When the “impossible” happens

May 25, 2011 by Bruce Landsberg

Looks as if we’re about to learn the probable cause on the loss of Air France 447, the Airbus 330 that disappeared over the South Atlantic in convective weather about two years ago. The amazing discovery and recovery of the flight data recorders is a tribute to the skills and perseverance of the search teams. It is miraculous. The preliminary data from the FDRs shows that the aircraft was probably flyable but automated systems may have been dropping off line in steady succession as the computers were fed conflicting data due to icing . Please note there is more to be learned here and it’s not the final word.

The aircraft was up high and flying in a narrow portion of the flight envelope between over speed and stall. At some point the automation may have handed the aircraft back to the pilots and here’s where we’ll find out what the crew did or didn’t do. Was it out of trim? What were the thrust settings? What was the pitch attitude and bank?

Without being overly speculative, it may be that the “impossible” happened with compound system failures and a combination so improbable that there wasn’t a procedure or even a simulator scenario to cover it. The crew was overwhelmed and unprepared. Picture this – you’ve been airborne for 4 hours and everything is proceeding smoothly. You’ve flown thousands of hours and crossed the inter-tropical convergence zone dozens, maybe hundreds of times. Thunderstorms are a way of life here and one just works around them – there’s always been a way through – before.

Jet upset – something that used to be talked about much more in the dawn of the jet age – has never completely gone away. With better aerodynamics, more powerful engines and sophisticated autopilots it has become a rarity but stuff still happens. Did that happen? If the aircraft stalled it could be a long ride down and unlike light aircraft, big jets don’t recover easily.

Consider another area where we’ve seen the impossible. Dual engine failure is considered extremely unlikely and yet due to bird indigestion, extremely heavy rain or fuel interruption jet airplanes have become gliders. Happens often enough that crews should train for it. The Sioux City DC-10 accident decades ago where an improbable uncontained engine failure wiped out all three hydraulic systems was considered impossible. Stuff happens.

Retain just a bit of skepticism when someone says that something is “impossible.” Basic pilot skills never go out of style and perhaps even with the most sophisticated aircraft, it’s good to sometimes just fly the aircraft. Are your skills up to par? When was the last time you flew without a moving map? What about flying an approach on backup instrumentation? It’s easy to criticize other pilots who are no longer with us – a bit harder to know how we would measure up in a similar complex and confusing situation.

That the French are looking at criminal charges is not helpful and topic for another blog.

The more things change, the more they stay the same!

Bruce Landsberg
Senior Safety Advisor, Air Safety Institute

ASI Online Safety Courses  |  ASI Safety Quiz  |  Support the AOPA Foundation

  • Mark McCormick

    If the pitot tubes iced up then the airplane reverted from normal law (full protection)
    to direct law (control movement proportional to stick movement). This problem is not a big deal.

  • D. Norkus

    It seems as if the theory about what happened (and actions not taken) presented in the NOVA Crash of Flight 447 is about to be proven true. (The episode is viewable online.) Pitch + Power = Airspeed when your A/I becomes unreliable, no matter what size plane you are in. They were not the first crew to face this situation in an Airbus, only the first to die from it…RIP

  • R. Brown

    Yikes! Who would have thought that the autopilot disengaging precipitated the crash? I thought man was still superior to machine; at least for now. Also seems hard to believe that a stall at 35,000 ft could not be corrected by the time they reached the ocean’s surface. RIP

  • Thomas Boyle

    It’s my impression that
    – the kind of “seat of the pants” skills useful in operating lightly-loaded straight-wing airplanes at low altitude are relatively unhelpful in operating a heavily-loaded swept-wing airplane in the “coffin corner” of the flight envelope at high altitude
    – call it being “overly reliant on technology” if you wish, but depending on circumstances, hand flying an airplane at high altitude can be difficult or downright impossible, and especially so without any reliable airspeed indications. When you add the fact that this happened at night and possibly without a good visual horizon, matters get even worse.
    Bruce, any comment on this?

  • Bruce Landsberg


    My experience with big swept wing jets at altitude is non-existent. I have limited expereince with small jets both swept and straight wing and they are all a bit sensitive close to service ceiling. Human pilots would rapidly tire of constant hand flying.

    That said, I think flying attitude – the pitch power realationship is what’s called for here. Air Safety institute Chief Instructor JJ Greenway has big jet expereince and he should be weighing in shortly.

