel and 8% other.
The challenge facing the civil aviation industries today is to answer the questions raised by the mysterious loss of Air France Flight 447, and to convince the public that any problems that may be uncovered about the use of composites and computers in AF447 will be fully understood and solved before building and flying all-composite airliners with even more complicated computerized control systems.
So, it is no wonder that Boeing Chief Executive Jim McNerney defended electronic flight control technology and the Airbus A330, in an interview prior to the Paris Air Show: “The causes of the [AF447] accident are unknown, and I don’t think there is any link with a serious fault with the aircraft…the A330 is a reliable and proven aircraft.” ((Boeing Backs Airbus on AF447.))
The AF447 crisis in civil aviation may be similar to that of the two de Havilland Comet crashes of 1954. The Comet, introduced in 1949, was the world’s first passenger jet transport. During both January and April of 1954, de Havilland Comet airplanes broke apart at altitude while flying in clear weather over water. After the second crash, the fleet was grounded, many pieces were recovered from the seabed to assemble partial reconstructions, and many tests were conducted on another intact airframe. The cause of spontaneous disintegration was eventually found to be metal fatigue in the aluminum alloy used for the skin, by the cumulative effect of many cycles of cabin pressurization and de-pressurization.
The changes in design, materials and manufacturing techniques needed to solve the problems of the de Havilland Comets of 1949-1954 were used to produce an improved Comet, which returned de Havilland to passenger aviation in 1958. However, those same lessons had already been divined by Boeing to produce the 707, their first commercial jet transport, which was also introduced in 1958 and immediately went on to dominate passenger air transport through the 1960s.
If the air transport industries fail to fully resolve the AF447 mystery, then a portion of the public will assign an apprehensive image to the coming generation of composite computer-controlled air transports, a psychology we could think of as “’54 Comet dread,” as opposed to “’60s 7-0-7 optimism.”
AF447 In The Clouds
In the early pre-dawn hours (~2:15 UTC) of 1 June 2009, Air France Flight 447 from Rio de Janeiro to Paris fell out of the sky into the Atlantic Ocean near the equator about midway between Brazil and Senegal, with the loss of all 228 people aboard. The aircraft was one of the most modern, a dual engine Airbus A330-200.
(UTC is Coordinated Universal Time, which replaced Greenwich Mean Time in 1964 and is defined for the time zone straddling much of 0 degrees longitude. There are 24 time zones each generally of 15 degrees longitude, but there are numerous deviations of time zone boundaries.) ((Map of Time Zones.))
The accident occurred after the airplane had flown over 90% of its planned northeast-directed transect of 227 km through the width at mid length of a mesoscale convection system (MCS), a cluster of storms 800 km long east to west, and 160 km wide north to south. ((Tim Vasquez, “Air France Flight 447, A Detailed Meteorological Analysis.”))
The last radio message from the crew of AF447 was a routine notification at 1:33 UTC that the flight at 35,000 feet (10,671 m) along oceanic high altitude route UN873 had reached waypoint INTOL, near the outer boundary of airspace monitored by radar from Brazil. The pilots of AF447 expected to reach waypoint TASIL, near the edge of airspace radar-monitored from Senegal, in 50 minutes (by 2:23 UTC), a distance of 663 km between waypoints. A mid Atlantic gap of at least 500 km exists between the limits of Brazilian and Senegalese air traffic radar surveillance. ((Map, From INTOL To TASIL.))
Between about 1:46 UTC to 1:56 UTC, AF447 flew through the western fringe of the top of a storm that reached to between 35,000 feet (10.67 km) and 40,000 feet (12.2 km). It seems AF447 had shifted somewhat to the left, or westward, from its planned flightpath in order to avoid the brunt of this storm, and in anticipation of weaving between storm cells ahead. Thunderstorms in the tropics are usually very localized, of short duration, and produce abundant rainfall. They can develop so quickly that a Paris-bound flight 4 hours out from Rio de Janeiro might encounter an active storm cell over a patch of ocean that had been cloudless prior to takeoff. This is why airplane weather radar had been developed, to alert pilots of weather threats ahead, and to guide their weaving between active storm cells when they became unavoidably embedded in weather systems with numerous storms. After crossing about 42 km of clear airspace, AF447 entered the main MCS thunderstorm cluster, at about 1:59 UTC.
A sequence of satellite images of the MCS cluster show the large 800 km by 160 km (roughly) cloud mass with its variegated edge, drifting, evolving and fragmenting during that day. These images show the merged shape seen from above of the laterally spreading “anvil” tops of the many individual storm cells in the cluster. The updrafts in these cells had sufficient energy to push moisture up to between 40,000 feet (12.2 km) to 56,000 feet (17.1 km). Moisture that rises into the base of MCS clouds, perhaps near 3281 feet (1 km) at 20 C (68 F), can be chilled by strong updrafts to arrive at -40 C (-40 F) at the 10.67 km cruising altitude of AF447, and continue rising and chilling to as low a temperature as -80 C (-112 F) at 17 km elevation. This storm cluster was typical, not unusual, for the location and time of year.
