Seven miles above the empty expanse of the South Atlantic Ocean, on May 31, 2009, an Air France A330 passenger jet cut through the midnight darkness. The plane had taken off 3 hours earlier, climbing from Rio de Janeiro on a northeast heading, its navigation computers hewing to a great-circle route that would take the flight 5680 miles to Paris.
At 10:35 pm local time, one of the co-pilots on the flight deck radioed Atlantico Area Control Center in Recife, Brazil, and announced that the plane had just reached a navigation waypoint called INTOL, situated 350 miles off the Brazilian coast. The waypoint lay just shy of the Intertropical Convergence Zone, a meteorological region along the equator famous for intense Âthunderstorms. Staff at Atlantico acknowledged the transmission and received the airplane's reply: "Air France Four Four Seven, thank you."
It was the second time within the past 12 hours that the jet, F-GZCP, had crossed this stretch of ocean, having flown the Paris-to-Rio leg with only 2 hours to refuel and load passengers before departing again. Such was the lot of the four-year-old long-haul plane: a repeated cycle of flight and turnaround, as rhythmic and uneventful as the phases of the moon. But the routine was about to be broken.
After receiving AF 447's transmission, Atlantico asked for the estimated time it would take the aircraft to reach the TASIL waypoint, which lies on the boundary of the Atlantico and the Dakar Oceanic control areas. At that point communication would pass from Brazil to Senegal. AF 447 did not reply. The controller asked again. Still, there was no reply. The controller asked a third and fourth time, then alerted other control centers about the lapse.
According to the flight plan filed by AF 447, the plane should have crossed into Dakar Oceanic at 11:20 pm, at which point the flight crew would have made radio contact with Dakar to confirm their position. They didn't. They also failed to contact the Cape Verde controller, whose airspace they were supposed to enter at 12:43 am. As time went on, controllers along the aircraft's route began to worry that the problem was more than just a communications breakdown.
By 3:47 am, the flight should have appeared on the radar screens of Portuguese air traffic controllers. It didn't. An hour later, Air France contacted the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA), the French equivalent of the United States' National Transportation Safety Board. By 8 am, French authorities officially reached what had become a grim, unavoidable conclusion: Air France 447 had disappeared.
Vanishing without a trace is not supposed to happen in this day and age. The globe is crisscrossed by constant ship and air traffic. A constellation of satellites orbits overhead, and communication is nonstop. Yet, for a few days in early June, it seemed that the impossible had happened. Air France 447 and the 228 people onboard were simply gone. There was no distress call or wreckage; there were no bodies.
Within hours, the French government deployed a search-and-rescue airplane near the TASIL waypoint. Over the next few days a flotilla of ships and aircraft arrived to assist the search operation, including a French nuclear submarine and a research vessel withan unmanned deep-water submersible that were dispatched to find the flight data recorder, or black box.
At 10:35 pm local time, one of the co-pilots on the flight deck radioed Atlantico Area Control Center in Recife, Brazil, and announced that the plane had just reached a navigation waypoint called INTOL, situated 350 miles off the Brazilian coast. The waypoint lay just shy of the Intertropical Convergence Zone, a meteorological region along the equator famous for intense Âthunderstorms. Staff at Atlantico acknowledged the transmission and received the airplane's reply: "Air France Four Four Seven, thank you."
It was the second time within the past 12 hours that the jet, F-GZCP, had crossed this stretch of ocean, having flown the Paris-to-Rio leg with only 2 hours to refuel and load passengers before departing again. Such was the lot of the four-year-old long-haul plane: a repeated cycle of flight and turnaround, as rhythmic and uneventful as the phases of the moon. But the routine was about to be broken.
After receiving AF 447's transmission, Atlantico asked for the estimated time it would take the aircraft to reach the TASIL waypoint, which lies on the boundary of the Atlantico and the Dakar Oceanic control areas. At that point communication would pass from Brazil to Senegal. AF 447 did not reply. The controller asked again. Still, there was no reply. The controller asked a third and fourth time, then alerted other control centers about the lapse.