    As I mentioned above – this is a tough situation with the aircraft probably buffeted by turbulence, lots of warnings going off, possible lightning and it’s dark. Thanks for commenting.

  • JJ Greenway

    Actually, I’d disagree with that, Mr. Boyle. Stick/rudder/needle/ball/airspeed skills developed in “lightly-loaded straight-wing airplanes” figure quite heavily in controlling an airplane of this size once it’s off autopilot.

    I used to regularly try to keep my hand flying skills sharp by trying to spend an hour or so on each Atlantic or Pacific crossing with the autopilots off. Granted, take out airspeed indication and throw in the cacophony of deafening warnings and things might go to Hades in a shopping cart in a hurry.

    As long as they keep certifying airliners with sticks or yokes, they’ll continue to be approved for hand flying. Regardless of the altitude or instrumentation.

  • Jacques BEAUDEAUX

    Having flown the A320 at the begining (1988) I can assure you that this a/c was a revolution and this revolution has not yet ended, we were faced with stange events so stange that even AIRBUS was unable to explain the answer was it’s impossible. The tragedy of AF 447 confirm that some stange things still happen in the software, almost every time a bug has been fixed an other one is on its way. I’ve been faced with this kind of events fortunately I’ve escape bad issues by returning back to basics

  • Elias J Vujovich

    As to the crash of the Airbus, it seems that a simple GPS such as a Garmin396 mounted somewhere on the panel could have provided a backup display NOT relying on the pitot system. At least then they could have a synthetic AI to double check against. On a multi million $$$$ jet, not to have such a simple backup system seems irresponsible since we know a total failure of the pitot system is impossible, right???

  • Thomas Boyle

    Bruce, JJ,
    I have zero experience of these jets myself! I understood that the allowable speed range is quite narrow, and that without an ASI it would be challenging to stay safe with just attitude (from an attitude indicator) and power setting. Perhaps the problems of operating these aircraft at altitude have been over-hyped to me.

  • David Adams

    Everyone concetrates on the aircraft in discussing Flight 447. But the NOVA show identified another inportant issue that faced this flight. The rain! Flying into heavy thunder storms can quickly saturate the onboard weather radar’s ability to accurately depict the conditions ahead and blind the pilot to the true extent and intensity of the rain. Creating a deception that lures the pilot to fly into what may well be one of the worst parts of the storm.

    We tend to think of this as a problem of light twin and heavy single private pilots flying GA with little training and/or experience in the use of their onboard weather radar. But as shown in NOVA’s program, especially hundreds of miles from the support of ATC’s ground based radars, this is a monster waiting to catch any pilot in a moment of complacency.

    Any airline aircraft, but particularly aircraft such as the Airbus family with their plethera of computers taking over partically every aspect of the flight, combining with years of uneventful repetition are prime targets for just such complacency. And when the computors fail, it all falls back on those long forgotten stick and rudder skills – no matter how big or sofisticated the airplane.

  • Ward H Zimmerman

    Being a private pilot (ex-Navy WWII), and having designed the first all-electronic propulsion control system used in production aircraft (PW2037-powered 757, certificated in October 1985), I believe that EADS approach is wrong to take the pilots out of the loop (Airbus thrust levers don’t move in proportion to thrust; they use “detents” instead). If the pilots in AF447 had had the visual (and tactical) clue that the autothrottle had decreased thrust to idle, that information would have reduced some of the mystery to them.

    On the Air Data side, a colleague and I patented a scheme using air data from the engine inlets (engines with electronic engine controls require air data for accurate operation) as back up for the aircraft primary air data system. With the addition of two more air data sources, the total loss of this critical information might have been avoided.

    Finally, as has been well-said by JJ Greenaway, practice in hand flying your airplane can come in real handy when the “impossible” happens — which apparently happens more often than desirable with the Airbus family.

  • Mike Finkle

    Belowis some information about this accident that I received from a good buddy of mine at United Airlines. This information came from the gentleman listed, but I do not know whee he obtained it.

    If the information is correct, one can see how the crew (all three involved) may have been misled by some of the warnings they received and the timing of those warnings. For example, doing the right thing by decreasing angle of attack, and then subsequently getting a stall warning that was not occurring prior to initiating that proper corrective action. However, there are still many unanswered questions. The first, and perhaps most inexplicable, is why they went into a 7,000 FPM climb while so close to “coffin corner”, which caused the stall in the first place.

