Air France Flight 447

Air France Flight 447

F-GZCP, the aircraft involved in the accident, shown here at Charles de Gaulle Airport in 2007
Accident summary
Date	1 June 2009
Summary	Entered high altitude stall, impacted ocean
Site	Atlantic Ocean near waypoint TASIL [1] 3°03′57″N 30°33′42″W / 3.06583°N 30.56167°W / 3.06583; -30.56167Coordinates: 3°03′57″N 30°33′42″W / 3.06583°N 30.56167°W / 3.06583; -30.56167
Passengers	216
Crew	12
Fatalities	228 (all)
Survivors	0
Aircraft type	Airbus A330-203
Operator	Air France
Registration	F-GZCP
Flight origin	Rio de Janeiro–Galeão Airport
Destination	Paris-Charles de Gaulle Airport

Air France Flight 447 (AF447/AFR447)^{[lower-alpha 1]} was a scheduled passenger flight from Rio de Janeiro, Brazil to Paris, France, which crashed on 1 June 2009. The Airbus A330, operated by Air France, entered an aerodynamic stall from which it did not recover and crashed into the Atlantic Ocean at 02:14 UTC, killing all 228 passengers, aircrew and cabin crew aboard the aircraft.^[2]

The Brazilian Navy removed the first major wreckage and two bodies from the sea within five days of the accident, but the initial investigation by France's Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) was hampered because the aircraft's black boxes were not recovered from the ocean floor until May 2011, nearly two years later.^[1][3]

The BEA's final report, released at a news conference on 5 July 2012,^[4][5] concluded that the aircraft crashed after temporary inconsistencies between the airspeed measurements – likely due to the aircraft's pitot tubes being obstructed by ice crystals – caused the autopilot to disconnect, after which the crew reacted incorrectly and ultimately caused the aircraft to enter an aerodynamic stall from which it did not recover.^[4][6][7] The accident was the deadliest in the history of Air France.^[8][9] It was also the Airbus A330's second and deadliest accident, and its first in commercial passenger service.^[10]

Accident

The aircraft departed from Rio de Janeiro–Galeão International Airport on 31 May 2009 at 19:29 local time (22:29 UTC),^[11] with a scheduled arrival at Paris-Charles de Gaulle Airport at 10:03 the following day.^[12] The last voice contact with the aircraft was at 01:35 UTC, 3 hours and 6 minutes after the 22:29 UTC departure, when it reported that it had passed waypoint INTOL (1°21′39″S 32°49′53″W / 1.36083°S 32.83139°W / -1.36083; -32.83139), located 565 km (351 mi) off Natal, on Brazil's north-eastern coast.^[1] The aircraft left Brazilian Atlantic radar surveillance at 01:49 UTC.^[13]

The Airbus A330 is designed to be flown by a crew of two pilots. However, because the 13-hour "duty time" (flight duration, plus pre-flight preparation) for the Rio-Paris route exceeds the maximum 10 hours permitted by Air France's procedures, Flight 447 was crewed by three pilots: a captain and two first officers.^[14] With three pilots on board, each of them can take a rest during the flight, and for this purpose the A330 has a rest cabin, situated just behind the cockpit.^[15]

In accordance with common practice, the captain had sent one of the co-pilots for the first rest period with the intention of taking the second break himself.^[16] At 01:55 UTC, he woke the second pilot and said: "... he's going to take my place". After having attended the briefing between the two co-pilots, the captain left the cockpit to rest at 02:01:46 UTC. At 02:06 UTC, the pilot warned the cabin crew that they were about to enter an area of turbulence. Probably two to three minutes after this the airplane encountered icing conditions (the cockpit voice recorder recorded what sounded like hail or graupel on the outside of the airplane, and the engine anti-ice system came on) and ice crystals started to accumulate in the pitot tubes (pitot tubes are devices that provide critical information about how fast the aircraft is moving through the air).^[17] The pilots turned the aircraft slightly to the left and decreased its speed from Mach 0.82 to Mach 0.8 (the recommended "turbulence penetration speed").^[18]

At 02:10:05 UTC the autopilot disengaged because the blocked pitot tubes were no longer providing valid airspeed information, and the airplane transitioned from normal law to alternate law 2.^[19] The engines' auto-thrust systems disengaged three seconds later. Without the auto-pilot, the aircraft started to roll to the right due to turbulence, and the pilot reacted by deflecting his side-stick to the left. One consequence of the change to alternate law was an increase in the aircraft's sensitivity to roll, and the pilot's input over-corrected for the initial upset. During the next 30 seconds, the aircraft rolled alternately left and right as the pilot adjusted to the altered handling characteristics of his aircraft.^[20] At the same time he made an abrupt nose-up input on the side-stick, an action that was unnecessary and excessive under the circumstances.^[21] The aircraft's stall warning sounded briefly twice due to the angle of attack tolerance being exceeded, and the aircraft's recorded airspeed dropped sharply from 274 knots to 52 knots. The aircraft's angle of attack increased, and the aircraft started to climb. By the time the pilot had control of the aircraft's roll, it was climbing at nearly 7,000 ft/min^[20] (for comparison, typical normal rate of climb for modern airliners is only 2,000–3,000 ft/min at sea level, and much smaller at high altitude).

At 02:10:34, after displaying incorrectly for half a minute, the left-side instruments recorded a sharp rise in airspeed to 223 knots, as did the Integrated Standby Instrument System (ISIS) 33 seconds later^[22] (the right-side instruments are not recorded by the recorder). The icing event had lasted for just over a minute.^[23][24][25] The pilot continued making nose-up inputs. The trimmable horizontal stabilizer (THS) moved from three to 13 degrees nose-up in about one minute, and remained in that latter position until the end of the flight.

At 02:11:10 UTC, the aircraft had climbed to its maximum altitude of around 38,000 feet. There, its angle of attack was 16 degrees, and the engine thrust levers were in the fully forward Takeoff/Go-around detent (TOGA). As the aircraft began to descend, the angle of attack rapidly increased toward 30 degrees. A second consequence of the reconfiguration into alternate law was that stall protection no longer operated. Whereas in normal law, the airplane's flight management computers would have acted to prevent such a high angle of attack, in alternate law this did not happen. (Indeed, the switch into alternate law occurred precisely because the computers, denied reliable speed data, were no longer able to provide such protection – nor many of the other functions expected of normal law).^[26] The wings lost lift and the aircraft stalled.^[6]

At 02:11:40 UTC, the captain re-entered the cockpit. The angle of attack had then reached 40 degrees, and the aircraft had descended to 35,000 feet with the engines running at almost 100% N₁ (the rotational speed of the front intake fan, which delivers most of a turbofan engine's thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft's computer due to the high angle of attack.^[27] In other words, the aircraft had its nose above the horizon but was descending steeply. Roughly 20 seconds later, at 02:12 UTC, the pilot decreased the aircraft's pitch slightly, airspeed indications became valid and the stall warning sounded again and sounded intermittently for the remaining duration of the flight, but stopped when the pilot increased the aircraft's nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35 degrees. From the time the aircraft stalled until its impact with the ocean, the engines were primarily developing either 100 percent N₁ or TOGA thrust, though they were briefly spooled down to about 50 percent N₁ on two occasions. The engines always responded to commands and were developing in excess of 100 percent N₁ when the flight ended.