AF447 proceeded northeast through the MCS cluster, guided by its weather (moisture, rain, hale) radar along a corridor of mild radar reflectivity (and of anticipated least relative ‘storminess’), about equidistant between a strong cell to the west and the strongest cell of the moment, which was about 30 km east. About 8 minutes after entering the MCS system (2:07 UTC), AF447 began penetrating what was probably the most energetic part of the storm cluster along its flightpath.
At 2:10 UTC, the first of a series of automated signals was sent by AF447’s onboard computerized maintenance system, via satellite, to Air France computers in Paris logging maintenance information. The series of automated messages had a combined time span of 1 minute and occurred until 2:14 UTC; 5 failure reports and 19 warnings were transmitted. The earliest automated messages reported on the failure of the Pitot Tube sensors, which measure the airspeed of the airliner and provide an estimate of altitude based on the static pressure of the atmosphere. Subsequent messages in the initial burst indicated that the auto-pilot (automatic ‘steering’) and auto-thrust (automatic ‘gas pedal’) systems had been disengaged, the collision avoidance system (to detect other nearby airliners) had a fault, that the flight control computers (three for redundancy) had shifted to an “alternate” mode where they made fewer automatic adjustments to the airplane’s control surfaces, and placed fewer limits on the range of manual inputs by the pilots that would be implemented as motions of the control surfaces (ailerons, rudder and the many types of flaps). ((Air France Flight 447, Wikipedia.))
From 2:11 UTC to 2:14 UTC, messages indicated the failure of the gyroscopes (air data inertial reference system, ADIRU, used to provide the artificial horizon orienting the sense of ‘up,’ ‘down,’ and ‘level,’ essential during nighttime) and resulting faults in the instrument panel displays (screens and electronic images instead of mechanical dial gauges); there was disagreement between systems that interpreted air data (such as for airspeed and angle of attack of the wings into the airflow); that a fault had occurred in the flight control computer system (that transmits commands to the hydraulic actuators that physically move control surfaces); that a fault had occurred in the computer system that captures and processes pressure and electrical outputs from air and motion sensors that supply data; and finally, a “cabin vertical speed warning” indicating a rapid loss of cabin air pressure, due to either a rapid descent or a breaching of the cabin shell.
AF447 may have entered its period of most severe jolting, buffeting and external cooling near 2:07 UTC, when it began crossing the core of the MCS cluster between its most active cells. Some as yet unknown excessive structural strain — perhaps exacerbated by material embrittlement or loss of plasticity and cohesion due to excessive cooling, such as by micro-strains induced by the expansion of trapped moisture freezing inside composite materials — may have been delivered by turbulence and initiated the subsequent fragmentation of the aircraft.
Pressure sensor icing sustained during at least the three minutes prior to 2:10 UTC seems to have initiated the cascade of air data (speed, pressure, altitude and attitude) processing and instrumentation failures, and contributed to the growing uncertainty of the decision-making electronic processing for the navigation and flight control systems.
Pilots rank their priorities during flight, especially in emergencies, as: “aviate, navigate, communicate.” The pilots of AF447 would be working first to keep their airplane at a proper speed: fast enough to stay aloft at the given elevation and weight of the airplane, and not too fast to damage the structure because of excessive pressure differences produced by airflows near the speed of sound, and by excessive structural stresses induced by the alternating jolts of updrafts and downdrafts in turbulent air spaces. Given that the aircraft remains aloft and is not being rattled to pieces, the next priority is to point it in a safe direction, for example away from active thunderstorm cells, and along the best route to a safe landing. The third priority is to communicate the status of the flight to air traffic controllers, a useful task as long as it is not a distraction from essential aviating.
Troubleshooting a torrent of error messages from a computerized flight control system to then compose a radio report for air traffic controllers is not a sensible allocation of attention during an emergency to control an airliner in a storm. We can understand why the crew of AF447 might not send any radio messages during their 3 minutes (and possibly as much as 11 minutes) of weaving between the storm cells and riding the waves of turbulence, before the first automated alarm of trouble was transmitted at 2:10 UTC. At this point, AF447 had crossed 154 km of the MCS cluster, the last 42 km of which were probably the roughest. During the next 4 minutes, when the automated messages were sent, the flight probably travelled 56 km. At 2:14 UTC, AF447 was about 2 to 3 minutes (28 km to 42 km, at 14 km/minute) from exiting the northern edge of the MCS cloud system, and it sent its last transmission.
AF447 Into The Sea
The search for AF447 began at 2:23 UTC. Brazilian air traffic controllers called their Senegalese counterparts when they failed to receive the expected confirmation that AF447 had announced itself to Senegal by radio, as required upon entry to a new airspace. The Brazilian Air Force dispatched search planes, a Spanish maritime patrol plane searched southwest from the Cape Verde Islands, and the search effort quickly expanded in the following days to include Brazilian naval vessels, cargo ships within the search area, French military planes and ships, and satellites. ((Simon Hradecky, “Crash: Air France A332 over Atlantic on Jun 1st 2009, aircraft impacted ocean,” The Aviation Herald.))
