This 2009 airbus crash has very interesting engineering aspects, and the crash findings should scare the hell out of anyone who flys. In a nutshell the three pilots of Air France flight 447 were unable to fly the plane manually when the airspeed sensors froze up briefly! Most observers consider this a seminal accident in that it showed serious problems with airliner pilot training, weaknesses in the airbus flight control code and in the view of many in the airbus cockpit design.

Pilots don't seem to understand the plane is stalled
Airbus A330 --- a computer controlled airplane
Overview & summary
Unstallable plane?
Introduction
Pitot tubes freezing
     Wasn't freezing a well known problem?
     Three pitot tubes in A330 Airbus
     Angle of attack non-display
Can you say whitewash?
Causes of the crash from final crash report
     Poster's excellent summary of the automated plane problem
     Conservative course of action
BEA report discusses 13 other cases of pitot tube freezing

Who's to blame?
      Pilots are to blame
         Pilots didn't react conservatively
         Nobody looks up the loss of airspeed procedure
         Pilot severely stall the plane in 45 seconds
         Misled by the flight director?
         Continuous 'stall', 'stall' warning doesn't give them a clue?
         Why can't the pilots figure out the plane is stalled?
         No credible explanation in the crash report
         Airspeed display in the cockpit
         Two 30ish copilots don't seem to know how to fly the airplane!
     Senior Pilot
         "Damn it, where is he?", the copilots curse
             Was senior captain busy with a female friend?
         Copilots tell him they have lost control of the airplane
         Senior pilot takes a seat in back!
         Dual input conflict not resolved
         Bottom line --- pilots fly a perfectly good airplane into the ocean
                (And they never tell the passengers anything!)

     Airline is to blame
         Zero training for what to do if airspeed goes out
         Insufficient training for flying under 'alternate law'?
         Air France decides not to replace A330 pitot tubes until they show problems!
         Maybe tell pilots a pitot tube upgrade is under consideration because of reported icing failures? Nah!

Engineering aspects of the crash
      Airbus design is to blame
         Don't just beep and tell the pilots you are flying now
         Don't just remove airspeed, show all the conflicting data
         GPS speed?
         Stall warning algorithm may have problems (final report)
         Why the hell is the 'Stall Warning' turned off below 60 knots?
         Did flight director mislead the flying copilot to pull the nose up?
         Why no Angle of Attack display for pilots?
         Advise the pilot of the extra risk in flying in 'alternate law'
         Airbus flight control is not friendly in an emergency
         Flight control system could prompt for a conservative response from pilots
         Can warnings and alarms be heard and/or seen in the pilot rest area?
         Do the pilots' airspeed displays recover?
         Wider dynamic range of instruments?
         Why didn't airbus do more about frozen pitot tubes?
                 (crash reports lists 36 pitot tube icing failures in A330 and A340 alone in 6 years prior to crash)
         Misleadingly named 'Unreliable Airspeed Procedure'

BBC excellent 47 min documentary on 447 crash
        http://www.youtube.com/watch?v=BnZ5MmLkvj4

William Langewiesche's detailed review of events in Vanity Fair
        Langewiesche, who is an aviation writer, pulls together all the data shows how the pilots' comments are repeatedly at odds with what the plane was actually doing. Unless it is a french to english translation issue he shows the the pilots didn't even have the language to describe the pitch of the plane as opposed to the changes in the plane's altitude. This, of course, is the heart of the matter, and the discussion of the issue in the cockpit was a jumble of confusion. To me this is a clear indication that the pilots only had a cursory understanding of basic flying. The plane is buffeting and shaking strongly even before the pilot comes back, so even if they don't believe their instruments, the plane itself is telling them it's stalled, yet they still can't figure out they are stalled!

         Langewiesche says the air speed has recovered and  the displays are working normally even before the pilot comes back, which is probably right since the pitot tubes thawed in 30 sec. Yet not one of the three pilots seems to notice. For most of the crucial minutes all three are preoccupied with keeping the wings level and no one notices that the speed has dropped through the floor and the attitude rapidly is melting away. What happened to pilot monitoring? The junior flying pilots are flaying about, brakes go on then off, engines spool up and then down, yet the senior pilot does and says virtually nothing. The evidence screams to me that all three of these pilots were incompetent.
        http://www.vanityfair.com/news/business/2014/10/air-france-flight-447-crash

Airbus simulator video
        This ABC News video (2nd video in link below) taken in an airbus simulator shows the autopilot disconnecting, and you can hear the stall warnings.
         http://www.slate.com/blogs/the_eye/2015/06/25/air_france_flight_447_and_the_safety_paradox_of_airline_automation_on_99.html

    Sullenberger points out the aspects of airbus cockpit design that likely contributed to the accident
    Airbus code not clean for lack of airspeed
    Central mystery --- Why does the crew not recognize the plane is stalled?

Figures
     A330 cockpit
     Pitot tubes
    Static altitude system
     ABC timeline
         Stall in 2 to 5 seconds!
         How to stall an airliner in five seconds
     Airbus A330 flight envelope(s)
         Falling out of the sky increases angle of attack
         Simple height-speed energy calculation
     Conservative flying simulation
     Flight data recorder plots

References
      Link to the french (BEA) final report on flight 447 crash (released 7/12)
      My notes from reading through the transcript of the cockpit voice recorder
     Wikipedia summarizes the Air France flight 447 accident report
     Airbus <unreliable speed procedure>
      Flying without airspeed gets easier --- Back UP Speed Scale (BUSS)

Press
      Pilots not trained to fly without airspeed
      Airbus pitot tubes freeze on Air Caraibes over Atlantic
      What really happened aboard Air France 447 (Popular Mechanics)
      Hard hitting commentary on Aviation site AVWeb
      Misc

Appendix
      Airbus without power lands in Hudson river
         Was Sullenberger lucky that no one died?
         'Fly by Wire' book by William Langewiesche
      SAS double engine failure on takeoff
            (a flight controller screwup from 20 years ago)
      Airbus training material
      Another summary of the 447 crash
      Pilot deliberately flys into tropical storm clouds
      Boeing 787 (Dreamliner) has GPS air speed backup

Airbus A319 with dual engine failure (6/13)

Three crash landings in USA within five weeks
        Asiana flight 214, Boeing 777 crash landing at San Francisco airport (7/6/13)
        Southwest flight 345, Boeing 737 nose wheel collapse at LaGuardia (7/22/13)
        UPS A300 airbus cargo plane crash landing in Birmingham (8/14/13)
        Tatarstan Airlines Flight 363 Boeing 737 Crash (11/17/13)
        Malaysia flight 370 Boeing 777 disappearance (3/8/14)
        One engine Socata 'ghost plane' flys from NY to Jamaica (9/5/14)
        Air Nippon Being 737 violent dive, roll to near inversion, high speed stall and overspeed (10/8/2014)
        AirAsia flight 8501 AirBus 320-200 falls out of the sky with no distress call (12/28/1)
        GermanWings AirBus A320 falls from cruise altitude in southern france with no distress call (3/24/15)
        Russian Airbus A321 civilian airliner falls from cruise altitude over Sinai Egypt with no distress call (10/31/15)
             Dubai high rise fire (12/31/15)
             Grenfell Tower fire London (6/14/17)
        Flydubai flight FZ981, Boeing 737, from Dubai crashes trying to land in Rostov-on-Don (3/18/16)
        EgyptAir Airbus A320 civilian airliner falls from cruise altitude over Mediterranean with no distress call (5/19/16)
        Sullenberger ditches Airbus A320 with double engine failure in Hudson River (1/15/2009)
        AirAsia X A330 flight D7237 violently shaking of passenger compartment (6/26/17)

        The mysterious disappearance in 2009 of an airbus A330 flying from Brazil to Paris over the tropical Atlantic interests me, because like the Costa Concordia cruise ship crash, it has engineering aspects along with operational and pilot error. After a two year search, the plane's black boxes were found and recovered, and the final accident report has been issued, so it is now known what happened.

        Many in the aviation community consider this crash to be a seminal event. This crash of an airbus A330, a rare event, the first with passenger deaths since it entered airline service, exposed fundamental problems in the skills and training of pilots of highly automated planes. It showed how difficult it can be to try and fly a highly automated plane, like airbus, manually in an emergency.

        And what happened on this flight was very scary because it showed that some pilots (more likely younger pilots) of modern highly automated planes, which largely fly themselves, could not be trusted to take over and fly the plane manually at altitude when the need arose. The pilots of Air France 447 stalled the plane (briefly) within five seconds after taking control and severely after 45 seconds, and even though there were three pilots assigned to this flight, as a group they didn't have a clue as to how to recover, so a perfectly good, flyable airplane fell out of the sky into the Atlantic killing all 226 people on board.

        This essay has grown to great length as I have pulled together in one place various threads, theories, ideas and criticisms I found that are scattered all over the web and to add my own perspective as a retired engineer.

Pilots don't seem to understand the plane is stalled
        While there are a lot of contributing causes to this accident, the heart of the matter is that the pilots of Air France flight 447 can't seem to figure out their plane is stalled. The facts related to this stall, mostly well documented by the plane's black boxes, are simply astounding.

        At cruise altitude the air is thin so a plane needs to fly fast to generate enough lift with its wings to overcome gravity. The available speed range at altitude is quite small, often called 'coffin corner'. If a jetliner at cruise altitude loses just 15-20% of its airspeed, it stalls, meaning gravity is now greater than lift, so the plane begins to fall. This is just basic aerodynamics of flight that should be known by all pilots.

        In the case of flight 447 towering equatorial thunder clouds they entered (briefly) froze up the plane's pitot tubes so airspeed could not be measured. Within 29 seconds one of the airspeed readings on the cockpit display comes back and within a minute all three speed readings are back, valid and show the same reading. They all indicate that in the one minute airspeed was out the plane, still at cruise altitude, has lost 1/3rd of its airspeed. It's stalled. Yet the low airspeed readings don't appear to give the pilots a clue they are stalled. That the plane has slowed during one minute of manually flying should not be a surprise to the pilots because the flying pilot has had his stick back the whole time causing the plane to climb with the non-flying pilot repeated warning him 'watch your speed'. Confirmation that the plane has climbed could be seen in the altitude display, which remained always valid. Around this time the cockpit stall warning voice ('Stall, Stall, crickets', which is an annoying noise designed to be hard to ignore) is now going off continuously. Amazingly the stall warning, which reinforces the low speed readings, still doesn't appear to give the pilots a clue. The pilots can now see from the altitude readings, which are beginning to drop, that the plane is beginning to fall from the sky, and as time goes on they can see the plane is falling faster and faster. Gee you think we might be stalled? No one asks, no one in the cockpit ever mentions the word "stall". (The final test report drolly says, "Neither of the pilots formally identified the stall situation.") Not a clue. Angle of attack is not displayed in jetliner cockpits (a big mistake say many pilots), but from basic flight dynamics with the plane falling in a nose up orientation (nose held up by the pilot) the airflow seen by the wings can be visualized as coming from below the plane, so the wing angle of attack is terrible, far too high. Decreasing altitude readings with the nose up paints a picture of a deeply stalled wing, but still the pilots don't appear to have a clue they are stalled. The plane's airspeed continues to drop such that two minutes in more than 2/3rd of airspeed has now been lost with the plane still six miles up. Still the pilots don't appear to have a clue. Did maybe the pilots think the speed readings were invalid? Well there is an airbus procedure for that and even though there were two (later three) pilots in the cockpit no one looks it up. ("Neither of the two copilots called the "Unreliable IAS (indicated airspeed) procedure", says the final report.) In short with the recovered airspeed displays all showing very low air speeds at cruise altitude, a stall warning going off, decreasing altitude readings showing the plane falling out of the sky (oriented nose up and engines working), yet for some nearly inexplicable reason the pilots of flight 447 still can't figure out the plane is stalled!

        What I describe as the pilots 'not having a clue', the final report (with its deliberately obscure language) calls, "total loss of cognitive control of the situation'. The final report authors think they understand what the crew was thinking, saying, "the crew never understood that they were stalling and consequently never applied a recovery maneuver (p200)." Also under Causes of the Accident (p200) it says, "During this event, the initial inability to master the flight path also made it impossible (really!) to understand the situation and to access the planned solution." Translation: the flying pilot immediately put the plane into a steep climb for reasons totally inexplicable, and the resulting loss of airspeed resulted in a bad stall. However, I totally disagree with the final report that the climb of the plane made it "impossible" for the pilots to figure out what was wrong for the reasons I list above. And finally the report gives as one possible explanation as to why stall warning were ignored, "Difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection." Translation: the pilots may not have understood the flight control design of the airbus. They may not have understood that the normally 'unstallable' airbus was eminently stallable flying, as they were, under 'alternate' law.

        These are pilots? Really? Well the record shows they have passed all the exams and simulator tests, so what does that say about pilot training and certification? Computers fly modern jetliners 98% of the time, the small amount of flying pilots do is associated with landings and takeoffs. Pilots almost never fly modern jetliners at cruise altitude and almost never manually, and in this accident both conditions applied. The airbus in particular, because its design philosophy is to limit what pilots can do and in normal flying its computers override pilot commands that would stall the plane, is a special case. Do you suppose any of this might be relevant?

Airbus A330 --- a computer controlled airplane
        Airbus A330, launched in 1994, 891 planes flying, 800 million passengers, flown in USA by US Airways and Northwest is a highly automated plane. One expert says its pilots only fly the plane for about 3 minutes each flight (1.5 min on takeoff and 1.5 min landing). The rest of the time the plane flys itself! And when the pilots are 'flying' the plane (with the stick and throttle) at takeoffs and landings, the flight control software is limiting what they can do. For instance, it will ignore any pilot inputs that would stall the plane or damage the rudder, etc. I read on aviation blogs that even the airbus throttle in normal flying is really just setting switches, which correspond to its detent positions. For example, to take off the pilots don't give the engines full power or any preset level of power, what they do is put the throttle in the takeoff (switch) position, and the computer calculates (based on weight of plane, length of runway, height above sea level, etc) the throttle setting actually applied to the engines. This not only saves fuel, it is important to getting good life from the engines.

       This accident bears on the heated debate about 'whether pilots, especially younger pilots, are actually able to properly fly large commercial aircraft', because modern planes are so highly automated and to a large extent fly themselves. In the wake of the Air France 447 crash, an aviation guest on ABC said many airlines were retraining their pilots on flying manually.

Overview & summary
        I summarized what happened on Air France flight 447 in emails to my brother who had done a lot of business flying including a lot of flights across the Atlantic on Air France:

        As a veteran air flyer and someone who flew to France a lot you might be interested in this. Three years ago there was a very famous Air France airbus crash, flight 447 from Brazil to Paris flying in a zone of high thunder storms at night disappeared in mid-atlantic. All that was known for a long time came from a few automated messages sent by the plane via satellite that showed a host of problems that started with the autopilot turning off.

         It was immediately speculated that the plane had lost its ability to measure airspeed (due to freezing up of its pitot tubes), because it was near storms and inconsistent speed readings would cause the autopilot to disengage. Airbus and FAA soon ordered the model of pitot tube used on the crashed plane to be quickly replaced. We now know what happened inside the plane because after two years of searching the cockpit voice recorder and other black box was found two miles down in the Atlantic and recovered. The final report on the accident was just released (July 5, 2012), and it includes an appendix which is a transcript (in english, edited) of conversations in the cockpit during the last minutes of the flight and plots from the data recorder. (The full transcript leaked and was published in a French book.)

         I had read a while ago a feature story on what had happened on this plane and in the author's view how the pilots had screwed up, but it's always best to go to primary sources when writing, so this week when I learned about the cockpit voice transcript I read it carefully. What happened on this airbus should scare the living daylights out of everyone who flys! I read on aviation blogs that Air France is considered a well run airline with well trained crews. This is not some crazy African or Russian airline.

          Airplane control at cruise depends very heavily on the plane airspeed sensors, because in the thin air at 35,000 feet the difference between a speed too fast (breaking up of the airframe) and too slow (stall, or loss of lift) is pretty small. It's known as the 'coffin corner'. The airbus designers (smart engineers I am sure!) designed the plane so that in an emergency it could fly without working airspeed sensors. All that has to be done at cruise altitude is set the trim (tilt of wings) and the throttle to known values, take your hands off the stick, and the plane will safely fly itself, avoiding overspeed and stall.

         What is totally amazing is that the Air France pilots don't appear to know this! There are three pilots in the cockpit (captain and two copilots). There's an airbus procedure for <unreliable airspeed>. You look it up and it tells you what to do. Not one of the pilots in the cabin does, even though there are three pilots for this flight and the fall to the water takes over four minutes.

         Nor does the flying copilot (or apparently any of the pilots) have a clue about what to do in the event of a high speed stall! They appear to never to have been trained for this in a simulator, even though loss of airspeed reading and stall have caused a long series of crashes (and loss of control) in aviation history. Reading the transcript it at first seems like the non-flying copilot might have saved the day if he had been flying since he repeatedly tells the flying copilot to do the opposite of what he is doing, but when he is handed the controls he (appears) to makes the same error (though this is not 100% clear).

        The cockpit transcript shows that when autopilot turns off, the copilots notice immediately the loss of speed reading (in fact a video I saw shows the airspeed reading disappears off the cockpit video display), and 5 seconds later (!) an automated warning voice briefly says 'Stall, Stall' and in 45 seconds the stall warning is on continuously. The flying copilot in the transcript says within 30 seconds he can't get control of the airplane, he can't get out of the stall, and both copilots say they don't understand what is happening.

         What is chilling is that in the nearly four and a half minutes it takes to fall out of the sky no one thinks to check the Airbus documentation carried in the cockpit for what to do in the event of loss of airspeed or high speed stall. They never check (at least as far as you tell from the voice transcript). Not only that but airbus software appears to have no help system, it makes no suggestions, brings up no useful text. The plane control code should have known what had to be done, and either done it automatically or suggested it to the pilots. It did neither.

         There are other very disconcerting things in the transcript too. The senior pilot with 25 years more flying experience than the 32 year old copilot doing the flying goes off to rest just 10 minutes before they are approaching towering high storms. It takes him over a minute and a half after the stall warnings begin to come back to the cockpit (copilots are saying "damn, where is he"). When he shows up, he doesn't move into one of the two flying seats. He sits in back and lets the two copilots fly the plane all the way down. He says almost nothing, doesn't give any instructions, he never checks the manuals.

        An important issue here the complex interaction of pilots with nearly fully automated airplanes. As an engineer, I see all sorts of problems with how the airbus control system (didn't) handle this problem. It doesn't warn the pilots (in advance) that it is having trouble or that the three pitot tube speed reading are looking suspect, or it sees temperature changes as ice builds up. (For example the three tubes could not all freeze up at EXACTLY the same time.) No, the autopilot just goes on its merry way and with no warning suddenly goes 'beep' and dumps the control of the airplane (near coffin corner) into the hands of the pilots.

        And 5 seconds after having control of the plane suddenly handed to the copilot, the stall warnings began. This means either the copilot was able to stall the plane, i.e. get into serious trouble, in only five seconds (might be true as he is known to have pulled back on the stick, which I read is exactly wrong, and the plane looses speed as it climbs), or the autopilot had taken the plane (without any warnings) right to the edge of stall and then dropped it on the unsuspecting pilots.

         This same thing (loss of speed sensors at cruise) had happened just months earlier on an airbus of another French airline. They had looked up the procedure for loss of airspeed readings and got control of the airline, but they found the airbus loss of airspeed procedure a nightmare, too long and detailed for the short time available to recover. They had a meeting with the airbus people to complain about it, and the airbus people reportedly said they would consider rewriting it.

        What I have found in reading about this 2009 accident is amazing. The bottom line is that younger pilots of jetliners may not have known (as of 2009) how to fly these big automated planes. The planes basically fly themselves. An airbus pilot on a typical flight only manually flys the plane for 3 min, and all this flying is at low altitude at landing and takeoff! And what is called 'manual' flying isn't full control, the plane software for example won't let the pilots stall the plane or screw up the tail rudder.

         On balance this is all good and has made flying much safer. That is until something goes wrong with the flight controller at cruise altitude and with no warning the pilot has to fly the plane, and to compound the problem the protections like stall protection that the plane normally provides are largely gone.

         So what happened here was the first thing the 32 year old Air France copilot did was pull the stick all the way back, stalling the plane in just a few seconds, a stall from which the plane never recovered. (It seems he did what he would do when aborting a takeoff, pull back the stick and goose the throttle, unfortunately planes don't take kindly to this when they are flying in thin air 7 miles up.)

         And how much training had Air France pilots had for flying manually at high altitude? Zero, zero time in real flight, zero time in simulator, and no training in the classroom on how to fly the plane without a speed sensor. Why, because it doesn't happen very often. A US Air guy says it has never happened on any of the 30 airbuses they have, but then they probably don't do a lot of flying over the tropical atlantic where storms are fierce.

         Of course all airlines have now learned from this accident and pilots are now getting some time in the simulator learning to fly the plane manually at altitude. But what's shocking here is the mindset of over reliance on the flight computers, and the idiot airline managers who put savings over safety, skipping training for rare, but fatal events, even though the plane manufacturer recommended it.

        I guess the thinking is, Since planes can fly themselves, pilots basically don't have to do any flying anymore, they are little more than babysitters, so why spend money on training them! Well tell that to 'Sully' Sullenberger, a former jet pilot, who landed an airbus A320 with flamed out engines at takeoff in the Hudson river in 2009 with all passengers surviving...
                                                                                                      Don

        So if airbus pilots had been told (drummed into their heads) all their lives that this plane cannot be stalled that there is nothing a pilot can do to stall it, does this maybe hint at an explanation of the otherwise inexplicable reaction of the pilots of flight 447 when it stalled? The final crash report alludes to this as a possible cause of the accident. The implication is that this famous feature of the airbus (somehow) led the crew to forget (if they ever knew!) that while flying in 'alternate law' they could stall the plane as most stall protection were gone.

        Stall protection is so central to the airbus that the book details the three levels (three gates) of low level stall protection that all airbuses have had from day one (in what follows flight jargon name for 'angle of attack' is alpha):

            Alpha protection (gate 1) --- If above treetop altitude and the plane approaches within about 10 mph of its minimum speed (150 mph roughly), it gentle noses down to keep from losing speed trading altitude for speed.

            Alpha floor (gate 2) --- If the stick is held back, the plane begins to nose up increasing the angle of attack to get more lift from the wings while it continues to slow below the alpha protection speed. (I assume the pitch up rate is controlled to stop the decent.) At some preset angle of attack, but below its maximum, the controller will begin an emergency climb (away from the ground) by throwing the throttles to max (TOGA). However, the pilots can override the climb at this point by manipulating the throttle, and the plane will continue to slow and the angle of attack to further increase.

            Alpha maximum (gate 3) --- Flying below Alpha floor speed with the plane continuing to slow at some point a limit is reached on how high angle of attack can go (above 15-20 degrees increases in angle of attack reduce lift instead of increasing it). This is alpha maximum. No further reductions in speed are possible, so the throttles are thrown to (TOGA) maximum and locked to begin a strong climb that the pilot cannot override. When the angle of attack drops below alpha maximum, the pilots to regain control of the thrust must set the auto-thruster to off.

        It struck me, however, that with all the discussion of stall protection in William Langewiesche's book the issue of high speed stall is never mentioned. And as I look at the data I don't think the airbus designers thought through how to aid the pilots to recover from a high speed stall in alternate law. So this accident high lighted that there was another way to stall the 'unstallable' airbus besides flying too slow near the ground,. And this is the condition that flight 447 soon got itself into with the plane flight controller doing damn little to aid the pilots to recover, or as the crash reports alludes it may have perversely misled the pilots. Bottom line: the airbus circa 2009 was not really the unstallable plane it claimed to be, as attested to by 226 people dead on the floor of the Atlantic.