The flight data recordings stopped at 02:14:28 UTC, or three hours 45 minutes after takeoff. At that point, the aircraft's ground speed was 107 knots, and it was descending at 10,912 feet per minute (108 knots of vertical speed). Its pitch was 16.2 degrees (nose up), with a roll angle of 5.3 degrees left. During its descent, the aircraft had turned more than 180 degrees to the right to a compass heading of 270 degrees. The aircraft remained stalled during its entire 3 minute 30 second descent from 38,000 feet^[28] before it hit the ocean surface at a speed of 152 knots (280 km/h), comprising vertical and horizontal components of 108 and 107 knots respectively. The aircraft broke up on impact; everyone on board died.^[29]

Automated messages

Air France's A330s are equipped with a communications system, Aircraft Communication Addressing and Reporting System (ACARS), which enables them to transmit data messages via VHF or satellite.^{[lower-alpha 2]} ACARS can be used by the aircraft's on-board computers to send messages automatically, and F-GZCP transmitted a position report approximately every ten minutes. Its final position report at 02:10:34 gave the aircraft's coordinates as 2°59′N 30°35′W / 2.98°N 30.59°W / 2.98; -30.59.^{[lower-alpha 3]}

In addition to the routine position reports, F-GZCP's Centralized Maintenance System sent a series of messages via ACARS in the minutes immediately prior to its disappearance.^{[1](pp48–57)[30][31]} These messages, sent to prepare maintenance workers on the ground prior to arrival, were transmitted between 02:10 UTC and 02:15 UTC,^[32] and consisted of five failure reports and nineteen warnings.^{[1](p49)[33][34][35]} Until the black box flight recorders were recovered two years later, these messages represented the only recorded data available to the investigators. They offered a tantalizing but incomplete picture of what had happened to Flight 447.

Among the ACARS transmissions at 02:10 is one message that indicates a fault in the pitot-static system.^[32][35] Bruno Sinatti, president of Alter, Air France's third-biggest pilots' union, stated that "Piloting becomes very difficult, near impossible, without reliable speed data."^[36] The 12 warning messages with the same time code indicate that the autopilot and auto-thrust system had disengaged, that the TCAS was in fault mode, and flight mode went from 'normal law' to 'alternate law.'^[37][38]

The remainder of the messages occurred from 02:11 UTC to 02:14 UTC, containing a fault message for an Air Data Inertial Reference Unit (ADIRU) and the Integrated Standby Instrument System (ISIS).^[38][39] At 02:12 UTC, a warning message NAV ADR DISAGREE indicated that there was a disagreement between the three independent air data systems.^{[lower-alpha 4]} At 02:13 UTC, a fault message for the flight management guidance and envelope computer was sent.^[40] One of the two final messages transmitted at 02:14 UTC was a warning referring to the air data reference system, the other ADVISORY was a "cabin vertical speed warning", indicating that the aircraft was descending at a high rate.^{[1](pp48–57)[41][42][43]}

Weather conditions

Weather conditions in the mid-Atlantic were normal for the time of year, and included a broad band of thunderstorms along the Intertropical Convergence Zone (ITCZ).^[44] A meteorological analysis of the area surrounding the flight path showed a mesoscale convective system extending to an altitude of around 50,000 feet (15,000 m) above the Atlantic Ocean before Flight 447 disappeared.^{[45][46][47][48]} During its final hour, Flight 447 encountered areas of light turbulence.^[49]

Commercial air transport crews routinely encounter this type of storm in this area.^[50] With the aircraft under the control of its automated systems, one of the main tasks occupying the cockpit crew was that of monitoring the progress of the flight through the ITCZ, using the on-board weather radar to avoid areas of significant turbulence.^[51] Twelve other flights shared more or less the same route that Flight 447 was using at the time of the accident.^[52][53]

Search and recovery

Surface search

Flight 447 was due to pass from Brazilian airspace into Senegalese airspace at approximately 02:20 (UTC) on 1 June, and then into Cape Verdean airspace at approximately 03:45. Shortly after 04:00, when the flight had failed to contact air traffic control in either Senegal or Cape Verde, the controller in Senegal attempted to contact the aircraft. When he received no response, he asked the crew of another Air France flight (AF459) to try to contact AF447; this also met with no success.^[54]

After further attempts to contact Flight 447 were unsuccessful, an aerial search for the missing Airbus commenced from both sides of the Atlantic. Brazilian Air Force aircraft from the archipelago of Fernando de Noronha and French reconnaissance aircraft based in Dakar, Senegal led the search.^[55] They were assisted by a Casa 235 maritime patrol aircraft from Spain^[56] and a US Navy Lockheed Martin P-3 Orion anti-submarine warfare and maritime patrol aircraft.^[57][58]

By early afternoon on 1 June, officials with Air France and the French government had already presumed that the aircraft had been lost with no survivors. An Air France spokesperson told L'Express that there was "no hope for survivors",^[59][60] and French President Nicolas Sarkozy announced that there was almost no chance anyone survived.^[61] On 2 June at 15:20 (UTC), a Brazilian Air Force Embraer R-99A spotted wreckage and signs of oil, possibly jet fuel, strewn along a 5 km (3 mi) band 650 km (400 mi) north-east of Fernando de Noronha Island, near the Saint Peter and Saint Paul Archipelago. The sighted wreckage included an aircraft seat, an orange buoy, a barrel, and "white pieces and electrical conductors".^[62][63] Later that day, after meeting with relatives of the Brazilians on the aircraft, Brazilian Defence Minister Nelson Jobim announced that the Air Force believed the wreckage was from Flight 447.^[64][65] Brazilian vice-president José Alencar (acting as president since Luiz Inácio Lula da Silva was out of the country) declared three days of official mourning.^[65][66]