Fernando de Noronha is an archipelago of 21 islands 354 km (220 miles) northeast from the eastern tip of Brazil. AF447 flew past (~1:18 UTC) and to the west of Fernando de Noronha on route to waypoint INTOL at 565 km (351 miles) from the coast. At about 2:44 UTC, the pilots of a TAM Airlines flight from Europe to Brazil reported observing “orange dots” on the surface of the ocean — burning wreckage? — when they were approximately 1300 km (808 miles) from Fernando de Noronha. This would put them about 515 km (320 miles) northeast of the last known position of AF447, 30 minutes after its last transmission.
If AF447 broke apart at 2:14 UTC, some wreckage might fall as far as 130 km from this location (an estimate based on the debris scatter from China Airlines Flight 611, a Boeing 747 that broke apart at 35,000 feet in 2002). Powered flight by AF447 beyond 2:14 UTC was unlikely since there were no subsequent automated messages (presumably, all power generation, controlled motion and thrust had ceased). If the “orange dots” were burning AF447 wreckage, then the TAM pilots had the ability to see glows no less than 380 km ahead of them. So, the “orange dots” sighting is probably unrelated.
The Brazilian Air Force spotted floating debris 650 km (404 miles) northeast of Fernando de Noronha on 2 June, the next day a Brazilian Navy patrol boat arrived in the area. On 6 June, bodies and debris from AF447 were recovered. On 8 June, the vertical stabilizer and rudder of the Airbus A330-200 was found and recovered. ((AF447 Airbus A330-200 Vertical Stabilizer And Rudder, Wikipedia.))
By 26 June, when the search for human remains ended, 51 bodies and 600 pieces of debris had been recovered from two debris fields about 80 km (50 miles) apart on the surface of the ocean. The finds were concentrated along a 150 km track almost due north from the last known position of AF447; debris (but apparently not bodies) was scattered as far as 50 km east and west of this track. The tendency of flat pieces of debris to glide haphazardly as uncontrolled airfoils would scatter them much further from the last heading of the airplane than more compact objects, which developed no aerodynamic lift. ((BEA’s AF447 “Sea Search Operations,” (link “sea search operations” produces PDF file with maps).))
Autopsies revealed the victims to have fractured limbs and hips, no seawater in their lungs, no signs of burning or charring, and some had little or no clothing. The presumptions are that AF447 broke up at altitude without a fuel explosion causing a cabin fire, that the victims were ejected from the wreckage at high altitude, which sucked out their breath and quickly made them unconscious, that the high speed air blast tore off their clothing, and that their bodies were not fragmented on hitting the sea because they fell more slowly individually than if they had been attached to a much heavier mass like a wrecked fuselage.
An explosion and fire in the lower fuselage (below the floor of the passenger cabin, in the center fuel tank or the cargo holds) cannot be ruled out because the passengers would be shielded from such a blast and fire, and the airplane still disintegrate in flight. Recovery of a sufficient number of parts from the lower fuselage will resolve the question of fire (no evidence yet). The recovery of parts has so far been restricted to those that float, so a great deal of plastic and composite material, and not so much metal. ((Brazilian Air Force, Information On AF447, see “fotos.” ))
The official investigators are anxious to find the cockpit voice recorder and the flight data recorder (the “black boxes” which are actually orange), which lie somewhere on the bottom of the Atlantic Ocean. To help locate them, each is equipped with a sonic emitter (“pinger”) with a range of 2 km. The sea floor is between 2.5 km and 4 km deep below the suspected crash site, and is quite mountainous since it is close to the Mid-Atlantic Ridge (the boundary from which tectonic plates originate and spread eastward and westward). The recorder cases can withstand pressure down to a depth of 6 km, and the pingers are designed to operate for at least 30 days, after which their signals fade.
Questions And Speculations
The sequence of known events for AF447 has been laid out in the sections above. The distances and UTC times quoted are either from news accounts or my simple calculations, which do not account for factors such as the curvature of the Earth and headwinds, which pilots, navigators and meteorologists use to arrive at precise numbers. Unless Airbus can make a more detailed analysis of AF447’s automated messages, and until more parts of the airplane are recovered and analyzed, especially the voice and data recorders, we are left without more facts. So, now we ask 5 questions and speculate.
Question 1. AF447 flew into a line of thunderstorms and was destroyed. Is this a case of pilot error?
The ranking for safety of nine modes of transportation on the basis of deaths per billion journeys (the basis of insurance rates) is: bus (4.3), rail (20), van (20), car (40), foot (40), water (90), air (117), bicycle (170), motorcycle (1640). ((Air Safety, Wikipedia.))
The primary causes for the complete loss of commercial jet aircraft in accidents during 1996 through 2005 were found to be the: flight crew (55%), airplane (17%), weather (13%), miscellaneous other (7%), air traffic control (5%), maintenance (3%). ((Aviation accidents and incidents, Wikipedia.))
Airline travelers demand rapid transit across vast distances with the punctuality of well-run train services. They also crave comfort, meal services and entertainment during their trips. Personal safety and incident-free travel are usually taken for granted, but highly prized when thought about. And, passengers want it all cheap. Everything about passenger airplane design and airline operations is focused on producing this type of experience for the flying public. An accident like that of AF447 is simply an unpleasant reminder that nature may not always be as conveniently benign as we had assumed and planned for in the design of our passenger airplanes and the operations of our air travel industry. Our margins may be too thin because we are in too much of a hurry, and too cheap.
