AF 447 – What The Crew Did … Maybe


From the BEA’s second interim report (BEA 2009) we now know that AF 447 was flown into the water while deeply stalled (1).

So, given the training and experience of the flight crew how could they have ended up in such a situation?

For the moment we don’t have hard data such as a Flight Data Recorder (FDR) would provide, but we do know something of the psychology of human behaviour and perhaps that can shed some light on the possible actions of the crew.

This post is part of the Airbus aircraft family and system safety thread.

BEA study of other incidents & crew responses

As part of the BEA’s second report the BEA studied 13 loss or unreliable indicated speed events. In summary they found that:

  • The maximum continuous duration of invalid speeds was three minutes & twenty seconds.
  • Turbulence was recorded and reported in 13 of the events.
  • Nine crews identified an unreliable air speed.
  • Nine cases of triggering of the stall warning were observed (2).
  • ISIS speed anomalies differed from the captain’s display.
  • Alternate law persisted until end of flight in 12 cases.
  • Memory items were not applied by crew (3)*.
  • Crews did not search for display of a 5 degree attitude (4)*.
  • In 10 cases the auto/thrust disconnected automatically.
  • In two cases, auto-thrust did not disconnect & flight directors did not disappear (5).
  • In only one case did a crew manually disconnect auto-thrust for flight in turbulent conditions.
  • In five of the a/thrust disconnections thrust lock was not manually disconnected for over one minute.
  • In five instances the crew initiated a stall recovery descent in response to stall warnings.

* The BEA could not find any indication that this was carried out by crews.

Expressing this data in probabilistic terms (6):

  • An icing event is extremely likely to be associated with turbulence, and extremely likely to result in both auto/thrust disconnection and permanent alternate law,
  • A crew faced with an icing incident would be very likely to identify the situation as unreliable airspeed but would be extremely unlikely to then apply memory items or search for a 5 degree attitude, and
  • A crew would be very unlikely to disconnect auto/thrust prior to an icing event but are as likely as not to disconnect thrust lock within one minute of the auto/thrust disconnect
  • Crew are as equally likely as not to carry out a recovery descent.

Naturalistic decision making

So how do aircrew make decisions in these sort of circumstances?

Studies of how experts, such as experienced flight crew, make decisions under constraint (7) show that they use a cognitive strategy that derives decisions directly from the recognition of similarities between current events and past experience. Klein (1998) terms this cognitive strategy Recognition Primed Decision Making or RPD.

In RPD current events are compared with previously experience and memorised rules. Recognised similarities are then used to help select appropriate reactions, judgments and decisions.

The objective of RPD is above all to quickly find a workable, not necessarily optimal, solution. This leads to the serial consideration of options and in the case of expert decision makers, the need to only consider a couple of options.

So in the context of AF 447, the crew would have recognised the combination of anomalies in the air data and system responses (e.g. ECAM warnings) as fitting an ‘unreliable air speed’ pattern and have selected a response on that basis.

From the BEA’s study such a response would be equally likely to have been, ‘sit tight and wait for the air data to recover’ as it would have been to initiate a voluntary descent.

Heuristics and biases

But when decisions are made under time constraints, heuristics (or rules of thumb) are used that can bias decision makers to sample and process information selectively and subjectively.

Two pertinent biases in the context of the AF 447 crew’s responses to unreliable airspeed are confirmatory biasing and cue salience.

Confirmatory biasing. In confirmatory biasing having initially formed a theory a decision maker then notices information that confirms the theory but disregards conflicting information.

So in the case of AF 447 the crew may have:

  • interpreted stall buffeting as turbulence from the thunderstorm,
  • interpreted loss of buffet after entry into stable deep stall condition as normal flight (8),
  • Misinterpreted air data indicating stall as continuing unreliable air data, and
  • Potentially evaluate increasing alpha as another unreliable airspeed parameter.

Cue salience. In cue salience, cues (perceived events, data and so on) may be disregarded because of their lower salience (attensity) by a decision maker.

So again in the case of AF 447:

  • the accident occurred at night eliminating cues from the external visual field,
  • Air data indicating stall would have low salience given continuing unreliable air data including conflicts between ISIS and Captains displays,
  • stall buffeting would have had low salience the aircraft was then in a region of high thunderstorm induced turbulence,
  • having departed into a deep stall any reduction in buffet would have reduced the salience of that cue, and
  • stall warnings would have had low salience, given they had been generated by the unreliable air data in the first instance.

Experts and Novices

In RPD experience is the key to making effective decision making, given that pitot icing events were not normally experienced by air crew and only annually trained for this lack of experience in effect limits their expertise.

To put it another way flying an aircraft in high turbulence with unreliable air data in or near the ‘coffin corner’ (9) is not a scenario that a pilot is prepared for by either training or experience.

A tentative scenario

So, based on what we know about the events onboard AF 447, including estimated terminal velocity at impact, and what we can reasonably infer from the BEA’s study of other unreliable air speed incidents a possible scenario may be as follows.

Note that I make no assumption that the event occured whilst flying within the extreme weather of a thunderstorm as previous pitot icing incidents (such as the Air Caraibes incident) have occurred ‘in the vicinity’ of bad weather.

The aircrew would have initially responded to the air data anomalies by sitting tight and attempting to fly the aircraft through the event.

Due to the use of erroneous air data by the auto-thrust system the engines disconnect, leaving the engines auto-locked with a low N1 value.

In turn this results in a speed/thrust mismatch that initiates a slow pitch rate entry into stall, the buffeting of which is misinterpreted as being turbulence by the crew (10).