According to the flight plan filed by AF 447, the plane should have crossed into Dakar Oceanic at 11:20 pm, at which point the flight crew would have made radio contact with Dakar to confirm their position. They didn't. They also failed to contact the Cape Verde controller, whose airspace they were supposed to enter at 12:43 am. As time went on, controllers along the aircraft's route began to worry that the problem was more than just a communications breakdown.
By 3:47 am, the flight should have appeared on the radar screens of Portuguese air traffic controllers. It didn't. An hour later, Air France contacted the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA), the French equivalent of the United States' National Transportation Safety Board. By 8 am, French authorities officially reached what had become a grim, unavoidable conclusion: Air France 447 had disappeared.
Vanishing without a trace is not supposed to happen in this day and age. The globe is crisscrossed by constant ship and air traffic. A constellation of satellites orbits overhead, and communication is nonstop. Yet, for a few days in early June, it seemed that the impossible had happened. Air France 447 and the 228 people onboard were simply gone. There was no distress call or wreckage; there were no bodies.
Within hours, the French government deployed a search-and-rescue airplane near the TASIL waypoint. Over the next few days a flotilla of ships and aircraft arrived to assist the search operation, including a French nuclear submarine and a research vessel withan unmanned deep-water submersible that were dispatched to find the flight data recorder, or black box.
Air France Flight 447 Flight PathOn May 31, at 7:30 pm, Air France 447 leaves Rio de Janeiro on an 11-hour flight to Paris. After 3 hours in the air, the Airbus 330 plunges into a wall of towering storm clouds looming 350 miles off the Brazilian coast. The airplane--with 216 passengers and 12 crew members onboard--never emerges. | |||
 | |||
| 8:19 pm AF 447 contacts air controllers in Recife, Brazil. | 9:30 pm AF 447 passes over the city of Natal, on the Atlantic coast. | 10:30 pm AF 447 reaches INTOL GPS navigation waypoint. | 10:35 pm AF 447 radios final verbal message (to Atlantico Area Control Center): "Air France Four Four Seven, thank you." |
| Final Moments An automatic messaging system onboard AF 447 transmits a torrent of text messages via satellite to the airline's headquarters in Paris. The 24 encoded texts, reported in just 4 minutes, provide clues about the flight's final moments. | 11:10 pm The flight control computer receives unreliable sensor data; in response, autopilot disconnects. | 11:11-11:12 pm Speed-limit settings shut down. Safeguards that help pilots prevent rudder damage now fail. | 11:13-11:14 pm Loss of backup instruments that measure pitch angle and velocity. Loss of all internal reference, including heading, vertical speed, flight-path vector and position. Last transmission: a vertical speed advisory, triggered when the cabin drops faster than 30 feet per second. |
Yet for days nothing was found. The only clues to the plane's fate were automatic messages that the onboard maintenance computer transmitted by a datalink system called the Aircraft Communications Addressing and Reporting System (ACARS). The system transmits text messages via satellite to ground stations, which then forward them on landÂlines to the intended destination. In just a 4-minute span, the system had broadcast 24 reports to Air France's dispatch center in Paris, each concerning problems with subsystems onboard the aircraft.
At 11:10 pm, about 35 minutes after AF 447's last verbal communication, the system sent a message that the autopilot had disconnected. Seconds later, it reported that the flight control system was unable to determine the aircraft's correct speed. Subsequent messages cited a cascade of other malfunctions. At 11:14 pm, the final message reported that the airliner's cabin either had depressurized, was moving with high vertical velocity, or both.
ACARS messages are transmitted in a dense alphanumeric code and are used for airplane maintenance, not real-time monitoring of flights by dispatch centers. When investigators realized that the plane was lost, they scrutinized the messages. The story the transmissions told was tantalizing, but inconclusive. Did the error messages suggest a fault in the sensors, or was the flight management system somehow fatally corrupted--perhaps because of a midair lightning strike?
