Faultory

Case file 63 · Engineering & technology

The speed readings that could not be trusted

Air France 447, 2009: how did a brief loss of airspeed data turn into a stall from cruise altitude?

Subject
Air France 447 crash (2009)
Reading
14 min
Evidence
5 exhibits
Reasoning
4 steps
Level
Advanced
An Airbus A330 in Air France livery lands on a runway at Paris-Charles de Gaulle airport.
28 March 2007 Air France Airbus A330-203 F-GZCP landing at Paris-Charles de Gaulle in March 2007. The same aircraft was lost on flight AF 447 in June 2009. Photo: Pawel Kierzkowski · CC BY-SA 3.0 · Wikimedia Commons.
Illustrative signature. An illustrative strip-chart sketch of an airspeed trace that wanders, drops and recovers, drawn to show the shape of the disturbance rather than measured values. Drawn to explain the case, not plotted from source data.

01 · The briefing

Begin with the question.

On 1 June 2009, Air France flight 447, an Airbus A330-203 carrying 216 passengers and 12 crew from Rio de Janeiro to Paris, was cruising at 35,000 feet over the Atlantic. The crew had turned 12 degrees left, probably to avoid weather radar returns. At 2 h 10 min 05 in the report’s timeline the autopilot and autothrust disconnected, the speed displays became inconsistent, and the flight control law changed from normal to alternate law. The aircraft stalled and struck the sea a little over four minutes later, and all 228 people on board died. The report weighs weather, the aircraft’s instruments and the crew’s handling as candidate factors. This investigation asks which events the loss of airspeed data made possible, which were caused by the crew’s response, and which were shaped by the aircraft’s design, training and procedures. The BEA’s final report, published in July 2012, reconstructs the sequence from the flight recorders and the cockpit voice recorder, and it separates a probable mechanism from the actions that followed. Test each link against the evidence and look for where the chain could have been broken.

The timeline

  1. The first temporary loss of airspeed indications at high altitude on an Air France A330 occurs. Air France reports such events to Airbus from July 2008.

  2. Air France starts replacing the Thales C16195AA pitot probes on its A330s with the BA version; the first BA probes arrive on 26 May. The accident aircraft still has the original probes.

  3. Flight AF 447 departs Rio de Janeiro Galeão for Paris with 12 crew and 216 passengers on board.

  4. At 2 h 10 min 05 the autopilot and autothrust disconnect. The flight control law changes to alternate law, and the speed indications become inconsistent.

  5. The stall warning sounds intermittently and the aircraft strikes the sea at 2 h 14 min 28, killing all 228 people on board.

  6. The BEA publishes its final report, which identifies ice-crystal blockage of the Pitot probes as the probable starting point of the sequence.

A researched reconstruction for learning. These reasoning steps simplify a complex record; no score can capture the full history.

02 · The evidence

What does the record show?

Read each exhibit before settling on an explanation. The source links below every exhibit lead to the record behind it.

Exhibit 01

A chain of linked events, not a single failure

The BEA’s summary lists the accident as a succession of events: a temporary inconsistency between the measured airspeeds, probably caused by ice crystals obstructing the Pitot probes; inappropriate control inputs; the crew not connecting the lost airspeeds with the right procedure; a late identification of the deviation in flight path; the crew not identifying the approach to stall; and the failure to diagnose the stall. This establishes the chain the BEA reconstructs. It does not establish how strongly each link contributed, and the word ‘probably’ marks the icing as an inference rather than a proven fact.

Source record s1bea.aero

Exhibit 02

Ice crystals and a temporary blockage

Section 1.6.9.6.1 describes how ice crystals can build up inside a Pitot probe tube and disturb total pressure measurement, while leaving no visible ice on the outside of the probe. The report says such a loss of function is usually temporary, around one or two minutes. This establishes the mechanism the BEA considered most likely. It does not show which probes were blocked on this flight, and the right-side speed was not recorded on the flight data recorder, so the three readings cannot be compared in full.

Source record s1bea.aero

Exhibit 03

The stall warning depends on valid airspeed

The report explains that the stall warning uses the highest valid angle-of-attack value. If the three measured airspeeds fall below 60 knots, the angle-of-attack values are declared invalid and the warning is inoperative. During AF 447 the warning stopped and restarted as the readings failed and recovered, and it sounded continuously for 54 seconds at one point. This establishes why the warning was intermittent. It does not establish whether an uninterrupted warning would have changed the crew’s actions.

Source record s1bea.aero

Exhibit 04

Crew actions and the missing procedure

The findings state that the copilots identified the loss of airspeed indications, but neither called the ‘Unreliable IAS’ procedure. Neither pilot formally identified the stall or referred to the stall warning or buffet. The pilot flying made nose-up inputs and selected take-off and go-around thrust, and the Captain returned about 1 minute 40 seconds after the autopilot disconnected. The copilots had had no in-flight training at high altitude for the unreliable airspeed procedure or for manual handling. This establishes gaps in training and procedure. It does not establish what each pilot understood at each moment.

Source record s1bea.aero

Exhibit 05

Probe history and the post-accident response

The report notes that the first event of temporary airspeed loss at high altitude was in May 2008, and that Air France began replacing its original Thales AA probes on 27 April 2009. The report describes AD 2009-0195, issued as a precaution after reviews of further events, which prohibited the AA probes on A330 and A340 aircraft and limited the BA probes to one per aircraft. This establishes the operational history of the probes and the regulatory response. It does not show that the probe type was the decisive cause on this flight, because the report presents the icing as probable rather than proven.