Introduction
       Air France Flight 447 Airbus in 2009 crashed into the Atlantic at night in a storm while flying from Brazil to Paris. The cause of this crash was originally a big mystery as it disappeared with no distress calls from the cockpit, just a series of short robotic maintenance calls relayed via satellite. From the cryptic robotic calls, which began with the autopilot disengaging, it was immediately suspected that the plane's air speed sensors had failed (frozen up), so airbus quickly switched to a slightly different design (with better heaters). What happened has now pretty much been figured out, as a huge search two years later in 2011 found the plane's black boxes. The final French accident report (I was surprised to see) just recently came out (July 5, 2012). There is a dedicated Wikipedia page for this crash.

         http://en.wikipedia.org/wiki/Air_France_Flight_447

Plane engineering and pilot incompetence
        The new data confirmed that the trigger for the accident was the loss of the air speed sensors, but the root cause of the crash was total pilot incompetence (though with contributing causes from airbus and Air France). Turns out the designers at airbus, being good engineers, had designed the plane so it was flyable without the need to know air speed. All the pilots had to do was set the pitch (tilt of the wings or 'angle of attack') and throttle setting to values shown in the manual and the plane could cruise without stalling, which it turns out in the thin air at altitude can happen relatively easily. But the pilots didn't do it! Either they did not recognize that the air speed readings were bogus (they did), or got totally distracted by stall warnings (which they never mention!), or, and here we are talking total pilot incompetence, they just didn't know (or remember) that plane was flyable without air speed sensors, and all they had to do was look up and set manually the pitch and throttle settings!

        I am not a pilot nor had I read much about flying until I began researching this accident. It is, however, my understanding that most commercial and general purpose airplanes are designed to (in a sense) fly themselves, meaning that if you can take your hands off the controls and the plane will fly level and straight. And even though this is a computer controlled airplane it's likely this is also true of airbus so its pilots can fly it safely by hand.

Initial question
        So the first mini-mystery (this is prior to reading the Wikipedia page on the accident yet, but I have read a few articles on the accident over the last three years), is why didn't the airbus software do what was needed automatically (or semi-automatically), setting the pitch and throttle, when it sensed the airspeed sensor readings were bogus, or at least prompt the pilots on what to do? Why do the pilots have to look up the settings in (presumably) printed manuals and make the settings manually?

        What is the problem here? Is it that it is hard to know when airspeed readings are wrong? Does this happen so infrequently, that no code has ever been written for it? (The latter is hard to believe, because the press soon after the accident reported quite a few cases where airbus airspeed sensors had frozen up and failed, though without causing a crash.) Is it like a philosophy thing, meaning code is only written for normal flying and common problems, and more exotic problems (of which there might be I am guessing hundreds!) are put into notebooks. Was it possible that the problem was the manuals were so poorly written that the key information was not easily found (possibly yes)? Is it possible the time window before the plane flips or stalls is so short that there is not time to recognize the problem of frozen air speed sensors and to respond?  (It sure seems like this might be the case, since 'stall, stall ...' warnings began in the cockpit just 5 seconds after control of the plane was handed to the pilots.)

        Soon after the accident airbus sent a reminder to airlines flying the A330 that in the event of inconsistent airspeed readings crews should consult "Quick Reference Handbook and the Flight Crew Operating Manual", which NYT says is a more detailed volume that is also kept in the cockpit. So very likely the information about how to fly the plane with non-working pitot tubes was in printed form (in two places) within the cockpit, and none of the three pilots in nearly 4.5 minutes ever pulls it out. (At least there is no evidence for this in the cockpit voice recorder, which is the only evidence we have.)

Pitot tubes freezing
        Air speed is sensed by a pitot tube, or a slightly more elaborate version called a pitot-static (or prandtl tube), which also has side holes to sense static pressure and a solid state pressure sensor to read the pressure difference between the center (ram) and side (static) pressures. On a big plane it projects out (mounted a little airfoil) about a foot from the body of the airplane to sense the ram pressure of the airflow there.

        A pitot tube is a classic simple device (invented by Henri Pitot 200 years ago) that translates fluid flow into a measurable a pressure difference, which corresponds (at least roughly) to the dynamic pressure that rises as velocity squared. The Bernoulli formula shows that in an airflow [static pressure + dynamic pressure or [1/2 x density x vel^2] = constant (Total pressure)]. Planes have tubes sticking out directly in front of the plane that sense 'head on' pressure (like a hand out the car window) and side pressure, both from holes on the side of the tube and/or opening on the side of the plane. The difference between these pressure readings is the dynamic pressure, which if the density of air is known (function of altitude and temperature) can be converted to the relative speed of the plane through the air.

Pilots using 'wrong' airspeed
       I later learned that correction for air density is pretty much ignored. Pilots fly (including even on airbus!) with 'indicated' speed that does not include an air density correction. At (relative) cruising speed of about 540 mph (A330) the main airbus display panel shows airspeed as 280 knots (322 mph), yup grossly wrong, far too low.

pitot tube flow measurement (with manometer)
left: static pressure
middle: total pressure = static pressure + dynamic pressure
right: differential pressure = total pressure - static pressure = dynamic pressure
source -- http://www.engineeringtoolbox.com/pitot-tubes-d_612.html

'Head' refers to the pressure difference (Pt - Ps)
source -- http://www.engineeringtoolbox.com/pitot-tubes-d_612.html

Mechanical air speed indicator
       The old classic mechanical airspeed indicator on planes is just a pressure diaphragm connected to a dial. The air on one side of the diaphragm is from the pitot tube and the other side from a port on the side of the plane. So the diaphragm movement controlling a dial is a reading of the pressure difference, also called the 'impact pressure', between the pitot tube pressure (also called ram pressure) and the (side) static port pressure. (There's no mention of of how the velocity squared term is accommodated, maybe by the markings on the dial, or the design of the coupling linkage.)

        Most write-up on pitot tubes and airspeed instruments just say the diaphragm moves because pitot ram pressure goes up. I suspect this is an oversimplification. A company that repairs airplane instruments (Southwest Instruments) fudges on its web page. It says the diaphragm in an airspeed sensor moves because the pitot tube pressure goes up or the static side pressure goes down, which is certainly true as far as the instrument is concerned, but doesn't say what happens in flight.

Wasn't freezing a well known problem?
       I would think that pitot tubes freezing would be part of pilot lore. The press reported quite a few instances of this on airbuses soon after the accident (and an appendix in the final test reports lists dozens). Apparently the main failure mode of the tubes is freezing, though other strange failures have happened. (For example, a plane that had sat on the ground for a month in the tropics apparently had an insect nest built into its tube, and small planes can have pitot tube covers that, obviously, have to be removed before flight.) The pilots know they are flying in a storm on a route (near the equator over south Atlantic) famous for wicked thunder storms. How could they not have suspected their pitot tubes were freezing when air speed data didn't look right? (Well, I see no sign of this on the flight data recorder. It shows airspeeds that are flat and then suddenly step down to absurdly low values.) Also I read even in small planes pitot tubes have heaters to melt frost. Like maybe Airbus pitot tubes could have been designed with a two stage heater as an extra protection and check against frost? (Another interesting question is whether the pitot tubes on airbus have built-in temperature sensors. From looking at the pitot tube data sheets and wiring diagrams of the plane I can see no indication that they do. (I wonder if this was a  mistake?  Wouldn't probe temperature show a rise if supercooled water hitting was changing state and freezing? Have seen nothing about this.)

        I read a whole host of stories about failure of pitot tube speed sensing causing a whole bunch of accidents and near accidents, for example, "In February 1996, a Boeing 757 crashed shortly after takeoff from the Dominican Republic, killing all 189 people onboard. Flight data and cockpit recordings showed the conflicting speed-readings confused the crew, they stalled the plane, and it plunged into the ocean." The relevant phrase is 'conflicting speed-readings confused the crew'.

        Even the plane at Laguardia in 1994 that aborted a takeoff and skidded off the runway into the river was due to frozen pitot tubes because the pilots forgot to turn on the pitot tube heaters! (This was an old MD-82 a McDonnell Douglas plane.) A Youtube video of a pilot training on a small plane shows a takeoff being aborted when he notices he has no airspeed indication. In this case the plane's one pitot tube has a cover and he forgot to take it off!

 How is pitot tube information displayed?
        It's hard to find detailed information about the pitot tubes on the airbus, and how they are displayed in the cockpit. But I am beginning to suspect that part of the problem is that the crew has no clear visibility of the pitot tube parameters, it's all handled by the flight control system, which just gives them a single airspeed reading. This is fine for normal flight, but not in an icing situation.

        The crew should be able to call up a display of all three pitot tube parameters. Does this include a temperature measurement on airbus pitot tubes? It should. I read that one crew figured out their pitot tubes (on some unspecified airplane) were likely reading wrong when they saw a temperature change in the tubes that suggested icing.

Three pitot tubes in A330 Airbus
        Air speed sensing is so important, there is redundancy with the plane having three pitot tubes. Clearly (with some small tolerance) all three should read the same all the time (I presume). This provides a built in check mechanism. This is a classic technique used all the time in control, a cross check (often with voting) among multiple redundant sensors. They idea is that they are not going to all freeze up at the same time (statistically very unlikely), so when one reading  disagrees with the other two, doesn't the plane automatically warn the pilots? If not, I would say this is a clear case of poor design of the air bus control software.

        Also in the case of something like this, if one watches a suspect reading there are generally clues that all is not right. For example, as freezing is blocking the opening the reading would likely be seen drifting down (or up) in a way inconsistent with the way the plane is flying. Also when a sensors is really fouled up, it generally gives nonsense reading, in fact sensors are designed to fail in just this way. They don't for example, normally fail by reading say 10% low.

How many pitot tubes is the flight control system using?
        On pictures of the front of the airbus three pitot tubes are present, and are labeled pilot, copilot and standby. This would seem to imply that the flight controller runs using two (that it compares for validly) and the 3rd is a spare. How is the space used, is the switch over automatic or must it be done manually by the pilots. There are hints in the 'unreliable speed readout' procedure that the check list has the pilots looking at the pitot tubes (one by one) and allowing them to chose which to use. How often are the pitot tubes sampled. Articles always just talk about airspeed being lost, but this is a conclusion the flight controller is making. There are three pitot tubes, they can't all ice up at EXACTLY the same time. A high speed sampling and display of all three tubes to the crew could be useful in an icing environment. I read that loss of airspeed is often transitory, presumably as the heaters are able to melt the ice. (I saw one pitot tube spec showing both a 30 watt and 100 watt heater inside.)

Airbus software bug --- faulty reengagement of the autopilot
        Air Bus in a 2010 directive admits (in effect) to a software bug, or a weakness in their control code. The problem is that the reengagement of the autopilot can happen all too easily even though the speed reading from the pitot tubes may still be wrong.

        After differences in the pitot tube readings are detected, the flight control system automatically disengages and air speed 'bars' are no longer displayed. This is what happened on flight 447. However, if two of the pitot tube readings later agree, even if way out of range and likely wrong, the control system again automatically begins to display air speed bars, and it allows the pilots to reengage the autopilot. A directive is 2010 said they planned to change the code in 2011 to prevent this, and that in the meantime pilots should manually check the pitot tube reading to see if they look right before reengaging the autopilot. I find it very curious that the directive gives not even a hint on how to tell if a pitot tube reading is right or wrong! The actual directive text reads, "If unreliable speed indication is suspected".

Stall issues
        As a non-pilot, there's something I don't understand about the stall flight 447 got into. The flight profiles show that as the altitude drops the flyable speed range expands a lot as minimum speed goes down (because air density goes up), and maximum speed goes up (as speed of sound rises due to higher temperature). OK, so at high altitude the plane stalls and begins to drop as the wings no longer provide enough lift to counter gravity. All the way down the engines are running (don't know what throttle), and the plane is dropping pretty much in normal fly position with belly down (says ABC news) and wings level, in fact I think the accident report says it hits the water in this orientation.

        Once the pilot at high altitude pulled up on the stick so much the angle of attack got > 15 degrees do the control surfaces maybe lose bite, so the plane sort of gets stuck there stalled? (total uninformed speculation on my part)

        The Popular Mechanics article does say the angle of attack was about 15 degrees all the way down, while the plane was heading down toward the water at about a 40 degree angle. All this time air speed remained extremely low (60 to 100 knots) with the loss of airspeed occurring when the plane climbed from 35,000 feet steeply to its highest flyable attitude. But as a non-pilot I still don't understand why at on a decent path of 40 degrees for minutes doesn't the power of the planes engines increase the air speed? I see no mention that the engines were ever throttled back.

Explanation
        From a poster's comment the apparent explanation of the angle of attack inconsistency is that the pitch of the airplane is measured relative to earth. So if the plane is tilted up say 15 degrees or so relative to earth, while the plane is descending on a path 25 to 40 degrees  (references disagree) from horizontal, then the angle of attack the wings see is the sum of these two numbers or 40 degrees or so, hugely stalled.

        "We have to infer angle of attack indirectly by referencing speed. That makes stall recognition and recovery that much more difficult. For more than half a century, we've had the capability to display AoA (in the cockpits of most jet transports), one of the most critical parameters, yet we choose not to do it."

        "We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircraft design and certification, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure..."

        Sullenberger is not alone. I read on aviation blogs that may pilots complain bitterly about not having an Angle of Attack display in the cockpit, especially in light of the fact that it exists and is being used by the computer to fly the plane. Also I find in Wikipedia that "Most military combat aircraft have an Angle of Attack indicator among the pilot's instruments, which lets the pilot know precisely how close to the stall point the aircraft is." (Wikipedia, Stall)

        The 447 crash report touches of the 'angle of attack' non-display. The english (below) from the report is not crystal clear, but I think they are saying (consistent with Sullenberger's view) that in light of what happened on flight 447 the usefulness of adding an 'angle of attack' indicator to the cockpit display should be evaluated.

        "The regulatory authorities should evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on board airplanes."

Can you say whitewash?
       In 2011 at the time of the release of the preliminary crash report, Air France releases a statement that praised the three pilots, who "demonstrated a totally professional attitude and were committed to carrying out their task to the very end". Meaning what, that they were at least trying to fly the airplane? Can you say whitewash?

        Air France on release of the final crash report IN 2012 emphasized that its pilots had “acted in line with the information provided by the cockpit instruments and systems,” adding that “the reading of the various data did not enable them to apply the appropriate action.” (ENABLE them?) In other words Air France is exonerating its pilots and blaming the airbus design.

        The worst is this from an Air France spokesman (in uniform), identified as Eric Schramm, VP of Air France speaking in front of a microphone. He is speaking in French, but CBS puts up this translation, "We had an optimal level of competency in this Air France cockpit ... They were not able to regain control of the plane after it stalled." Can you say whitewash!

       The official french BEA accident report notes that the Air France pilots had had no training for how to fly the airbus at altitude without help from its flight computers, or how to handle loss of airspeed. Note this was not a problem of insufficient training or no recent training, but that they had never received any training at all (none, zero, nada) for what to do in case of pitot tube icing! In light of this you'd think the crash report would put a lot of the blame on Air France. Right? Think again. Can you say whitewash?

        The flying copilot instead of doing the conservative thing, which is basically nothing (hands off the stick), when the autopilot suddenly shut down at cruise altitude, almost immediately pulled back all the way on the stick causing the plane which was cruising at 35,000 feet to nose up, climb and lose airspeed causing a stall within seconds. All the pilots who have written about this accident are baffled by his actions and can't even fathom a guess as to what he was thinking. Yet the crash report blandly says, 'Inappropriate control inputs destabilized the flight path'. Can you say whitewash?

        There is an airbus procedure carried in the airbus cabin that lists what to do when airspeed is lost: how to fly the plane without a valid airspeed and how to diagnose what's wrong. There are two pilots in the cockpit not flying the airplane, but nobody looks it up, nobody even mentions it in over four minutes! The crash report says about this failing by the three pilots, a contributing cause of the accident was the 'The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure'. Can you say whitewash?

        ABC Nightline in an interview with a BEA director (french crash investigation agency) says they were told by two sources that the senior pilot on this flight was "traveling socially with an off duty flight attendant". They ask if he was with her on his break and does maybe this explains is why it took him to long to return to the cockpit? The BEA guy says "we are not interested in that". Can you say whitewash?

Causes of the crash from final crash report
        The July 2012 final crash report gives the following list 'causes' of the flight 447 crash. It's written in nearly impenetrable bureaucratic gobbly-gook, but I think I now know what most of them mean, so under each I give a translation. (list extracted from Wikipedia page on Flight 447 accident):

        -- "Temporary inconsistency between the airspeed measurements, likely following the obstruction of the pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law";

           Translation --- The airspeed reading of the two operating pitot tubes disagreed (for 30 sec), and without a valid airspeed reading the autopilot suddenly shut down, hand over control of flying to pilot. At same time most of the protections the plane software normally provides when pilots manually fly the airplane, like stall protection, are gone as the flight controller shifts to "alternate law".

        -- "Inappropriate control inputs that destabilized the flight path";

        Translation --- Pilot pulls back on stick (all the way) and hold it back with Stall warning going off. Most observers are baffled by this because all pilots are taught to push the stick down in the event of a stall. Nobody really understands this, and the 2nd copilot who took control did the same thing! All the pilots ignore, they never even mention, the nearly continuous stall warning heard in the cockpit voice recording. Another total mystery. With stick back the nose comes up, air speed drops, and stall deepens as the plane begins to decend, and it holds in this position all the way to the water.

       -- "The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure";

        Translation --- None of the three pilots mention, looks for, or even seem to know of the existence of a printed airbus procedure that's in the cockpit for what to do when the airspeed sensor (pitot tube) freezes up. It would explain that the plane can safely fly itself without an operating airspeed sensor by just setting the angle of attack and throttle. (However, to be fair to the pilots, the immediate problem, which they got themselves into almost immediately was recover from a high speed stall, but it's not clear they even understood this.) The report says they had never been trained on this procedure, so it may very well be that they did not know it existed, but still very curious that they don't go looking anyway. (Trained or not, I find it hard to believe that pilots don't on their own do a lot of reading about the planes that they professionally fly for a living.)

        -- "The late identification by the PNF (Pilot Not Flying) of the deviation from the flight path and the insufficient correction applied by the PF (Pilot Flying)";

        Translation --- The 'deviation from the flight path' probably refers to the big climb the plane did when the stick was pulled all the way back and the consequent loss of flying speed. The flying copilot doesn't say what he has done, the side sticks on an airbus are not coupled, so it appears to take a long time before the other copilot realizes the stick is back. "Insufficient" correction applied by the PF" is absurd wording (a whitewash) as the flying pilot from the get go is doing the wrong thing, he has the stick pulled back hard instead of just doing nothing when taking control and later pushing the stick forward when the plane stalls.

       -- "The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope";
       -- "The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it".

        Translation --- These two are similar. There is a total mystery here. The report says, "The crew’s failure to diagnose the stall situation". How hard can it be to figure out that the plane is stalled when the stall warning system voice is saying 'stall, stall, ...' (75 times!) on and off for 54 seconds accompanied by a noise designed to be so annoying it can't be ignored? The warning stall voice can clearly be heard in the recording, yet no pilot ever mentions it! If they thought it was bogus, wouldn't there be a discussion? If they thought it was valid, wouldn't the pilots be commenting? All pilots in training are taught to push the stick down on stall (dive to gain speed and it lowers the angle of attack), but the copilot here does the opposite. The pilots seem to have no understanding of a high speed stall.

Possible 'explanations' of crew's actions from final report
        -- No training (in simulator) in manual airplane handling at high altitude
        -- No training for flight with questionable Indicated Airspeed
        -- The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers

        Translation --- The pilots don't normally get to see the pitot tube parameters, just a single airspeed. When the two controlling pitot tubes don't agree, the airspeed just disappears from the display. This leaves the pilots blind as to what is happening, and they don't have time to screw around, as the stall they triggered in just five seconds shows! Don't really know for sure, but it seems the check list for loss of airspeed might explain how to look at individual pitot tubes. There is a spare tube, and maybe temperature readings too.

        With hindsight this information should have come up on the display automatically when the two pitot tube readings disagreed! Poor design of the airbus flight control software.

Two airspeed displays?
       From a comment by a poster to an aviation web site, the pitot tubes labels on the plane, and comments in the accident report it may be two airspeed displays. The pilot and copilot may each have their own airspeed reading, presumably using the pitot tubes labeled 'pilot' and 'copilot'. Don't know what the reasonableness check the plane software uses. Since there is a 3rd pitot tube labeled 'spare' it might be that the two used pitot tubes are each compared against it.

       If there are two airspeed readout using two pitot tubes, then it appears that one of them recovered in 30 sec or so and the other one recovered in 45 sec to a minutes. (I read this is typical of the 19 reported pitot problems. The ice can normally be melted in tens of seconds and airspeed returns.

        As a non-pilot I remain confused as to why if the the engines are highly powered, even with a wing angle of attack really high and the plane falling, why the plane doesn't regain a high airspeed (in some direction). The flying pilot says twice says he thinks he is in TOGA, and this is the name for detent on the airbus throttle that is its highest setting. But this brings up another question. TOGA is an input to the computer to set the throttle. Is it possible that at altitude a TOGA throttle setting by the pilot is interpreted by the computer to be quite a low throttle setting? (The pilots, however, could probably tell this from the engines sound and vibration.)

Informed perspective of the 447 disaster by a poster on an airline blog
        From poster Nalliah Thayabharan August 1, 2012
        http://gregbrownflyingcarpet.com/2012/01/05/air-france-447-flight-data-recorder-transcript-what-really-happened/

        Here's the poster's explanation of why the plane remained stall --- "Its pitch attitude was about 15 degrees nose up and its flight path was around 25 degrees downward, giving an angle of attack of 35 degrees or more. Its vertical speed was about 100 knots, and its true airspeed was about 250 knots."

Stall explanation!
        Finally an explanation that makes sense of the stall. This is right, if the 15 degrees nose up orientation of the plane means 15 degrees relative to the earth surface, and the plane is decending on a path of 25 degrees, then the angle of attack is about 35 to 40 degrees, so the wings are providing almost no lift! So the engines drive the plane forward on its downward glide path (maybe with an upward 15 degree thrust), but the air flow over the wings at this orientation of the plane is so bad that there is no way the plane ever begins to fly.

        To fix the angle of attack and to get out of stall the plane orientation (relative to earth) has to be tipped downward about as steep as the glide path (25 to 40 degrees). The poster say this is not a 'deep stall' but a normal aerodynamic stall, and can be corrected by pointing the nose strongly downward. This lowers the angle of attack (orientation of air flow over the wings) and picks up speed too.

Poster's excellent summary of the automated plane problem
        She is very tough on the pilots and on the airlines too who scrimp on pilot training because they think modern planes don't need highly skilled pilots. I think with good reason. However, seems to me that the airbus hides too much information from the pilots, especially when things to wrong and the pilots need all the help and info they can get.

        "Airbus A330-203 is a new generation, highly automated piece of equipment with drastically simplified controls, displays, and instrumentation compared to older models. There is no excuse for the co-pilots of AF flight 447 to be confused in a generally much simpler and easier-to-fly aircraft.

        The Airbus A330 is not a video-game airplane, it is the airlines that make it a video-game by cutting corners, taking advantage of its superior automated capabilities thinking that it flies by itself, and no training and no knowledge of even the basics of the principles of flying is required in them for their pilots, as was demonstrated by the co-pilots of flight 447, who seemed to be incapable to react even on a basic level to the phenomenon of the aerodynamic stall.

        If this piece of equipment falls in the hands of the airlines who use it as a video game to save training costs, telling only their pilots that “if the red light on the right side blinks, just pull the stick back as hard as you can, and let the system do the rest”, they can get away with it as long as everything is normal.

        Practicing recovery from “Loss of Control” situations and improve flight crew training for high altitude stalls (simulator training usually has low altitude stalls which are significantly different due to energy status of the aircraft) should become the mandatory part of recurrent training."

        The aviation link below has a very good summary of what happened and also includes more of the post above.
         http://www.flightstrory.net/20110729/report-air-france

Conservative course of action
        On airline blogs I read pilots recommending a common sense, conservative course of action that applies to a lot of flying and should be applied when airspeed goes out. The argument runs at cruise you have time. Just wait, do nothing, assess the situation, wait some more. The plane can easily fly for 30 sec, a minute, maybe more via dead reckoning. The posters say the airbus auto-thruster fails gracefully, it puts the system in 'thrust lock' before returning control to the pilots, so thrust will be maintained at its last level without the pilots doing anything.

        If the pitot tubes have frozen up, waiting alone might just solve the problem, give the heater time to melt the ice. In fact one of the airspeeds did come back in the case of flight 447 in about 30 seconds (and the other in 45 seconds), so if the pilots had just waited a bit before grabbing the stick, this probably would have been nothing but a minor hiccup.