The absence of clues causes concerns that reach beyond the AF 447 investigation. Was the crash a result of pilot error, an unexpected breakdown of vital equipment or a combination of both? Without answers, there is no way to guarantee that another airliner won't suffer the same fate.
A search party from the Brazilian navy recovers the largest physical clue in the Air France 447 mystery: the tail fin, which likely broke off the airplane when it hit the water. (Photograph by Getty Images)
All the attention given to a crash like Air France 447's can obscure an important truth: Commercial air travel is incredibly safe--and getting safer. In 2008, the U.S. fatality rate was fewer than one death per nearly 11 million passenger trips. This impressive record is the result of more than a century of incremental improvements that have been amassed through painstaking forensic analysis.
After each plane crash, investigators study the wreckage, analyze flight data and examine clues regarding flight conditions. Once they have determined a cause, they often help create recommendations that prevent the problem from recurring.
The FAA is determined to cut the already minuscule airliner fatality rate in half by 2025. With this in mind, the agency recently developed a new approach to make safety improvements. In 2007, it began working with airlines to sift through the masses of data that planes record about their normal flight operations, looking for safety improvements that could preempt accidents before they happen, instead of learning these lessons after a plane crash occurs.
The sophistication of aircraft makes this strategy possible. Modern planes are studded with environmental sensors that record flight conditions, while other sensors constantly assess the health of the airplane's subsystems. This information is fed to a central computer, forming a network that resembles the neural system of a primitive organism. At the end of each flight, maintenance crews can easily download the data for analysis. Airlines have been using this information to improve their safety performance since the early '90s, but two years ago the FAA began collecting these records as part of its Aviation Safety Information Analysis and Sharing (ASIAS) system.
This year, the FAA opened the Accident Investigation and Prevention Service to scrutinize the ASIAS data. "We're having many fewer accidents, but the ones we do have are being caused by threats that are much harder to detect," says Jay Pardee, the director of the new office. As an example of the kind of problem that ASIAS data could prevent, consider Comair Flight 5191, which was scheduled to take off from Lexington, Ky., in August 2006. Thinking they were on 7000-foot Runway 22, the pilots failed to get their aircraft airborne before they ran out of asphalt on the runway they were actually on--3500-foot Runway 26. The airplane's wheels clipped an airport perimeter fence and the plane plowed into a grove of trees 1800 feet from the end of the runway. All 47 passengers and two of three crew members were killed. After the accident, the FAA reviewed 25 years of data and discovered that 80 commercial aircraft around the country had either taken off or tried to take off from incorrect runways. "Nobody connected the dots," Pardee says.
Following the AF 447 disappearance, other Airbus 330 operators studied their internal flight records to seek patterns. Delta, analyzing the data of Northwest Airlines flights that occurred before the two companies merged, found a dozen incidents in which at least one of an A330's airspeed indicators--Â4-inch-long, pressure-sensing pitot tubes located on the fuselage under the cockpit--had briefly stopped working. Each time, the flights had been traveling through the Intertropical Convergence Zone, the same location where Air France 447 disappeared.
In the case of the Northwest A330s, the pitot tube malfunctions had been brief and harmless. But what if a severe version of the problem had struck Air France 447 amid more unforgiving circumstances?
At last, on June 6, the multinational search effort began to find evidence of the crash. The Brazilian military recovered bodies and debris floating approximately 40 miles north of the last automatic Aircraft Communications transmission. Over the next two weeks, search vessels retrieved 51 corpses from a stretch of ocean 150 miles wide, along with bits of wreckage--a section of the radome, a toilet compartment, part of a galley--that collectively added up to less than 5 percent of the aircraft. The largest single piece was the tail fin, marked with the distinctive blue and red stripes of the French national carrier.