    Here is that info:

    Air France 447: the facts and what’s behind them

    By David Learmount on May 27, 2011 3:48 PM

    This is what the Air France A330’s trajectory looked like during its last few minutes, starting when everything was still fine…

    The BEA’s simple three-page factual summary is here. It doesn’t attempt to judge, it just reports facts. Conclusions will come with the final report.

    From this point I will number the paragraphs so I can refer back to information already mentioned. The paragraph numbers are not intended to tally with those on the diagram – it has its own key directly below it.

    1. On page 1 the report sets the scene on the flight deck. The captain has gone for a rest, and has been replaced by a supernumerary First Officer. That is standard for long flights.

    2. The aircraft is cruising at FL350 (35,000ft) and there are storm clouds in the area, as there always are in the inter-tropical convergence zone. The two copilots are aware of them. The pilot flying (PF) briefs the copilot who has just taken the captain’s seat that they are in choppy air but cannot climb above it because the aircraft’s weight and the relatively high outside air temperature means that they are about as high as the aircraft can safely go until it has used up more fuel.

    3. A few minutes later the PF makes a sidestick control input which raises the nose and causes the aircraft to climb rapidly to 38,000ft. There was no reason to climb, the PF did not announce an intention to do it, and the aircraft was not cleared by ATC to do so. The natural result of climbing without an increase in power is a loss of speed. But we’ll deal with that shortly.

    4. The problems for the pilots began when the autopilot(AP)/autothrottle (AT) disconnected. The disconnect occurred because there was a temporary disagreement between two independent airspeed sensors (pitot tubes) about what speed the aircraft was flying at. When there is a disagreement between two inputs to the flight control computers, the computers do not adjudicate, they abdicate control to the pilots.

    5. The drill for pilots at that point, according to flight manuals for Airbuses and Boeings alike, is to leave the power where it is and to continue to fly straight and level. That way the aircraft’s speed remains the same as it was, no matter what the airspeed indicators are showing. When the AP/AT trip out the aircraft is fully in trim and the power stays where it is.

    6. The same logic that caused the autopilot disconnect also caused a change to the flight control law, taking it from “normal” to “alternate” law. This robs the pilots of the flight envelope protection that is automatic in “normal” law, but otherwise the aircraft flies in the same way. The main protection they lost was protection against stalling.

    7. The PF verbally acknowledged the fact that the AP had tripped out and that alternate law was in force.

    8. Meanwhile the BEA report says that the airspeed disparity that caused autopilot/authrottle disconnect, lasted for less than a minute.

    9. The crucial moment in this flight came 11s after the autopilot had tripped out. Because of the light turbulence, the aircraft rolled slightly to the right when no longer controlled by the AP, and the PF naturally made a sidestick input to bring the right wing back up. The problem is that, simultaneously he pullled the stick back, pitching the nose up. There is no indication of why he should have done that (see paragraph 3), but a few minutes before this action he had stated that they should not climb (see paragraph 2). He said: “So we’ve lost the speeds”, and then: “alternate law”, so I suspect it was a slightly panicky reaction to the airspeed disparity and the AP/AT trip-out, but it was not a logical reaction.

    10. The result of the PF’s flight control input was a dramatic climb at 7,000ft/min and a similarly dramatic drop in the airspeed because of the climb. The aircraft reached 38,000ft, way beyond the height at which it could have sustained stable flight. Almost immediately upon applying the nose up demand the stall warning sounded twice.

    11. When the stall warning first sounded the PF maintained nose-up pitch, but as the speed dropped with increasing height he applied a nose-down input and the rate of climb dropped from 7,000ft/min to 700ft/min. The aircraft reached a maximum height of about 38,000ft, and at that point the angle of attack was 16deg, which is well beyond the stall.

    12. The stall warning sounded again when the aircraft began to descend, and the pilots selected maximum power on both engines (TOGA). At that height this would not have had the dramatic effect it would have had at a low altitude. But the PF still maintained nose-up inputs, and the trimmable horizontal stabiliser was gradually trimming further and further nose-up because those inputs were maintained.