        In fact one poster puts forward the argument that the flight control system could do a lot of this itself. When air speed is lost it could warn the pilots, but not hand over control immediately, fly the plane for maybe 20-30 sec, holding the last valid settings for thrust and direction.

        And the poster continued, and here I think he hits the nail on the head, the flight control system could either display the recommended settings for trim and throttle for flying without airspeed, or it change to these setting before handing over control to the pilots. Yes, this is the ultimate in waiting. The plane has been set to safely fly itself at its altitude, so the pilots have the maximum time to figure out a course of action.

BEA report discusses 13 other cases of pitot tube freezing
        The crash investigators found dozens of reports of pitot tube freeze ups on airbuses had been reported, and they include in the final report a discussion of what happened in 13 of these cases (various airlines) where sufficient data was available, including crew interviews. (p85)

        -- In all cases the autopilot disconnected, the flight control law changed to 'alternate law', and (later) the crew regained use of the autopilot and autothruster. In 12 of 13 cases the flight law remained in 'alternate law' to the end of the flight.
        -- In all cases airspeed ('flight director') disappeared from the display and later reappeared.
        -- In 7 cases the auto-pilot reengaged. In 2 of these cases the autopilot reengaged when the pilot and copilot airspeeds agreed, even though both airspeeds were wrong! (This code 'bug' led to airbus changing it code to prevent automatic reengagment of the auto-pilot.)
        -- In 10 cases the auto-thruster disconnected and left the throttles in "thrust lock" mode
        -- Typical airspeed dropout was 1-2 min with the longest being three and half minutes (so this is transient problem)
        -- A "fall" in altitude was reported (in at least one case) (This is very interesting, but how? How can pitot tube freeze ups affect the altitude system which works off pressure from the static ports? Turns out (see figures) there is 1% (300 ft) 'correction' term applies to altitude in this plane using airspeed, so it's likely the 'fall' in the cockpit altitude display was 300 ft or less.)
        -- Why would we look up a procedure for "unreliable" airspeed, when what we needed was a procedure for 'lost or incorrect' airspeed, some crews told investigators. Exactly. The key airbus procedure in this accident was not only badly written and bloated (included tests to diagnose bad computers), it was misnamed! Combine this with no Air France training on the procedure and the information needed to fly the plan manually is not accessible.

Who's to blame?
        There are three candidates for blame: pilots, airline, airbus. There's blame enough that all get a share, but the pilots get the most as they were unable to handle a weather related glitch, in the process doing pretty much everything wrong, and ended up flying a perfectly good airplane into the ocean killing everyone on board.

Pilots are to blame
        The final report has detail biographies of the pilots of flight 447. Most people assume airline pilots are mostly ex-military pilots, but the bios show not one of these three pilots, even the senior pilot at age 58, had ever been in the military.

        -- Pilot, age 58, gets his private pilot license at age 23 and works as a flight attendant (on Air France) for six years from age 25 to 31. During this time he continues to train as a pilot and at age 32 begins to work as a pilot for "various companies". Had been rated to fly airbuses for 12 years.
        -- Copilot, age 37, he gets his first pilot license at age 20 and a professional pilot license at age 21. He had been airbus rated since age 26, for 11 years.
        -- Copilot, age 32, (flying pilot here) gets his private pilot license at age 23 and professional and glider pilot licenses a year later at age 24. He had been rated to fly airbuses since age 27, for 5 years.

Pilots didn't react conservatively
        A simulation included in the final accident report shows that if the pilots had reacted conservatively, i.e. kept their hands off the stick, to the shut down of the auto-pilot everything would have probably been OK. The plot shows the plane flying level without stalling for 30 sec to a minute without airspeed and in that time the pitot tube heater would have melted the ice and airspeed would have returned.

Nobody looks up the loss of airspeed procedure
        The airbus engineered the airbus to fly at cruise altitude without a valid airspeed. If the pitch and thrust are set to levels shown in the 'lack of valid airspeed procedure' the plane will fly straight and level avoiding stall and overspeed. The cockpit voice recorder has the pilots noting almost immediately that they have lost airspeed when the auto-pilot shuts down. Yet amazingly in four and a half minutes with two non-flying pilots in the cockpit nobody mentions the existence of this procedure or (apparently) looks it up!

Pilot severely stalls the plane in 45 seconds
        By immediately pulling back on the stick the pilots caused the plane to climb and lose a lot of airspeed, and it only took a 20% loss of airspeed at cruise altitude to stall the plane. If may be that the plane was at the edge of stall when the autopilot shut down, but it's fair to say that the pilots made the stall far worse driving the angle of attack to something like 40 degrees.

        The flying copilot doesn't do the basic thing all pilots are taught to do in a stall, push the stick down to reduce the angle of attack and gain airspeed. Instead flying copilot pull back on the stick (I think) as far as it will go. The 32 year old flying copilot twice says we are in 'touch and go mode', right? This is the procedure used at low attitude to abort a landing, and neither the other copilot or the senior pilot say no.

Misled by the flight director?
        The crash report (vaguely) suggests that maybe they might have been (initially) mislead by the flight director display (which is crosshairs on a horizon) that was not working correctly due to lack of airspeed. It might have shown they needed to pull the nose up. But the three altitude sensors never shut down and all agreed (noted by the pilots in the cockpit transcript), so when the stick was pulled back and the altitude sensors show the plane climbing 3,000 feet, how could it be that the pilots didn't know the nose was up, which is exactly the wrong orientation if the plane is stalled.

Continuous 'stall', 'stall' warning doesn't give them a clue?
        The non-flying copilot says to the flying copilot twice in the first 30 seconds 'watch your speed', and this may indicate he was concerned about a high speed stall, but aside from this incredibly not one of the three pilots in the cabin in four and half minutes every comments on, or asks a question about, the audible stall warnings going off repeatedly. The word 'stall' is never spoken by any of the three pilots on the cockpit recording.

Why can't the pilots figure out the plane is stalled?
      The plane is in a simple aerodynamic stall. This should not be too much of a surprise as they know the plane has been climbing and thus must have lost some airspeed. Also the Stall warning came on after 45 seconds near the top of the climb from 35,000 to 38,000 feet and stayed on continuously for nearly a minute. What, this doesn't give them a clue?

No credible explanation in the crash report
       They must know (don't they?) that up near 'coffin corner', where all big airplanes cruise, it takes only a relatively small loss of airspeed to stall a plane. Given these facts known to all the pilots, how can they not figure out they are in a stall? There is simply no credible explanation for this in the crash report! Or, just as troubling, do they know they are stalled, and don't know what to do about it?

        A poster to an aviation blog summaries the pilots screw ups:  "The co-pilots did not apply the unreliable airspeed procedure. The co-pilots apparently did not notice that the plane had reached its maximum permissible altitude. The co-pilots did not read out the available data like vertical velocity, altitude, etc. The stall warning starts within seconds of the copilot taking control of the plane, and it sounded continuously for 54 seconds, yet incredibly there is no hint that any of the three pilots took notice of it."

Airspeed display in the cockpit
        Did the airspeed displays in the cockpit return when the iced pitot tubes thawed? The answer is yes. In nearly all press articles this point is unclear, but p23 of the final report says (in effect) that the speeds shown on the flight data recorder were the same as displays in the cockpit. The report says specifically that the airspeed of the NF copilot came back in 29 seconds (@ 223 knots) and at one minute into the event all three airspeed displays in the cockpit were valid and consistent reading 185 knots. At this point in the report there is no further comment, but this brings up huge issues.

        When at one minute into the event all three cockpit airspeeds return and are consistent, and at that point they show the speed is 185 knots (vs 275 knots just prior to the autopilot disengaging) no wondert theyare staled. First mystery, I have read the transcript and no one mentions that airspeeds are back, yet they noted when airspeeds disappeared from the display just into the event. (I suppose if the return of airspeeds was noticed, it might explain why the procedure for unreliable airspeeds was not pulled.)

        But the BIG mystery is, Why the hell can't they figure out they are stalled? The (returned) airspeed readings are showing at cruise altitude they are now flying at only 2/3rd (185 kt/275 kt = .67) of normal cruise speed. If they have any understanding of coffin corner, of the narrowing of the allowable speed range as altitude increases, why isn't it clear to them that they are likely stalled? And these low speed readings explain why the the stall warning is on. It all fits, low airspeed readings, high altitude readings, and stall warning active are all consistent with the plane in a stall. And still (apparently) they can't figure it out. And it's should have been no mystery to them why the airspeeds look so low, because both copilots know the plane has been climbing (it's discussed in the transcript a lot), even though just minutes before they had said they were unable to climb because the outside air temperature was too high given the weight of the plane.

Two 30ish copilots don't seem to know how to fly the airplane!
      The airbus has been designed to fly itself up near the coffin corner without a valid airspeed reading by just setting the trim and throttle, yet incredibly none of the three pilots seem to know this. The make no attempt in over four minutes to look for the airbus procedures carried in the cockpit on what to do if the pitot tubes freeze over and a valid airspeed reading is lost. The two 30ish copilots don't seem to know how to fly the airplane.

Senior pilot
"Damn it, where is he?", the copilots curse
        Here's a dude, 58 years old, tons of flying experience. He leaves the cockpit as the plane is 10 mins from thundering storms ahead and leaves the most junior copilot flying. It takes him over a minute and a half to return after the crises begins. No one apparently has any idea why it takes him. "Damn it, where is he?", the copilots are cursing. By the time he gets back (didn't he hear the nearly continuous stall warning?) the copilots have not reacted conservatively to the shut down of the auto-pilot, have done the wrong thing and have badly stalling the plane, which is now beginning to fall out of the sky.

Was senior captain busy with a female friend? (update 9/2/12)
        After writing above I came across an ABC Nightline interview on YouTube with the BEA director (french crash investigation agency) that suggests a possible explanation as to why it took the senior pilot so long (1.5 min) to return to the cockpit (after leaving 10 minutes earlier). ABC Nightline says two sources told them the senior pilot was "traveling socially with an off duty flight attendant", and they ask were they possibly together while he was on his break? BEA answers 'The private life of the pilot? We are not interested in that.' and never pursues it in their accident investigation!

        It does explain several otherwise inexplicable facts: why he leaves the cockpit as the plane is approaching towering thunder storms, why he doesn't leave clear instructions for the two copilots, and why it takes him so ungodly long (stall warning has been going off for almost a minute straight!) to return to the cockpit. (And maybe why he doesn't take control upon returning.) The ABC story says he was called to return six times.

         http://www.youtube.com/watch?v=4pYCctsdN9Q  (ABC Nightline BEA interview)

        This video has some good stuff. It includes footage with the ABC reporter sitting in an airbus simulator with the stall warning going off. You can hear the Stall warning voice interspersed with a deliberately annoy sound identified in the transcript as a 'cricket' sound. Notice at the end of the video the reporter nails the BEA director about BEA (deceptive) editing of the transcript as he is nonplused by her excellent comeback.

 Shades of the Costa Concordia......

        So what does he do when he finally gets back? Does he take charge, say get out of that seat and sit down and take over the controls? Nope. So nobody knows if the senior pilot could have recovered the plane from the stall because he never takes over the controls or gives specific orders to the flying pilot!

Senior pilot takes a seat in back!
       He just sits in back, and by then the plane is really out of control with very low air speed and an angle of attack far above the 15 degree flyable maximum. He doesn't ever ask the flying copilot what he is doing or what commands he gave the plane while he was out of the cockpit? He doesn't give any firm instructions, or even suggest things to try, even though both copilots have told him they have lost control of the plane and don't understand what is happening. Curiously the copilots don't ask him about the repeated stall warning, does he think they are valid or bogus, and he doesn't offer an opinion. Stall, scmall, why worry about that...

        Near the end when flying copilot (finally) says he has had the stick all the way for a while, the senior captain finally comes alive saying, "no, no, no, no, don't climb", but this is an order nullification, what not to do. The captain doesn't follow it up with instructions on what to do.

Dual input conflict never resolved
        Minutes into the crises the flight controller repeatedly warns 'dual input', which means both copilots are trying to fly the plane with their stick. This is a disastrous situation, because with two stick inputs the airbus (I read) averages the two sticks, which means neither pilot is really flying the plane! Yet the senior pilot makes no effort to clear this up, nor does he says anything about the conflict (dual input warning). When the flying copilot volunteers (twice) that he thinks they are in TOGA ('touch and go' mode, right?), the senior pilot says nothing. Nor does he ever tell the passengers anything. What a guy, I wonder if he and the captain of the Costa Concordia are somehow related.

Bottom line --- pilots fly a perfectly good airplane into the ocean
        Bottom line is that the pilots flew a perfectly good working airplane into the ocean, because they didn't know how to manually fly the airplane at altitude! The didn't have a clue as to what to do when the airspeed sensor went out even though the plane was designed to be safely flyable without valid airspeed. Either they didn't recognize the plane was stalled (the warning voice 'Stall, stall, ... didn't give them a clue?), or they didn't have a clue what to do in the event of a stall, which (I gather) for a pilot is about as bad as it gets!

And they never tell the passengers anything!
       And for good measure all during the decent the pilots never talk to the passengers or crew, never say mention they have a problem, but are working on it. Opinion varies on blogs as to exactly what was happening in the cabin of the plane, about whether the passengers knew they were falling out of the sky, but many think there would have been panic. (I don't remember any rapping on the cockpit door by the flight attendants to ask.) With a large negative vertical velocity gravity sensed would be less than 1g, so I would think the passengers would have felt they were falling, as indeed they were.

        Also because the plane was severely stalled, the airflow over the wings would have been turbulent, and turbulence is one of the classic symptoms of stall, so I would think it must have been clear to everyone on board that the plane was not flying right.

Airline is to blame
Zero training for what to do if airspeed goes out
        Air France management has to take a lot of the blame. They didn't train their pilots to manually fly the plane at altitude! Their thinking seems to be, Why spend money doing that, the plane flys itself at altitude, there are three computers, the code is robust. So it is known that in pilot training for flying the airbus A330, they did not include any training on the invalid airspeed procedure, even though airbus recommended it. Since 2006 I see this procedure has been merged with the procedure to diagnose a bad computer, so that must have not been covered either.

        In other words it appears that Air France didn't bother to tell its pilots that the airbus can fly safely with no airspeed measurement by setting the throttle and trim. Incredible! Or tell them that how to do this is spelled out in two places in the documentation carried in the cockpit. Nor did they include any training in the simulator for flying the airplane manually at altitude, nor during airbus test flights for pilots (if there are any!) was the autopilot turned off at altitude so the pilots could see what happens and get some experience flying the plane manually at altitude.

        No, Air France couldn't be bothered to spend any money on training its pilots to actually lean to fly the plane they were assigned to (except for takeoff and landing flying)! I mean the plane is fully automated, it flys itself, it's unlikely that the pilots will ever need to fly it at altitude (true), ignoring the fact that loss of airspeed is a potentially lethal problem with a history of causing many crashes and near misses. No, they couldn't be bothered to spend any money on training for a low probability, lethal, event. Some airline. (How common this attitude was at the time is a very interesting question, but I seen no discussion of it.)

Insufficient training for flying under 'alternate law'?
        From a few random comments and the accident report it seems like Air France may have done little to teach its pilots about flying under alternate law. Was this just a slide that gets popped up in a presentation, or were the details of the loss of protections really spelled out in detail? Did pilots every train in the simulator (or on real planes) flying under alternate law. Have seen almost nothing on this, but many observers suspect the crew of 447 didn't understand much about alternate law. (They did know they were flying under alternate law when the auto-pilot disengaged, because it was acknowledged in the transcript.)

        What many posters suspect (really guess) is that with the shift to 'alternate law' the pilots didn't remember, or failed to understand, that the plane's computers were no longer going to give them stall protection, no longer going to prevent them from stalling the airplane. It might explain the lack of concern for stall, but it poses another question. You mean not one of the three pilots remembered this? This is hard to believe if there is any competence at all in this crew. There was no mention on the cockpit recording of the pilots discussing less protections (or risks) flying in alternate law. I would interpret this as 'alternate law' was so fundamental to airbus flight control strategy (even though not encountered often in practice), that all the pilots assumed it was understood by all of them, so no comment was necessary.

Air France decides not to replace A330 pitot tubes until they show problems!
       Then there's the issue of the pitot tubes. Air France appears to have done the minimum, and delayed as long as possible, to upgrade the tubes, which was replacing the Thales AA pitot tubes with the Thales AB model that airbus recommended, doubtless to save money. Airbus recommended removal of the Thales AA pitot tubes beginning in 2007, which is 19 months before the accident! (Aviation Weekly had reported in 2009 there were reports of a 'significant number of events involving the Thales (pitot) tubes causing a large reduction in (flight) safety margins'.) Months went by because Air France asked for tests to confirm the new model was really better (good engineering or foot dragging, hard to say), and it was. When they first decided to change tubes, they decided to replace only the tubes on the smaller airbuses, where they had seen most of the freeze up problems. Replacement of the pitot tubes on the larger A330 and A340 were to wait until the tubes 'showed a problem'. Whoops.

Maybe tell pilots a pitot tube upgrade is under consideration because of reported icing failures? Nah!
       Then there is the question about whether Air France took any steps to inform pilots there was a directive from airbus (issued in 2007) to replace the pitot tubes, about what was known of the history of pitot tube freeze ups, and (importantly) remind pilots what to do about it if it happened. (I have seen nothing on this point, but if Air France put this info about, it appears to have been missed by this crew.)

        Notice the mismatch between Air France's two decisions. One the one hand they decide to wait, to not replace pitot tubes on the A330 until 'problems' with the tubes show up. While at the same time they know, or should know, that training for loss of airspeed has been omitted in their pilots A330 training.  Any competent airline if it was going to take a safety risk like this should have taken steps to close the training gap and insure their pilots would know what to do if a pitot tube did freeze up. Yet it appears that Air France did not do this.

Engineering aspects of the crash

Airbus design is to blame
        I have seen at least one poster laying all the blame on the pilots and exonerating the airbus. However, the list of causes from the final report (listed below) includes weaknesses in the airbus design, and to my eye (as a non-pilot, but an engineer) the plane can be an unfriendly beast to fly.

Don't just beep and tell the pilots you are flying now
        -- "Poor management of the startle effect that generated a highly charged emotional factor for the two copilots"

        Translation --- The plane apparently doesn't give any warnings that the pitot tubes are looking suspect or that there is any problem with the autopilot. The plane just without any other warning beeps and (apparently) immediately transfers control of the plane to the pilots. I read that the autopilot shuts down gracefully in the sense that it puts the throttle into a hold position (at last valid position), and I suspect it does the same with the flight orientation, but I have not seen this called out. The report says this transfer of control by the plane "startled" the pilots.

Don't just remove airspeed, show all the conflicting data
        -- "The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers"

        Translation --- If the airbus were the slightest bit friendly to fly, or if their flight control code designers had any common sense, it would dictate that if the two pitot tube reading disagree that more information (probably all the information available) about the tubes should come up on a display. From what I saw in a video taken in a simulator all that happens (by default) is that the airspeed indication on the display disappears. Reading between the lines it looks like more information can be called up (like airspeed reading of all three tubes, plus maybe their temperatures and heater power), but to do this the pilots need to dial it up from instructions in 'loss of a valid airspeed' procedure.

        This ridiculous, all the pitot tube information should come up by default, or at the minimum a Y/N requester to see the information.

GPS speed?
        The data from the recovered flight data recorder has a ground speed plot that remains valid during the whole event. This is probably the plane's forward speed relative to ground obtained from a GPS receiver. Why was not this speed shown to the pilots when the pitot tube airspeed went out? Was it even selectable for viewing? I have seen zero discussion anywhere of this presumably GPS airspeed that must have been available on the plane.

Stall warning algorithm may have problems (final report)
        -- "The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds"
        Translation --- I think this is in reference to the binary (on/off) nature of the stall warning and the complicated algorithm it uses, which it is likely the pilots know little about. (Though it might also mean more of an analog type display rather than just 'stall' or 'no stall' as it is now to give the pilots some more information.) The stall should be more analog in nature, maybe just adding a 'close to stall' indication would be useful. The speed of the plane got so low (60 knots) that the stall warning turned off, because it didn't pass a reasonableness test, but this lead to a potentially confusing result that when air speed was increases (good) it made the stall warning start up again. Something should be done to the stall warning code in airbus to fix this. Maybe show 'Stall?' at low speeds or say 'Stall cannot be determined because speed too low'.

        I don't see anyway the pilots would be expected to know the arcane details in the code of how the stall warning reasonable checks would be done, and what would happen if the reasonableness checks failed. I read the french pilots union was very critical of how the airbus stall warning worked in flight 447. Having the stall warning be off and then come on when the plane began to gain airspeed was just plain perverse and could have been hugely confusing. Looking at the how a lot of the data plots go crazy at about one min and 40 seconds into the event, I am not sure that stall was not swept up into whatever was the root cause of the data mess.

        Also if the flight recorder data goes nuts at one minute and 40 seconds, doesn't this likely indicate that the pilot displays at this time also were full of incorrect data randomly jumping around? What was the root cause of this data corruption anyway? I have seen nothing written about this, though my guess is that it is related to the angle of attack getting really large (> 30 degrees).

Why the hell is the 'Stall Warning' turned off below 60 knots?
        Airbus' explanation, such as it is, given in the final report for turning off the stall warning (voice) below 60 knots airspeed is that at such a low speed the angle of attack sensors would not be reliable because they don't have sufficeint airflow, hence below 60 kn the report explains the "logic" is to make the stall warning "inoperative". But a poster pointed out the obvious (except apparently to the flight control designers at airbus!) that if the plane is in the air at 60 knots (or less) and is above some threshold altitude so it is not taking off or landing, then of course it's stalled! At low speeds ignore the angle of attack sensors and leave the damn stall warning on!

        It's clear the idiots at airbus never thought through this situation. Oh, the angle of attack sensors aren't to be trusted, so just turn off the stall warning (ignoring the airspeed)! And this stupidity in the airbus control system might have been a (major) contributing cause of the accident. When the pilots put the nose down several times, the stall warning if off would turn on, potentially very confusing. What a brilliantly designed control system.

Did flight director mislead the flying copilot to pull the nose up?
        -- "Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not"

        One news article about the final crash report said that the flight displays (cross hairs on a horizon) might have indicated a nose up position and this might (possibly) explain why the flying pilot pulled the nose up? This would be consistent with 'Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not', but I have seen almost nothing else on this scenario. I have seen some random comments that when airspeed goes out the pitch cross hair display should have been taken out, because it wasn't reliable. I don't understand this technically, but if it is right, then it was a big bug in the airbus code.

        Did the pitch crosshair display indicate the nose was down, so the copilot upon taking control of the airplane tried to correct the pitch and pull the nose up (to level)? This could be very important. It might explain, at least initially, why the copilot yanked back on the stick, which is otherwise inexplicable. But there's a problem with this explanation. After a bit of time, the rising values of altitude should have indicated to the pilots that they were climbing regardless of the crosshairs, so the nose must be up. The transcript notes the non-flying copilot saying all three altitude readings (probably the readings from the three static ports) are indicating a climb. In fact 20 seconds into the event the non-flying copilot is very concerned saying twice 'watch your speed', but by the time the flying copilot responds in about 45-50 seconds the plane has lost about 20% of its airspeed and has entered a high speed stall.

Why no Angle of Attack display for pilots?
        -- "The regulatory authorities should evaluate the relevance of requiring the presence of an angle of attack indicator directly accessible to pilots on board airplanes."

        Translation -- Why is Angle of Attack hidden from pilots when it is measured and used by the auto-pilot to fly the plane. It's standard on military aircraft. Sullenberger and a lot of pilots have long been pissed that angle of attack is not displayed in the cockpit. Sullenberger says pilots now have to infer it from airspeed, which is obviously a problem if you have no measured airspeed! This is (apparently) not just an airbus issue, it appears that Boeing doesn't include Angle of Attack on their cockpit displays either.