The most important piece of the wreckage, however, remained missing. More than a month after the plane went down, despite the joint efforts of the French and U.S. navies, the black box still hadn't been found. Given the huge search area, the ruggedness of the undersea terrain and the depth of the water (up to 15,000 feet), locating the recorder, let alone retrieving it, was proving to be an enormous task. Once the unit's acoustic pinger passed its 30-day certified life span, the chances of recovering the black box became virtually nil.
Without the box's data, the only physical evidence of the airplane available to investigators was the mangled wreckage. From the way it had been deformed--in particular, the way the floor of the crew's rest compartment had buckled upward--French investigators determined that the fuselage hit the water more or less intact, belly first, at a high rate of vertical speed. Added to the ACARS messages and the satellite weather data, the evidence began to conform to a possible scenario.
By 10:45 pm, 10 minutes after the last radio transmission, the plane hit the first, small storm cell in the Intertropical Convergence Zone. Fifteen minutes later, it hit a larger, fast-Âgrowing system. And then, just before its last ACARS transmissions, the plane hit a whopper, a multicell storm whose roiling thermal energy rose more than 3 miles higher than AF 447's altitude. Buffeted by turbulence, near the heart of a strong thunderstorm, the pitot tubes froze over. Lacking reliable speed indicators, the airplane's computerized Flight Management System automatically disengaged the autopilot, forcing the co-pilots to fly the airplane manually.
Without autopilot, the pilots had no envelope protection restrictions, which are designed to keep the pilot from making control inputs that could overstress the aircraft. This is particularly dangerous for airliners at high altitudes. The thin air demands that airplanes fly faster to achieve lift, but they still must remain below speed limits. Flying too fast can create a phenomenon known as mach tuck, when supersonic shock waves along the wings shift the aircraft's center of pressure aft and can make it pitch into an uncontrollable nose-dive. Flying too slow can cause a plane to stall.
AF 447's flight crew, disoriented in the storm, uncertain about their speed and buffeted by turbulence, could easily have taken the A330 outside its flight envelope. "The fact that they didn't transmit a mayday would seem to indicate that whatever happened to them happened quickly," says William Waldock, a professor of safety science at Embry-Riddle Aeronautical University in Arizona.
Without more data, this kind of scenario can never be verified completely. But the global aviation community has already taken steps to prevent another accident like AF 447. Within days, Air France replaced pitot tubes on its Airbus planes with ones made by another company, and in July Airbus advised other airlines to do the same. Three months later the FAA turned the recommendation into a regulation.
To be sure, the pitot tubes are not the definitive cause of the crash. Even if they had failed, that alone should not have been enough to bring down an airliner. As in virtually every fatal air crash, what doomed AF 447 was not a single malfunction or error of judgment, but rather a sequence of missteps that crash investigators call the accident chain. "There's always a series of events," the FAA's Pardee says. "That means there are multiple opportunities to intervene and break that accident chain."
In the case of AF 447, the error chain included the co-pilots' decision to fly too close to severe thunderstorms--bad weather that several other pilots, flying similar routes that night, had chosen to give a wide berth. There were certainly other links in the accident chain that pushed AF 447 beyond its limits. But unless the black box is found, we may never identify those links. And that means safety officials might never learn the full lessons of the disaster. To prevent a similar loss of forensic evidence, executives at Airbus say they are now studying alternatives to physical black boxes.
It is feasible to create a system that could broadcast not only text messages like ACARS but comprehensive data about the status of every aircraft, in real time. The aircraft would continuously transmit data to VHF stations within a radius of 125 miles, or by satellite if the plane is farther away.
Airliners in flight could one day stream all sorts of high-speed data, sharing information directly with one another. "It would be a network in the sky," says Bob Smith, chief technology officer at Honeywell, which manufactured AF 447's ACARS. "Aircraft could pass not only information about their location and where they're headed," he says, "but whole data sets. An airliner over Seattle could send its weather radar picture to a plane inbound from Dallas. And the guy from Dallas could pass it along to five other aircraft." Military aircraft already use a similar system; it is not clear if civil aviation will adopt it.