Passenger airplanes are designed to withstand forces comparable to about 2 to 2.5 times their maximum loaded weight (2 to 2.5 times their total mass times the constant of gravitational acceleration, g = 9.81 meters per second-squared). We could design passenger airplanes that are essentially unbreakable, like the F-35 fighter now under development, which can be stressed to 8 or 9 g, and uses composite materials for its wing and nacelle skins. However, ‘unbreakable’ passenger airplanes would be much smaller and slower than the 200-500 seat turbofan-propelled transports we are used to. They would be more like the Lockheed P-3 Orion that has been used as a “hurricane hunter,” flying through violent storms to gather meteorological data. The P-3 Orion (1962-1990) is a maritime patrol plane developed from the Lockheed Electra passenger airplane (1957-1961), which could carry about 120 people. The four engine turboprop P-3 Orion has an operational limit of 3 g, but the plane was shown to survive a 7 g stall recovery in 2008; see the photo of the wing. ((P-3 Orion At 7 g.))
Compare the photo of the overstressed P-3 Orion wing to photos of a recovered spoiler (wing flap) from the AF447 airplane. ((AF A332 Crash (F-GZCP) Part 16, ‘Recovered Spoiler‘:
Reply 204, Pihero,
Reply 205, KingFriday013,
Reply 242, Guillermo.))
We could restrict air travel to times and routes of guaranteed clear weather, but then direct flights between Brazil and Europe would be impossible because planes would be barred from crossing the approximately 700 km wide Intertropical Convergence Zone (ITCZ), a permanent band of thunderstorms that circles the globe near the equator. Flights are often grounded or diverted to alternate destinations when dangerous weather develops, but neither the flying public nor the airline operators are eager to expand this practice to the point of avoiding any possibility of contact with rain, snow, ice, lightning, turbulent air and birds.
So, on the basis of accepted practice, the Captain of AF447, Marc Dubois, did not make an error to set off on his fateful flight. It remains to be determined if he and his two assisting pilots made the right decisions in maneuvering the airplane through the atmospheric conditions they encountered, and in responding to the technical problems that erupted.
There are three possibilities of root causes here: human error, systemic error, or natural catastrophe. If the pilots made mistakes, then the information on the voice cockpit recorder and the flight data recorder will probably reveal them (if the recorders can be found). If the piloting was flawless, then the accident could be a systemic failure, a result of inadequacies in: airplane performance, design, maintenance, certification (the performance and safety standards we choose to adhere to, through government regulation), and the operational practices of the air travel industry.
The third possibility, that an unusual and rogue natural force overwhelmed AF447 and could not have been anticipated, lets humanity off the hook. The current best guess for an AF447 natural catastrophe is wind shear, a large and abrupt change in wind velocity experienced in crossing an invisible plane through the atmosphere. But this excuse is weak. Wind shear produced by the updrafts and downdrafts in thunderstorms is now monitored by onboard Pulse-Doppler weather radar. Clear air turbulence (CAT) is a form of cloudless wind shear that is difficult to avoid because it cannot be detected visually nor with radar (a laser range-finding and reflectivity-measuring system called Doppler LIDAR is needed). CAT is created near the four high-altitude jet streams that ring the earth, in the wind shadows of mountain peaks, and as the wake turbulence of large airplanes. AF447 was far from all of these.
The Captain of AF447 was 58 and had 21 years of piloting for Air France. He had undoubtedly flown Airbus planes between Rio de Janeiro and Paris many times. On the 31st of May, he probably saw nothing unusual in the weather predicted along his route (see Figure 4 in Reference 3, and the associated maps of higher elevation winds). He expected the usual thunderstorms near the equator and would be sure to monitor his weather radar during flight, to adjust his course as needed to evade active storm cells that might develop along his intended track.
The northern hemisphere’s trade winds move southwest, and the southern hemisphere’s trade winds move northwest; they converge in the Intertropical Convergence Zone (ITCZ). The converged masses of heavily laden moist air then rise to great height (17 km) before diverging into a northward flow north of the equator, and southward flow south of the equator. These high-altitude flows toward higher latitudes sink to low elevation at 30 degrees north and south latitude, and then skim along the surface of the Earth westward and toward the equator, as the trade winds. These toroidal patterns of atmospheric circulation are called Hadley Cells. The ocean regions of the ITCZ were called “the doldrums” by early European mariners because of the typical absence of surface winds. The tropical heat and vertical trend of atmospheric circulation within the ITCZ continuously spawns thunderstorms, and these can group into squall lines or clusters now called mesoscale convection systems (MCS). The updrafts in these storms can reach 17 km, well past the usual 10-11 km cruising altitude of airliners. Pilots experienced at transoceanic flight, like those of AF447, would understand the nature of the air spaces they intended to cross, and plan accordingly.