Advise the pilot of the extra risk in flying in 'alternate law'
        -- "The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection"

        Translation --- The pilots in the transcript note that as the autopilot has shut down that they have gone from normal law to alternate law. But my understanding is that the pilots either have to remember from their training the specifics of this rarely used flight mode, or they need to dig into printed documentation to look it up. This cause from the final report seems to indicate this us (frankly) stupid. The report appears to be suggesting that (as a minimum) the airbus display panel should have warned the pilots about the increased control they now had, and specifically that they now (with their sticks) could increase the angle of attack to stall the plane, which in normal law the flight controller prevents.

Airbus flight control is not friendly in an emergency
        In other words the accident report is being critical of airbus for being unfriendly. That when there is a problem it should offer up additional information that might bear on the problem. That it could and should offer up reminders and hints.

        For example, in the case of flight 447 the first thing that should have happened is that all the pitot tube information should have come up (and a statement that all three computers appeared healthy). When control was handed to the pilots they at a minimum should have been directed to the loss of valid airspeed procedure. Or better, why isn't critical information like this stored electronically so it can be called up and read online (maybe this is a technology issue as this was not common when the display and memory were designed).

        Even more relevant in this accident is why didn't the flight controller on hand-off either a) just set the throttle and trim settings to the values in the loss of speed procedure (for the altitude), so the pilots need do nothing, or at a minimum display them for Y/N selection or for the pilots to set manually. With hindsight this was a terrible mistake.

        The airbus designers have designed the plane to fly itself when airspeed goes out at cruise, but (apparently) aside from printed material in the cockpit, which Air France did not both to include in pilot training, the plane give no help at all to the pilots in how to setup the plane to fly without a working airspeed sensor! Really poor.

        The whole thing is doubly ridiculous when you consider that given a little time for the pitot tube heaters to work to melt the ice the airspeed might come back. And in flight 447 it did come back in 30 seconds, just a little ways into the four and a half minute plunge toward the water.

Flight control system could prompt for a conservative response from pilots
        A conservative response from the pilots is called for when at cruise attitude the autopilot suddenly shut down and the protections of normal law are lost. One poster puts forward the argument that the flight control system could do a lot, much more than it now does, to help the pilots take command and to prompt from them a conservative response. When air speed is lost, it could warn the pilots, but not hand over control immediately, fly the plane for maybe 20-30 sec, holding the last valid settings for thrust and direction.

        And the poster continued, and here I think he hits the nail on the head, the flight control system could either display the recommended settings for trim and throttle for flying without airspeed, or maybe change over to these setting before handing over control to the pilots. (Yes, this is the ultimate in waiting.) If the plane were to be set to safely fly itself (via dead reckoning) for a while at altitude without airspeed, then the pilots would have the maximum time to understand the problem and figure out a course of action.

Can warnings and alarms be heard and/or seen in the pilot rest area?
        Can warnings and alarms, like change in flying law, 'stall, stall', etc, be heard and/or seen in the pilot rest area? Clearly the experience of flight 447 shows they should be, but I suspect they are not. There's nothing I see in the cockpit voice recorder about the copilots calling the pilot, but I read that one of the copilots pushed a button to call the captain to come back. The change from 'normal law' to 'alternate law' happened immediately and was obviously very important, and airbus doesn't make this known to a (senior) pilot in the rest area? Big mistake.

Do the pilots' airspeed displays recover?
        A key issue here is did the pilots' airspeed readings recover when the ice melted? And if they did return did they go out again for some other reason? This is absolutely critical. If airspeeds returned (and were correct and believable) it would have indicated to the crew, if they had any understanding of flight envelopes, that they were flying far too slow for cruise altitude, that the plane was stalled.

        The final report has a high resolution plot (see below) showing the airspeeds derived from the two cockpit pitot tubes. One recovers in 30 seconds and the other one in one minute. (A recovery in a minute or so was the common pattern in other airbuses where the pitot tubes had frozen as the heater melted the ice and the water drained.) Since the plot is labeled pitot tube 'computed and calibrated airspeeds', seems to me it is likely that the pitot airspeed displayed must have returned in this time window, which means airspeed would have returned before the senior captain returned. (However, you would think this return of airspeed would be mentioned in the transcript since it's loss was mentioned.)

        But critically there is another problem with the airspeeds. The same plot shows that at a little after a minute and half into the event (2 hr 11:45), just seconds after the senior captain returns to the cockpit, both airspeed plots go crazy, i.e. they begin to oscillate going from valid to invalid (zero speed) every few seconds. If this is what happened on the cockpit display, then airspeeds would have been unreadable, just wildly jumping around. And the flight data recorder showed this continued to the end. While it's possible this is a flight flight data recorder limitation, it's more likely there is some fundamental problem with the airspeed readouts!

        Haven't seen any discussion of this so don't know if it is something to do with the high angle of attack or if there was some limitation in the code that processed airspeed. In other words a code bug (probably in the form of some unnecessary range limitation)!

Incorrectly oriented pitot tubes
       Upon thinking about this I can see that at a high angle of attack with the plane oriented slightly upward but falling on a 25 degree path (25 degrees from horizontal), the forward facing pitot tubes are not correctly oriented. Unlike in normal flight where the nose of the plane pretty much faces into the wind, here the airflow is coming from below the plane, so they are going to see a somewhat lower pressure. I can envision that the plane designers seeing this as an unlikely mode for the plane, just writing the code so that at a high angle of attack, rather than making a correction factor larger and larger, they just decided to make the speed reading invalid. What looks like oscillation then in the airspeed would then be the airspeed cutting in and out because the angle of fall of the plane just happens to be right at the threshold. This would be consistent with labelling of the airspeed in the report (valid or invalid).

Why didn't airbus do more about frozen pitot tubes?
        An appendix in the crash report lists 36 reported pitot tube icing failures in A330 (and sister A340) alone in the 6 years prior to crash, at one point in 2006 reports were coming in one a week. Why didn't airbus the manufacturer of the plane do more about this? Apparently there was a regulation/testing problem in that the pitot tubes met whatever the testing standards were, but the evidence was showing the standards were not adequate. Airbus should have moved on two fronts: to advise airlines and air agencies about the reported failures and the prompt that pilots are trained on what to do, and also, of course, to work the engineering problem of finding and qualifying a better tube.

        The 'obvious' fix would be to increase the heater power in the tube, but this may be trickier than it sounds. For example, did the plane support a higher power load (it's in the 100 watt range). Do the increased temperatures, or wider range of temperatures, mess with the calibration of the tube? Testing is probably particularly difficult. Flight 447 was thought to have encountered supercooled liquid water at -40C (-40F). A water/weather guy on BBC documentary says he has never encountered supercooled water this cold, so testing of the tubes would probably have been a long drawn out affair, since both new standards and testing procedures were needed.

Misleadingly named 'Unreliable Airspeed Procedure'
        There is what I see as a damning indictment of the airbus 'Unreliable Airspeed Procedure' in the final test report. The crash investigators interviewed a bunch of other airbus crews who had faced a similar problem, by which I think they mean drop out of airspeed (due to pitot tube freeze ups). A lot of them didn't look up the 'Unreliable Airspeed Procedure'. One reason is that many already knew they had to fly by setting pitch and throttle and proceeded to to that.

        However, some crews gave another answer that was very interesting. They said why would we look up a procedure for "unreliable" airspeed, when we knew our airspeed readings were wrong. Exactly! It's not all that hard to know, 447 pitot tubes showed huge step decreases in airspeed that are physically impossible. The key airbus procedure here was not only badly written, it was misnamed!

Sullenberger points out the aspects of airbus cockpit design that likely contributed to the accident
        In the ABC video (below) the hero airbus pilot (he landed an airbus in Hudson with no power) and now an ABC contributor in an airbus simulator goes over aspects of the airbus cockpit that he argues likely contributed to the accident. He says if the cockpit of flight 447 had been of the Boeing type (with mechanically linked yokes instead of side sticks) that the accident would have been "much less likely"!

        Sullenberger, an expert airbus pilot, asked about why the 32 year old copilot pulled back on the stick to hold the plane's nose up says, "It's difficult to explain that. I just don't know why he did that". Asked if it makes sense on any practical level, he says "no". But why this was a disaster, Sullenberger and ABC are arguing, is that the design of airbus cockpit made it very difficult for the other pilots to see or figure out what the flying pilot was doing. The video then switches to Sullenberger in a Boeing 747 simulator. He shows with the Boeing coupled yoke (sticks) that if the flying pilot pulls all the way back it is immediately obvious to the pilot in the other seat (and to anyone sitting behind too), it can't be missed as the yoke is in your lap.

        Essentially the flying pilot has done (and is doing) something stupid, but it is not visible to the other two pilots in the cockpit because of the airbus cockpit design. The (near) proof that the two non-flying pilots in the cockpit didn't understand what the 32 year old flying copilot had done, and was continuing to do (pull the stick back to hold the nose up), is found on the cockpit voice recorder. Approaching the end when the plane has fallen to 10,000 feet copilot Bonin (finally) says what he has been doing, "I have had the stick back the whole time" to which the other copilot responds "Give me the controls, Give me the controls".

        I think Sullenberger makes a lot of good points. He shows how sensitive the side stick is, how little it moves going from neutral to all the way back. The conversation in the video is if you don't see the other pilot pull back, you can't really tell by looking that the stick is back, and this looks to be the case. The two side sticks are not linked (in any way). If they had been, then the left seat copilot would have known the right seat (flying) copilot had the stick back continuously. This 'feature' of the airbus cockpit design does a pretty good job of concealing from the two non-flying pilots what the flying pilot is doing with the stick, and in this sense was major a contributor to the accident. It looks here like a real flaw in the airbus cockpit design, but I bet the airbus designers could rattle off some advantages too, as this design has been used for a long time.

        As a non-pilot I don't see that linking the motion of the side sticks would be much (if at all) a problem. Maybe this is a philosophy thing. On the airbus there is no mechanical feedback to the throttle levers either. As the autopilot adjusts engine thrust up and down the thrust levers in the cockpit never move. Some have argued this is a video game mentality. The cockpit sticks and thrust lever are just input devices. There is no feedback from the plane or between the flying seats to these input devices.

        7 min video, Sullenberger talks about airbus cockpit design and implications for 447 accident;

        http://www.youtube.com/watch?v=kERSSRJant0&feature=related

Airbus code not clean for lack of airspeed
        There seems to be a common theme here. It seems like the airbus people didn't put enough work into the control code for loss of airspeed: how to advise the pilots, which instruments to shut down, which backup information to provide, how to transfer control to the pilots, maybe preset the throttle and pitch. None of these issues seems to have been fully addressed. It just seems like this failure mode didn't get the work it needed. The code was functional, but crude, unfriendly, and potentially misleading.

        I bet that this accident has caused airbus to totally rework the code for loss of airspeed.

Central mystery --- Why does the crew not recognize the plane is stalled?
        The central mystery, the heart of the problem, in this accident is 'Why does the crew not recognize the plane is stalled?' Of course, there is no way to know what the crew was thinking, but a hard fact in this case is that the word "stall" does not appear in the transcript. With the cockpit aural (spoken) 'stall warning' going on and off for most of the event not a single member of the three member crew ever asks about stall, warns about stall, or comments on the stall warning.

Did they know they were stalled?
        I suppose there is a secondary possibility. This is that all the crew understood they were in stall, which (sort of) explains why no one comments about the stall warning, but they just didn't have the flying skills and/or plane knowledge to recover an airbus from a high altitude, high speed stall.

Sullenberger's analysis
        Sullenberger has an interesting scenario. He believes the big 'stall mistake' has been made by only one member of the crew, the 32 year old junior copilot who takes over flying when the autopilot disengages. He posits that the other crew members don't understand the flying copilot has made a big mistake (stick back) causing the plane to climb and then badly stall, because one, they don't ask what is doing or trying to do, and two, the design of the airbus cockpit hides his stick inputs from them. (On TV Sullenberger shows how little the side stick need be moved to command a strong nose up attitude.)

        The key to Sullenberger's interpretation occurs at three and a half minutes into the event. Here the flying copilot finally tells the others what he has been doing, saying I have had the stick back the 'whole time' (says Sullenberger video translation, transcript says 'for a while'). At which point the senior captain says or yells "no, no, no, don't climb".

        When Sullenberger is asked (several times), why he thinks the flying copilot has pulled the stick back when the autopilot disengages, Sullenberger says he has no idea.

        Let's explore this scenario a little. For one thing the senior pilot is out of the cockpit for the first minute and a half, and by the time he returns the plane has lost about 50% of its airspeed (due to a climb) and even though it is still near its cruise altitude without enough lift from the wings it is beginning to fall out of the sky. Within seconds of his return the angle of attack reaches 30 degrees, so the plane is hugely stalled. So the only one who could have seen the stick go back during this time is the other copilot, and there is no clear indication in the transcript that the non-flying copilot disagreed (at least for a long time) with the flying copilot's flying. The plane climbs 3,000 feet in a minute after the event and since the altitude system remains working (possibly with a small drop (300 ft) when an airspeed correction term is lost), I don't see how the other copilot could fail to understand that the stick is back. And at the three and half minute mark what prompts the flying copilot for the first time to tell the others he has the stick back is the non-flying copilot saying "climb, climb, climb, climb", to which the sensor pilot responds "no, no, no, don't climb", then the non-flying copilot agrees and says "so go down".

        So does the senior pilot eventually figure out the plane is stalled and needs to dive? This is not clear either. After the plane has fallen five miles (from 1.5 to 3.5 min of the event) all this time with the captain in the cabin, and the captain finally hears that the stick has been back, he orders 'don't climb', but he never says dive. In fact he never says what to do!

The climb
        The flight data recorder shows the plane climbs for about a minute after the autopilot disengages (35,000 to 38,000 feet) and all during the climb the plane is losing speed. About 45 seconds into the climb, nearing the peak, it has shed 20% of its speed and even though the Angle of Attack is still very small the plane is no longer flying fast enough in the thin air to oppose gravity and it starts to fall. In other words the climb has cost enough speed near coffin corner to stall the plane, and the stall warning comes on and stays on. With the plane beginning to fall while remaining in a nose up position the incoming air is now coming at an angle from below the wings so the flight data recorder shows the Angle of Attack continuing to increase for the next 45 seconds, where at about 30 degrees it goes off the charts, the plane now hugely stalled even though it remains 7 miles in the sky.

        Pilots have an intuitive understanding that, if they don't adjust the throttle, and if the plane climbs it slows, and if it dives it gains speed. Basic flight dynamics. In level flight the throttle is set so engine thrust (force) cancels drag. Nosing up the plane not only trades speed for height (kinetic energy for potential energy), but it increases the bite of the wings into the air (higher angle of attack) which increases drag, so there are two reasons the plane slows. In a dive the opposite happens with height traded for speed (potential energy for kinetic energy) and angle of attack decreased.

        Now I have little doubt that when pilots fly the airbus normally (i.e. in 'normal law') that unlike in a small plane they don't have to adjust the throttle when they climb, that the airbus flight controller does it for them, just as it does when the plane is banked for a turn. Now the questions...

        Is it perhaps possible that the pilots were so used to not having to worry about the throttle or speed when making flying adjustments in an automated plane like airbus that they just didn't realize that the climb they put the plane in while in 'alternate law' cost them quite a bit of speed loss, enough to trigger a stall at cruise altitude? They do know basic flight dynamics, that it takes only a modest loss at cruise altitude to stall the plane, don't they? If they don't know this, then we are dealing with 'pilots' who don't really understand the flight envelope in which airliners fly!

So why the climb anyway?
        So why the climb anyway? Another key mystery. No one has any real idea of why the flying pilot immediately pulls back on the stick and climbs the plane. I would add that the other copilot watches him and doesn't object, or object much, though he does caution him to watch his "speed", which since there is no airspeed display at this time can be read in different ways.

        Conservative flying would say keep your hands off the stick for a while (30 sec to 1 min) and assess what is happening before you do anything, after all they are seven miles in the sky. A computer simulation in the crash report shows in the winds they had this would have been fine, and in 30 sec to one minute the airspeeds came back as they usually do when the heat melted the ice and the water exited the drain hole.

        There is a vague suggestion in the crash report that maybe the need for a climb was suggested by the flight controller, which again vaguely, was not programmed to respond correctly when the airspeed was lost. Now, I have seen no description of what this means, but it may be referring to a small drop ('fall') in altitude that one or two other crews with frozen pitot tubes noticed. But upon digging into this the crash report shows this so called 'fall' is probably no more than 300 feet (our of 35,000 feet at cruise), because the cause is that there is a (minor) airspeed correction made to static pressure, and the altitude reading is derived from the static pressure readings.

A330 cockpit

Why do airspeed knots look so low in airbus display above?
        It took me over an hour screwing around to understand why the airbus display above shows 275 knots and 0.81 mach (left) at 35,000 feet (right). 275 knots doesn't agree with 0.81 mach, so I was confused. Turns out the left side 'knot' airspeed is not the speed of the plane relative to the air in which it is flying, known as the 'true airspeed'. It is what is called 'indicated speed'. There are a bunch of different airspeeds! 'Indicated airspeed' is the speed figured from the pitot-static system without an air density correction (but including I think an air compressibility correction). At the attitude where jet liners cruise 'true air speed' is much higher (x1.7 or so) than the 'indicated speed' shown on the cockpit dial.

        So why is the cockpit airspeed so wrong? At first glance this seems very puzzling. Turns out the reason 'indicated speed' is used is the response of the plane to movement of control surfaces depends on dynamic pressures on these surfaces, which is a function of airspeed and air density (attitude). Indicated airspeed is derived from a (relative) pitot-static pressure measurement, so being basically a pressure measurement (translated into knots), it gives useful information about how the plane will respond. (It's also easier to instrument for smaller planes.) Pilots know that for a given 'indicated speed' on their airspeed dial, the 'true air speed' of the plane rises with altitude as the decreasing air density reduces the pressures in the pitot-static ports.

        Information about 'true airspeed' is included in the airbus display in the form of the 'mach speed'. This airspeed too is directly is a useful guide for control of the plane (especially for avoiding overspeed). With a chart of how speed of sound varies with attitude and temp, 'true airspeed' can be worked out. Add a correction for wind speed to true airspeed and speed of the plane over the ground is obtained.
-------------------------------------------
        For the big new airbus, and airbuses with the new enhanced system to fly without airspeed (BUSS) option, here is how the display changes when airspeed is lost. Note airspeed is derived from angle of attack and altitude from GPS. In level flight angle of attack is related to airspeed (for a given altitude), so my guess is airspeed is calculated from Angle of Attack sensors with GPS to determine ground airspeed. Don't know if there is any way to make a correction for wind, which can be very important at high altitudes.

Pitot tubes
       I read that some pitot tubes have side opening, and I found this. But note the bottom side opening pressure is mixed with the pitta opening and differenced from the top side opening. What? How the hell can this work?

        Advertising and data sheet for improved Thales pitot tube for A300. Note the improvement is all about preventing water entry and icing.

        The actual pitot system in the airbus is shown in a figure (below) of the final accident report. This output of the pitot tube is just ram (in a pneumatic line). The other port is the electrical input port for the heater. The figure shows the airspeed system is triply redundant. The captain's pitot tube pressure is compared with the captain static pressure, copilot pitot tube pressure is compared with the copilot static pressure, and the standby pitot tube pressure with the standby static port pressure.  The standby pitot tube goes into the ISIS (Integrated Standby Instrument System), which is an independent backup system for airspeed, attitude, etc. From this figure it is likely that there are two separate airspeed displays in the cockpit. (Yup, pictures of the cockpit show both pilots have a lot of the same displays including an airspeed screen.)

Static altitude system
        Altitude is generally described as being derived from the plane's (three) static port pressure readings, which would appear to make altitude readings robust and not affected by pitot tube freezing, but now I am not so sure. The figure below is from the accident report. The accompanying text says in the A330-200 model the placement of the static ports on the plane requires that the measured static pressure must first be 'corrected' using airspeed from pitot tubes. (Flight 447 is an A330-203 model) Notice how Pt (from pitot tube) is 'mixed' with Ps (from static port) to generate Altitude.

        In other words there is some code to 'correct' the static port reading using the pitot tube reading, but clearly there is the potential for real problems in the altitude display to the crew when the pitot tube freezes. How big is the correction normally, and what will this code do if the pitot readings are junk? In other words is the correction term bounded and/or checked in some way? Curiously the report notes that the correction of static port pressure by airspeed is "negligible" in A330-300 and A340-300 models.

Tempest in a tea pot?
        When I read further in the report, I find the airspeed correction to altitude in our flight 447 plane is very small, (tiny really). The following figure in the report (below) shows altitude readings would have dropped only 300 feet when when its corresponding pitot tube froze up. Ok maybe noticeable on the display, and I will grant potentially confusing to the crew, but still it's a drop of only 300 feet when they are cruising at 35,000 feet, less than 1%!

        It's less than clear from above as to which way the cockpit altitude reading would have jumped. The text says the port pressure sensors 'overestimate' the true static pressure, which would mean an uncorrected altitude reading would be low. So presumably when the airspeed readings drop way down, the upward correction is mostly lost, so the cockpit reading may have jumped down by 300 feet. Could this quick lose of 300 feet possibly have prompted the flying copilot to climb 3,000 feet? Doesn't make much sense.

ABC timeline
       ABC news has this useful timeline (obviously including input from the cockpit voice recorder).

        Don't know when this timeline was assembled, if it was before the release of the final accident report, but I see some differences between its times and the times listed on the voice cockpit transcript attached to the final accident report. For example, the accident report transcript clearly shows the pilot leaving the cockpit at exactly 2 hr and 00 min, four minutes later than shown above. A more important difference is the time between when the pilot takes control and stall warnings begin. The above time line has this happening in 2 seconds, buy the times attached to the transcript in the final report (as I read it) show its more line 4-5 seconds.

Stall in 2 to 5 seconds!
       A key point of the above timeline, which differs a little from what I find in the transcript, is when the stall warnings begin. I find in the transcript stall begins in about five seconds (or from above two seconds) after the pilot is given control! The interpretation given above is that the pilot causes the stall by pulling up of the stick. Really? As a non-pilot am skeptical that a huge jetliner could be stalled so quickly. Can the angle of attack really be changed this fast in a big jetliner? Or did the autopilot, maybe using bad data from the pitot tubes bring the aircraft to the edge of stall before dumping it on the pilots?

How to stall an airliner in five seconds
        Maybe the explanation of how the plane stalled so quickly is this piece of information I found in the final report: "In cruise at Mach 0.8 (close to typical cruise speed), the margin between the flight angle of attack and the angle of attack of the stall warning is of the order of 1.5 degrees  (p44)." Yikes, does this mean that all the pilot of flight 447 had to do immediately after taking control was to nose up the plane by 1.5 degrees to stall it? Sure seems like it. If this is true, then it reflects very badly on knowledge of basic aerodynamics of flight of the two copilots in the cockpit.

        On p22 of the report it says the flying copilot within ten seconds after taking control had increased the pitch of the plane from its normal 2.5 degrees (at cruise) to 11 degrees. 40 seconds into the event the pitch is down to 6 degrees and the angle of attack is 5 degrees. Due to the climb, about 20% of cruise airspeed has been lost when the angle of attack hit 6 degrees a few seconds later, a continuous stall warning began. After that with the plane in a nose up attitude and stalled, the angle of attack continued to increase.

        The big advantage of the side stick, which a lot of pilot like, is that you have a (much) more comfortable seat without a yoke column between your legs all the time, and also a better view of the instruments. The disadvantage of a side stick is no tactile feedback as the plane responds. (In fly by wire Boeing planes feedback is simulated, as I think it is too in car power steering.)

        Some posters have argued the side stick may have been relevant in the Air France crash because the left side copilot may not have known what the right side flying copilot was doing. The cockpit transcript doesn't really support this, as (maybe with some delay) the left seat copilot can see the plane is climbing and he tells the flying copilot to go down.

Airbus A330 flight envelope
        A blog about this accident on Scientific American has this operating profile that it implies would apply to the airbus A330 for air temperature and pressures expected over the tropics. Note at 35,000 feet it shows the allowable speed range is pretty damn tight. The blue limit is stall the minimum speed the plane can generate enough lift to fly steadily at this altitude. The green is 82% the speed of sound where planes the author says often cruise and the red is of the speed of sound where "airflow begins to break away from the wings, becomes turbulent, and lift is reduced".

