Understanding Air France 447 (20 page)

There were a series of phone contacts between the Atlantico, Dakar, and Sal controllers attempting to confirm exactly where AF447 had been and at what time.

At 05:01 Dakar, still trying to figure out where the flight was, contacted the CANARIES controller in the area north of his, asking if he was in contact with AF447. He replied that he had no information.

Between 05:11 and 05:26 Air France continued to try to contact the flight over a dozen times via ACARS and SATCOM calls. Within that time the Air France maintenance deputy shift supervisor requested information on the automatic error messages that had been received from the flight. It was noted that the problem seem to be located in the pitot tubes, and there had been messages concerning the flight controls. The maintenance officer noted that he had seem similar messages before from airplanes passing through storms, but there were no communication errors reported.

At 05:23, over three hours after AF447 had crashed, Atlantico-Recife ARCC (Aeronautical Rescue Control Center) registered the disappearance of the AF 447 and triggered the Search and Rescue (SAR) process which consisted initially of gathering information.

At 05:30 the Air France OCC dispatcher called the CANARIAS controller, from whom he could not obtain any further information on AF447. The CANARIAS controller said that he could only contact the Sal center and had no contact with the Atlantico center. The controller added that given the time, he should have had AF447 in radar contact but that the flight was not in his air space or in Sal’s. The CANARIAS controller and the dispatcher agreed to try and contact the Atlantico center and to keep each other informed.

At 05:37 the OCC maintenance shift supervisor and the maintenance center officer were anxious about the last ACARS message at 02:14 mentioning cabin vertical speed and the lack of radio contact with any control center.

At 06:35, after several exchanges between controllers, the Madrid controller confirmed to the Brest controller that flight AF447 was in the Casablanca FIR and would enter the Lisbon FIR within 15 minutes. This information was immediately transmitted to Cinq Mars la Pile ARCC and to Air France OCC.

Shortly thereafter The OCC told the Brest controller that the Casablanca center was in contact with the crew of flight AF 4595. This information was retransmitted to the Madrid and Lisbon controllers.

Three phases of alerts are supposed to happen when contact with an aircraft is lost:

• INCERFA (uncertainty phase), when no communication has been received from the crew within a period of 30 minutes after a communication should have been received.
  
• ALERFA (alert phase), when subsequent attempts to contact the crew or inquiries to other relevant sources have failed to reveal any information about the aircraft.
  
• DETRESFA (distress phase), when further inquiries have failed to provide any information, or when the fuel on board is considered to be exhausted.
  

But there had been some confusion about what agency was expected to trigger the appropriate alerts.

At 06:57, the OCC shift supervisor informed the CNOA (the French military body in charge of the aerial resources assigned to the French RCC) that Casablanca was not in contact with flight 447 after all. The CNOA asked if an uncertainty phase had been set off by a control center and if foreign search and rescue organizations had been alerted. The OCC answered that for the moment it was the control centers who were questioning the situation among themselves.

Between the hours of 05:30 and 08:00 numerous calls between the various air traffic control centers and Air France were made. There was no protocol between the various control centers to be able to make inquiries directly about the presence of an airplane. There were only protocols between adjacent control centers. At one point, the Atlantico-Recife ARCC asked the Air France station manager at Rio if he had the numbers of the Casablanca and Lisbon control centers. He did not.

At 07:26, the Brest and Bordeaux center controllers (in France) were surprised that following so many exchanges between the various centers, no critical INCERFA / ALERFA / DETRESFA type phase had been triggered.

At 07:55, the Madrid duty officer and Madrid ARCC were surprised that everyone was requesting information on this flight but that no-one had yet triggered the INCERFA or ALERFA phases. The air traffic controller questioned whether it was for him to trigger these phases. The Madrid ARCC pointed out to him that if radar and radio contact was lost a DETRESFA phase would have to be triggered directly.

At 08:00 (9am in Paris), Air France set up a crisis group.

At 11:04 the first Brazilian plane took off to begin search and rescue (SAR) operations.

From the last contact with AF447, it took three and a half hours before the SAR process was put into effect, and nine hours to launch the first search aircraft.

The failure of the ADS logon prevented the immediate alerting of ATC of the flight’s diversion from the normal path and altitude, and delayed the awareness that the airplane was in any kind of trouble for almost three hours. The absence of position data that could have been transmitted by ADS-C contributed to the hours it took to fully realize the flight was missing, the five days it took to locate the floating debris, and the nearly two year delay in locating the sunken wreckage.

Due to the confusion and poor communications among the various agencies, the BEA recommended that ICAO ensure the implementation of SAR coordination plans or regional protocols covering all of the maritime or remote areas for which international coordination would be required in the application of SAR procedures, including in the South Atlantic area.

A more detailed chronology of the communications between the various agencies can be found in Appendix 4 of the Final Report, (SAR Communications) found at:
http://www.bea.aero/docspa/2009/f-cp090601.en/PDF/annexe.04.en.pdf

ACARS Messages

When the aircraft was first lost, one of the only clues as to what happened was a series of maintenance messages automatically downlinked from the airplane in the final minutes of the flight to the Air France maintenance department.

Virtually all airliners use a system commonly referred to as ACARS. ACARS (Aircraft Communications Addressing and Reporting System) allows for message transfers between the airplane and airline, and some Air Traffic Control functions through the system as well (clearances, ATIS, etc.). The worldwide communications infrastructure is run by several companies the provide the ground radio stations, contract for communications satellites, and other communications services. On the A330, the aircraft’s communications system can switch between air-to-ground VHF radio and SATCOM in order to be able to send and receive messages anywhere in the world. The system is used for a variety of purposes including sending text messages between the crew and company (e.g., dispatchers, arrival stations, etc), and automatically reporting takeoff and landing times, position reports, requesting weather, clearances, etc. Though voice radio relays and Satellite phone are normally available, most routine en route communications between the airplane and the airline are accomplished through ACARS.