At least 12 other airplanes passed through the area of AF447’s disappearance during the period from 3 hours before, to perhaps 1 hour after 2:15 UTC. It is likely most were Airbus airplanes since the carriers were Air France (four, besides AF447), Air TAM (three), Air Iberia (two), Lufthansa (two) and British Airways (one). One Air France plane left São Paulo bound for Paris on 31 May 2009 at 22:10 UTC after AF447 left Rio de Janeiro at 22:03 UTC that same day, so they must have been as close to each other on the same route as allowed by regulations for safe separation. Several of the other planes passed AF447’s last known position within 30 minutes of the disappearance. None reported anything unusual (one passenger on a flight 40 minutes behind AF447 recalled a half hour of turbulence near the equator).
The effects causing AF447 to fall from flight were extremely localized and short-lived.
Question 2. Pitot Tubes measure airspeed, but on AF447 they failed due to icing. Did a loss of speed data cause the flight control computers to issue bad commands, which led to a loss of control in bad weather?
A Pitot probe is a small tube facing into the airflow from the nose of an airplane; it’s purpose is to sense ram pressure, which is interpreted for speed. Obviously, the speed sensor fails if the tube becomes plugged. It has to be maintained and cleared of insect nests, insects impacted during flight through swarms, and dirt; it has to drain off rainwater without distorting the pressure reading; and it has to be equipped with a heater to melt impacted ice.
A number of Airbus planes have had problems with Pitot probes that failed due to icing, and the entire A330 and A340 series have been undergoing retrofits. The AF447 Airbus A330-200 did not yet have the improved Pitot tubes, but since its loss Air France has speeded the retrofitting of its Airbus fleet, and all carriers are now quite focused to complete this task. There have been many recent articles in the news and in pilot forums like airliners.net, about the Pitot tube problems on Airbus planes.
The Airbus A330 uses three Pitot tubes, and its air data computers select the reading from any two that agree. None agreed on AF447 (at 2:10 UTC) so the flight control system informed the pilots that speed data was unreliable — absent — and it shifted flight control from the fully automatic mode to an alternate mode, which is comparable to the amount of computerized flight control on a Boeing 777.
Airbus pilots have a back-up procedure for estimating speed on the basis of other instruments (angle of attack and engine power) in case their airspeed indicators fail. This procedure is simplified to about three simple control settings (for thrust), for low, medium and high altitude; and which are to be committed to memory for use in emergencies. ((Joelle Barthe, procedure for Airbus flight without airspeed data.))
The computerized flight control system does not blindly use inconsistent data to compute bad commands to control surface actuators. Instead, it flags the discrepancy and turns control over to the pilots, and the pilots have their back-up procedure for flight with unreliable speed data. The loss of speed data alone is not sufficient to cause the loss of flight control.
Question 3. Did a loss of speed data cause the AF447 pilots to overspeed the airplane to the point of structural damage, because they believed they were preventing a stall?
An airplane must move fast enough to generate the aerodynamic lift force that holds its weight aloft. The stall speed is the minimum for flight. Stall speed increases with altitude because the atmosphere becomes thinner. The stall speed for the AF447 Airbus A330-200 at 35,000 feet was 759 kph (472 mph).
Airliners are designed to fly at high subsonic speeds because supersonic travel requires much higher fuel consumption. They have swept wings that remain behind the curved pressure wave the airliner’s nose plows before it, and which becomes a shock wave when the airplane moves at or above the speed of sound.
Consider a straight-wing airplane moving at sonic to low supersonic speed. The outer parts of the wings will extend ahead of the curved bow wave, and produce additional shock waves. Because neither flight speed nor incoming air density and temperature are perfectly uniform, shock waves will oscillate about some mean position relative to the airplane, causing fluctuations in the distribution of pressure force on the aircraft surface. Also, shock waves that cross the surfaces of wings will cause the flow to separate, destroying the lift. Shock waves create drag, and more shock waves create more drag. Maintaining high speed against high drag requires large engines with high fuel consumption. Supersonic airplanes are equipped with very powerful engines to accelerate them quickly from the subsonic to supersonic regime.
The maximum speed for a subsonic airliner is set by the criterion of ensuring no localized sonic flows nor shocks. For example, flow scooting around the joint of a wing and the fuselage, or some bulge on the skin, might be locally faster than the average aircraft speed. That average must be kept below the point where the fastest localized flows are sonic. Besides ensuring a smooth attached flow over the skin of the airplane, the absence of shock waves ensures there are no abrupt changes in pressure from point to point along the airframe. Such jagged and fluctuating distributions of aerodynamic force would produce large stresses and torques on airframes, and require they be much more robust. Robust equals heavier equals smaller equals less payload equals more fuel consumption equals unprofitable civil air transport like the now-retired Concorde. The upper speed limit for AF447, at 35,000 feet in clear weather, was 913 kph (567 mph).
The speed of sound depends entirely on the temperature of the air, and as this cools with elevation (below the stratosphere where most civil aviation occurs), the speed of Mach 1 decreases with height. Since stall speed increases with height, an altitude is reached beyond which a given airplane cannot fly. This is called the “coffin corner.” A pilot cruising near this altitude has only a narrow window of safe speed. This pilot must be alert to stay ahead of a stall while not speeding too quickly and subjecting the airplane to large fluctuating forces pounding and ultimately breaking it. AF447’s speed window at 10.67 km altitude was 759-913 kph (472-567 mph, Mach 0.72-0.86).
