On June 1, 2009, Air France Flight 447 was cruising from Rio de Janeiro to Paris when suddenly the communications were lost, and debris from the flight was later recovered from the Atlantic Ocean. The investigation revealed several issues that caused the flight to crash, which would later be addressed to improve flight safety.

Flight Details

Air France Flight 447 originated from Rio de Janeiro International Airport (GIG) and flew to Paris Charles de Gaulle Airport (CDG). An Airbus A330-200 operated the flight with registration F-GZCP. This A330 had its first flight on February 25, 2005, and was 4.3 years old at the time of the accident. There were 216 passengers and 12 crew members on board.

The flight crew consisted of three people who had to comply with a 10-hour permitted flight time rule. Hence, there was a captain, a relief first officer, and a first officer. Of the twelve crew members, 11 were French, and one was Brazilian. Notable passengers include Prince Pedro Luiz of Orléans-Braganza, the grandnephew of Grand Duke Jean of Luxembourg. Silvio Barbato, a famous composer, was also on the flight to Kyiv.

The Incident

The flight departed Rio de Janeiro at 7:29 p.m. local time and was expected to arrive at Paris 10 hours and 40 minutes later. Two hours and 36 minutes after takeoff, the captain woke up the relief first officer for him to take over his place. After briefing the two first officers, he left the cockpit six minutes later.

Seven to eight minutes after the captain left, the A330 entered icing conditions, and ice began accumulating in the pitot tubes used to measure aircraft speed. As a result, erroneous speed information was sent to the computers, which caused the aircraft to disengage the autopilot and the auto thrust and change its control law from normal to alternate. When a control law changes as such, some maneuvering protections are removed, making the aircraft susceptible to danger.

The aircraft had started banking to the right due to turbulence by then. The co-pilot in the right seat moved his control stick to the left. However, he overcorrected this due to the increase in sensitivity to alternate law. He simultaneously applied full nose up by fully pulling back his control stick, causing the stall warning to sound. The reason for this maneuver is not explained and was unnecessary in the circumstances. As a result, the aircraft climbed rapidly, reaching a maximum altitude of 38,000 feet (11,582 meters) with the engines operating at TO/GA, equivalent to full throttle.

As the aircraft descended, it reached an extreme nose-up attitude of 30 degrees and began to stall as it lost lift to the wings. Due to the flight being in alternate law, the computers did not protect the aircraft from entering a stall. The co-pilot exclaimed that he had no control anymore, and the relief co-pilot responded with "Controls to the left" and pushed his control stick forward to lower the nose. However, the co-pilot was still fully pulling back his control stick, and the two control inputs canceled each other out, with an audible "dual-input" warning sound in the cockpit.

The relief co-pilot called for the captain, and the captain re-entered the cockpit ten minutes after he left and seven minutes after the aircraft entered icing conditions. The plane was still in a stall when he came back, but 20 seconds later, when the co-pilot released his control stick slightly, the nose of the aircraft came down a little bit, and the speeds became valid again, so the stall warning started activating. The stall warning sounded for the rest of the flight, only stopping when the control input increased the nose-up attitude.

The relief co-pilot told the captain that they had lost all control of the aircraft and said "climb" to himself four times. The co-pilot heard this and said, "I have been nose-up for a while!". Realizing the problem, the captain shouted, "No, no, no, don't climb! No, no!". The relief co-pilot, hearing this, told the co-pilot to give control of the aircraft. 

The co-pilot obliged this time; however, it was too late. The aircraft was too low for a stall recovery maneuver, and the ground proximity warning system sounded, warning the crew of an imminent crash. Hearing the warning, the co-pilot once again responded with a full nose-up control input, saying, "We're going to crash! This can't be true. But what's happening?". The last words recorded was the captain speaking, "(ten) degrees pitch attitude.".

Three hours and 45 minutes after takeoff and six minutes after the start of the event, the cockpit voice recorder (CVR) stopped working as the aircraft crashed into the ocean. It hit the sea at a 200 kilometers (124 miles) per hour vertical speed. All passengers and crew died on impact.

Recovery and Investigation

Investigators recovered the black box and CVR from the ocean floor on May 1, 2011, and the next day on May 2, 2011, respectively. The BEA of France, the counterpart of the NTSB, was able to extract crucial data from the devices and investigate the crash of Flight 447.

As the black boxes and CVR were found, the recovery vessel also discovered a debris field, and bodies were recovered from the ocean floor. Along with the 50 bodies previously retrieved from the ocean, 104 were also recovered. The remaining 74 are not found.

According to the BEA aviation accident report about Flight 447, the following was found as the cause of the crash:

• Inconsistencies between the airspeed measurements leading to autopilot disconnection and the change of flight law to alternate law
• Inappropriate control inputs leading to destabilization of the flight path
• The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure
• The crew not identifying the approach to stall, their lack of immediate response, and the exit from normal flight.
• The crew's failure to diagnose the stall situation and, consequently, a lack of inputs that would have made it possible to recover from it

Essentially, the main causes can be seen as the following:

• The accumulation of ice rendered the airspeed indicators erroneous
• The inappropriate control inputs of the co-pilot

Preventing Similar Incidents

The BEA suggested that A330/A340 (as the A340 largely shares the same basics as the A330) operators check for related incidents regarding pitot tubes blocked by icing. Investigations were conducted on two other Air France flights, one on an A330 and the other on an A340. A TAM A330 flight was also investigated as the flight identically experienced an airspeed inconsistency while flying over the Atlantic Ocean. 

Also of concern was the side-stick control issue. All modern Airbus aircraft are equipped with side sticks, which each pilot independently controls. This means that both pilots can make different control inputs, which can lead to the dual-input situation seen in Flight 447. 

This issue was again shown in the Air Asia Flight 8501 crash, which also stalled and crashed into the Indian Ocean. To remedy this issue, new technology is being developed using force feedback to make both pilots communicate the feel of control inputs.