        As I eyeball the curve, this translates into an airbus at 35,000 feet in the tropics typically flying at 565 mph, roughly in the center of the allowing speed range of 530 mph stall and 590 mph where turbulence of air over the wing and loss of lift begin at 86% speed of sound. In other words at high altitude near 'coffin corner' it only takes a speed change of 5% either too slow or too fast and the plane is in trouble without enough lift to sustain it.

        Stall speed (blue) is the minimum speed the plane can fly and still generate enough lift to balance gravity. The explanation for stall speed (blue) rising with altitude is that the density of air drops as you go higher, so the plane must fly faster to generate enough lift to stay aloft. The red (86% of speed of sound) curves the other way, because at altitude goes up the speed of sound come down. (I confirm from a google search that speed of sound drops about 10% or so from 5,000 feet to 35,000 feet as the temperature drops from +41F to -66F.) The combination is the tight box, coffin corner, in which the speed must be held during high speed cruise.

        The crash final report has a 'coffin corner' figure like above. Below shows attitude-airspeed envelope(s) for the plane as it was loaded that night (for what looks like different throttle settings). Time runs right to left here.

        As the event starts (2 hr, 10 min, 5 sec) the plane was comfortably inside the allowable envelope flying at mach 0.81 at 35,000 feet. The (middle) red circle (2 hr, 10 min, 51 sec) at 45 seconds into the event is when the stall warning comes on continuously, and speed at this point has slowed to mach 0.675, about 17%, as the plane has climbed to 37,500 feet. The left red circle (2 hr, 11 min, 38 sec), or 1 minute and 33 seconds into the event, is just about the time the captain comes back and shows how stalled the plane now is. In the thin air of 36,000 feet it needs to be flying something like a minimum of mach 0.7 to stay aloft, but is only flying at mach 0.4, barely half as fast as it needs to be flying.

        The relationship between pitch, attitude and angle of attack (AoA) is shown in this software simulation (not related to the 447 accident).

Falling out of the sky increases angle of attack
       This simulation shows what happens when the stick is pulled way back (not flight 447 conditions). As the pitch of the airplane rises (purple) with attitude constant, the angle of attack (green) increases (degree for degree). However, when the angle of attack gets too high (here 25 degrees) and plane stalls and attitude begins to decrease. The important point is that as the path of the airplane turns downward the angle of attack seen by the wings continues to increase (above 25 degrees). As the angle of attack gets higher and higher the lift of the wings gets less and less (stall deepens), so the plane falls from the sky faster and faster. The steepening dive of the plane in a nose up attitude (relative to earth) results in astoundingly high angles of attack (here reaching 100 degrees!).

        It's positive feedback: high AoA (angle of attack) leads to falling plane, which increases AoA (nose is still up relative to earth), which further reduces wing lift, which steepens the fall, which further increases AoA, etc.

        What is seen above with strongly rising AoA is basically what happened to flight 447. This is only partially seen on the 447 flight data recorder because the AoA signal, rising steadily as in the simulation above, suddenly fails at 30-40 degrees. Something in the data and computation system either hits a limit or goes unstable.

Simple height-speed energy calculation
        When the flight 447 climbed after the event began, the flight data recorder showed a 20% reduction in airspeed that triggering a nearly continuous stall warning. Not being a pilot I didn't know any rules of thumb about how much climbing reduces airspeed, but I realized that a simple energy calculation might be revealing. To climb higher (further away from the center of the earth) requires the potential energy of the plane increase.

        Here's a simple energy calculation equating all the plane's kinetic energy to an increase in its potential energy (its altitude). The mass of the plane occurs on both sides of the equation, so it drops out. The engines are contributing thrust (force) of course, but in level flight [thrust = drag], so to a first order if the throttle settings didn't change this level of thrust doesn't aid the climb. (In fact since a pitch up of the plane to climb increases the angle of attack, the plane's (wing) drag increases, so without a throttle change the resulting height increase would be somewhat less than the calculation below shows.)

                                         1/2 x m x vel^2 = m x g x (delta h)
                                                    (delta h) = vel^2/2g
                                                        where
                                                               g =  gravitational constant (32 ft/sec^2)
                                                            vel = A330 cruise speed @ 35,000 feet (540 mph)

                                                   (delta h) = [540 mph x (5,280 feet/3,600 sec)/1 mph]^2/ (2 x 32) ft/sec^2
                                                                  = (782 ft/sec)^2/64 ft/sec^2
                                                                  = 9,555 feet

        In other words a climb of 9-10 thousand feet without additional help from the engines would drain 100% of the kinetic energy from the plane slowing it to a stop (in this ideal world). Flight 447 climbed 3,000 ft (35,000 to 38,000) after the event, so without engine help 31% [(3,000/9,555) = .31] of its initial kinetic energy has been used to gain height. Thus the plane at the top of its climb to 38,000 feet would retain 69% of its initial (cruise speed) kinetic energy. This works out to be about a 17% loss of speed (540 mph => 447 mph), since [sqrt{.69} = .83].

        Surprisingly this simple energy calculation of speed loss is in pretty good agreement to what the flight data recorder shows, about a 20% reduction in speed at the end of the 3,000 feet climb. The math here seems to indicate that engine thrust did not increase very much (or at all) during the climb to 38,000 feet in the first 30-45 seconds of the event.

Conservative flying simulation
        As part of the crash analysis BEA did a simulation of what would have happened if the flying copilot had reacted conservatively, meaning if he had kept his hand off the stick when the autopilot disconnected. It's shown below. It shows that pretty much nothing would have happened, no significant change in altitude or speed in the 30 seconds to 1 minute or so after the autopilot disengaged. Looks to me (as a non-pilot) that when all the airspeeds again agreed, all the pilots would then need to have done is just reengage the autopilot (if it didn't reengage automatically, which from what I read I think it would have).

Flight data recorder plots
        These plots are from the recovered data recorder included in the final accident report. I have cropped them to show the key data (with my very limited understanding of the airbus and the abbreviated labels on the plots a lot of the data is not understandable). I drew in the black arrows.

        The first two are cropped from the same figure and show the whole event from 2:10:05 to 2:14:30. The start is the first black arrow when the auto-pilot disengages (2:10:05), and (thank goodness) the data and cockpit recorder times seems to be in agreement. The smallest time grid (black line to dotted line) is 15 seconds.

        Note the climb and slight loss of altitude (to 32,000 ft) has bled off 2/3rd of the airplane's (forward) ground speed (475 to 150 knots). (I read in a weather article that the the reported headwind was only about 10 knots. If that's right then groundspeed is pretty close to the horizontal component of the airplane's true airspeed.)

** Airspeed readings
        I did not realize until I saw it mentioned in an article that the the data recorder plots include the airspeed readings from the pitot tubes. It's the two middle plots (above) labeled 'computed airspeed' (green) and 'ISIS calibrated airspeed' (orange). I think I read the data recorder only records the pilots pitot tube airspeed and not the copilots. These airspeed readings are very interesting. The ice caused the two airspeeds reading to drop in seconds (who knows the sampling rate) from 280 knows (indicated air speed) to 80-100 knots. So the reading does not disappear, it drops to a very low speed, very quickly, so quickly that even without a cross-check it would be clear upon inspection that it must be invalid.

        The green (pilot's pitot tube airspeed) recovers (ice melts) in 30 seconds! The ISIS speed, which is probably the airspeed of the backup flight system using the spare pitot tubes, recovers in about 1 minute. Once they recover the two airspeeds agree and appear to agree with the ground speed plot (bottom). So the data plots indicated that in 30 sec to 1 min the airspeed probably return to the captain's display (though you can not tell this from the data plots) until about 1 min and 40 sec into the event when they go crazy along with a lot of other signals, somehow probably tied in with the sever stall.

        Looking through the hires figures of the final crash report I discovered the airspeed data (above) shown in more detail (see below).

        The blue curve shows the pilot airspeed (blue) drop out time was 29 seconds, and it then became valid again for the next minute or so. During the drop out time the (indicated) speed of the airplane dropped from 270 to 225 knots, about 17%, as the plane climbed, and the GPS ground speed data shows a similar percentage drop of 480 to 400 knots.

        The response of the ISIS airspeed (orange) is curious. It is supposed to be an entirely separate airspeed with its own pitot tube and static port. Seems to me it would be extremely unlikely that two pitot tubes would freeze up at exactly the same times, and the one minute or so ISIS airspeed drop out does start about five seconds after the pilot  airspeed drop out (little dots on the graph show the resolution is 1 second), but what's curious is why the ISIS airspeed dips briefly at exactly the same time as the pilot airspeed drops out.

Ground speed data --- GPS airspeed?
        It has just occurred to me to ask, Where does the plot (above, bottom) labeled 'Ground speed' (orange) come from? Presumably this is a real plot from the data recorder, not some computer reconstruction after the event. So if the airspeed sensors are transiently out (for 30 sec to 1 min) where does this data come from? My guess is that this is that this airspeed comes from a GPS receiver on the plane. It would in fact give a (forward) ground speed and would be unaffected by the pitot tube drop outs. Note unlike much of the other data on the recording it does not go crazy at 1 min and 40 sec into the event, it looks like it remains valid until the end.

        A very interesting question is was this GPS airspeed available for the pilots to see? If not, why not?

        Did a little googling to research the question above, and I found a column in USA Today ('Ask the Captain') that says, "There was GPS ground speed information available on the (airbus) Navigation Display". He points out that airspeed could be +/- 100 knots different from ground speed in high winds, but that was not the case in this accident.

        "By the time the airspeed indicators came back, the plan was stalled and flying slower than the computer engineers writing the stall warning program even imagined. The stall warning was designed to cut out below something like 40 knots."

        First arrow at about 2:10:05 is the auto-pilot disengaging. I thought I understood the two stick active plots, but on a closer look either something is wrong or I don't understand it. The labels are sticks "inoperative" and presumably 'operative', as this is a binary plot. (The damn chart doesn't show the '0' reference for most of the binary plots.) We know the first officer is flying the plane most of the time, but the red plot seems to show the first officer stick at '0', which is inoperative nearly the whole time. Doesn't make sense.

        If the red (first officer) plot is flipped here or is labeled backwards, now things make more sense. It would then indicate the first officer is flying until 2:11:37 when he briefly gives up control and the stick on the pilot side becomes active for just 6 seconds or so. But continuing with this assumption, it shows something very interesting that no one has commented on. The first officer's stick, except for a second or two near 2:11:37 is always active. The flying copilot never really gives up control to the other copilot in the captain's seat. No wonder there are 'dual inputs'! However and other problem arises with this chart. It does not show a dual input at 2:13:23 listed in the above timeline (presumably from the cockpit voice recorder).

Stall vs Angle of Attack
        Focus on the Stall Warning (dk red, bot) and the AOA (angle of attack) curves (red, blue, 2n from top). (Angle of attack scale does not show here, but in plot below it can be seen that the baseline Angle of Attack (prior to the event) at cruise was very low (2-3 degrees positive). Note that when the stall warning, which we can interpret as an actual stall(!), comes on continuously (at 2 hr 10:53), the Angle of Attack is barely changed (blue shows no change at all), so the stall starts because of the 20% loss of (forward) airspeed at cruise altitude. The Flight Path Angle (blue) and Vertical Speed (orange) on data plot below shows that this remains the case until about a minute into the event. It it at about 2hr 11:5-10 that the plane begins to decend on a path that for the next 45 seconds continues to steepen and with vertical speed continually getting more and more negative. It is this steeper and steeper negative flight path that reaches about -25 degrees when all the data goes fluky, combined with a relatively stable nose up orientation of the plane that causes the Angle of Attack (AoA) above to increase from a very small value to 30-35 degrees.

 Angle of Attack to high to read?
      I'll bet that the reason the Angle of Attack and a lot of other data signal go crazy near 2 hr 11:45 is that the angle of attack goes out of of range. Hard to say what saturates, but since the data appears to oscillate (or go in and out of validity), I would guess the wing angle of attack sensor just doesn't work right (or has not been calibrated) when angles of attack are this high.

        Note the pull up of the stick by the flying copilot for one min and 40 seconds leaves the plane at 2:11:45 still at 35,000 feet, but the climb had dropped the forward speed (ground speed) drastically from 480 knots to 200 knots. Don't pilots understand that a steep climb with a heavily loaded plane at 35,000 feet would bleed off a lot of airspeed?  This may be the source of the comment from the non-flying copilot to 'watch your speed'. Anyway by this time one (or two) of the pitot tubes have recovered, so it's likely that airspeed display presumably has returned, so pilots know the airspeed. (I have seen no commentary that airspeed returns automatically when the heater is able to melt the ice in pitot tubes, but it seems to me it would be a serious error in the flight control software if it did not.)

Pitch altitude
        Here's another view of the pitch altitude showing the scale, which presumably is in degrees. As in the other figures I marked the beginning of the event (2:10:05) with a black arrow and the time scale is 30 sec between solid black vertical lines.

        This figure shows the plane was pitched up at an angle of 10 to 20 degrees for most of its one minute and 40 second climb. (At this point I don't understand the reference for pitch attitude. Is this degrees relative to earth of relative to the direction of travel through the air stream?)

        In addition to the arrow at 2:10:05, which marks the beginning the event, I drew a vertical line at 2:11:40-45, because at this time much of the instrument data goes nuts, and from then on we see just oscillations on the chart. The loss of data integrity, probably because something is out of range, may be the underlying cause the stall warning at this time transition from continuously on to pulsing on/off. At this time the plane has gone over its little rise in attitude and while it is still at 35,000 feet, it now on a path sloping downward at -25 degrees (blue, flight path angle), and the angle of attack at the wings has risen to 30 degrees, far above the normal operating maximum of 15 degrees.

        Curiously 2:11:40-45 is also, according to the cockpit voice recorder, the time the captain returns to the cabin. So in the minute and three quarters that the copilot has been flying the plane while the captain has been gone (and doing god knows what!), the plane climb initiated by the copilot has lost nearly 2/3rd of the plane's forward speed, has stalled the plane, has put it on a steep downward path, has increased the (wing) angle of attack to off the charts (> 30 degrees), and from that time to the end the black box shows a lot of the plane's data has become invalid.

References

Link to the french (BEA) final report on flight 447 crash
        The link to the final test report (in English) is below. It is 223 pages something like 25-30 Mbyes. It names the twelve appendixes, which include the cockpit voice recorder transcript and data from the data recorder, but these are separate documents.

        http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf
Appendix 1 --- Cockpit voice transcript
         http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/annexe.01.en.pdf
Appendix 3 --- Data from the flight data recorder
         http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/annexe.03.en.pdf

Misc tidbits from the final report
        -- On takeoff the weight of the plane was almost double its empty weight. Most of the added weight is the weight of the fuel, which at takeoff was almost 1/3rd the weight of the plane! Passengers and the cargo hold each contribute about 8%.

My notes from reading through the transcript of the cockpit voice recorder
        The French accident report, which I read, contains an edited transcript of the cockpit voice recording, however the full transcript was leaked and was published in France.

         http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/annexe.01.en.pdf

1 hr 59 min        copilot is awaked from his rest,   "Did you sleep? so-so"
2 hr 00 min        pilot leaves cockpit for his rest,   "I'm out of here"
                                    (note this conflicts with timeline above which has pilot leave 4 min earlier)

        There are now two copilots sitting in the right and left seats. (From the transcript with its three columns I thought there might be three seats in a row, but photos of the airbus cockpit show two (snug) flying seats at the windows each with side sticks and a large center console between. Hence the 3rd man, which would have been the pilot when he returned to cockpit from the rest area, must have been sitting behind the two copilots. From the photos for the pilot to get into his chair would take a while, its a snug fit, looks like you need to crawl in and out.

        Popular Mechanics article notes the pilot when he leaves cockpit as the plane is approaching tropical thunder storm the junior 32 year old copilot (in right seat) as the flying pilot rather than the more senior 37 year old copilot (with twice the flying hours) who at 2 hr 00 min had just returned from his rest and replaces the pilot in the left seat.

        A curious feature of the cockpit layout seen in the photos is that the side sticks are on the outside. This means that the copilot who normally sits in the right seat must operate it with his right hand, while the pilot in the left seat pilot must use his left hand. Probably not as bad as it seems since the pilot probably always sits on the same side (left), but in this case one of the copilots was sitting in the pilot's seat so the side stick was on the opposite side from what he (as a copilot) is used to!

2 hr 07 min       approaching high storm, "-42 (C or F?) we won’t use the anti-ice that’s a plus"
2 hr 08-09         copilots wonder what smell is and did one of them change A/C
                               They conclude everything is OK, that they are smelling ozone and can
                                feel warming (apparently from strong warm storm updrafts), "you can
                                feel already that it is a lot hotter"
2 hr 09:20       "It's amazing how hot it is all of a sudden"
-----------------------------------------------------------------------------------
What follows is the last four minutes of flight. The problems begin with the (sudden) disconnect of the auto-pilot

2 hr 10:04          autopilot disconnect warning (chime)
2 hr 10:06          "I have the controls" (copilot in right seat), "all right" (copilot in left seat)
2 hr 10:10-13     synthetic voice says "stall, stall, stall"

        Stall warning start almost immediately (within 4-5 seconds). As a non-pilot how rapidly the stall warning starts really surprises me.
                -- 1) Could the copilot have done something to stall the plane in only 4-5 seconds of flying the plane? Four to five seconds!! Hard to believe, but it might be possible to change the angle of attack pretty fast.
                --2)  Or did bad readings from the frozen pitot tubes begin the problem while under autopilot control. This is just as scary, because it says the autopilot accepted bad speed readings and the plane was on the edge of a high speed stall when the autopilot shut down and handed over control to the pilots. I have seen no mention of this in any article or pilot blog.
                -- 3) Or is this initial stall warning bogus? (probably not, because the accepted that the cause of the crash was the plane went into a high speed stall from which it never recovered, however, I have no idea how stall detectors work)

2 hr 10:15-18      "we haven't got a good display of .... speed" (FP, flying pilot in right copilot seat)
2 hr 10:22           "alternate law protections" (acknowledgment by the 2nd copilot that protections built into the flight control system, like not allowing a stall, are now removed or lessened.)

        OK, it's 17 seconds in and what do the pilots know?
                -- 1) They see they have no speed reading (I saw in a video taken the the airbus cockpit (video ref below), that when the autopilot disengages due to inconsistent speed readings, the quite prominent speed reading of the display goes off.) And almost for sure they would know that this is what can trigger a sudden shutdown of the autopilot. No airspeed reading should scare the hell out of them because they should know they are cruising close to the 'coffin corner' where the gap between dangerous overspeed and stalling is quite small, so an accurate speed reading is vital.
                -- 2) They are getting some (spoken) stall warnings ("stall, stall, stall")

        What have they done or not done in these first 15 seconds?

        -- 1) The flying pilot has not said anything about what he has done, and because both copilots have separate 'side sticks' (on opposite sides of the plane), if the flying pilot has pulled up, the other copilot has no real way of knowing.

        -- 2) No indication the either of them has pulled out the book (to look for <unreliable speed reading procedure>) to see what to do when faces with loss of speed reading at cruise (due to pitot tubes freeze), which would tell them how to query the pitot tubes (I think there is a spare pitot tube called the 'standby'), and crucially no indication not only that they they have not  looked up how to set angle of attack and throttle so the plane can fly safely without a speed reading, or even that they are even aware that this is possible!

        -- 3) No spoken indication that they have notified the captain (who left cockpit only 10 min earlier to rest). Nor did they contact him a few minutes earlier as they could felt from the heat and ozone smell (and no doubt the radar) that they were flying into very high thunder storms.  (ABC news said they contracted the pilot six times, but I don't see any indication of this in the official voice transcript. ABC news expert says the pilot rest area is just behind the cockpit and you can get from there to the cockpit in 10 sec.)

        -- 4) Most amazing is that no one comments on the stall warning! (ABC news says it was "ignored".) If the either of the two copilots had thought it was bogus, I can't believe they wouldn't say something.

2 hr 10:24-28     "Non flying copilot says, Wait we're losing, wing anti-ice, watch your speed, watch your speed".
        "Watch your speed"  seem puzzling since the same copilot just noted a few seconds ago that there was no speed readout, but he is could be referring to 'speed' in reference to the stall warning. (or did the speed readout return, possibly erroneous?) (Popular science article speculates this may refer to vertical speed.)

        My later thoughts are that the NF copilot's comments 'watch your speed' (twice!) are related to the stall warnings telling them they are flying too slowly and/or about speed loss that is occurring because they are climbing. He probably knew, or should have known, that they are flying near coffin corner, where it doesn't take much loss of speed can cause a stall. and only 20 seconds earlier the stall warning had briefly sounded. I have read it can take as little as a 10% drop in speed at cruise to cause a stall, but the flight data recorder here shows the stall warning came on continuously (at about 35,000 feet) when the speed had dropped 20%. If this is right, it helps partially to explain how stall was never mentioned.

        The flight data recorder shows the pilots pitot tube recovered in 30 seconds, but that would 2 hr 10:35, so at this time they had no valid airspeed.

        Later thought --- Non flying pilot says, "according to all three you are going up". The altitude system is working. Altitude is read from static ports and airbus has three static ports, so this must mean that there were three altitude readouts, from the three static ports. This is interesting, because pictures of the pilot and copilot displays show they each have an altitude display (on right side) almost for sure from their own static ports. So where did the 3rd altitude display come from. Is this an indication that the NF copilot has dialed up some additional data, in this case from the backup system (ISIS).

        The altitude reading should have been believable. Why? There is no evidence altitude readings ever went weird, there are three (or two?) of them, and I have never read of a static port freezing up though I suppose it is possible. Thus it must have been clear to the two copilots that with their climb for 30+ seconds (starting at 35,000 feet) they would likely have understood that they had lost substantial airspeed, which at least the NF copilot understood was not smart.

        Hence it may not have been surprising to them when about 15 seconds later the stall warning came on and stay on. Maybe this is why they did not comment about stall, they expected it.

        Popular mechanics article says airspeed reading returns at this time (2 hr 10:35) as anti-icing works on at least one pitot tube. Really? I find it very curious if this is true that there is no mention of this in the transcript. The flight data recorder does show the pilot's pitot tube recovers at this time (30 seconds in), but whether this was clear to the pilots I doubt. It may be they could have dialed it up (if they had tried!), but the flight data recorder shows it took a minute for the ISIS pitot tube to recover, so for the next 30 seconds the two airspeeds would disagree, and my understanding is this means the airspeed is missing from the flight display.

      On stall --- The plane was able to climb because at this time it was not stalled. The flight data recorder shows the continuous stall did not begin until about 20 seconds later (45-50 seconds into the event at 2 hr 10:53). The stall did not begin until the climb had knocked off about 20% of forward airspeed.

        This comment is important, because it says that during the climb the throttles have not been increased. Now my guess is that (I haven't researched this) in 'normal law' with auto-thrust active that when the plane climbs the throttles remain in 'climb' and the autothrust automatically adjusts the throttles higher to keep from losing speed. This throttle adjustment here in 'alternate law' is (almost for sure) gone since the auto-thruster is off. So if the pilots have left the throttle at its normal 'climb' position and the autothruster will have locked the throttle in this position when it disengaged, so this explains the speed loss as the plane climbed. The engines (almost for sure, or very likely) were not throttled up, either automatically or manually by the pilots, when the plane needed extra energy to climb and had increased drag, hence the slow down, hence the stall.

2 hr 10:49         "Where is he?" (must be a reference to the captain)
                          (unedited: "Damn it, where is he"?)
2 hr 10:51-54    (synthetic voice) "stall, stall, stall"
        The stall warning start up again and continues
2 hr  10:56        (TOGA)
                         At 53 seconds into the event (at about the peak of the climb) we have a 2nd throttle refeerence. It is written as above in parenthesi's. Not sure why. Maybe it means that at this time the flying copilot changed the throttle setting from 'climb' to 'TOGA'. As shown below, seven seconds later (11:03) the flying copilot confirms the throttle setting of TOGA saying, 'I'm in TOGA'.

            So at the peak of the climb the throttle lever is now set to high. What puzzles me is that there is no hint in the flight data recorder that that this increased thrust at about 2 hr 10:56-11:03 does anything. At this time the angle of attack is still pretty low, but it just continues to smoothly increase and airspeed to decrease. I see no hint that the plane engines have more thrust. I wonder, is perhaps TOGA at cruise calculated by the computers to be not really a high thrust setting at all like it would be at low altitude?? If this speculation is right, then it would really fake out the pilots. They think they have increased thrust to combat stall, but maybe next to nothing has happened?