Subsequent stall warnings, decreasing altitude and increasing vertical speed are again mis-interpreted by the crew as due to unreliable air speed.

The aircraft departs into a deep stall that then reduces stall noise & kinesthetic cues.

Having unknowingly entered into a deep stall the crew may then have exacerbated the situation by control inputs that initiated an unrecoverable flat spin (11), or a flat spin could have been triggered by turbulence induced yaw.

The crew then either fail or are unsuccessful in responding to the stall within the remaining altitude.


1. A high rate of vertical descent with a positive attitude is consistent with a deep stall condition, that is nose high and wings level (Carbaugh, et al. 1998). The aircraft may have also been in a flat spin at the time of impact (11).

2. In alternate law, alpha protections are no longer available but a stall warning is triggered when the greatest of the valid alpha values exceeds a certain threshold.

The highest of the valid mach values is used to determine the threshold. If none of the three Mach values is valid, a Mach value close to zero is used. For example, it is of the order of 10° at Mach 0.3 and of 4° at Mach 0.8 (BEA 2009).

3. These are imediate actions that should be performed from memory, in the case of unreliable airspeed these consist of ensuring that AP/FD/ATHR OFF then flying memorised pitch – thrust settings of the FCOM and QRH.

4. For example five degrees of pitch is the memory pitch value for flight above FL 100 (AirBus) for the A320/330 aircraft.

5. In case of automatic disconnection of the auto-thrust with activation of the thrust lock function, the absence of appropriate manual adjustment of thrust can present a risk of an attitude/thrust mismatch, especially when this disconnection occurs with a low N1 value (BEA 2009).

6. For the purposes of discussion likelihood terms are defined as follows:

  • Virtually certain > 99% probability of occurrence
  • Very likely > 90% probability
  • Likely > 66% probability
  • Equally likely as not 33 to 66% probability
  • Unlikely < 33% probability
  • Very unlikely < 10% probability
  • Exceptionally unlikely < 1% probability

7. Naturalistic environments may include time constraints, high adverse consequences, competing objectives, poorly defined or structured goals and feedback loops.

8. Given a slow enough pitch rate upon entry into a stall an aircraft may take up a stable ‘deep stall’ attitude with little pitch oscillation and stall buffeting. In a fly by wire flight control direct kinesthetic feedback indicating incipient stall is not available, unless a ‘stick shaker’ function is implemented.

9. The term ‘coffin corner’ is used as per the definition of FAA Circular AC denote an upper portion of the operating envelope where low indicated airspeeds yield high true airspeeds (MACH number) at high angles of attack, for a given gross weight and G force, not the more exaggerated meaning used by the media.

10. Noting that recovery from a spin would itself have been made more difficult given the unreliable air data being presented to the crew.

11. A hazard of large aircraft design is that they can become inertially locked in a developed spin and are unrecoverable without a drag chute, if at all.


Carbaugh, D., Cashman, J. Carriker, M., Forsythe, D., Melody, T., Rockliff, T., Wainwright, W., Aerodynamic Principles of Large-Airplane Upsets, Boeing Online Aero Magazine Issue No. 3, 1998.

BEA, Interim report no. 2, on the accident on 1st June 2009, to the Airbus A330-203, registered F-GZCP, operated by Air France flight AF 447 Rio de Janeiro – Paris, Report Number f-cp090601ae2, November 2009.

Klein, G., Sources of power: How people make decisions, MIT Press, 1998.

3 responses to AF 447 – What The Crew Did … Maybe

    Victor Fernandes 03/06/2010 at 12:42 pm

    Dear Matthew,
    I would tend to agree with your theory of what pilots may have done in the case of the AF447 accident, except for the idea that the attitude to be set up in case of unreliable airspeed at high altitudes should be, in fact, 2.5º (not 5º).
    Although QRH Memory items are (for the A330):
    – Above TR ALT and Below FL100 10º
    – Above FL100, 5º.
    this numbers are to be used close to the terrain. If AF447 pilots have used that attitude by memory, and specially if they kept a low power set up, that must have contributed to enter the Stall.
    We know by experience that, the use of 5º is (in most cases) beyond available power, especially when flying in the “coffin corner”, as most pilots do.
    Also, regarding your note: “10. A hazard of large aircraft design is that they can become inertially locked in a developed spin and are unrecoverable without a drag chute, if at all”. I would like to add that, the momentum created by the 4.9 Tons of fuel in the Trim Tank, would have impaired the crew to recover from a flat spin, even with visual references or reliable speed information.
    Great article, thanks for sharing.



    I am a retired airline Captain.
    My training and experience is that a succesful thunderstorm penetration requires complete disregard of pitot information. Attitude and power control are the essential elements. No pilot would knowingly penetrate a thunderstorm. In the event a penetration is inevitable, the attitude gyro, along with the establishment of an adequate power setting are primary. Maintaining a wings level, nose level, attitude is critical. After an adequate power setting is established, changes to it, if any, would be minimal. In a thunderstorm, displayed pitot information, ie., airspeed, altitude, changes dramatically. It becomes unreliable.
    Maintaining proper attitude is key.

    To think of how the crew of 447 must have felt when the loss of aircraft control left them helpless, because of a poor, almost reckless design concept, makes me ill. Not only because of them, and their passengers, but also because it will happen again.
    Bob Klenke


Trackbacks and Pingbacks:

  1. In einem Wort « Erich sieht - October 23, 2010

    […] Recognition Primed Decision Making (RPD) […]