    13. The horizontal stabiliser eventually stopped at a 13deg nose-up setting, and the report says it stayed in this position for the remainder of the flight. At about the same time the airspeed disparity that had caused the confusion resolved itself, and the airspeed on both ASIs increased to 185kt in response to the high power.

    14. The captain re-entered the flightdeck 1min 40s after the AP/AT disconnect, and about that time the stall warning stopped because the recorded speeds become invalid. The BEA explains that this occurs because, when the indicated airspeed drops below 60kt, the angle of attack measurements become unreliable and are rejected.

    15. The aircraft by this time was descending through 35,000ft with an angle of attack exceeding 40deg, a nose-up attitude of 15deg or less, and a rate of descent of about 10,000ft/min, and the aircraft was oscillating in roll up to 40deg each way. The pilot’s response, says the report, was to pull back the stick to the stops (full nose-up demand) combined with full left roll demand for about 30s.

    16. At some point the pilots had taken the throttles out of the TOGA detent and set them to idle thust. The PF declared he had no valid instrument indications. The BEA does not explain this, but it may have been caused by the very high angle of attack.

    17. Then the PF made some nose-down inputs, the angle of attack decreased, and the airspeed readings became valid again, causing the stall warning to recur.

    18. The BEA observes that whenever the angle of attack readings were valid, they exceeded 35deg, so the aircraft was deeply stalled during its entire descent.

    19. The aircraft, at impact with the water, had a nose-up attitude of 16.2deg, it was 5.3deg left wing low, and had a vertical speed of -10,912ft/min.

    I’m sure there is still much more information to be assessed even if what I presented above is all correct. While we don’t yet have a specific finding of “probable cause”, it certainly appears that this may have been a completely avoidable accident… one that may have come about as a result of somewhat unusual circumstances, but which could have been prevented through the application of the most basic of piloting skills in response to those unusual “partial panel” circumstances.

  • Cary Alburn

    Old cliche: To make the houses get larger, push the stick. To make them get smaller, pull the stick. To make them get larger again, pull harder.

    The physics of this may be obvious, but the “why” isn’t. Why did not the PF or the PNF see that the aircraft was in a severely steep angle of attack? All the signs seemed to have been there–declining airspeed (perhaps compromised by faulty airspeed readings), stall warnings, mushy roll response, nose up pitch accompanied by rapid descent, etc. And doesn’t the Airbus have an AOA indicator on the panel? Or do some of today’s airline pilots get too complacent about the infallibility of the bells and whistles and thereby forget the basics?


  • Pranesh Dey

    I’m not a pilot but many of you who have commented here are. So I cannot make any expert observations but here’s what I’d like to say. BEA’s initial report carries very limited text of the cockpit conversation between Air France 447’s three pilots. Nowhere does any pilot yells something like: “Put the nose down,” despite the aircraft being in a nose-up attitude. So I’ll patiently wait for BEA’s final report to understand why the pilots did what they did in those final moments. At this stage, for me it’s difficult to visualise the difficulties the pilots were facing. The kind of g-force they were encountering as the plane plunged seawards? Whether they were able to move their hands and legs freely? What kind of mental model the pilot’s had of the plane in relation to the surroundings and how different was this from the plane’s real attitude in relation to the surroundings. Had they lost SA? Why would such experienced pilots not mind the Attitude Indicator? I believe the final report will answer all my questions and give me a clear understanding of the crash.
    Similar to CVR, should future aircraft be equipped with something like, say, Cockpit Video Recorder? Which will give investigators a view inside the cockpit in the event of a crash.
    Finally, I’m reproducing some paras from an article I read in Flightglobal. The article headlined ‘Industry sounds warnings on airline pilot skills’
    appeared under the byline of Mr. David Learmount. I quote from the piece:

    Federal Aviation Administration test pilots conduct stall recovery the classic way: push the control column forward to unload the wing and gain airspeed and, when the wing is no longer stalled, apply power until a safe airspeed is attained and the resulting loss of height may be recovered. The technique most US carriers teach, the Advanced Aerodynamics Workshop heard, is to act at the stall warning, maintaining pitch while simultaneously applying power. No-one at Geneva was certain as to when and why this technique came to be adopted in place of the classic stall recovery.

    One suggestion was that it might have dated from the 1950s, because it would have worked with piston-powered aircraft, where power application would immediately provide propeller-driven slipstream over the wing, and where the opposing power and drag vectors act through much the same point.