2 hr  11:03       "I'm in TOGA, eh"
                        This is a critical comment from the flying copilot, and about the only indication as to what he is thinking as he holds the stick full up a full minute after taking control. TOGA is an acronym for "Take Off, Go Around," usually used for taking off and landing. Planes need to gain speed and altitude quickly to take off, so pilots power up the engines and increase the pitch. This the one of the few times when pilots fly the airbus manually. Bonin here is apparently telling Robert that he's performing TOGA maneuvers.

        Not necessarily, TOGA is also the name of a throttle detent, so this comment ("I'm in TOGA, eh") could very well just mean he is asking for assurance on the throttle setting.

        I find in the airbus training manuals that when flying (slowly) in alternate law and the stall warning starts the airbus instructions are to fly level and recover (speed up) by increasing the throttle to the TOGA setting.

        Bonin says TOGA again twice, once near the end (2 hr 13:46), "Go ahead you have the controls, we are still in TOGA eh?" Seems to me that to TOGA mode means to Bonin hold the stick back! When he says we are in TOGA it means he has the stick back. And when he says TOGA, neither the pilot nor the other copilot say NO, or in fact say anything!

2 hr  11:06      (shit) "Is he coming or not?"
                         The copilots are baffled as to where the pilot is. There has never been any informed speculation as to why the pilot takes so long to show up. Was he in the john, maybe. Does he know about the stall? Can he hear them in the rest area? All unanswered questions.

2 hr  11:20       For the last 26 seconds the edited transcript contains not a single word spoken by no one. The spoken stall warning continue all this time (and other warnings too, like 'cricket', about which I have not a clue).

2 hr 11:21-24      The non flying copilot speaks up, saying to the flying pilot, "We've got the engines, What's happening ... Do you understand what's happening or not?" (stall warnings continue)

2 hr 11:25-34     For seven seconds the edit transcript is blank. Finally in answer to the non flying copilot question, the flying pilot says, "I don't have control of the airplane any more now" ... and two seconds later says, "I don't have control of the airplane at all". (stall warning continue, no sign of the captain now 90 seconds into the crises)

2 hr 11:37  "Controls to the left"
                I read that this means the left seat copilot, Robert, has taken control of the plane. Curiously the stick up continues, even though earlier his comments seemed to be that the stick should be down. Yet a minute later in the transcript (2 hr 12:27) Robert says "You're climbing", which would seem to mean that right seat copilot Bonin again (or still) flying the plane.

2 hr 11:42-46   Noise of cockpit door opening and pilot says, "What are you doing?" The non flying copilot answers "What's happening, I don't know, I don't know what's happening" and then the flying pilots says, "We're losing control of the airplane" and the non-flying copilot adds, "We lost all control of the airplane, we don't understand anything, we've tried everything"

        The two copilots tell the captain they don't understand what is happening and with the stall warnings continuing tell him they have lost all control of the airplane. Translation: we seem to have stalled, we don't know why and we don't know how to recover.

        The real (unedited) transcript is this
                        Captain: "What the hell are you doing?"
                        Bonin: We've lost control of the plane!
                        Robert We've totally lost control of the plane. We don't understand at all... We've tried everything.

2 hr 13:36    Flying copilot calls out "9,000 feet"
        Previous two minutes in transcript is a lot of cryptic comments including some discussion by the captain about keeping the wings level. Also a series of  'dual input' warnings begin, meaning the non-flying copilot has also engaged his stick. It's clear though from the context that the right seat copilot has continued to fly the plane. Curiously the captain back for two minutes at this point in a clear crises (stall warning, dual input warning and his copilot telling him they don't have control of the plane) doesn't take over as the flying pilot. (If I remember right, the captain is far senior to the 32 year old copilot who continues to fly the plane.)

2 hr 13:39-43 Non flying copilot says, "climb, climb, climb, climb"
                       flying copilot responds, "But I've been at maxi nose-up for a 'while' (ABC has this the 'whole time')
                       senior pilot contradicts, saying, "no, no, no, don't climb"
                       non-flying copilot (changing his tune) says, "so go down" (and asks for the controls)

        ** This somewhat puzzling back and forth, at 3:35 minutes into the event (and 45 seconds from the end at 9,000 feet) is interpreted by ABC News as being the key piece of evidence that the senior pilot and non-flying copilot until this time didn't know what Bonin had been doing, that he had had the stick back all the time. Well maybe, I think it can reasonably be interpreted as indicating that the senior pilot probably didn't realized the nose was being pulled up, but I don't think this indicates one way or the other what the non-flying copilot knew.

        News reports have often said that if Roberts, the non-flying copilot, had had the controls earlier he might have gotten out of the stall. Well maybe, but note from the dialog above this is less than clear. He starts by saying "climb, climb..." If he had suspected that they were stalled, it is unlikely he would be saying this (or saying it in this way). It implies he wants nose up and throttle max, just as Bonin has been doing.

        At this the senior pilot now finally comes alive and clearly nullifies a command ("no, no, no, don't climb"). This might or might not indicate that knows what needs to be done, and it is the opposite of what Bonin has been doing. But consider, if it suddenly dawned on the senior pilot that Bonin with his stick back maneuver might have stalled the plane, then why don't we hear from the senior pilot a clear command him about what to do (something like dive, dive, or xx degrees nose down, etc), but he doesn't do this. In fact he says nothing about what should be done, saying only what not to do! (yes, leadership!) Roberts picking up on the captain's nullification, now reverses himself and says, "so go down", and he asks for the controls. (during this time 'dual inputs' show up, so apparently Roberts is on his stick while Bonin still is flying)

2 hr 13:45-46   The left seat copilot asks the right seat copilot for the controls and the right seat copilot relinquishes to him the controls. The left copilot is now the flying pilot. But Bonin as he hands over control to Robert also tells him we are in TOGA, "Go ahead you have the controls, we are still in TOGA eh? (In fact in the last minute or two there's no real pilot of the plan as a bunch of "dual inputs" are signaled, so both copilots are trying to fly the plane. And the pilot just sits there and doesn't clear up this confusion!!)

2 hr 14:05     Almost nothing said (in edited transcript) for previous 20 sec, then flying copilot and pilot say we are "pitching up". The right seat copilot says, "Well we need to, we are at 4,000 feet"

2 hr 14:16-19 (synthetic voice) "sink rate, pull up, pull up", and the right seat copilot agrees, saying "Let's go, pull up, pull up, pull up"

2 hr 14:23-25   Right seat copilot says, "We're going to crash.... This can't be true ...  But what's happening" (meanwhile the warning 'pull up' continues)

2 hr 14:28    End of recording (the plane (intact) hit the water flat at high speed, passengers broke bones on impact)

Review
        Total time to fall from 35,000 feet (after auto-pilot disengaged and pilots took over) four minutes and 23 seconds. The right seat copilot flys the plane most of the way down,  only in the last 40 seconds (probably at about 7,000 to 8,000 feet does the flying of the plane shift to the left seat copilot (at his request). About one minute and 40 seconds into the crises the pilot returns to the cockpit, but he never takes over as the flying pilot, nor is there any indication that he requests to. He just sits in back as the two copilots are in the two front seats with side sticks, and they fly the plane to the end. About the only thing pilot says is 'keep the wings level'.

         None of the three pilots appear to know what to do in a high speed stall and/or when airspeed is lost. (That may be a little unfair, as the non-flying copilot keeps telling the flying co-pilot to go down not up, but he takes over control at 7,000 feet or so, and he too is unable to get the plane out of the stall.). No one in over four minutes, with one, and often two, non-flying pilots in the cockpit ever mentions (or apparently looks for or pulls out) the airbus documentation on what to do if the plane stalls for a high speed or loss of airspeed during cruise. Amazing!

        Do the pilots think maybe the stall warnings are bogus? Who knows, but no one ever comments about the stall warning, which I would think they would if they thought it was bogus. Certainly after the first 30 sec to one minute they have to know the plane is in a stall and not flying as they continue to rapidly lose altitude.

        Note frozen pitot tubes had been a continuing problem on the airbus, and this particular plane had the type of pitot tube due to be replaced (with one with a better heater). On top of this they are flying a route (Brazil to Paris over the tropical mid-Atlantic) that is famous for towering thunder cells that rise high into the sky. The pilot leaves the cockpit (for a rest) just ten minutes before they fly into the icing crystals, and he doesn't returns for over a minute and half after the loss of airspeed (though it's not clear from the transcript when or if the copilots called him.) Since a stall warning started almost immediately (4-5 sec in), wouldn't this emergency ring an alarm in the pilot rest area? (no info on this, if it doesn't it is a weakness in airbus).

        ABC news expert says once the plane had dropped to 10,000 to 15,000 feet control could probably not be recovered. He doesn't explain why except to say the plane is outside of the range for which it was designed. Probably he means the plane was in a severe stall with a huge angle of attack (30 degrees or much more) plus low air speed. If the ABC news expert is right, then it was not possible for the left seat copilot to rescue the plane as he doesn't take control until about 7,000 to 8,000 feet.

Wikipedia summarizes the Air France flight 447 accident report
        The July 5 French accident report overview (from with Wikipedia page:  Wikipedia Air France Flight 447) reads like so much mush.

        "(The final report) states that the accident resulted from a succession of events: temporary inconsistency between the airspeed measurements, likely following the obstruction of the pitot tubes by ice crystals that, in particular, caused the autopilot and computer-controlled flight system to disconnect; inappropriate control inputs that destabilized the flight path and led to a stall; and, pilot misunderstanding of the situation and consequently a lack of control inputs that would have made it possible to recover from it." Oh yea.

        Translation --- Apparently the pilots didn't understand the airspeed readings were wrong. And they didn't know, or certainly didn't attempt, to apply the setting specified by Airbus to allow the plan to fly without airspeed readings!

        It may be relevant that all the early articles I have seen on the Airbus pitot tubes never mention that the plane is designed to fly without airspeed information. (Was this a closely held secret?) In fact the Wikipedia article includes this quote from a pilot soon after the accident --- "Bruno Sinatti, president of Alter, Air France’s third-biggest pilots’ union, stated that “Piloting becomes very difficult, near impossible, without reliable speed data”. (no recognition there that the plane can fly itself)

        This is damming --- "Starting in May 2008 Air France experienced incidents involving a loss of airspeed data in flight (...) in cruise phase on A340s and A330s. These incidents were analyzed with Airbus as resulting from pitot probe icing for a few minutes, after which the phenomenon disappeared. ... After discussing these issues with the manufacturer, Air France sought a means of reducing these incidents, and Airbus indicated that the new pitot probe designed for the A320 was not designed to prevent cruise level ice-over. In 2009, tests suggested that the new probe (from Goodrich) could improve its reliability, prompting Air France to accelerate the replacement program, [149] but this work had not been carried out on F-GZCP (plane that crashed)."

        What! --- "Airbus indicated that the new pitot probe designed for the A320 was not designed to prevent cruise level ice-over."

      Since Airbus 330 was introduced in 1994 there had been several changes is the pitot tubes, going back and forth between various Goodrich and Thales models. The problem being addressed earlier was not icing, but "water ingress".

        Two months after the crash Airbus (and later FAA) issued a 'issued three Mandatory Service Bulletin' that the pitot tube model (built by Thales) was not to be used in the Airbus. They were to be replaced (in four to six months time) by at least two Goodrich pitot tubes with the 3rd pitot tube to be an improved Thales model or a Goodrich model. ... According to the FAA, in its Federal Register publication, use of the (older) Thales model has resulted in "reports of airspeed indication discrepancies while flying at high altitudes in inclement weather conditions".

        Here's a pretty clear cut indication that the either the old pitot tubes were prone to icing, or perhaps more likely that that the recommended models were more resistant to icing.

        From the accident report another damming fact --- "One factor may be that since the A330 does not normally accept control inputs that would cause a stall, the pilots were unaware that a stall could happen when the aircraft switched to an 'alternate mode' due to failure of the air speed indication.

        Translation --- The pilots might have been faked out by the complex rules programmed into the plane flight controls. In this I have some sympathy for the pilots.

        The Wikipedia section of the accident report states it is a mystery why the copilot held the nose up, since nose down is the usual thing to do to avoid a stall. And the report say (or thinks) this was a conventional stall due to flying too slow. The plane at the time of the icing was flying at 35,000 feet.

        From an interim (2011) accident report here is the most damming admission --- "The pilots had not applied the 'unreliable airspeed procedure'."

An aviation site with a nice technical summary of events on flight 447

        http://www.flightglobal.com/blogs/learmount/2011/05/air-france-447-the-facts-and-w.html

Some good excerpts
        --  Almost immediately upon applying the nose up demand the stall warning sounded twice.

        -- A few minutes later the PF makes a sidestick control input which raises the nose and causes the aircraft to climb rapidly to 38,000ft. There was no reason to climb, the PF did not announce an intention to do it, and the aircraft was not cleared by ATC to do so. The natural result of climbing withoutan increase in power is a loss of speed..

        -- The drill for pilots (when auto pilot and auto-thruster disengage in level flight), according to flight manuals for Airbuses and Boeings alike, is to leave the power where it is and to continue to fly straight and level. That way the aircraft's speed remains the same as it was, no matter what the airspeed indicators are showing. When the AP/AT trip out the aircraft is fully in trim and the power stays where it is.

        -- The stall warning sounded again when the aircraft began to descend (about 1 min into the event), and the pilots selected maximum power on both engines (TOGA). At that height this would not have had the dramatic effect it would have had at a low altitude.

        -- The captain re-entered the flightdeck 1min 40s after the AP/AT disconnect, and about that time the stall warning stopped because the recorded speeds become invalid. The BEA explains that this occurs because, when the indicated airspeed drops below 60kt, the angle of attack measurements become unreliable and are rejected.

        --  At some point the pilots had taken the throttles out of the TOGA detent and set them to idle thust. The PF declared he had no valid instrument indications. The BEA does not explain this, but it may have been caused by the very high angle of attack.

        -- Then the PF made some nose-down inputs, the angle of attack decreased, and the airspeed readings became valid again, causing the stall warning to recur.

        -- One poster says this about the airbus response:

The a380 FMS - arguably the most sophisticated of its kind:
        1. When confronted with conflicting information simply gave up control.
        2. Allowed the pilot to maneuver the airplane into a sustained 40-deg stall while cruising FL 350.
        3. Allowed the auto-trim to exacerbate the problem.
        4. Responded to airspeed decay below 60 KIAS by going blank - at altitude, 40 deg. nose-up, landing-gear fully retracted - with no alarm to flight crew that loss of aircraft was imminent.
        5. Allowed the pilot to maintain this condition all the way from FL 380 to impact.

        There is no evidence that a380 FMS won't allow this scenario to be repeated again on another flight. Does anyone see a safety-of-flight issue here?

        -- (poster)  3 min and 30 secs is actually quite a long time. There was no split second decision which was needed. Between the 3 of them they should've had enough time to process the situation and recover, but they didn't. This to me indicates either a training problem and/or air data information problem.

        -- (poster, who states he is an airbus pilot with thousands of hours)  When asked how I like the aircraft, I tell people that there is likely no easier airplane to take over an ocean, and that the systems design and presentation is superb. That said, the automation is more complex and less intuitive than necessary, and the pilot-aircraft interface is unlike that of a conventional aircraft. Most important with regard to this accident is the fly-by-wire sidestick control. The sidestick itself has a very limited range of motion, making inadvertent over-control very easy. Of even greater significance, the stick itself provides no "feel" feedback to the pilot.

        -- (poster)  Even if the PF appreciated the limitations of Alternate Law’s lack of stall protection and kept counter intuitively applying wing loading aft stick in a panicked state, it is highly unlikely he would have appreciated that in the “relatively naked” Alternate Law MANUAL flight, that the horizontal stabiliser was AUTO trimming fully nose up to trim the load on the stabiliser.

Airbus <unreliable speed procedure>
        Here is an airbus presentation to airlines on changes made to the 'unreliable speed procedure' in 2006. (I found this link on an aviation blog.)

         http://www.iag-inc.com/premium/AirbusUnreliableSpeeds.pdf
(or)     http://luckybogey.wordpress.com/2009/06/24/air-france-airbus-330-unreliable-airspeed-problems-since-2006/

Excerpts
       "Unreliable speed is one of the difficult situations that a pilot has to face. Once the failure has been identified, a procedure, based on pitch angles and thrust settings, will assist the pilot in safely flying the aircraft. But the main difficulty is to rapidly detect an unreliable speed situation. Reaction time is crucial, since the aircraft may stall and overspeed conditions could cause aircraft damage.

        Once airborne, how can the crew handle an unreliable speed situation? Water, ice, dust, ashes, etc. may partially or totally block pitot probes and static ports. Equally, tubes misconnected to the Air Data Modules (ADM), plastic covers not removed from probes, insect nest, radome damage, may lead to erroneous pressure measurements. The consequences of this erroneous pressure information, once used by the ADRs (flight computers), and/or the standby instruments, are the computation and the display of unreliable speed and/or altitude for all users.

Erroneous speed or altitude indications can be suspected, among others, in the following cases:
        - Speed discrepancy (between ADR 1, 2, 3 and standby indication),
        - The fluctuation of the Indicated Air Speed or of the Pressure Altitude.
        - Abnormal correlation between basic flight parameters (IAS, attitude, pitch, thrust, climb rate),
        - abnormal AP/FD/ATHR behavior,
        - STALL and OVERSPEED warnings or FLAP RELIEF on ECAM that are in contradiction with ar least one of the indicated airspeeds,
        - Inconsistency between radio altitude and pressure altitude,
        - Impossibility of extending the landing gear by the normal landing gear system.

        Nevertheless, it should be emphasized that identifying an unreliable speed indication is not always obvious: no single rule can be given to conclusively identify all possible erroneous indications and the display of contradictory information may confuse the flight crew. Pilots should therefore be aware of unreliable speed symptoms and consequences. ... In case of any doubt, the pilot should apply the pitch/thrust memory items.

        Depending on the effected probe, i. e. pitot probe or static port, different indications in the cockpit will become unreliable." (The attached table shows if the static ports are blocked a whole bunch of readings go out: airspeed, altitude, vertical speed, etc, but if it's the pitot tube(s) that are lost, then altitude and vertical speed are sill OK, which is important, because this was the case in flight 447).

        "An unreliable speed situation may be difficult to identify, due to the multiple scenarios that can lead to it. Therefore, training is a key element: indeed the flight crew’s ability to rapid detected the abnormal situation, and to correctly handle it, is critical." (To which Air France's response was to do no training at all for loss of airspeed!)

         "The aircraft entered the cloud tops and experienced light to moderate turbulence. After about 15 sec. it encountered moderate rain that was visible on the windshield. The pilots noted that the cockpit suddenly became very warm and humid and a few seconds later all three airspeed indicators rolled back to 60 kt. and autopilots and autothrottles disengaged, as did rudder limit protection ..." In both of these incidents, the aircraft continued to a safe landing.

        An official "safety information bulletin" issued only 9 days after the crash talks about the pitot tubes. It says that flight manuals include procedures for unreliable airspeed and "these should be well known by the flight crews". It goes on to recommend when airspeed is lost "(immediate) conservative actions" and then apply the unreliable speed procedures for continuation of the flight.
        http://legal.com/images/aviation/af447/EASA_SIB_2009-17.pdf

Flying without airspeed gets easier --- Back UP Speed Scale (BUSS)
       Turns out some airbuses have hardware or to support an optional procedure called, Back UP Speed Scale or (BUSS), whose purpose is also to allow the plane to fly without a speed sensor. This was introduced in 2006. It uses angle of attack (AOA) sensor information, which should still be valid, for speed and GPS for altitude, combined with control by thrust and pitch. Airbus says this enhanced procedure is intended to reduce the work load on the crew if airspeed is lost, and it is standard in the new jumbo A380 airbus.

More on BUSS
        "According to Airbus vice-president training and flight operations Capt Jean-Michel Roy, the degraded primary flight display mode uses angle-of-attack data to provide speed information while barometric altitude is replaced with positional data derived from the GPS navigation and, when close to the ground, height data from the radio altimeter." (see figures for the flight display in BUSS)

        In other words, keeping a highly automated plane flying in the event of equipment failure (frozen pitot tubes or static ports and defective flight computers) is so important to safety that airbus over the years has continued to work to improve it, to allow more equipment to go down, and for success to be less dependent on the crew. Their new improved approach uses angle of attack sensors combined with open loop setting of pitch and thrust, and they have made it standard in the newest (and biggest) airbus, A380, and it is available as an option on other airbus planes.

Unfair?
       Glancing through this procedure (difficult for a non-pilot to fully understand as it is full of abbreviations), I see in it a  reference to TOGA. I wonder if some of the online (and mine!) criticism of the pilots not using this procedure is off target and not fair. The copilot twice says, we are in 'TOGA mode right' (transcript says "eh", but I think 'right' is OK). So maybe he and the other pilots do know about this procedure and think they remember it, and the problem is they don't remember it correctly!

        This would explain a lot. How could all three pilots be totally unaware the plane can fly itself without a speed sensor? And it would explain why they don't go to look it up.

Not really
       However, looking more closely at the loss of reliable speed procedure I think I see where TOGA comes in. The procedure covers what to do for loss of airspeed at different points in the flight path (takeoff, cruise, landing). There is apparently something called a 'TOGA thrust' that may be used in takeoffs or/or an aborted landing. TOGA (along with CLB) appear to be the name of a detent in the thrust levers. The procedure does not show TOGA thrust as the throttle setting if airspeed fails during cruise.

         http://www.pprune.org/tech-log/468394-af-447-thread-no-7-a-40.html

Thrust levers
        Another little tidbit about how the pilots control thrust on automated planes from a poster on an aviation blog:

        "On Airbus A320’s and any other Airbus models, the thrust levers themselves don't shift when the autothrottles are engaged, so it’s a reminder for the pilot bring the thrust levers all the way back to idle to match the thrust setting of idle for landing. This drove pilots mad especially when they converted over from Boeings to Airbus. If the pilot ignores the instruction, the thrust will still be at idle despite the position of the thrust levers."

        "Takeoff is performed with the thrust levers in the FLX/MCT detent or the TOGA detent, depending on aircraft weight, runway length, pressure and temperature etc.  At thrust reduction altitude the thrust levers are pulled back into the CLB detent and the autothrust engages. The autothrust stays in until landing with the thrust levers staying in the CLB detent for the remainder of the flight. If the pilot intends to land with manual thrust, he'll disconnect it somewhere on the approach, and the thrust levers are used conventionally. Alternatively the autothrust can be left in for approach and landing, so the thrust levers stay in the CLB detent until the pilot pulls them back to idle in the flare, thus disconnecting the autothrust."

        Another poster to this thread says with auto-thrust engaged (as it is for most of the flight) the cockpit thrust levers serve only to determine the maximum thrust the auto-thrust can command.

         http://www.youtube.com/watch?v=XenolE_tQ8w&feature=related

        -- Their first conclusion (from examination of floating wreckage) is that the plane was intact when it hit the water, it didn't explode in midair, and it hit the water in a level orientation at high speed. This is correct and consistent with a stall decent.

        -- Simulator views show that in the highly automated airbus even when flying manually and making a banked turn, the pilot can take his hand off the stick and the plane continues to turn. And in the turn it doesn't gain or lose altitude because the computers adjust the throttle and pitch.

        -- "Airliners are struck once a year on average by lightning" (This is unclear, does it mean one plane a year is struck or every plane is struck every year?) "No modern airliner has been lost to lightning since 1963." The show include a spectacular video of a Boeing plane being struck with the lighting coming down into the nose and exiting at the tail down to the ground.

        -- They say that simulator tests show that (valid) airspeed could have been maintained in this case with all three pitot tubes frozen by controlling pitch and throttle.

        -- One pilot has a theory. He notes that standard practice when flying into a thunderstorm, which the plane was doing, is for the pilots to dial back the plane's speed a little bit. The implication here is that the auto-thruster transiently lowers engine power (substantially?) to slow the plane, and maybe when the auto-thruster disengaged and it holds its last setting that setting was quite low and the pilots don't notice.