Also on 2 June, two French Navy vessels, the frigate Ventôse and helicopter-carrier Mistral, were en route to the suspected crash site. Other ships sent to the site included the French research vessel Pourquoi Pas?, equipped with two mini-submarines able to descend to 6,000 m (20,000 ft),^[67][68] since the area of the Atlantic in which the aircraft went down was thought to be as deep as 4,700 m (15,400 ft).^[69][70]

On 3 June, the first Brazilian Navy ship, the patrol boat Grajaú, reached the area in which the first debris was spotted. The Brazilian Navy sent a total of five ships to the debris site; the frigate Constituição and the corvette Caboclo were scheduled to reach the area on 4 June, the frigate Bosísio on 6 June and the replenishment oiler Almirante Gastão Motta on 7 June.^[71][72]

Early on 6 June 2009, five days after Flight 447 disappeared, two male bodies, the first to be recovered from the crashed aircraft, were brought on board the Caboclo^[73] along with a seat, a nylon backpack containing a computer and vaccination card, and a leather briefcase containing a boarding pass for the Air France flight.^[74][75] The following day, 7 June, search crews recovered the Airbus's vertical stabilizer, the first major piece of wreckage to be discovered. Pictures of this part being lifted onto the Constituição became a poignant symbol of the loss of the Air France craft.^[1][76]

The search and recovery effort reached its peak over the next week or so, as the number of personnel mobilized by the Brazilian military exceeded 1100.^[77] Fifteen aircraft (including two helicopters) were devoted to the search mission.^[78] The Brazilian Air Force Embraer R99 flew a total of more than 100 hours, and electronically scanned more than a million square kilometers of ocean.^[79] Other aircraft involved in the search scanned, visually, 320,000 square kilometres of ocean and were used to direct Navy vessels involved in the recovery effort.^[77]

By 16 June 2009 a total of 50 bodies had been recovered from a wide area of the ocean.^[80][81][82] The bodies were transported to shore, first by the frigates Constituição and Bosísio to the islands of Fernando de Noronha and thereafter by air to Recife for identification.^{[82][83][84][85]} Pathologists identified all 50 bodies recovered from the crash site, including that of the captain, by using dental records and fingerprints.^[86][87][88] The search teams logged the time and location of every find in a database which, by the time the search ended on 26 June, catalogued 640 items of debris from the aircraft.^[80] The BEA documented the timeline of discoveries in its first interim report.^[89][90][91]

Underwater search

On 5 June 2009, the French nuclear submarine Émeraude was dispatched to the crash zone, arriving in the area on the 10th. Its mission was to assist in the search for the missing flight recorders or "black-boxes" that might be located at great depth.^[92] The submarine would use its sonar to listen for the ultrasonic signal emitted by the black boxes' "pingers",^[93] covering 13 sq mi (34 km²) a day. The Émeraude was to work with the mini-sub Nautile, which can descend to the ocean floor. The French submarines would be aided by two U.S. underwater audio devices capable of picking up signals at a depth of 20,000 ft (6,100 m).^[94]

Following the end of the search for bodies, the search continued for the flight data recorder and the cockpit voice recorder, the so-called "black boxes". French Bureau d'Enquetes et d'Analyses (BEA) chief Paul-Louis Arslanian said that he was not optimistic about finding them since they might have been under as much as 3,000 m (9,800 ft) of water, and the terrain under this portion of the ocean was very rugged.^[95] Investigators were hoping to find the aircraft's lower aft section, since that was where the recorders were located.^[96] Although France had never recovered a flight recorder from such depths,^[95] there was precedent for such an operation: in 1988, an independent contractor recovered the cockpit voice recorder of South African Airways Flight 295 from a depth of 4,900 m (16,100 ft) in a search area of between 80 and 250 square nautical miles (270 and 860 km²).^[97][98] The Air France flight recorders were fitted with water-activated acoustic underwater locator beacons or "pingers", which should have remained active for at least 30 days, giving searchers that much time to locate the origin of the signals.^[99]

France requested two "towed pinger locator hydrophones" from the United States Navy to help find the aircraft.^[67] The French nuclear submarine and two French-contracted ships (the Fairmount Expedition and the Fairmount Glacier, towing the U.S. Navy listening devices) trawled a search area with a radius of 80 kilometres (50 mi), centred on the airplane's last known position.^[100][101] By mid-July, recovery of the black boxes still had not been announced. The finite beacon battery life meant that, as the time since the crash elapsed, the likelihood of location diminished.^[102] In late July, the search for the black boxes entered its second phase, with a French research vessel resuming the search using a towed sonar array.^[103] The second phase of the search ended on 20 August without finding wreckage within a 75 km (47 mi) radius of the last position, as reported at 02:10.^[104]

The third phase of the search for the recorders lasted from 2 April until 24 May 2010,^{[105][106][107]} and was conducted by two ships, the Anne Candies and the Seabed Worker. The Anne Candies towed a U.S. Navy sonar array, while the Seabed Worker operated three robot submarines AUV ABYSS (a REMUS AUV type).^{[105][108][109][110]} Air France and Airbus jointly funded the third phase of the search.^[111][112] The search covered an area of 6,300 square kilometres (2,400 sq mi), mostly to the north and north-west of the aircraft's last known position.^{[105][109][113]} The search area had been drawn up by oceanographers from France, Russia, Great Britain and the United States combining data on the location of floating bodies and wreckage, and currents in the mid-Atlantic in the days immediately after the crash.^{[114][115][116]} A smaller area to the south-west was also searched, based on a re-analysis of sonar recordings made by Émeraude the previous year.^{[117][118][119]} The third phase of the search ended on 24 May 2010 without any success, though the BEA says that the search 'nearly' covered the whole area drawn up by investigators.^[105]

2011 search and recovery

In July 2010, the U.S.-based search consultancy Metron, Inc. had been engaged to draw up a probability map of where to focus the search, based on prior probabilities from flight data and local condition reports, combined with the results from the previous searches. The Metron team used what it described as "classic" Bayesian search methods, an approach that had previously been successful in the search for the submarine USS Scorpion and SS Central America. Phase 4 of the search operation started close to the aircraft's last known position, which was identified by the Metron study as being the most likely resting place of flight 447.^[120][121]