AF447’s nominal cruising speed of 871 kph (Mach 0.82) was relative to headwinds of about 28 kph, so its speed relative to the earth (ground speed) was 843 kph (524 mph).
If AF447 had only lost its speed data the pilots would used their back-up speed scale (BUSS), described earlier, and the flight would have continued. There had to be additional problems to rob the pilots of the readings on which the BUSS relied, or to distract them from aviating. Additional problems could be natural: the ‘act of god’ catastrophic updraft or turbulence that went undetected by all and disappeared with AF447; the problems could be multiple and simultaneous aircraft systems failures; and the additional problem could be the pilots’ own mistake in becoming absorbed in trying to interpret the cascade of error messages and to reboot their computer systems, and so lose sight of their drifting airspeed until it was too late.
The mystery at this point is that nature does not seem to have been unusually unkind at that time and place, it is hard to believe the airplane would have multiple systems failures and suffer a catastrophic disintegration without some overwhelming external force being applied, and it is hard to believe the flight crew was anything other than highly competent, experienced, prepared and alert.
Question 4. Can lightning more easily penetrate the composite panels of the Airbus A330-200, and this effect initiate the problems of AF447: by causing an electrical fault disrupting computer systems, or sparking a fire or fuel explosion?
The first 20 years of aviation were dominated by composite airplanes, which were made of resin-painted canvas-covered wood frames, a construction method used earlier for canvas-covered canoes. Metal airplanes were built to meet the demands of higher speeds, larger load capacity and greater reliability. Aside from its aerodynamic and mechanical functions of producing lift, reducing drag, and containing cabin pressure, the surface of a metal airplane has the electromagnetic function of acting as a Faraday Cage, shielding the interior (passengers and crew, cargo, fuel system, electronics and control systems) from any external electromagnetic threats, such as lightning.
Electromagnet waves and arcs (like lightning) will easily penetrate composite panels unless they contain layers of metal foil or metallic fibers, which are connected to grounding points so as to short-circuit and bleed away incident electric currents. Composite panels designed for airplane skins must incorporate such metallic lamina to shield the aircraft from lightning, and to ensure that no external electromagnetic emissions can penetrate to sensitive electronic systems within the airplane and interfere with their operation (electrical noise shielding). Engineers are aware of these requirements and have standards (and regulations) to guide their design efforts.
The electronics and computer systems in airliners today are so complex and sensitive that the electromagnetic shielding has to be a critical part of the design of the airframe. Ideally, a new design is tested against real electromagnetic waves and electric arcs, and not just “virtually” with computer simulations, to verify the Faraday Cage performance of the structure. Since the average airliner experiences about one lightning strike a year, reality eventually weeds out the bad designs.
The fact of the automatic messages from AF447 shows that electrical power was available until at least 2:14 UTC that day, there were no indications of interruptions or surges.
Also, there was no indication that lightning occurred near AF447’s last known position during the time of its disappearance (based on NASA surveillance). Storms in equatorial oceanic regions exhibit an unusual lack of lightning, a fact motivating current meteorological research. See (3) for sources on this topic.
So, it seems lightning is a very unlikely contributing factor to the disappearance of AF447.
Question 5. Do composites degrade more easily and quickly than aluminum and steel, and are composite airplanes more fragile that all-metal airplanes?
The contemporary use of composite materials for aircraft structures is very new, and there is less than twenty years experience with them in the field. From the very studies that were used to devise these engineered materials, scientists learned about their weaknesses as well. Composites are fibrous or mesh layers (lamina) bonded together by a resin or cement matrix. Shock and cyclic stresses can lead to failure of the material by separation of layers — delamination.
Cyclic stresses can be from pressurization and de-pressurization, or cycles of temperature extremes that cause stresses by thermal expansion and contraction, or severe vibration and repetitive torquing. A composite panel may develop an interior separation that remains unnoticed for some time before the complete failure of the panel. The integrity of composite airliner panels must to be checked periodically, by visual inspection and acoustic probing (which might be tapping to hear a ‘funny’ sound).
In 2002, airplane mechanics working for the Federal Express delivery service discovered that the hydraulic fluid used in the actuators of an Airbus plane had dissolved some of the composite material of the rudder, causing a separation from control rods, and difficulties during flight. In 2005, a rudder removed for inspection revealed extensive delamination between its outer layer and its inner core; traces of hydraulic fluid were found between these layers in the area of separation.
These and other incidents of composite material-related rudder malfunctions on Airbus planes cast doubt on the ascription of pilot error as the cause of the American Airlines Flight 587 accident of 12 November 2001. An Airbus A300-600 just airborne and climbing crossed into the wake turbulence of a nearby Boeing 747; the first officer made aggressive rudder motions to keep the Airbus plane upright, and the rudder snapped off followed by the vertical fin, leading to a horrific crash into a residential neighborhood of Queens, New York City. What if the strength of the rudder and its joints to its actuators and axle had been seriously degraded earlier?