        My take is this might be a hint as to why the plane stalled within five seconds into the event, that the combination of slowing the plane for the storm and the disengaging of the auto-thruster at the wrong time could have left the plane close to stall when it was handed to the pilots. (However, I don't see this in the data from the flight recorder, but my problem is I don't know how to assess if some of it might be wrong.)

        It's a good thing the black boxes were found and were readable, because this accident investigation was only able to suggest the crew got (somehow) overloaded by faults and probably the plane stalled. The lead investigator with a model airplane showed how to recover from a stall (tip plane's nose down and apply full thrust. The idea they have as to why the plane didn't recover is that maybe the plane went into a strong roll as it stalled, which is what can happen if one wing stalls before the other. (In fact the airbus was well behaved and only rolled a tiny bit when it stalled, a roll quickly recovered from.) The pilots say only somebody with jet fighter experience could recover from a spiraling stall. They go on to suggest that because the plane hit the water level, maybe the crew had gotten out of the spiral and was close to recovery only to have the plane stall again as they tried to pull out of the dive. This theory is wrong.

        ** The do rightly focus on training and how pilot skills are eroding with automated planes. In fact one pilot says that transport pilots these days are not even taught how to recover (a big plane) from a stall. (Wow, haven't seen this elsewhere). 'No need you see, the automated planes never stall!'

        In looking at some other YouTube clips of TV covering the crash. I see something really stupid on CBS news. They have what they purport to be an animation of the pilots in the flight 447, except both pilots are holding a yoke in their lap, ala Boeing!

Press
Pilots not trained to fly without airspeed
       This is damming (if true) from a 2011 Aviation Today article. The plane is designed to fly without airspeed sensors and no one bothers to tell the Air France pilots about this! (Does this also mean they have not had simulator training about how to recover from a high speed stall?)

        "At the time of the occurrence, most of the operator's A330 pilots had not received unreliable airspeed training. Most of these pilots had transferred from the operator's A320 fleet, and the third-party training provider had not included the topic in its A320 endorsement training program, even though it was included in the aircraft manufacturer's recommended program since 2004."

        "Meanwhile, Boeing and Air France have been studying what happens when tiny, high-altitude ice crystals clog Pitot tubes on jetliners. The companies are advocating adoption of tougher industry-wide testing requirements for the sensors, the officials said, along with new procedures and more-precise checklists to help pilots maintain control of commercial jets if their airspeed indicators suddenly malfunction or fail."

http://www.aviationtoday.com/regions/usa/More-Pitot-Tube-Incidents-Revealed_72414.html

        "An EASA directive expected to be issued in the coming weeks will require operators to change out at least two of the three Thales probes on each Airbus aircraft, though officials at Airbus say the devices meet certification standards as written."

        The relevant point here is that the pitot tube "certification standards" appear to not cover icing correctly because the Thales made tubes meet the standard, yet are known to have failed a lot on the Airbus.

http://www.flightglobal.com/news/articles/aero-instruments-to-offer-pitot-tubes-for-airbus-aircraft-330592/

        From ABC news in June 2012 ---   "According to Bill Voss, the president and CEO of the Flight Safety Foundation, Air France was so confident in the design of the Airbus A330, the airline had not trained nor prepared its pilots for the situation the crew of Flight 447 encountered the night of the crash. ... No one was trained for high-altitude stall recovery in the cockpit," said Voss. "It's not part of the normal training curriculum...this is something that really has to be reformed globally. This is a really big deal."

        Translation --- Does this mean no one told the crew the plane could fly within its small high speed cruising envelope (avoiding a stall) by just setting angle of attack and throttle? It could also mean that maybe no one told them how to check for faulty pitot tube readings.

        The ABC news story continues --- "According to the tapes, First Officer Cardiac Bonin, a 32-year-old pilot who had fewer than 5,000 flight hours under his belt, was at the controls but had never been in this situation before at high-altitude. Bonin made the fatal mistake of pulling the plane's nose up, which caused it to go into a deep stall. (Wikipedia says deep stall is incorrect, as only planes with T tails can get into deep stalls, this was a normal aerodynamic stall) ... It seems that the pilots did not understand the situation, and they were not aware that they had stalled." said Jean-Paul Troadec, the director of BEA, the French authority conducting the investigation into the Flight 447 crash.

        Translation --- The either don't understand the pitot reading are faulty, or they don't know what to do if they suspect they are.

        More from ABC --- "As co-pilot Cardiac Bonin pulled continuously up on the controls, the stall alarm sounded for 54 seconds straight. But as Flight 447 went deeper into its catastrophic stall, the alarm cut in and out intermittently, the black box tapes revealed. The stall warning was working as designed, but critics charge the pilots would have been confused by the mixed signals. ... The co-pilots called frantically for help from the captain, the black box tapes showed, but it took Capt Dubois more than one minute to return to the cockpit. ...  "What's happening?" Dubois is heard asking when he re-enters the cockpit. ...  "I don't know what's happening," one co-pilot responded. ... It was not until the final three seconds before the plane hit the Atlantic that the pilots even realized they were going to crash, the black box tapes revealed. Co-pilot David Robert is heard on the tape recording saying, "Oh my God, we're going to crash. I can't believe it." The last words on the recording are Bonin saying, "But what's happening?"

        Here we have a key piece of data from the cabin voice recorder. One of the co-pilots, who are flying the plane, after one minute or so still don't understand what the problem is, and they never figure it out. (I read elsewhere it was four minutes after the auto-pilot disengaged before the plane crashed.)

        The stall alarm is set to disengage if conditions look too weird to be true, which apparently was the case here, because the co-pilot had done something totally wrong.

Airbus pitot tubes freeze on Air Caraibes over Atlantic
       An especially damming story is about Air Caraibes airline who flew two A330 (Caribbean from Paris) and had the same pitot icing problem on both planes prior to the crash of flight 447. And it led to just the problems flight 447 had with the autopilot disengaging and the plane switching into 'alternate control law'. In these cases the pilots did as Airbus recommends and used the <unreliable speed indication> check list (from 2001).

http://www.flightglobal.com/blogs/unusual-attitude/2009/06/af447---the-air-caraibes-story.html

        The article continues --- Unsurprisingly Air Caraibes then requested a meeting with Airbus and the main point they raised with them is very interesting. Not the pitot issue itself, but "we stressed the difficulty encountered by the crew in using the <unreliable speed indication> checklist".

        A poster speaking of this checklist says --- "The real issue is why Airbus have such a complicated, time consuming and sometimes contradictory procedure to deal with a scenario in which you may have so little time to assess and handle the situation."

        Posters are asking if a cheap GPS can tell them their car speed, do not commercial airplanes have a GPS (true) speed airspeed sensor as backup. (I have not researched this for an answer.)

        From another poster I see a description of the high speed stall window --- "flying into narrow stall speed margin (coffin corner)"

        Translation --- documentation from Airbus about what to do when airspeed sensors fail was crap!

        I read the ‘Unreliable Airspeed’ procedure does specify 'pitch attitude' and 'power setting'

        Here's some good info on the 'unreliable airspeed' issue --- 'Unreliable Airspeed checklist has the pitot check the individual pitot tubes, and they can switch off those tubes that look bad, allowing the plane to fly on the ones that are OK. If none are good, they fly on "pitch and power" only. There's also something (on some planes) called the Backup Speed Scale (BUSS) that can kick in if all the pitot tubes are out, and you fly on that.

        Pilots seem to have different views on the Airbus 'side stick' vs a 'yoke'. A poster says --- The side stick provides no tactile feedback or visual clue to the monitoring pilot. His point is that the other pilots may not have known the young copilot had pulled back the stick and held it back, but others dispute this saying the report says he told the senior pilot what he was doing. He also suggests that if the two side sticks (joy sticks) were linked somehow it would provide tactile feedback to one pilot what the other pilot was doing. (Both seem like valid points to me, and the senior pilot acts surprised when he find out near the end that the nose is up, and he says no, no, down, down.)

http://www.airliners.net/aviation-forums/general_aviation/read.main/5328431/

        A poster says another weird aspect of the Airbus control if the two sticks are contradictory, say one nose up and one nose down, the control system averages the two inputs.

What really happened aboard Air France 447 (Popular Mechanics)

         http://www.webcitation.org/63mlsUX81

        Detailed feature story in Popular Mechanics. This is the story I think I first read. It uses not just the 'edited' cockpit voice transcript, but the full recording that was leaked and published in a book in France (Erreurs de Pilotage).

        Key summary: "Neither weather nor malfunction doomed AF447, nor a complex chain of error, but a simple but persistent mistake on the part of one of the pilots (right seat 32 year old copilot)."

        "But neither Bonin (right seat) nor Roberts (left seat) has ever received training in how to deal with an unreliable airspeed indicator at cruise altitude, or in flying the airplane by hand under such conditions.

        "Bonin's (right seat copilot) behavior is difficult for professional aviators to understand. "If he's going straight and level and he's got no airspeed (reading), I don't know why he'd pull back," says Chris Nutter, an airline pilot and flight instructor. "The logical thing to do would be to cross-check"—that is, compare the pilot's airspeed indicator with the co-pilot's (translation --- compare the pilot and copilot pitot tube readings and the 3rd 'standby tube) and with other instrument readings, such as groundspeed, altitude, engine settings, and rate of climb. In such a situation, "we go through an iterative assessment and evaluation process," Nutter explains, before engaging in any manipulation of the controls. "Apparently that didn't happen."

        "Almost as soon as Bonin pulls up into a climb, the plane's computer reacts. A warning chime alerts the cockpit to the fact that they are leaving their programmed altitude. Then the stall warning sounds. This is a synthesized human voice that repeatedly calls out, "Stall!" in English, followed by a loud and intentionally annoying sound called a "cricket."

        "All pilots are trained to push the controls forward when they're at risk of a stall so the plane will dive and gain speed.  The Airbus's stall alarm is designed to be impossible to ignore. Yet for the duration of the flight, none of the pilots will mention it (Yes, not once in the transcript does any pilot ever mention the almost continuous 'stall, stall ...' warning.) or acknowledge the possibility that the plane has indeed stalled—even though the word "Stall!" will blare through the cockpit 75 times! Throughout, Bonin will keep pulling back on the stick, the exact opposite of what he must do to recover from the stall." (Are the pilots all drunk??)

A critical piece of the picture from the flight data recorder
        "The plane is soon climbing at a blistering rate of 7000 feet per minute. While it is gaining altitude, it is losing speed, until it is crawling along at only 93 knots, a speed more typical of a small Cessna than an airliner. Robert notices Bonin's error and tries to correct him."

Popular Mechanics article says the airspeed returns 30 seconds after it is lost!  I find it very curious that there is no mention of this in the transcript.. Unless they are monitoring individual pitot tubes, I think the flight control system only shows airspeed if the two(?) pitot tubes it is using agree. Maybe what happened here is that the flight data recorder shows a pitot tube working, but the pilots don't know this because the other pitot tubes stays iced over, so there is no airspeed display in the cockpit.

        2 hr 10:35 "Thanks to the effects of the anti-icing system, one of the pitot tubes begins to work again. The cockpit displays once again show valid speed information." (This is probably wrong, because the article goes on to say 20 seconds later (2 hr 10:55) the 2nd pitot tube unfreezes and cockpit airspeed reading is now correct.)

Key discussion of the interaction of pilots with the automated flight control system
        "Still, the pilots continue to ignore it (stall warning), and the reason may be that they believe it is impossible for them to stall the airplane. It's not an entirely unreasonable idea: The Airbus is a fly-by-wire plane; the control inputs are not fed directly to the control surfaces, but to a computer, which then in turn commands actuators that move the ailerons, rudder, elevator, and flaps. The vast majority of the time, the computer operates within what's known as normal law, which means that the computer will not enact any control movements that would cause the plane to leave its flight envelope. "You can't stall the airplane in normal law," says Godfrey Camilleri, a flight instructor who teaches Airbus 330 systems to US Airways pilots.

         But once the computer lost its airspeed data, it disconnected the autopilot and switched from normal law to "alternate law," a regime with far fewer restrictions on what a pilot can do. "Once you're in alternate law, you can stall the airplane," Camilleri says. (the copilots have acknowledge almost as soon as the auto-pilot disengages they immediately that they are in 'alternate law')

         It's quite possible that Bonin had never flown an airplane in alternate law, or understood its lack of restrictions. (Yikes, no book learnen for Air France pilots!) According to Camilleri, not one of US Airway's 17 Airbus 330s has ever been in alternate law. (Really!) Therefore, Bonin may have assumed that the stall warning was spurious because he didn't realize that the plane could remove its own restrictions against stalling and, indeed, had done so.

Another key insight --- partial explanation (maybe) of the copilot's actions?
        The article points out that pilots do almost there only manual flying of the airbus at low altitude (landing and takeoff). The flying copilot asks at 2 hr 11:03, "I'm in TOGA (Take Off and Go Around), huh?". In an aborted landing the planes needs to gain altitude fast, so the planes nose is raised and the throttle increased, and this looks like what the copilot is doing. But the article points out that in the thin air of 35,000 feet the plane doesn't at all respond the same way.

        " But he is not at sea level; he is in the far thinner air of 37,500 feet. The engines generate less thrust here, and the wings generate less lift. Raising the nose to a certain angle of pitch does not result in the same angle of climb, but far less. Indeed, it can—and will—result in a descent."

        "The vertical speed toward the ocean accelerates. If Bonin were to let go of the controls, the nose would fall and the plane would regain forward speed. But because he is holding the stick all the way back, the nose remains high." (The article also says that because the two side sticks (joysticks) in the airbus are not linked in any way that Roberts has no idea that Bonin has pulled his stick all the way back that he is continuing to hold the nose of the plane high (> 18 degrees is mentioned at one point.)

        The article says at 2 hr 11:37 (before the captain comes back) the left seat Roberts takes control of the airplane and he too pulls back on the stick. I didn't see this in the transcript. The article says he later returns control to Bonin.

        *** Here is the key problem the plane is after about one and half minutes (2 hr 11:3, just before captain returns). The article says the plane is decending at a "40 degree angle". I at first thought this meant this was the angle of attack, but from context I see it means the decent angle. (Actually the black box data recorder shows the flight decent angle increasing to 25 degrees, and at that point something limits and the data becomes unreliable.)

        Ten seconds later (2 hr 11:47) the condition of the plane is now returned to around its original altitude at 35,000 feet is given as 15 degree angle of attack with only forward speed of only 100 knows, and decending at an angle of 41.5 degrees. (Yup, that's stalled!) And it basically holds this position for the next two minutes, all the way to the water.

        The article goes on to say the speed drops to 60 knots, and that's so slow the angle of attack inputs are not accepted as valid by the flight control system (now fully working), so the stall warning shuts off.

        **  On the pilot not taking control. Some pilots thought this was not unreasonable if the plane was being buffeted to have a pilot standup for the switch (but this would be the non-flying copilot). And the author speculates that if the pilot had taken control with his years of manual flying, he would have pulled the nose down. But a key fact is that the design of the airbus comes into play. With the pilot sitting behind the article says he can't figure out from the displays what his flying pilot is doing, and (really damning) "he doesn't ask"!

       Missing from the edited transcript (I think) is this tidbit. Copilot Roberts asks the captain "What do you think? What should we do?", and the captain say, "Well, I don't know!

        I think this is butchered in the edited transcript too: At 2 hr 13:40 At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself. " But I've had the stick back the whole time!" To which the captain says "No, no, no... Don't climb... no, no", and control passes again to Robert who asks for it, "Give me the controls... Give me the controls!"

        The article says Roberts now pushes the nose down and starts to regain speed, but there is probably not enough time, and when an alarm triggers at 2,000 feet, Bonin again pulls back on his stick, and airbus is running in an averaging mode, so it averages the two stick inputs.
------------------------------------------
Flight control issues
        The final accident report says there was "Lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers". Translation, the individual pitot tubes nor any of there parameters (like temperature) were not shown. The crew got only a summary airspeed, which just disappears when (apparently) just one of the two controlling pitot tubes froze.

        Final report: "The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection."
Translation: In normal flying the pilots of an airbus can just pull back their sticks all the way (no sure touch needed), because the flight control system will clip, set an angle of attach that is steep but avoids stall. The report is speculating that the pilots were so unknowledgable about 'alternate law' that they may not have known that there was no clipping of their up and down stick inputs, that they could drive the angle of attack too high.

        I see another weakness of the interface of the airbus flight control system here. Even though in 'alternate law" restrictions are removed, clearly some sort of low key (maybe text) warnings could have been given, but there is no indication that the airbus works this way.

         http://abcnews.go.com/Nightline/video/air-france-report-wrong-16721903

Hard hitting commentary on Aviation site AVWeb
        This aviation web site builds itself as, 'World's premier independent aviation news source. What I like about this site as they don't pull any punches. Many of the commenters to its articles are experienced airline pilots. I found this site when this essay was nearly finished.

        http://www.avweb.com/blogs/insider/AVwebInsider_447Transcript_205623-1.html
        http://www.avweb.com/cgi-bin/texis/scripts/avweb-search/search.html?query=447&x=46&y=6

        In 2011 after the full cockpit transcript had been leaked and read, here are some selected quotes:

        "Have we become so arrogant in the age of automation that, institutionally, we think it unnecessary to train people to actually hand fly on instruments? Are all Air France pilots so poorly trained, or was this crew simply an anomaly? And how about other airlines? It strains credulity to think that three ATPs in a glass cockpit can't put their heads together to recover a stall. And what of Airbus? Are the displays and alarms badly designed enough to have contributed? Could this have happened to any pilots, no matter how well trained? We await BEA's illumination."

Unfortunately there is very little (to no) illumination in the BEA's final crash report.

        "In preliminary findings revealed last summer, The New York Times reported that the co-pilots in the two command seats were, improbably, never trained in hand flying a jet transport at high altitude."

To which someone posted this comment:

        "If that's the case, please don't call them pilots. A person in the cockpit who can't hand fly the jet is not a "pilot." They may as well have had a steward or stewardess siting up there.  Pilot: A person who operates the flying controls of an aircraft."

        "I have not read any comments here that suggests anyone thinks they could have recovered this situation when these three pilots could not. But the fact that they could not indicates a profound failure in either skill, training, aircraft systems or a combination of all three."

        "To be fair, all modern transport jet aircraft use computerized fly-by-wire systems, and are susceptible to producing contradictory warning messages to the pilots. However, not all of these systems behave the same when receiving faulty data. It seems at least part of the problem in this case is that the displays don't clearly indicate when certain failure modes exist, or get buried in a list of other faults."

        "I have 32 years with a major US carrier plus Corporate, and military experience. Times that high altitude stall recovery or upset training has been conducted in the simulator....ZERO, Zilch, Nada. No regulatory requirement."

        "The scope of training received by an airline pilot is almost totally determined by regulatory requirements. If it is not mandated, don't expect to receive it. That would be "guilding the lily" in the eyes of any bean counter worth his salt. Training is an evolutionary process, in that it is constantly being adjusted in response to the last mishap (or near mishap). I hope and expect to see "Unreliable Airspeed", high altitude upset, and deep stall recover at my next training event. Have I received that training in a simulator before? Not that I can recall."

** Regulatory requirements ---  This seems to be one of the keys. I don't know who sets such international 'regulatory requirements', but the fact that they apparently do not cover manually flying at cruise, which seems to me as a non-pilot to be ridiculous, is at the heart of the training program. It's easy for airline managers whose mail goal is the bottom line and not safety to just to train to the requirements. It explains why posters from many different airlines have posted that they have received no such training either.

        If this is all true, it seems to be that airbus has some responsibility here. Airbus should have pushed for flying manually at altitude to be included in the regulatory requirements.

        ** "So don't blame it on the plane, it was intact, all controls working, and the engines developing full power. At least at lower altitudes nobody should have been afraid of overspeed and just push the nose down when the stall alarm is blaring!" (yup!)

        "Upset training is part of the curriculum, but as practiced in the simulator is done at intermediate to low altitudes and usually with some degree of visual reference and full instrumentation."

        "But the stall warning was not continually blaring. It was designed to cease alarming at indicated speeds below 100kts because the airplane was assumed to be on the ground. So every time the crew put the nose down, the horn would sound. If they raised the nose, the warning would cease. Just another of many Airbus gotchas."

        "Flying the plane at an angle of 5 degrees with thrust at 85% would have been enough to fly without working pitot probes."

        "To me, and every other pilot I've spoken with, it's clear the French pilots just didn't know how to fly in the most basic sense of the word. Unfortunately, this is not rare in today's airline cockpits. Today's crews are far more likely to be "systems managers" than skilled 'stick and rudder' pilots.

        I have lost airspeed data many times - sometimes due to airframe icing. It's no problem at all - just keep flying the airplane using backup systems like attitude and power settings until the heated airspeed sensor (pitot) melts the ice. A given power will always produce the same airspeed in level flight."

================================================================================================

        Some perspective on the Air France flight 447 airbus crash into the atlantic is provided by looking at what happened that same year when an airbus A320 (US Air flight 1549) taking off from LaGuardia hit a huge flock of Canada geese. It almost immediately lost power in both engines while climbing at 3,000 feet and was forced to ditch in the Hudson river. Great piloting and flying saved the life of everyone on board, and the pilot, 'Sully' Sullenberger, became an instant hero.

        The difference between what happened in the cockpit of flight 1549 and flight 447, when a crises without warning suddenly struck, is striking. Turns out the pilot of the US Air plane, an old timer in his late 50's could really fly, he used to be an fighter pilot. When the crises struck, he immediately took control of the plane (the copilot was flying the takeoff), stayed calm, figured out what to do, and with great flying skill did it.

Sullenberger tells what happened
       "Well, it was a normal climb out in every regard. And about 90 seconds after takeoff, I notice there were birds, filling the entire windscreen, from top to bottom, left to right, large birds, close, too close to avoid," Sullenberger recalled.

        Asked when he realized there had been a bird strike, he said, "Oh, you could hear them, as soon as they did. Loud thumps. It felt like the airplane being pelted by heavy rain or hail. It sounded like the worst thunderstorm I'd ever heard growing up in Texas. It was shocking." (Post crash the birds in the engines were found to be Canada geese.)

        "When did you realize that these birds had seriously damaged the aircraft?" Couric asked. "When I felt, heard and smelled the evidence of them going into the engines. I heard the noises. I felt the engine vibrations, of the damage being done to the engines. And I smelled what I described at the time, and I still would as a burned bird smell being brought from the engine area into the conditioning system of the airplane," he said.

        "I put my hand on the side stick and I said the protocol for the transfer of control, 'my aircraft,' and the first officer Jeff immediately answered, 'Your aircraft,'" Sullenberger remembered. The plane is about 3,000 feet. That decision to go in the Hudson was made two and a half minutes into the flight - and just one minute after the birds had hit.

         "As soon as I assumed control of the aircraft, I turned the engine ignition on. So if there was any chance of a relight, we would have gotten it automatically. The next thing I did was I started the auxiliary power unit, another small jet engine that we used to provide electrical power for the airplane."

        There were just three and a half minutes for Captain Sullenberger to accomplish what only a few commercial airline pilots had ever done, and he was determined to avoid the fate of an Ethiopian airliner, which landed in the Indian Ocean in 1996 and broke into pieces, killing most of the passengers on board.

        "What were some of the things you had to do to make this landing successful?" Couric asked. "I needed to touch down with the wings exactly level. I needed to touch down with the nose slightly up. I needed to touch down at a descent rate that was survivable. And I needed to touch down just above our minimum flying speed but not below it. And I needed to make all these things happen simultaneously," he explained.

        Ninety seconds before hitting the water, Captain Sullenberger made an announcement to the passengers and crew. Three simple words: "brace for impact." (The voice cockpit recording shows the Air France crew never talks to the passengers. It guess their attitude was screw the passengers, and final accident report doesn't even comment on this.)

        "I was sure I could do the landing," Sullenberger said. There couldn't have been a better man for the job: a former Air Force fighter pilot who spent nearly 30 years flying commercial aircraft, specialized in accident investigations, and instructed flight crews on how to respond to emergencies in the air.

Poster comments:

        "The US Air landing was great, but the flight control system was in normal law, Sully had envelope protection and could pull the stick fully back and hold it and the airplane would be at minimum speed with no danger of stalling."