Within a week of resuming of the search operation, on 3 April 2011, a team led by the Woods Hole Oceanographic Institution operating full ocean depth autonomous underwater vehicles (AUVs) owned by the Waitt Institute discovered, by means of sidescan sonar, a large portion of the debris field from flight AF447.^[120] Further debris and bodies, still trapped in the partly intact remains of the aircraft's fuselage, were located at a depth of 3,980 metres (2,180 fathoms; 13,060 ft).^[122] The debris was found to be lying in a relatively flat and silty area of the ocean floor (as opposed to the extremely mountainous topography that was originally believed to be AF447's final resting place). Other items found were engines, wing parts and the landing gear.^[123]

The debris field was described as "quite compact", measuring some 200 by 600 metres (660 by 1,970 ft) and located a short distance to the north of where pieces of wreckage had been recovered previously, suggesting that the aircraft hit the water largely intact.^[124] The French Ecology and Transportation Minister Nathalie Kosciusko-Morizet stated the bodies and wreckage would be brought to the surface and taken to France for examination and identification.^[125] The French government chartered the Île de Sein to recover the flight recorders from the wreckage.^[126][127] An American Remora 6000 remotely operated vehicle (ROV) and operations crew from Phoenix International experienced in the recovery of aircraft for the United States Navy were on board the Île de Sein.^{[128][129][130]}

Île de Sein arrived at the crash site on 26 April, and during its first dive, the Remora 6000 found the flight data recorder chassis, although without the crash-survivable memory unit.^[131][132] On 1 May the memory unit was found and lifted on board the Île de Sein by the ROV.^[133] The aircraft's cockpit voice recorder was found late on 2 May 2011, and was raised and brought on board the Île de Sein the following day.^[134]

On 7 May the flight recorders, under judicial seal, were taken aboard the French Navy patrol boat La Capricieuse for transfer to the port of Cayenne. From there they were transported by air to the BEA's office in Le Bourget near Paris for data download and analysis. One engine and the avionics bay, containing onboard computers, had also been raised.^[135]

By 15 May all the data from both the flight data recorder and the cockpit voice recorder had been downloaded.^[136][137] The data was subjected to detailed in-depth analysis over the following weeks, and the findings published in the third interim report at the end of July.^[138] The entire download was filmed and recorded.^[138]

Between 5 May and 3 June 2011, 104 bodies were recovered from the wreckage, bringing the total number of bodies found to 154. Fifty bodies had been previously recovered from the sea.^{[90][139][140][141]} The search ended with the remaining 74 bodies still unrecovered.^[142]

Aircraft

The aircraft involved in the accident was an Airbus A330-203, with manufacturer serial number 660, registered as F-GZCP. This airliner's first flight was on 25 February 2005, and it was Air France's newest A330 at the time of the crash.^[143][144] The aircraft was powered by two General Electric CF6-80E1A3 engines with a maximum thrust of 68,530/60,400 lb (take-off/max continuous)^[145] giving it a cruise speed range of Mach 0.82–0.86 (871–913 km/h, 470–493 knots, 540–566 mph), at 35,000 ft (10.7 km altitude) and a range of 12,500 km (6750 nmi, 7760 statute miles). On 17 August 2006, this A330 was involved in a ground collision with Airbus A321-211 F-GTAM, at Charles de Gaulle Airport, Paris. F-GTAM was substantially damaged while F-GZCP suffered only minor damage.^[146] The aircraft underwent a major overhaul on 16 April 2009^[147] and at the time of the accident had accumulated about 19,000 flying hours.^[147] The aircraft made 24 flights from Paris, to and from 13 different destinations worldwide, between 5 and 31 May 2009.

Passengers and crew

Nationality	Passengers	Crew	Total
Argentina[148]	1	0	1
Austria	1	0	1
Belgium	1	0	1
Brazil	58	1	59
Canada	1	0	1
China	9	0	9
Croatia	1	0	1
Denmark	1	0	1
Estonia	1	0	1
France	61	11	72
Gabon	1	0	1
Germany	26	0	26
Hungary	4	0	4
Iceland	1	0	1
Ireland[149]	3	0	3
Italy	9	0	9
Lebanon	3	0	3
Morocco	3	0	3
Netherlands[150]	1	0	1
Norway[151]	3	0	3
Philippines	1	0	1
Poland	2	0	2
Romania [152]	1	0	1
Russia	1	0	1
Slovakia	3	0	3
South Africa	1	0	1
South Korea	1	0	1
Spain[153]	2	0	2
Sweden[154]	1 (2)	0	1 (2)
Switzerland	6	0	6
Turkey[155]	1	0	1
United Kingdom	5	0	5
United States	2	0	2
Total (33 nationalities)	216	12	228
Notes: Nationalities shown are as stated by Air France on 1 June 2009.[156] Attributing nationality was complicated by the holding of multiple citizenship by several passengers. Passengers who had citizenship in one country but were attributed to another country by Air France are indicated with parentheses ().

The aircraft was carrying 216 passengers, three aircrew and nine cabin crew in two cabins of service.^{[157][158][159]} Among the 216 passengers were 126 men, 82 women and eight children (including one infant).^[55]

There were three pilots in the aircrew:^[160]

• The captain, 58-year-old Marc Dubois (PNF-Pilot Not Flying)^[11] had joined Air France (at the time, Air Inter) in February 1988 and had 10,988 flying hours, of which 6,258 were as captain, including 1,700 hours on the Airbus A330; had carried out 16 rotations in the South America sector since he arrived in the A330/A340 division in 2007.
• The first officer, co-pilot in left seat, 37-year-old David Robert (PNF-Pilot Not Flying) had joined Air France in July 1998 and had 6,547 flying hours, of which 4,479 hours were on the Airbus A330; had carried out 39 rotations in the South America sector since he arrived in the A330/A340 division in 2002. Robert had graduated from École Nationale de l'Aviation Civile (ENAC), one of the elite Grandes Écoles, and had transitioned from a pilot to a management job at the airline's operations center. He served as a pilot on this flight in order to maintain his flying credentials.^[161]
• The first officer, co-pilot in right seat, 32-year-old Pierre-Cédric Bonin (PF-Pilot Flying) had joined Air France in October 2003 and had 2,936 flight hours, of which 807 hours were on the Airbus A330; had carried out five rotations in the South America sector since arriving in the A330/A340 division in 2008.