The disquieting truth is that we don't really know precisely what happened to Air France 447, and perhaps never will. The same links in the accident chain could someday take down another unlucky airliner. If they do, improved technology might provide investigators with the data they need to make sure that the next time is the last time.
After each plane crash, investigators study the wreckage, analyze flight data and examine clues regarding flight conditions. Once they have determined a cause, they often help create recommendations that prevent the problem from recurring.
The FAA is determined to cut the already minuscule airliner fatality rate in half by 2025. With this in mind, the agency recently developed a new approach to make safety improvements. In 2007, it began working with airlines to sift through the masses of data that planes record about their normal flight operations, looking for safety improvements that could preempt accidents before they happen, instead of learning these lessons after a plane crash occurs.
The sophistication of aircraft makes this strategy possible. Modern planes are studded with environmental sensors that record flight conditions, while other sensors constantly assess the health of the airplane's subsystems. This information is fed to a central computer, forming a network that resembles the neural system of a primitive organism. At the end of each flight, maintenance crews can easily download the data for analysis. Airlines have been using this information to improve their safety performance since the early '90s, but two years ago the FAA began collecting these records as part of its Aviation Safety Information Analysis and Sharing (ASIAS) system.
This year, the FAA opened the Accident Investigation and Prevention Service to scrutinize the ASIAS data. "We're having many fewer accidents, but the ones we do have are being caused by threats that are much harder to detect," says Jay Pardee, the director of the new office. As an example of the kind of problem that ASIAS data could prevent, consider Comair Flight 5191, which was scheduled to take off from Lexington, Ky., in August 2006. Thinking they were on 7000-foot Runway 22, the pilots failed to get their aircraft airborne before they ran out of asphalt on the runway they were actually on--3500-foot Runway 26. The airplane's wheels clipped an airport perimeter fence and the plane plowed into a grove of trees 1800 feet from the end of the runway. All 47 passengers and two of three crew members were killed. After the accident, the FAA reviewed 25 years of data and discovered that 80 commercial aircraft around the country had either taken off or tried to take off from incorrect runways. "Nobody connected the dots," Pardee says.
Following the AF 447 disappearance, other Airbus 330 operators studied their internal flight records to seek patterns. Delta, analyzing the data of Northwest Airlines flights that occurred before the two companies merged, found a dozen incidents in which at least one of an A330's airspeed indicators--Â4-inch-long, pressure-sensing pitot tubes located on the fuselage under the cockpit--had briefly stopped working. Each time, the flights had been traveling through the Intertropical Convergence Zone, the same location where Air France 447 disappeared.
In the case of the Northwest A330s, the pitot tube malfunctions had been brief and harmless. But what if a severe version of the problem had struck Air France 447 amid more unforgiving circumstances?
At last, on June 6, the multinational search effort began to find evidence of the crash. The Brazilian military recovered bodies and debris floating approximately 40 miles north of the last automatic Aircraft Communications transmission. Over the next two weeks, search vessels retrieved 51 corpses from a stretch of ocean 150 miles wide, along with bits of wreckage--a section of the radome, a toilet compartment, part of a galley--that collectively added up to less than 5 percent of the aircraft. The largest single piece was the tail fin, marked with the distinctive blue and red stripes of the French national carrier.
The most important piece of the wreckage, however, remained missing. More than a month after the plane went down, despite the joint efforts of the French and U.S. navies, the black box still hadn't been found. Given the huge search area, the ruggedness of the undersea terrain and the depth of the water (up to 15,000 feet), locating the recorder, let alone retrieving it, was proving to be an enormous task. Once the unit's acoustic pinger passed its 30-day certified life span, the chances of recovering the black box became virtually nil.