    In modern jet aircraft there is no extra slipstream over the wing when power is applied. The power vector is acting below the wing and the drag vector is slightly above it, leading to a natural pitch-up moment on power application, which can upset the stall recovery – especially if the wing has not been properly unloaded.

  • John Bejot #00555332


    In your article “When The Impossible Happens”, it is the thunderstorm like no other that will get you. Having an experience just like those pilots experienced,
    but with a successful conclusion, I think much more rainy day training is needed.

    When you are being slammed against your seat belt, the instrument panel is a blur, the VSI is reading plus/minus 6000 fpm, plus a noise level that drowns out the engine noise, you fall back on “all” of your training.

    A simulator program that puts all of that in to give training plus a respect for
    weather which I suspect was missing.

    Good article. Keep up the good work.

    John Bejot #00555332

  • Pranesh Dey

    Agree John. Bruce speculates about whether the AF447 was out of trim? Read a true account many years ago in a book by Capt. Stanley Stewart. A 747 suddenly went into a dive when the autopilot disengaged. The pilot was Capt. Ming.

  • http://don'tknow C Boswell

    When you Don’t know your Angle of Attack, bad things happen.

    OK i’m a guy that’s done the following,
    Naval Aviator, Attack community, not patrol or helo
    Airline Captain, (Major Airline, typed in 737, DC-9, DC-10, currently flying).
    20,000+ hrs, flying for 37 years.
    Flight Instructed in the Navy.
    Built my own airplane, etc.

    Hmmm, another case of the pilots not having the instruments available to tell them they were going to stall, or had already stalled, when all the speed and temp probes were iced over.

    Is it really pilot error, or did the aircraft manufacturer, this also goes for Boeing, not provide a stand alone Angle of Attack instrument? One that doesn’t get its information derived from some black box like the Air Data computer.

    I’m sure the investigators will rule its PILOT ERROR. But if I was a surviving spouse I might consider suing the airplanes maker for not providing the pilots with a separate, stand alone, AOA instrument. In other words, the manufacturers accepted the fact that if the probes iced over, something that would never happen right, that the pilots would be unable to fly the aircraft while IFR. (By the way, their are AOA systems available that do not need a heated probe. The AOA system that measures the difference in air pressure, between the top and bottom of the wing, would have saved this crew and airplane because it doesn’t require heating of a probe).

    In this case, as in the other A-330 incidents at hight altitude, the pilots appear to have lost control of the aircraft when the airplane experienced high Altitude Icing. When this occurred, as it had quite a number of times previous to this incident with other airlines, the pilots received erronious airspeed information. If a AOA gauge HAD been available, then the pilots could have been trained to cross check it with the airspeed instruments. This is not rocket science.

    What is it with the Feds and Aircraft Manufacturers, where they continue to insist that a AOA gauge is not necessary. Look at all the previous GA and Airline accidents that could have been prevented had a AOA gauge been present in the cockpit. Not to mention the near accidents that could have been avoided.

    In conclusion, the historical data suggests that the death rate, is acceptable, to the feds and airline execs, when it comes to aircraft loss of control from airspeed indication failure.

    Its interesting to note that the highest accident rates in GA, loss of aircraft control on approach, and this incident are related. Both are caused by the pilot/s not being given Angle of Attack information when it was critical to the safety of flight. This is a failure of the approving authority, the FAA and their European counterparts, not the pilots.

    Finally, the Feds, like all bureaucracies, won’t change, The change in this situation will come from the Insurance companies. After reviewing the data for both GA and Airlines, the insurance companies will come to the conclusion, for economic reasons only, that to fly a fixed wing airplane, without an AOA gauge, is bad for the insurance business. i’m sure the stockholders will put pressure on the insurance companies execs to mandate AOA changes.

    They will require that airplanes be refitted or that new ones be certified with Angle of Attack info for pilots. This will be required or you will not receive an insurance policy regardless of what the Feds want.

    Of course pilot training will change. When it comes to the airlines, the Feds will now require a course in how to deal with loss of aircraft control at high altitude. For GA, the course will be, loss of aircraft control at low altitude and how to recover. This only works if your high enough or you have Angle of Attack information provided to you in the cockpit.

    My two centavos