Of the 12 crew members (including aircrew and cabin crew), 11 were French and one was Brazilian.^[162]

The majority of passengers were French, Brazilian, or German citizens.^[163][164] The nationalities, as released by Air France, are shown in the adjacent table.^[156] The passengers included business and holiday travelers.^[165]

Air France had gathered approximately 60 to 70 relatives and friends to pick up arriving passengers at Charles de Gaulle Airport. Many of the passengers on Flight 447 were connecting to other destinations worldwide, so other parties anticipating the arrival of passengers were at various connecting airports.^[166]

On 20 June 2009, Air France announced that each victim's family would be paid roughly €17,500 in initial compensation.^[167] In March 2010, relatives of 23 victims filed wrongful death lawsuits against Airbus and several of its component suppliers in a Florida court. The suit maintained that design and manufacturing defects supplied the pilots with incorrect information, rendering them incapable of maintaining altitude and airspeed.^[168]

Notable passengers

• Prince Pedro Luís of Orléans-Bragança, third in succession to the abolished throne of Brazil.^[169][170] He had dual Brazilian–Belgian citizenship. He was returning home to Luxembourg from a visit to his relatives in Rio de Janeiro.^[171][172]
• Silvio Barbato, composer and former conductor of the symphony orchestras of the Cláudio Santoro National Theater in Brasilia and the Rio de Janeiro Municipal Theatre; he was en route to Kiev for engagements there.^[173][174]
• Fatma Ceren Necipoğlu, Turkish classical harpist and academic of Anadolu University in Eskişehir; she was returning home via Paris after performing at the fourth Rio Harp Festival.^[175]
• Pablo Dreyfus from Argentina, a campaigner for controlling illegal arms and the illegal drugs trade.^[176]

Investigation and safety improvements

The French authorities opened two investigations:

• A criminal investigation for manslaughter began 5 June 2009, under the supervision of Investigating Magistrate Sylvie Zimmerman from the Paris Tribunal de Grande Instance.^[177] The judge gave the investigation to the Gendarmerie nationale, which would conduct it through its aerial transportation division (Gendarmerie des transports aériens or GTA) and its forensic research institute (the "Institut de Recherche Criminelle de la Gendarmerie Nationale", FR).^[178] As part of the criminal investigation, the DGSE (the external French intelligence agency) examined the names of passengers on board for any possible links to terrorist groups.^[179]

In March 2011, a French judge filed preliminary manslaughter charges against Air France and Airbus over the crash.^[180]

• A technical investigation, the goal of which is to enhance the safety of future flights. As the aircraft was of French registration and crashed over international waters, this is the responsibility of the French government, under the ICAO convention. The Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) is in charge of the investigation.^[181] Representatives from Brazil, Germany, the United Kingdom, and the United States became involved under the provisions of ICAO Annex 13; representatives of the United States were involved since the engines of the aircraft were manufactured there, and the other representatives could supply important information. The People's Republic of China, Croatia, Hungary, Republic of Ireland, Italy, Lebanon, Morocco, Norway, South Korea, Russia, South Africa, and Switzerland appointed observers, since citizens of those countries were on board.^[182]

On 5 June 2009, the BEA cautioned against premature speculation as to the cause of the crash. At that time, the investigation had established only two certain facts: the weather near the airplane's planned route included significant convective cells typical of the equatorial regions; and the speeds measured by the three pitot tubes had differed from each other during the last few minutes of the flight.^[183]

On 2 July 2009, the BEA released an intermediate report, which described all known facts, and a summary of the visual examination of the rudder and the other parts of the aircraft that had been recovered at that time.^[1] According to the BEA, this examination showed that:

• The airliner was likely to have struck the surface of the sea in a normal flight attitude, with a high rate of descent;^{[lower-alpha 6][1][184]}
• There were no signs of any fires or explosions.
• The airliner did not break up in flight. The report also stresses that the BEA had not had access to the post-mortem reports at the time of its writing.^[1][185]

On 16 May 2011, Le Figaro reported that the BEA investigators had ruled out an aircraft malfunction as the cause of the crash, according to preliminary information extracted from the flight data recorder.^[186] The following day, the BEA issued a press release explicitly describing the Le Figaro report as a "sensationalist publication of non-validated information". The BEA stated that no conclusions had yet been made, that investigations were continuing, and that no interim report was expected before the summer.^[187] On 18 May the head of the investigation further stated that no major malfunction of the aircraft had been found so far in the data from the flight data recorder, but that minor malfunctions had not yet been ruled out.^[188]

On 27 May 2011, the BEA released a short factual report of the findings from the data recorders without any conclusions.

Airspeed inconsistency

In the minutes before its disappearance, the aircraft's onboard systems had sent a number of messages, via the Aircraft Communications Addressing and Reporting System (ACARS), indicating disagreement in the indicated airspeed (IAS) readings. A spokesperson for the BEA claimed that "the airspeed of the aircraft was unclear" to the pilots^[92] and, on 4 June 2009, Airbus issued an Accident Information Telex to operators of all its aircraft reminding pilots of the recommended Abnormal and Emergency Procedures to be taken in the case of unreliable airspeed indication.^[189] French Transport Minister Dominique Bussereau said, "Obviously the pilots [of Flight 447] did not have the [correct] speed showing, which can lead to two bad consequences for the life of the aircraft: under-speed, which can lead to a stall, and over-speed, which can lead to the aircraft breaking up because it is approaching the speed of sound and the structure of the plane is not made for enduring such speeds".^[190]

Pitot tubes

Between May 2008 and March 2009, nine incidents involving the temporary loss of airspeed indication appeared in the Air Safety Reports (ASRs) for Air France's A330/A340 fleet. All occurred in cruise between flight levels FL310 and FL380. Further, after the Flight 447 accident, Air France identified six additional incidents which had not been reported on ASRs. These were intended for maintenance Aircraft Technical Logs (ATLs) drawn up by the pilots to describe these incidents only partially, to indicate the characteristic symptoms of the incidents associated with unreliable airspeed readings.^[191][192] The problems primarily occurred in 2007 on the A320 but, awaiting a recommendation from Airbus, Air France delayed installing new pitot tubes on A330/A340 and increased inspection frequencies in these planes.^[193][194]

When it was introduced in 1994, the Airbus A330 was equipped with pitot tubes, part number 0851GR, manufactured by Goodrich Sensors and Integrated Systems. A 2001 Airworthiness Directive required these to be replaced with either a later Goodrich design, part number 0851HL, or with pitot tubes made by Thales, part number C16195AA.^[195] Air France chose to equip its fleet with the Thales pitot tubes. In September 2007, Airbus recommended that Thales C16195AA pitot tubes should be replaced by Thales model C16195BA to address the problem of water ingress that had been observed.^[196] Since it was not an Airworthiness Directive, the guidelines allow the operator to apply the recommendations at its discretion. Air France implemented the change on its A320 fleet where the incidents of water ingress were observed and decided to do so in its A330/340 fleet only when failures started to occur in May 2008.^[197][198]