Source record s1bea.aero

03 · Your reasoning

Follow the strongest explanation.

Choose an interpretation, then compare it with the evidence. You can revise your choice. The goal is understanding, not a perfect score.

Reasoning step 01 of 04

Which explanation best accounts for the autopilot disconnection and the change to alternate law within seconds of the speed inconsistency?

Evidence-based explanation

The three airspeed measurements became inconsistent within the same short window, and the BEA judges that ice crystals probably obstructed the Pitot probes. The autopilot and autothrust disconnected, and the aircraft reconfigured to alternate law, which the report links to that inconsistency. The control surfaces moved in line with the inputs, which argues against a structural failure. Turbulence and the course change explain the setting, but not the timing of the speed inconsistency.

Weigh it against

Exhibit 01A chain of linked events, not a single failureExhibit 02Ice crystals and a temporary blockage

Reasoning step 02 of 04

Why did the stall warning stop and restart during the approach to stall, rather than sounding steadily?

Evidence-based explanation

The stall warning relies on valid angle-of-attack values, and those values depend on a minimum measured airspeed. The warning therefore stopped when the three speed measurements failed and restarted when at least one angle-of-attack value became valid again. The Mach-dependent threshold also mattered, but the report judges it secondary in this event. The recorded parameters support this reading, and the short warning activations, picked up from the cockpit voice recorder rather than the stall warning parameter, limit how precisely their timing can be read.

Weigh it against

Exhibit 03The stall warning depends on valid airspeed

Reasoning step 03 of 04

Which change would most directly address the gap in crew response that the report identifies?

Evidence-based explanation

The report’s findings point to the crew’s ability to recognise and act on a failure they had rarely practised. The copilots called out the loss of speed but did not use the unreliable airspeed procedure, and neither formally identified the stall. Probe changes and warning changes address parts of the chain. Training that covers the procedure, manual flight at altitude, stall recognition and coordination addresses the gap that the BEA describes most directly.

Weigh it against

Exhibit 04Crew actions and the missing procedureExhibit 05Probe history and the post-accident response

Reasoning step 04 of 04

Why did the aircraft not recover from the stall during its last four minutes?

Evidence-based explanation

Neither pilot formally identified the stall, and the report concludes that the crew did not diagnose it, so no recovery action was taken for a long period. The nose-up inputs raised the angle of attack beyond 40 degrees, and the pitch-down inputs that lowered it came about half a minute after the Captain re-entered the cockpit. The engine and structural explanations are not supported by the data the report quotes.

Weigh it against

Exhibit 03The stall warning depends on valid airspeedExhibit 04Crew actions and the missing procedure

04 · The findings

The chain behind the outcome.

Flight AF 447 was a chain of linked events rather than a single failure. Ice crystals probably obstructed the Pitot probes at high altitude, producing three inconsistent airspeed measurements. The autopilot and autothrust disconnected, and the flight control law changed to alternate law, which gives the aircraft less automatic protection. The stall warning depends on valid angle-of-attack data, which in turn depend on a minimum measured airspeed, so the warning stopped and restarted as the readings failed and recovered. The copilots called out the loss of speed, but neither used the unreliable airspeed procedure, and the aircraft climbed while the pilots made large and sustained nose-up and roll inputs. The stall was not formally identified, and the copilots had had no training at high altitude for the procedure or for manual handling. The Captain returned about 1 minute 40 seconds after the disconnection, and the stall persisted until impact. The established facts are the speed inconsistency, the disconnection, the change of control law, the stall warning logic and the crew actions. The relative weight of probe icing, training and cockpit coordination is the investigators’ judgment, drawn from the recordings.

Contributing causes and conditions

  1. Ice crystals at high altitude probably obstructed the Pitot probes, producing temporarily inconsistent airspeed measurements.
  2. The autopilot and autothrust disconnected, and the flight control law changed to alternate law.
  3. The stall warning depended on valid angle-of-attack data, so it stopped and restarted as the speed readings failed and recovered.
  4. Large, sustained nose-up inputs raised the angle of attack beyond the stall range.
  5. The crew did not use the unreliable airspeed procedure or formally identify the stall, and had little high-altitude training for that situation.
  6. No regulatory crew resource management training existed for a two-copilot crew with a relief captain.

OutcomeAir France 447 crash (2009)

Take the method with you

  1. A measurement that disagrees with its neighbours is a warning in itself, and the system should announce that disagreement clearly.
  2. Automation that returns control to a crew must be matched by training for the state it returns.
  3. A warning that depends on the validity of other data can go silent exactly when it is most needed, so that dependency must be documented for the crew.

You can read findings at any time. Exploring every reasoning step marks this case as complete in your notebook.

Open another investigation

The open record

Sources & further reading

Read the original record and its scope before relying on a conclusion. Source references support the exhibit summaries; Faultory’s reasoning prompts are editorial reconstructions.

  1. s1
  2. s2

Written and curated for Faultory by Yunus Emre Vurgun, with AI-assisted research and drafting. Sources and interpretations can need correction. Read our editorial standards or report an issue.

From the journal

Field notes that use this case

Keep investigating