In addition to the overt messaging between the crew and airline, a fair amount of other messaging takes place behind the scenes that is totally transparent to the crew. This may include such things as sending periodic engine data readings for maintenance monitoring of engine condition, reports of events such as pushback, takeoff, and touchdown times; and reporting of known maintenance events.

With the heavy amount of computer control and monitoring on the airplane, most maintenance items (failure, partial failure, abnormal conditions) are identified by the on-board maintenance computers that record and and then automatically report these parameters and anomalies. In general these failures and/or abnormal conditions are then reported to the company maintenance department via the automatic ACARS messaging system, so that maintenance can better prepare for arrival and quick repair of the airplane and maintain high operational reliability. After all, it is much easier to keep the airplane on schedule for the next flight when maintenance can know about a failed component five hours ahead of time, instead of waiting for the airplane to pull into the gate.

Because the maintenance reporting system is automatic, it does not rely on the crew to transmit text reports of failures (though they may do that too). Additionally, the system can report on system issues that the crew may not know about because they are of such a minor level that the crew was not made aware of them. Some such items might be those that do not affect the operation of the flight and the crew can not do anything about anyway, but should be looked at by maintenance over the next few days.

Each item recorded is noted with the date and time, phase of flight (climb, cruise, etc), a system code number, and a general text description of the issue.

The maintenance reporting system is intended to keep maintenance personnel reasonably informed about malfunctions on the airplane. It is not designed to closely monitor the flight. Therefore, exact time recording (to the second) and immediate transmission of the messages in the exact order they occurred is not considered important. The messages may also be queued for delivery and transmitted when possible. For a satellite communication link, there is an exchange protocol that takes some time to establish and execute, and may depend on the availability of a signal and other higher priority data being transmitted or received. For example, an automatic position report was sent at 02:10:34 (30 seconds after autopilot disconnected) that took higher priority over maintenance message transmission. There was also a 30 second interruption of the satellite communication link about 45 seconds prior to impact.

When contact with AF447 was lost that night, the maintenance reporting system continued to operate until the time of impact. Before the aircraft and flight recorders were found years later, these messages were some of the only clues as to what happened on board the airplane. However, because the messages are only noted with to-the-minute accuracy, the exact sequence of two messages with the same time stamp cannot be assured. Nor can it be known, if all the messages that were going to be sent, were sent. Contrary to statements made in some narratives, these messages are not transmitted to ATC, or visible to the crew (unless they access the maintenance computer, which is almost never done.)

Except for the phase of flight digit, no other flight parameters are provided (such as altitude, speed, etc), so the picture it paints is one of individual data points often with insufficient data to draw definitive conclusions about what was really happening. The messages themselves also do not necessarily provide a complete picture of why it was triggered. For example, a system failure and a pilot turning off that system may generate the same message, or several similar faults may generate the same message. As if that were not enough to paint an incomplete picture, each message is only transmitted once, even if the fault occurs multiple times. The system also does not record or transmit when a system regains functionality, nor are all events recorded or transmitted, such as configuration issues, stall, and over-speed.

The messages are decoded below. Additional detail is provided in the first initial report of the accident. A brief description and explanation of the message’s meaning follows each message below.

Example Message: (Spaces added for clarity)
WRN/WN 09 06 01 0210 22 10020 06 AUTO FLT AP OFF

WRN:
- A warning, with some cockpit displayed effect

FLR:
A fault not displayed in the cockpit (not in the example)

09 06 01 0210:
Date and time stamp. In this example: 2009, June 01, at 02:10 UTC

22 100 20:
A system and standardized reference number to a sub system. In this case system 22 is auto-flight and 100 20 refers to the autopilot

Added to this is a list of names of the other system identifiers that have generated correlated messages.

AUTO FLT AP OFF:
The message text description including the system name: Auto flight, autopilot off.

An additional note of INTERMITTENT or HARD, indicates if a fault was transient or confirmed over a period of time.

Two times are provided below. The first is the time of occurrence transmitted with the message - with accuracy only to the whole minute, and the second is the time of reception - recorded with the seconds value.

Time of
Origination/Reception: Message Content

02:10 / 02:10:10 WRN/WN0906010210 221002006 AUTO FLT AP OFF

Autopilot disconnection due to a fault (not pilot selected)

02:10 / 02:10:16 WRN/WN0906010210 226201006 AUTO FLT REAC W/S DET FAULT

Reactive wind shear detection system is no longer available. Valid airspeed data is required for this system to operate, among other items, but wind shear detection is only available at low altitude.

02:10 / 02:10:23 WRN/WN0906010210 279100506 F/CTL ALTN LAW

The change from Normal to Alternate Law 2

02:10 / 02:10:29 WRN/WN0906010210 228300206 FLAG ON CAPT PFD SPD LIMIT

02:10 / 02:10:41 WRN/WN0906010210 228301206 FLAG ON F/O PFD SPD LIMIT

The speed limits on the airspeed scales were no longer displayed, and were replaced by fault flags. The airspeed itself was most likely still displayed (though incorrect at this time)

02:10 / 02:10:47 WRN/WN0906010210 223002506 AUTO FLT A/THR OFF

Auto-thrust disconnection due to a fault (not pilot selected)

02:10 / 02:10:54 WRN/WN0906010210 344300506 NAV TCAS FAULT