After discussing these issues with the manufacturer, Air France sought a means of reducing these incidents, and Airbus indicated that the new pitot probe designed for the A320 was not designed to prevent cruise level ice-over. In 2009, tests suggested that the new probe could improve its reliability, prompting Air France to accelerate the replacement program,^[198] which started on 29 May. F-GZCP was scheduled to have its pitot tubes replaced as soon as it returned to Paris.^[147][199] By 17 June 2009, Air France had replaced all pitot probes on its A330 type aircraft.^[200]

In July 2009, Airbus issued new advice to A330 and A340 operators to exchange Thales pitot tubes for tubes from Goodrich.^{[201][202][203]}

On 12 August 2009, Airbus issued three Mandatory Service Bulletins, requiring that all A330 and A340 aircraft be fitted with two Goodrich 0851HL pitot tubes and one Thales model C16195BA pitot (or alternatively three of the Goodrich pitot tubes); Thales model C16195AA pitot tubes were no longer to be used.^[204][205] This requirement was incorporated into Airworthiness Directives issued by the European Aviation Safety Agency (EASA) on 31 August^[204] and by the Federal Aviation Administration (FAA) on 3 September.^[206] The replacement was to be completed by 7 January 2010. According to the FAA, in its Federal Register publication, use of the Thales model has resulted in "reports of airspeed indication discrepancies while flying at high altitudes in inclement weather conditions", that "could result in reduced control of the airplane." The FAA further stated that the Thales model probe "has not yet demonstrated the same level of robustness to withstand high-altitude ice crystals as Goodrich pitot probes P/N 0851HL."

On 20 December 2010, Airbus issued a warning to roughly 100 operators of A330, A340-200 and A340-300 aircraft, regarding pitot tubes, advising pilots not to re-engage the autopilot following failure of the airspeed indicators.^{[207][208][209]} Safety recommendations issued by BEA for pitot probes design, recommended that "they must be fitted with a heating system designed to prevent any malfunctioning due to icing. Appropriate means must be provided (visual warning directly visible to the crew) to inform the crew of any non-functioning of the heating system".^[210]

Findings from the flight data recorder

On 27 May 2011, the BEA released an update on its investigation describing the history of the flight as recorded by the flight data recorder. This confirmed what had previously been concluded from post-mortem examination of the bodies and debris recovered from the ocean surface: the aircraft had not broken up at altitude but had fallen into the ocean intact.^[1][185] The flight recorders also revealed that the aircraft's descent into the sea was not due to mechanical failure or the aircraft being overwhelmed by the weather, but because the flight crew had raised the aircraft's nose, reducing its speed until it entered an aerodynamic stall.^[28][211]

While the inconsistent airspeed data caused the disengagement of the autopilot, the reason the pilots lost control of the aircraft remains something of a mystery, in particular because pilots would normally try to lower the nose in case of a stall.^{[212][213][214]} Multiple sensors provide the pitch (attitude) information and there was no indication that any of them were malfunctioning.^[215] One factor may be that since the A330 does not normally accept control inputs that would cause a stall, the pilots were unaware that a stall could happen when the aircraft switched to an alternate mode due to failure of the airspeed indication.^{[211][lower-alpha 7]}

In October 2011, a transcript of the voice recorder was leaked and published in the book Erreurs de Pilotage ("Pilot Errors") by Jean Pierre Otelli.^[211][220] The BEA and Air France both condemned the release of this information, with Air France calling it "sensationalized and unverifiable information" that "impairs the memory of the crew and passengers who lost their lives."^[221] The BEA would subsequently release its final report on the accident, and Appendix 1 contained an official cockpit voice recorder transcript that did not include groups of words deemed to have no bearing on flight.^[222]

Third interim report

On 29 July 2011, the BEA released a third interim report on safety issues it found in the wake of the crash.^[6] It was accompanied by two shorter documents summarizing the interim report^[223] and addressing safety recommendations.^[224]

The third interim report stated that some new facts had been established. In particular:

• The pilots had not applied the unreliable-airspeed procedure.
• The pilot-in-control pulled back on the stick, thus increasing the angle of attack and causing the aircraft to climb rapidly.
• The pilots apparently did not notice that the aircraft had reached its maximum permissible altitude.
• The pilots did not read out the available data (vertical velocity, altitude, etc.).
• The stall warning sounded continuously for 54 seconds.
• The pilots did not comment on the stall warnings and apparently did not realize that the aircraft was stalled.
• There was some buffeting associated with the stall.
• The stall warning deactivates by design when the angle of attack measurements are considered invalid, and this is the case when the airspeed drops below a certain limit.
• In consequence, the stall warning came on whenever the pilot pushed forward on the stick and then stopped when he pulled back; This happened several times during the stall and this may have confused the pilots.
• Despite the fact that they were aware that altitude was declining rapidly, the pilots were unable to determine which instruments to trust: it may have appeared to them that all values were incoherent.^[6]

The BEA assembled a human factors working group to analyze the crew's actions and reactions during the final stages of the flight.^[225]

A brief bulletin by Air France indicated that "the misleading stopping and starting of the stall warning alarm, contradicting the actual state of the aircraft, greatly contributed to the crew's difficulty in analyzing the situation."^[226][227]

Final report

On 5 July 2012, the BEA released its final report on the accident. This confirmed the findings of the preliminary reports and provided additional details and recommendations to improve safety. According to the final report,^[4] the accident resulted from the following succession of major events:

• temporary inconsistency between the measured speeds, likely as a result of the obstruction of the pitot tubes by ice crystals, causing autopilot disconnection and reconfiguration to alternate law;
• the crew made inappropriate control inputs that destabilized the flight path;
• the crew failed to follow appropriate procedure for loss of displayed airspeed information;
• the crew were late in identifying and correcting the deviation from the flight path;
• the crew lacked understanding of the approach to stall;
• the crew failed to recognize that the aircraft had stalled and consequently did not make inputs that would have made it possible to recover from the stall.^[228]

These events resulted from the following major factors in combination:^[4]

• feedback mechanisms on the part of those involved made it impossible to identify and remedy the repeated non-application of the procedure for inconsistent airspeed, and to ensure that crews were trained in icing of the pitot probes and its consequences;
• the crew lacked practical training in manually handling the aircraft both at high altitude and in the event of anomalies of speed indication;
• the two co-pilots' task sharing was weakened both by incomprehension of the situation at the time of autopilot disconnection, and by poor management of the "startle effect", leaving them in an emotionally charged situation;
• the cockpit lacked a clear display of the inconsistencies in airspeed readings identified by the flight computers;
• the crew did not respond to the stall warning, whether due to a failure to identify the aural warning, to the transience of the stall warnings that could have been considered spurious, to the absence of any visual information that could confirm that the aircraft was approaching stall after losing the characteristic speeds, to confusing stall-related buffet for overspeed-related buffet, to the indications by the Flight Director that might have confirmed the crew's mistaken view of their actions, or to difficulty in identifying and understanding the implications of the switch to alternate law, which does not protect the angle of attack.