William John Cox has reviewed many incidents and accidents with Airbus planes in which the composite-material vertical stabilizer and rudder was a key factor. The strength of his doubts about composite rudders is reflected by the title of his article, “Should the Airbus Be Grounded?” ((William John Cox, “Should the Airbus Be Grounded?“))
The overall technical question that has to be answered about composite materials used in aviation is: what causes them to degrade during their service life, and how long is that service life? We can break down the overall question to types of sources of both sporadic and cyclic stress: aerodynamic (pressure), mechanical (vibration, torque, impact, shock), thermal (heated expansion and cooled contraction), chemical (surface reactions with gases and liquids found in aviation, the effect on bulk integrity by the absorption of moisture, gases, volatile organic compounds), electrical (corona and arc discharge effects on surface integrity) and radiative (ultraviolet light embrittlement).
There is no technical reason why composite-material aviation structures should be less safe than their metal counterparts. But, it may be that an equivalent degree of safety would require that composite panels, shells and structures be replaced more often than metal pieces, because the composites may degrade more quickly under the combined actions of the pressurization and deep cooling cycles of flight, the corrosive and embrittling effects of ozone and ultraviolet light, the dissolving and delaminating effects of hydraulic fluids and volatile organic compounds (fuel and solvent vapors), and the fracturing by impact with hail and other hard airborne grit.
The loss of AF447 underscores the need to answer these questions.
An Imagined Final Sequence
Assume AF447 flies into a patch of especially dense and especially cold fog whose supercooled droplets freeze on contact to rime ice, which clings tenaciously; 12 other flights miss as intense a fog freeze. Supercooled fog droplets are small and have low reflectivity to radar, pilots have to tilt their radar antennas down and turn up the gain to see the rain and hail at lower elevations ahead to infer a high concentration of ice crystals and supercooled fog above, assuming there is little horizontal wind shear so the high ice and fog have not moved laterally from their formative updraft and rainout downdraft. But, this can happen as the cloud’s anvil, so perhaps fog freeze is unavoidable if the flight is weaving between storm cells. Rime ice sticks on contact, accumulating into a solid mass with many air pockets. Twenty four steps of an imaginative sequence follow.
1. Gradual icing reduces the inlet areas of all 3 Pitot probes, uniformly. The angle-of-attack (AOA) sensor is a weathervane attached to a horizontal shaft at the side of the aircraft near its nose. The AOA measures the angle between the airflow and the longitudinal axis of the airplane. Assume the AOA vane also ices, swiveling gradually to higher angle. Both effects cause a gradual speed-up on auto-thrust (the airplane version of cruise control).
2. Pitot icing blockage becomes severe and non-uniform; a 50 kph discrepancy between probes is recorded.
3. The Pitot system fails at 2:10 UTC, auto-pilot and auto-thrust go to the “alternate” mode, which is comparable to the combination of automatic and manual control used on the Boeing 777. The rudder is no longer limited to only 5 degrees of deflection because the flight control programming presumes the pilots would need the freedom of greater motion to perform recovery maneuvers. The shift to alternate mode is not a failure of the automated system, but the response programmed for the situation.
4. The speed window (“coffin corner”) at 35,000 feet is 757-913 kph (Mach 0.72-0.86). The pilots had set auto-thrust to maintain a speed near 881 kph (Mach 0.83). They are fooled into thinking their present speed is about 834-850 kph because of the last presumably good speed readings they observed prior to the warnings of 2:10 UTC. They assume the current power settings are for this speed, when actually the speed has crept up to 913-929 kph without notice.
5. Arriving at excessive speed causes 1.3 g shaking, which is self-induced but they interpret as atmospheric turbulence. If they were really cruising at 881 kph (Mach 0.83) and had encountered turbulence, then they should have reduced their speed to 819 kph (Mach 0.77). Assuming this is their situation, they try reducing speed by using the ‘no airspeed data’ flying procedure. They throttle back a bit, guessing at a 16-32 kph reduction based on the combination of the AOA sensor (which is iced and showing too high an angle) and the power setting. They assume the power setting accounts for a higher headwind than is the case (because it seems high), and they want to be assured of avoiding a stall, so they actually only reduce power to slow down by 16 kph to 897-913 kph (a good thing, too!), imagining they are now flying at 819-834 kph.
6. The AOA system fails at 2:11 UTC. Either the vane stalk is frozen into position, or the 1.3+ g shaking from excessive speed has caused too many erratic and wide swings of the vane, and it has faced broadside into the flow and become heavily balled up in ice. So, speed guessing is now nearing impossible. They are at about 897-913 kph when they should be 819 kph, assuming turbulence; and there may actually be some real turbulence as well. The majority of the “turbulence” they are experiencing is really the buffeting effect of excessive speed caused by the erratic shock and pressure jumps along the fuselage, wings, tailplanes, vertical stabilizer and rudder during transonic cruise. At 2:12 UTC, air data discrepancies are flagged; perhaps icing and transonic flow (shock wave effects) prevent other measurements such as of total air temperature.