Without the box's data, the only physical evidence of the airplane available to investigators was the mangled wreckage. From the way it had been deformed--in particular, the way the floor of the crew's rest compartment had buckled upward--French investigators determined that the fuselage hit the water more or less intact, belly first, at a high rate of vertical speed. Added to the ACARS messages and the satellite weather data, the evidence began to conform to a possible scenario.
By 10:45 pm, 10 minutes after the last radio transmission, the plane hit the first, small storm cell in the Intertropical Convergence Zone. Fifteen minutes later, it hit a larger, fast-Âgrowing system. And then, just before its last ACARS transmissions, the plane hit a whopper, a multicell storm whose roiling thermal energy rose more than 3 miles higher than AF 447's altitude. Buffeted by turbulence, near the heart of a strong thunderstorm, the pitot tubes froze over. Lacking reliable speed indicators, the airplane's computerized Flight Management System automatically disengaged the autopilot, forcing the co-pilots to fly the airplane manually.
Without autopilot, the pilots had no envelope protection restrictions, which are designed to keep the pilot from making control inputs that could overstress the aircraft. This is particularly dangerous for airliners at high altitudes. The thin air demands that airplanes fly faster to achieve lift, but they still must remain below speed limits. Flying too fast can create a phenomenon known as mach tuck, when supersonic shock waves along the wings shift the aircraft's center of pressure aft and can make it pitch into an uncontrollable nose-dive. Flying too slow can cause a plane to stall.
AF 447's flight crew, disoriented in the storm, uncertain about their speed and buffeted by turbulence, could easily have taken the A330 outside its flight envelope. "The fact that they didn't transmit a mayday would seem to indicate that whatever happened to them happened quickly," says William Waldock, a professor of safety science at Embry-Riddle Aeronautical University in Arizona.
Without more data, this kind of scenario can never be verified completely. But the global aviation community has already taken steps to prevent another accident like AF 447. Within days, Air France replaced pitot tubes on its Airbus planes with ones made by another company, and in July Airbus advised other airlines to do the same. Three months later the FAA turned the recommendation into a regulation.
To be sure, the pitot tubes are not the definitive cause of the crash. Even if they had failed, that alone should not have been enough to bring down an airliner. As in virtually every fatal air crash, what doomed AF 447 was not a single malfunction or error of judgment, but rather a sequence of missteps that crash investigators call the accident chain. "There's always a series of events," the FAA's Pardee says. "That means there are multiple opportunities to intervene and break that accident chain."
In the case of AF 447, the error chain included the co-pilots' decision to fly too close to severe thunderstorms--bad weather that several other pilots, flying similar routes that night, had chosen to give a wide berth. There were certainly other links in the accident chain that pushed AF 447 beyond its limits. But unless the black box is found, we may never identify those links. And that means safety officials might never learn the full lessons of the disaster. To prevent a similar loss of forensic evidence, executives at Airbus say they are now studying alternatives to physical black boxes.
It is feasible to create a system that could broadcast not only text messages like ACARS but comprehensive data about the status of every aircraft, in real time. The aircraft would continuously transmit data to VHF stations within a radius of 125 miles, or by satellite if the plane is farther away.
Airliners in flight could one day stream all sorts of high-speed data, sharing information directly with one another. "It would be a network in the sky," says Bob Smith, chief technology officer at Honeywell, which manufactured AF 447's ACARS. "Aircraft could pass not only information about their location and where they're headed," he says, "but whole data sets. An airliner over Seattle could send its weather radar picture to a plane inbound from Dallas. And the guy from Dallas could pass it along to five other aircraft." Military aircraft already use a similar system; it is not clear if civil aviation will adopt it.
The disquieting truth is that we don't really know precisely what happened to Air France 447, and perhaps never will. The same links in the accident chain could someday take down another unlucky airliner. If they do, improved technology might provide investigators with the data they need to make sure that the next time is the last time.
No comments:
Post a Comment