Independent analyses

Before and after the publication of the final report by the BEA in July 2012, there were many independent analyses and expert opinions published in the media about the cause of the accident.

Significance of the accident

In May 2011, Wil S. Hylton of The New York Times commented that the crash "was easy to bend into myth" because "no other passenger jet in modern history had disappeared so completely – without a Mayday call or a witness or even a trace on radar." Hylton explained that the A330 "was considered to be among the safest" of the passenger aircraft. Hylton added that when "Flight 447 seemed to disappear from the sky, it was tempting to deliver a tidy narrative about the hubris of building a self-flying aircraft, Icarus falling from the sky. Or maybe Flight 447 was the Titanic, an uncrashable ship at the bottom of the sea."^[139] Dr. Guy Gratton, an aviation expert from the Flight Safety Laboratory at Brunel University, said, "This is an air accident the likes of which we haven't seen before. Half the accident investigators in the Western world – and in Russia too – are waiting for these results. This has been the biggest investigation since Lockerbie. Put bluntly, big passenger planes do not just fall out of the sky."^[229]

Angle of attack indication

In a July 2011 article in Aviation Week, Chesley "Sully" Sullenberger was quoted as saying the crash was a "seminal accident," and he suggested that pilots would be able to better handle upsets of this type if they had an indication of the wing's angle of attack (AoA).^[230]

Following its investigation, the BEA recommended that EASA and the FAA should consider making it mandatory to have an angle of attack indicator directly accessible to pilots on board airplanes.^[231]

Human factors and computer interaction

On 6 December 2011, Popular Mechanics magazine published an English translation of the analysis of the transcript of the cockpit voice recorder controversially leaked in the book Erreurs de Pilotage.^[211][232] It highlighted the role of the co-pilot in stalling the aircraft while the flight computer was under alternate law at high altitude. This "simple but persistent" human error was given as the most direct cause of this accident.^[211] In the commentary accompanying the article, they also noted that the failure to follow principles of crew resource management was a contributory factor.

Other reports (including the final BEA report) point to poor Human Computer Interface (HCI) of the Airbus as a significant factor contributing to the crash. As reported by AIN Online, the final BEA report provides an explanation for most of the pitch-up inputs by the pilot flying (PF), left unexplained in the Popular Mechanics piece.^[233] The Flight Director (FD) display was misleading and probably accounted for most of the inputs. Furthermore, the pitch-up input at the beginning of the fatal sequence of events appears to be the consequence of an altimeter error. The investigators also pointed to the lack of a clear display of the airspeed inconsistencies even though the computers had identified them. Some systems generated failure messages only about the consequences but never mentioned the origin of the problem. The investigators recommended that a blocked pitot tube should be clearly indicated as such to the crew on the flight displays. The Daily Telegraph pointed out the absence of angle of attack information, which is so important in identifying and preventing a stall.^[234] The paper stated that "though angle of attack readings are sent to onboard computers, there are no displays in modern jets to convey this critical information to the crews." Der Spiegel indicated the difficulty the pilots faced in diagnosing the problem: "One alarm after another lit up the cockpit monitors. One after another, the autopilot, the automatic engine control system, and the flight computers shut themselves off."^[235] Against this backdrop of confusing information, difficulty with aural cognition (due to heavy buffeting from the storm as well as the stall) and zero external visibility, the pilots had less than three minutes to identify the problem and take corrective action. The Spiegel report asserts that such a crash "could happen again."

In an article in Vanity Fair, William Langewiesche noted that once the angle of attack was so extreme, the system rejected the data as invalid and temporarily stopped the stall warnings. However, "this led to a perverse reversal that lasted nearly to the impact: each time Bonin happened to lower the nose, rendering the angle of attack marginally less severe, the stall warning sounded again—a negative reinforcement that may have locked him into his pattern of pitching up" which increased the angle of attack and thus prevented the plane from getting out of its stall.^[161]

Sidestick control

In April 2012 in The Daily Telegraph, British journalist Nick Ross published a comparison of Airbus and Boeing flight controls; unlike the control yoke used on Boeing flight decks, the Airbus side stick controls give little visual feedback and no sensory or tactile feedback to the second pilot. Ross reasoned that this might – in part – explain why the handling pilot's fatal nose-up inputs were not countermanded by his two colleagues.^[234][236]

In a July 2012 CBS report, Sullenberger suggested that the design of the Airbus cockpit might have been a factor in the accident. The flight controls are not mechanically linked between the two pilot seats, and Robert, the left seat pilot who believed he had taken over control of the plane, was not aware that Bonin had continued to hold the stick back, which overrode Robert's own control.^[237][238]

Fatigue

Getting enough sleep is a constant challenge for pilots of long-haul flights.^[239] Although the BEA could find no "objective" indications that the pilots of Flight 447 were suffering from fatigue,^[240] some exchanges recorded on the cockpit voice recorder (CVR), including a remark made by Captain Dubois, "I didn't sleep enough last night. One hour – it's not enough right now", could indicate that the crew were not well rested before the flight took off.^[241] The co-pilots had spent three nights in Rio de Janeiro.^[242][243]

Other incidents

Shortly after the crash, Air France changed the number of the regular Rio de Janeiro-Paris flight from AF447 to AF445.^[244]

Six months later, on 30 November 2009, Air France Flight 445 operated by another Airbus A330-203 (registered F-GZCK) made a mayday call because of severe turbulence around the same area and at a similar time to when Flight 447 had crashed. Because the pilots could not obtain immediate permission from air traffic controllers to descend to a less turbulent altitude, the mayday was to alert other aircraft in the vicinity that the flight had deviated from its normal flight level. This is standard contingency procedure when changing altitude without direct ATC authorization. After 30 minutes of moderate-to-severe turbulence, the flight continued normally. The flight landed safely in Paris six hours and 40 minutes after the mayday call.^[245][246]