7. Swept-wing transports have a tendency to swing back and forth in a lateral rolling motion called a Dutch Roll. A combined yaw and roll make the nose point left and the right wing dip (or go into the opposite combination), which is countered by the ailerons to level the wings, and the rudder to steer back on track. But, the lag in response swings the plane past straight and level into a nose pointing right and the left wing down attitude. The Dutch Roll is an oscillation between control inputs and lateral swings. Part of the automatic flight control system is a yaw damper, a slight shifting of the rudder back and forth as needed to keep the airplane straight and level.
At 2:13 UTC, AF447 was flying at excessive speed, the surrounding atmosphere may have exacerbated flight instability by being turbulent, and the flight control system no longer limited rudder deflection to 5 degrees. Yaw damping became ineffective. Because of the 1.3+ g shaking and the shock-induced flow disruptions of transonic cruise, the responses to the deflections of the ailerons and rudder became erratic, and an amplifying Dutch Roll oscillation sets in.
8. A big tail swing right is countered by a rightward rudder deflection of greater then 5 degrees, and the combined moment (torque) to the right and the air resistance against the vertical fin (to the left) puts a greater then 2.5 g load on the vertical stabilizer, and snaps the entire fin-plus-rudder assembly off to the left.
9. The loss of the vertical stabilizer releases resistance to the rightward moment, and an instant angular acceleration of 3.5 to 5 g, or more, swings the tail rightward.
10. The rear pressure bulkhead in the fuselage has a pressure force directed rearward, from the pressurized cabin and cargo hold toward the unpressurized tailcone. During a rightward tail swing, this force points to the back and rightward. At the same time, the rightward moment acting on the tailcone puts a lateral force on it, which is to the left and increasingly back during the rightward swing. With the tail wagged right, the rear bulkhead is tilted forward on right side, backward on left side, and the resultant force on it is more or less straight back. This causes a rotation of the bulkhead so as to open its seam on the right side of the fuselage, breaching the pressure seal and allowing the cabin to de-pressurizes rapidly.
11. An automatic signal sent at 2:14 UTC announces cabin de-pressurization.
12. The unimpeded rightward tail swing sweeps the right wing square into the airstream while the airplane is near its maximum speed, about 881-913 kph (Mach 0.83-0.86). This swings the right wing leading edge forward at a higher relative speed than Mach 1, so it moves forward of the leading shock.
13. The shock extends along the middle chord of right wing, now angled more squarely into the flow, and causes flow separation behind it, with a complete loss of lift; shock stall.
14. The plane’s nose is yawed left in a rightward tail swing, the right side losses lift force while left keeps it, and the result is a sudden strong moment causing a rotation (perhaps 5 g) about the plane’s longitudinal axis: left side/wing up, right side/wing down.
15. The excessive right twist of the fuselage causes engine pylons to fail. Engine number 1 (left side) breaks off — cutting electrical power — rotating in an upward swing right, smashing into the bottom of the left wing near the wing root and trailing edge, and then smashing into and through the left side of the fuselage just past the left wing root.
16. Engine number 2 (right side) swings up and right to twist bottom-up through the right wing leading edge, outboard of the engine location, and the outer wing then snaps off by rotating about the rip, with a tip upward motion. Air blast through its underside blows off upper surface spoilers like the one recovered by the Brazilian Navy.
17. The tailplanes probably snap off at the same time as the engines.
18. The reduction in mass on the right side, relative to the left, gives a boost (less inertia and drag) to the rightward roll underway.
19. The rear section of fuselage twists off from its remaining right side connection with a leftward swing, and the tailcone section separates from it, tearing off from the right to left side of its pressure bulkhead seam.
20. The interior of the fuselage originally behind the wings experiences an air blast through its forward open section toward the tail end; many panels and weakly attached objects are blown out.
21. The still intact assembly of forward fuselage plus right wing stub plus left wing continues to roll completely over while also yawing back and forth, for several cycles. The wing experiences lift forces that make the entire body spin, like a maple seed pod, whose single airfoil causes it to gyrate during a swinging descent.
22. The angular force at the left wingtip and at the cockpit end of the fuselage are greatest, so the fuselage snaps apart aft of the cockpit and also ahead of the left wing root, while an outboard length of left wing also snaps off.
23. The sections of the airplane that fall are: the vertical stabilizer with its rudder (recovered by the Brazilian Navy), the tailcone (with or without tailplanes), the rear cabin section (probably further ruptured during descent by air blast), the engines, the right wing outboard of the number 2 engine location; then after a bit of ‘maple seed’ auto-rotating helicopter flight as a unit: the cockpit section of the forward fuselage, another length of the forward fuselage, an outer length of left wing and the wing root section of the fuselage with the remaining wing stubs.
24. The four sections of the cabin (the tailcone is a fifth fuselage section) guessed here might experience further air blast rupture and content ejection as they descend; and the large structural remnants hitting the water would then suffer collision fragmentation.
What’s Next?
Perhaps some day we will know the real sequence of events and apply its lessons to improve our aircraft, or modify our air transport habits.
To move beyond imagination we need more facts. If the voice and flight data recorders are ever recovered (lost under the ocean over a month at this point), then investigators will learn much more. The public may learn more soon because the French Investigation and Analysis Bureau (BEA) is set to issue an initial technical report on the 2nd of July.