Inaccurate airspeed indicators

There have been several cases where inaccurate airspeed information led to flight incidents on the A330 and A340. Two of those incidents involved pitot probes.^{[lower-alpha 8]} In the first incident, an Air France A340-300 (F-GLZL), en route from Tokyo to Paris experienced an event at 31,000 feet (9,400 m), in which the airspeed was incorrectly reported and the autopilot automatically disengaged. Bad weather, together with obstructed drainage holes in all three pitot probes, were subsequently found to be the cause.^[247] In the second incident, an Air France A340-300 (F-GLZN), en route from Paris to New York, encountered turbulence followed by the autoflight systems going offline, warnings over the accuracy of the reported airspeed and two minutes of stall alerts.^[247]

Another incident on TAM Flight 8091, from Miami to Rio de Janeiro on 21 May 2009, involving an A330-200, showed a sudden drop of outside air temperature, then loss of air data, the ADIRS, autopilot and autothrust.^[248] The aircraft descended 1,000 metres (3,300 ft) before being manually recovered using backup instruments. The NTSB also examined a similar 23 June 2009 incident on a Northwest Airlines flight from Hong Kong to Tokyo,^[248] concluding in both cases that the aircraft operating manual was sufficient to prevent a dangerous situation from occurring.^[249]

Following the disappearance of Air France 447, other Airbus A330 operators studied their internal flight records to seek patterns. Delta Air Lines analyzed the data of Northwest Airlines flights that occurred before the two companies merged and found a dozen incidents in which at least one of an A330's pitot tubes had briefly stopped working when the plane was flying through the Intertropical Convergence Zone, the same location where Air France 447 disappeared.^[250][251]

In popular culture

A one-hour documentary entitled Lost: The Mystery of Flight 447 detailing an early independent hypothesis about the crash was produced by Darlow Smithson in 2010 for Nova and the BBC. It employed the skills of an expert pilot, an expert accident investigator, an aviation meteorologist and an aircraft structural engineer. Using the then-sparse publicly available evidence and information, and without data from the black boxes, a critical chain of events was postulated.^{[252][253][254][255]}

On 16 September 2012, Channel 4 (UK) presented Fatal Flight 447: Chaos in the Cockpit, which showed data from the black boxes including an in-depth re-enactment. It was produced by Minnow Films.

The aviation disaster documentary television series Mayday (also known as Air Crash Investigation and Air Emergency) produced an hour-long episode titled "Air France 447: Vanished". It aired on 15 April 2013 in Great Britain and 17 May 2013 in the U.S.^[256]

An article about the crash, by American author and pilot William Langewiesche, entitled "Should Airplanes Be Flying Themselves?", was published by Vanity Fair magazine in October 2014.^[161]

A 99% Invisible podcast episode about the flight, entitled "Children of the Magenta (Automation Paradox, pt. 1)", was released on 23 June 2015. It is the first part of a two-part story about automation.^[257]

In November 2015, MIT Professor David Mindell discussed the Air France Flight 447 tragedy in the opening segment of an EconTalk podcast dedicated to the ideas in Mindell's book, Our Robots, Ourselves: Robotics and the Myths of Autonomy (2015).^[258] Mindell said that the crash illustrated a "failed handoff," with insufficient warning, from the plane's autopilot to the human pilots.^[259]

See also

• Birgenair Flight 301
• Aeroperú Flight 603
• Search for Malaysia Airlines Flight 370
• List of aircraft accidents and incidents resulting in at least 50 fatalities
• Air France accidents and incidents

Notes

References

Further reading

• Jean-Pierre Otelli (13 October 2011). Erreurs de pilotage : Tome 5 [Pilot Error: Volume 5] (in French). Altipresse. ISBN 979-10-90465-03-9. 
• Roger Rapoport (2011). The Rio/Paris Crash: Air France 447. Lexographic Press. ISBN 978-0-9847142-0-9. 
• Palmer, Bill (20 September 2013). Understanding Air France 447 (paperback)|format= requires |url= (help). William Palmer. p. 218. ISBN 9780989785723. 

External links

Wikimedia Commons has media related to Air France Flight 447.

• First interim report (PDF) (report), BEA, 2 July 2009 , French version
• BEA report 17 December 2009 (Second interim report): English version, French version
• BEA report 29 July 2011 (Synopsis of the Third interim report): English version, French version
• BEA report 30 July 2011 (Third interim report, including CVR transcripts) English version, French version
• Final report on the accident on 1 June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
• "Appendixes and high resolution photos", Final Report, BEA .
• Accident / Serious Incident Report for Air France Flight 447 on SKYbrary categorised under Loss of Control/Human Factors/Airworthiness/Weather
• Air France Flight 447 – Air France
• Information on the investigation – Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile
• "Timeline of Flight AF 447." BBC. Wednesday 10 June 2009.
• N.V. "The Difference Engine: Wild blue coffin corner." The Economist. 25 March 2011. A clear description of the "coffin corner", where a small change in airspeed causes either stalling or breaking up of the aircraft.
• "Les pilotes sont répartis en deux catégories : commandant de bord et officier pilote de ligne. (Pilots are divided into two categories: captain and first officer)". 
• Wise, Jeff A (9 July 2012). "Air France 447 and the Limits of Aviation Safety". Popular Mechanics. Retrieved 4 January 2012. But the greater issue remains unaddressed. No matter how many possible scenarios a training program can simulate, pilots will continue to find themselves in unexpected circumstances. 
• Gerald Traufetter (25 February 2010). "Death in the Atlantic: The Last Four Minutes of Air France Flight 447". Der Spiegel. Retrieved 28 May 2014. 
• "Air France plane: debris 'is not from lost aircraft'". The Daily Telegraph. London. 5 June 2009. Retrieved 23 April 2010. 
• Sibaja, Marco; Keller, Greg (6 June 2009). "No wreckage found from doomed Air France plane". The Guardian. London. Associated Press. Retrieved 31 May 2011. 
• Jim Thomson (2013). "Situation Awareness and the Human-Machine Interface" (PDF). SafetyInEngineering.com. Retrieved 12 September 2016.  – discusses situation awareness, coffin corner, and the Airbus sidesticks
• "Air France to resume Atlantic flight recorder search". BBC News. 25 November 2010. Archived from the original on 26 November 2010. Retrieved 25 November 2010. 
• William Langewiesche (October 2014). "The human factor". Vanity Fair. 
• "Cockpit Voice Recorder transcript and accident summary". Tailstrike.com. 

Press releases

• "AF447", Actualité, FR: Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile .
• From the Brazilian Air Force (Archive)
• From Air France
• Flight Air France 447 Rio de Janeiro – Paris-Charles de Gaulle Press Releases
• Point presse du 5 juillet 2012