        "I have spent the last 6 years as a simulator instructor for the Global Express Bizjet. We have relegated modern pilots to "Aircraft System Supervisors" (ASS's) who can't wait to click on the autopilot and play with the FMS's and iPads. When the automation goes "Tango Uniform", so does their flying. Our training programs need to take a hard look at how we let this happen and how best to return to training pilots and not ASS's.

        A book about this incident, 'Fly by Wire', written by a pilot says also that airbus computers helped avoid stall during the landing, implying the plane was still flying in 'natural law'. In an Amazon review of the book an airline pilot does not give airbus a lot of credit, saying any skilled pilot flying could have manually avoided stall. A critical issue here it seems to me is does airbus 'natural law' mode allow the plane to fly as slow as possible while staying just above stall speed, or can be directed to do this by the pilot?  I have seen nothing on this. If it does and Sullenberger could trust the airbus to do this, then it seems to me it would have been an advantage, because it was one less thing he had to worry about.

Missing Angle of Attack readout
       I saw Sullenberger on the news commenting on this accident and he mentioned that the automation geeks have taken out of the cockpit an indicator that could have made a difference - Angle of Attack! My airplane has it (it goes into the autopilot, which uses it), but the geeks decided to hide it from the pilots! We really need to learn from this accident and get back to basics!"

    I have since see that a lot of other pilots feels like Sullenberger, that 'Angle of Attack' is often a critical indicator. There is some of sort of dedicated set of vanes on the wings that reads it, and it is used by the autopilot to fly the plane, so it is absurd that it is not available as a display to the pilots.

        Langewiesche says Sullenberger and his copilot gave only one only communication to the passengers and crew about the pending water landing. He told them to brace, but this was about a minute and a half before impact! (I find in the A320 airbus training manual for a landing with two engines out recommends (calling out) "Brace, Brace" at a more reasonable 200 feet.) Another goof up is that Sullenberger never tells them, passengers or crew, that it is going to be a water landing. In fact none of the three flight attendants were aware they were coming down into water, though some passengers did! (One guy kept people around him up to date as when to brace by looking out the window and estimating the height.) All three attendants were strapped into their jump seats and in those seats they don't have a window they can see out of (a little design boo-boo in the airbus Langewiesche notes). Amazingly it was only when the plane hit hard in huge spray (people thought the plane had gone underwater) that the attendants became aware that they had to manage a water evacuation.

        There was more luck too. In a textbook ditching the plane drops onto the water at about 3 ft/sec where the fuselage is rated to not let the water in. Sullenberger is coming in essentially with no power and is vertically dropping at three times this rate, so the rear of the tail rips open when it hits, letting water rush in and crushing the luggage compartment and forcing what he calls a jagged bean up into the cabin. This beam later injures one of the flight attendants quite badly ripping open her leg, yet still she gets out from the rear of the plane. Compounding the problem in the rear of the plane, where water got up the chest of people, is that someone opened a rear door whose sill was under water. Also a huge number of people standing on one wing ended up in waist high water as the plane settled.
 

'Fly by Wire' book by William Langewiesche
        There is a (small, quick read) book about the A320 Hudson river bird strike crash, Fly by Wire by William Langewiesche, who writes for Atlantic. I've just read it, and it gives a different perspective on the airbus and Hudson River crash. Here's my Amazon review of 'Fly by Wire'
----------------------------------

Title: Unstallable plane?

       I want to take a different tack from other reviewers by discussing what was learned in the fatal crash of a different airbus in 2009 (Air France flight 447).... Langewiesche, who is a writer for Atlantic Monthly and a private plane pilot, has written an exciting quick read book with two major themes skillfully interwoven:

            1) Sullenberger lands an airbus in the Hudson River in 2009 with everyone surviving after the engines shut down on takeoff from LaGuardia due to ingesting geese, and

            2) The design philosophy of the airbus, quite different from Boeing, with a different style cockpit and with computer limits (banking, pitching, airspeed, etc) on pilot commands that the pilots CANNOT override.

        Langewiesche clearly likes the airbus, he is a fan, and he repeatedly hammers home it's advantages. It's biggest advantage is probably that the airbus was designed so that the pilots could NOT stall it, and undoubtedly this has prevented crashes and saved lives. On page 113 we find the chief airbus engineer (Zeigler) "wanted to build an airplane that could not be stalled -- not once, not ever -- by any pilot at the controls". Langewiesche even details the three layers of stall protection designed into the airbus flight control system. I agree with many other reviewers, however, that while the airbus computers helped Sullenberger with his water landing, it is not clear it was all that crucial.

        In 2009 another famous airbus crash occurred. This was Air France flight 447 that ended up at bottom of the Atlantic killing all 226 people on board. Langewiesche mentions it briefly, but in 2009 when the book was written, the cause of the accident was not known. But the black boxes were eventually found and recovered so it is now known what happened, and whoops(!), it turns out the airbus is not so unstallable after all! The plane stalled at cruise altitude, and the three pilots of the flight were unable to unstall it as fell seven miles out of the sky. This kind of throws a monkey wrench into the song Langewiesche is singing.

        Langewiesche never mentions high speed stall, which is what did-in flight 447, and from the final crash report it looks like the airbus people didn't think this case though. The immediate cause of the problem was freezing up of the airspeed sensors (pitot tubes). This caused the flight control system to go 'beep' and suddenly dump the control of the airplane on the pilots (pilots in an airbus virtually never fly the plane at cruise altitude), and, in what turned out to be crucial, to remove most of the stall protections as the system dropped to 'alternate law'. What happened was the flying pilot promptly stalls the plane, the cockpit stall warning goes off briefly in 5 seconds (!) and after 45 seconds it is on nearly continuously.

        The crash reports suggests that maybe the pilots didn't realize that they could now stall the plane. After all airliners rarely stall, and if Langewiesche is right, it has probably been pounded into their heads that airbus could NEVER be stalled, so maybe that's why they ignored the repeated stall warnings. And airline management (Air France).... If the airbus is unstallable, why train the pilots on what to do if it stalls? So Air France had never provided any simulator training for this and ignoring airbus had even skipped the classroom work!

        In a wonderful tie it all together moment, Sullenberger later explains on TV how some of the innovative features of the airbus cockpit (which Langewiesche apparently thinks are so jim-dandy) in his opinion (as the world's most famous airbus pilot!) contributed to the crash of flight 447. In fact he goes so far as to say that if this had been a Boeing plane, almost for sure the mistake that the flying pilot had initially made to stall the plane would have been recognized and corrected quickly by the other pilots. The issue here is that the two sidesticks in the airbus are not coupled together in any way, so when the flying pilot pulled the stick back instead of forward, Sullenberger thinks this mistake could easily have been missed by the non-flying pilot in the other seat. In a Boeing cockpit the sticks are yokes between the pilots legs and are mechanically coupled together, so if the flying pilot had pulled the yoke back (nose up, the wrong way to recover from a stall), it would be in the lap of the other pilot and could not possibly be missed. This 7 min CBSNews video (Sullenberger and flight 447) is available on YouTube.

        What's the message? Not sure, but maybe there are two sides to every story.

        Pilots flying time is concentrated, so they have a lot of time at home. Being an airline pilot is no longer the high paid job it once was. Both Sullenberger and the copilot had 2nd jobs, Sullenberger as some sort of consultant, and the copilot as a contractor who built houses. Sullenberger had flown 700 hours the previous year, about 17 hours a week average (not counting commuting flights). He had had two weeks off prior to this four day sequence of trips with the crash occurred on the last trip.

       USAir had gone bankrupt twice the previous ten years, which had cut Sullenberger's salary in half and damaged his pension. At the time USAir had (in round number) about 5,000 pilots, 3,000 from the old USAir and 2,000 from US West which had taken over USAir after the 2nd bankruptcy and fired the old USAir management. The east and west USAir pilot groups jockeyed for power and had their own unions. After the accident, the copilot was asked if he liked working for USAir and he said, 'No one liked working for USAir'.

        When Sullenberger took over the flying, he ask the copilot to pull out the (printed) airbus Quick Reference Handbook and look up the procedure for double engine failure. Much of what it recommended turned out to useless here, as it advised doing nothing while the situation was assessed. But the bird strike occurred when the plane was taking off and was only at 3,000 feet, so the pilots had to act fast. The airbus as a glider decends about 1,000 ft/min, so the (near) powerless plane had about three minutes to turn 180 degrees and (avoiding the bridges!) line up with the Hudson for a water landing.

=================================================================================================

        I stumbled across a non-airbus twenty year old accident that is sort of a cross between flight 447 and Sullenberger's Hudson landing. The similarity of this crash with these other two crashes is quite spooky. Like Sullenberger's Hudson crash, this plane too lost both engines on takeoff, crash landed hard (cabin cracked into three sections), yet miraculously everyone on board surviving, the pilot, an experienced former air force pilot, becoming a hero. Like flight 447 a contributing cause of the accident was the pilots struggling with the plane's automation. In this case the pilot does the right thing, while the plane's computers, thinking he is doing something wrong, override him with the result that both engines were destroyed on takeoff!

        The year is 19991 and the plane is a nearly new two engine DC9. The SAS plane (SAS flight 751) has sat overnight at Stockholm in a storm and has 10" of snow, sleet and ice built up on its wings. De-icing of wings misses about 1" of clear ice, so when plane takes off and the wings bend to accept the weight of the plane, the ice loosens and pieces of it are sucked into both engines, which on a DC9 are mounted on the rear of the fuselage behind the wings. The engines are rated to take some ice damage, but some of the fan blades are bent. The engines are still working, but air flow is reduced, and this leads to surges in both engines. As the video below describes it, a 'surge' is burning fuel moving forward into the front part of the engine (where it should not be) and exploding. This is heard by the passengers and crew as a series of loud explosions. The correct pilot response is to pull back on the throttle (to match reduced airflow with reduced fuel flow), and the pilot does this.

        However this DC9 has a feature new to SAS, automatic thrust restoration, a 'safety' feature intended to override pilots who throttle back too soon when the plane is climbing after takeoff. So when the pilot pulls the throttle back, the control system (a few seconds later) pushes the throttle forward causing the engine to speed up. What says the pilot? The pilot later says he was totally confused by how the engines did the reverse of what he was commanding (they went up to 110% of rated speed)!

        It turns out the reason the pilot was confused was that he had no idea his plane had such a system in it. SAS not only didn't train him about automatic thrust restoration, it didn't even tell him the plane had this new 'protection' feature added, because (they claim) they didn't know anything about it either! So here we have a total screw up by the airline. The airline's response was they didn't order this feature for their planes, and it sort of got snuck in!

        There was a screw up on the automation side too by the plane builder. This new code was added to the DC9 computers to override a too early throttle down by pilots that had been observed. Of course with hindsight it's clear that the control system designers forgot, or incorrectly ruled out, a throttle down might be needed if an engine was surging during climb. So here the pilot does the right thing to stop the surges, and the plane's computer overrides his throttle inputs leading to destruction of both engines!

        This accident so shook the pilot's confidence in planes with computer controlled flight control systems that he ended his flying career. He said he no longer could trust the airplane he was flying. This is absolutely basic. The machine the pilot flys has to respond in dependable predictable ways to his inputs, and with crazy overrides suddenly popping up seemingly from nowhere, and in this case it nearly killing everyone on board, pilots have lost the predictability they need.

        Everything I know of this crash comes from an excellent National Geographic hour long TV show on the crash that mixes actors recreating the flight with interviews with the real pilots, flight attendants and crash investigators.

         http://www.youtube.com/watch?v=f-9X8IlmEKQ&feature=related
=================================================================================================

        I dug up airbus training material prior to the accident: Airbus Flight Training Guide (2003) from from British Airways (link below). This is distributed to all pilots doing an A320 conversion. It is 137 pages long and discuss various normal flying modes, the airbus three control laws, and many abnormal conditions (like loss of engines). A search for 'pitot' comes up blank and 'airspeed' only once.

        Pity the pilots. This training material contains no general overview of the airbus control modes (laws), it just dives into detail procedures for routine and emergency flying, and it's all written in a jargon of abbreviations.

        A search for 'unreliable' produces one hit (p81). It's just a table, it does not mention alternate law (just says AutoPilot and AutoThrust are off), not does it say airspeed may be out (pitot tubes give zero hits). It gives "pitch and thrust guidance" (for A320) which for a clean configuration are: Thrust: CLB (which I assume is 'climb' detent) and pitch 5 degrees (above 10,000 feet and 10 degrees below 10,000 feet.
 

What? ---- Opaque text in airbus pilot training manuals
        Consider this beaut from the airbus training manuals. It's in a section on the summary of Alternate Law, so it relevant to the accident. It is 'explaining' the message that pops up on the display (ECAM) when the system switches to Alternate Law. Expanding the abbreviations ‘F/CTL ALTN LAW (PROT LOST)’ means [Flight control: Alternate Law (Protections Lost)]. The interpretation is, "refers to the loss of Normal Law Protections and does not necessarily imply Alternate Law Without Protections." What?  And the manual author actually add this, "Confused? Blame the French".

                Note:
                The ECAM STATUS message ‘F/CTL ALTN LAW (PROT LOST)’
                refers to the loss of Normal Law Protections and does not necessarily imply Alternate Law Without Protections.
                Confused? Blame the French. (p17)

        http://www.scribd.com/doc/49938028/72/Alpha-Floor-Protection

        -- "The controls are very sensitive, so smoothly select the desired attitude and then release the pressure on the side-stick.

      -- "The side-sticks are not linked so movement of one side-stick is not felt by the other pilot. Inputs from both side-sticks are algebraically summed and so care must be taken not to move a side-stick (eg. whilst using the RT
switch) when the other pilot is flying manually. With the autopilot engaged both side-sticks are locked in the neutral position. Applying sufficient force to move them will disengage the autopilot."

Alternate Law
         "Above VMO/ MMO the auto-pilot will disconnect and a simple nose up demand is introduced to avoid an excessive speed increase. This demand can be overridden by the pilot."

High AOA Protection
Normal Law
            As the aircraft enters the alpha protection region, back stick pressure is necessary to maintain attitude and auto-pitch trim ceases. Prior to reaching alpha-max, autothrust alpha-floor protection is activated and TOGA
thrust is automatically applied. Alpha-floor protection should be backed up with the thrust levers. If the stick is moved fully aft the aircraft will stabilise at alpha-max. Lateral control is still effective but the maximum bank
angle is limited to 45º.

The aural stall warning is triggered at alpha-max + 4º, but since the system limits alpha to alpha-max the warning should not activate in normal law.

Releasing the back stick pressure completely will allow the speed to increase and stabilise at alpha-prot. Forward pressure is required to accelerate further. As speed increases away from alpha-prot, the FMA changes from
ALPHA FLOOR to TOGA LOCK indicating that thrust is locked at TOGA. Once an acceptable speed is reached, deactivate TOGA LOCK by pressing the instinctive disconnect button on the thrust levers and move the thrust levers to select the desired thrust.

Note: Alpha Floor protection is an autothrust mode - not a flight control protection mode.

Alternate Law
        During the initial deceleration, a side-stick input is not required to maintain the pitch attitude for level flight. The speed scale markings display only VLS (lowest selectable speed) and the VSW (stall warning speed) (black red ‘barber’s pole’). As the angle of attack increases, 5 - 10kt above the stall warning, a low speed stability term is introduced resulting in a gentle nose down pitching moment which can to be resisted using back pressure on the side-stick. Autothrust alpha-floor protection is inoperative.

        Eventually (at VSW) the master warning and aural warnings will activate (crickets and “STALL, STALL”). Recover at the stall warning by selecting TOGA thrust, maintain a pitch attitude for level flight and accelerate through VLS (lowest selectable speed). (p15)

** key text --- "Recover at the stall warning by selecting TOGA thrust, maintain a pitch attitude for level flight and accelerate through VLS (lowest selectable speed)".

Summary table of Airbus Control Laws

        http://www.airbusdriver.net/airbus_fltlaws.htm
=================================================================================================

From an email trail between my nephew and me

        My project of the last few weeks has been looking into, and writing an essay about (a companion piece to my essay on the Costa Concordia cruise ship crash), the famous crash of an Air France airbus in 2009 into the Atlantic on a flight from Brazil to Paris. After two years they finally found the black boxes, and the final accident report was just issued last month. Once you scrape away the whitewash, the findings were real scary.

         Modern airplanes, especially airbus, are so highly automated the plane flys itself most of the time. Airbus pilots only 'fly' the plane for 1.5 min on takeoff and 1.5 min on landing on a typical flight, and even for these 3 min they are not really in full control, because the computers will overrule them if they do something stupid.

         In the plane that crashed the crew suddenly had to fly the plane manually at 35,000 feet at night in a storm because the airspeed sensors had frozen up and the autopilot can't work without a valid airspeed. It turns out that even though the flight had three pilots assigned to it, none of them could do it! Airbus had been designed to fly without airspeed sensors working, all the crew had to do was look up the procedure (set pitch and throttle and the plane will fly level). No one does. Or just fly conservatively, keep their hands off the stick for a minute or so and figure out what's wrong, a simulation in the accident report shows this would have worked. But the 32 year old copilot immediately pulls back on the stick, stalls the plane in seconds, and it stays stalled for four and half minutes as the plane falls seven miles out of the sky.

         The experienced 58 year old captain when he come back into the cabin never sits in one of the front seats and takes control of the plane even though both copilots tell him they have lost control of the plane. Another scary thing!

        The fundamental concern on aviation blogs is that this crash shows that with computers basically flying big airliners almost all the time, pilots no long know how to control these flying computers in an emergency. And because the planes fly themselves the airlines skimp on training. The pilots on this plane had ZERO training in class or in the simulator as to what to do if the airspeed sensor drops out, even though it has caused a string of accidents and was recommended by airbus. Very scary.

       So while flying is a lot safer these days because computers are in control, when the computers shut down, it is less safe.
                                                                                                                            Don
-------------------------------
Don
        That's interesting. Even before these planes were mostly run by computers, most accidents were pilot error. Even though that pilot pulled up instead of down to get the engine running, most pilot would know what to do, especially on the bigger planes. I still believe pilots know what they're doing, even in times of an emergency. Seeing Sully land that plane on the water was amazing and there hasn't been a major accident in the US in over a decade. Auto Pilot is a bit misleading, even though the computer can fly the plane, the pilots are still a huge part and can't just let the plane fly itself. What's scary is when those sensors go out, then there's a real problem!
--------------------------------
         Yes, I read up on Sullenberger, a real hero, and have included him in my essay. He is now a consultant to CBS News and you can find him on YouTube talking about the Air France flight 447 crash,

         http://www.youtube.com/watch?v=NwiGXhmV3q0&feature=relmfu

but he reinforces my points. Consider:

1) He was an old jet fighter pilot.

         It's the younger guys who are not as skilled. The copilot who made the disastrous mistake was 32. All pilots when getting their pilot license in small planes are trained on how to get out of stall, you push nose down to gain airspeed and lower the angle of attack. But this is a 'high altitude' stall, in an airliner, and you have to understand you are stalled, and the airlines don't train pilots for this. He pulled the stick 'back', which angles the nose up, the plane climbs and it loses airspeed, and the other two pilots didn't seem to realize what he had done.

2) Sullenberger flys the airbus. It was an airbus that landed in the Hudson.

        Sullenberger thinks there are weaknesses in the airbus cabin design that contributed to the Air France accident. He spent 7 min on CBC explaining the airbus problems. First the side stick (no Yoke between legs like in a Boeing) is very sensitive, he showed how little you have to move it to tilt the nose strongly up.

         http://www.youtube.com/watch?v=kERSSRJant0

        Unlike Boeing planes the pilot and copilot side sticks are not linked, so if the other pilots didn't 'see' the 32 year old copilot pull the stick back, it is very easy for them not to know what he has done (And amazingly they never ask!), because it is not clearly indicated on the displays. Sully says if this had been a Boeing cabin the other pilots would have seen the yoke come back (into their lap) and quickly corrected, so no crash.

       Sullenberger and many other pilots are incensed that a critical parameter to control of the airplane, 'angle of attack' (angle of wings to the airstream), is not available to the pilots, although it is measured and used by the auto-pilot to fly the plane. Boeing does the same thing. Totally stupid says Sullenberger. He says the nerds (engineers!) who design planes don't understand it can be useful to pilots. As Air France 447 was falling out of the sky the angle of attack got to be a ridiculously high value of 40 degrees (15 degrees is usable max). If this had been displayed, the pilots could have seen they were stalled and falling. Angle of attack say Sullenberger is normally 'inferred' by the pilot using airspeed, but here airspeed went out.

3) When Sullenberger landed in the Hudson, very tricky, he has explained he had to come in very slow (just above stall speed), keep the nose up at exactly right angle, and the wings exactly level.

       But unlike with Air France, Sullenberger had the airbus computers helping him. His engine power was out, but his computers were alive and well. This allows him to focus on holding the nose up and wings level, while simply commanding 'too slow' a speed. He knows the airbus computers will modify any command that will stall the plane, so in this way he gets the computer to control the throttle (see below) to control airspeed to keep the plane flying as slow as possible (5-10 knots above stall speed). One less thing he has to worry about.

        Well the computer controlling the throttle to control airspeed and keep the plane from stalling can't be right here since the birds had basically killed all engine thrust. But something is slowing and controlling the airplane speed as it approaches the water to land, maybe the flaps? Discussion on aviation blogs seems to imply the computer was still helping Sullenberger land the plane in the Hudson, but I really don't know if the airbus flight control system was flexible enough to keep the plane from stalling using flaps (or whatever) with the engines down.

      99.999% of the time airbuses fly under what is called 'normal law' where the computers just won't let the pilots stall the plane. But with Air France normal law turned off when airspeed was lost. It's very possible its pilots didn't really understand that now they could stall the plane. Since a real airbus almost never stalls, its pilots have had no flight experience unstalling it. And since the planes computers are so good, the airlines save money by scrimping on pilot simulator training. Why train the pilots to fly manually, when the triply redundant, reliable computers do almost all the flying! Sort of a catch 22, how to learn to fly these flying computers without help of the computer.
                                                                                                     Don

        Speaking of pilots and storm clouds I came across this gem in a recent (Aug 2012) NYT article. It's from the the flying experiences of a business traveler of 40 years, and provides some perspective on pilot training.

        He writes, "More recently, I booked a private charter to the Caribbean to get to some meetings for Exclusive Resorts. Midway through the trip, we saw massive storm clouds looming ahead. I was relieved to see they were spaced with gaps, which I expected the pilot to fly through. Only, he did not. He flew directly into the first towering dark cloud. Immediately the plane was buffeted sharply, and rain began to leak into the cabin. (yikes!)

        I was so happy when we emerged into clear sky again. But it was short-lived. The pilot quickly plunged us into the next cloud, where the winds seemed even stronger. I clung to the back of the seat ahead of me until we came out the other side.

        When we landed, the pilot was the first one out of the plane. I saw him leaning against a fence, breathing heavily. I asked why he had taken us through not one, but two storm clouds. He said he was scared, but felt he needed the experience since he was still a trainee. I really didn’t know what to say."

http://www.nytimes.com/2012/08/21/business/out-of-a-storm-cloud-and-straight-into-another-frequent-flier.html?ref=todayspaper

=================================================================================================

        Boeing apparently leared from the flight 447 disaster. The new Boeing 787 (Dreamliner) has a GPS backup to provide an alternate source of air speed if pitot tubes freeze up. From an Aviation Week review and test flight of the 787:

        "The 787 also has protection against pitot/static system failure, such as an icing blockage. Switching to alternate air data enables the aircraft to compute airspeed and altitude from aircraft weight, configuration, AOA (angle of attack) and 3-D GPS position. Using alternate air data, Bryan noted only a 8-9-kt. difference in airspeed and a 40-ft. variance in altitude while cruising at 300 KIAS and 16,000 ft." (Aviation Week Dec 10, 2012)

        "...explained that Boeing FBW (fly by wire) aircraft have back-driven and interconnected yokes and rudder pedals, along with back-driven throttles and speed brake handles, that provide visual and tactile cues of what is going on in the cockpit. This is in contrast to some FBW aircraft fitted with side-stick controls that are not interconnected or back-driven and auto-throttle systems that do not move the thrust levers. It is more difficult in such cockpits to keep all flight crewmembers in the situational awareness loop, Boeing engineers assert." (Aviation Week Dec 10, 2012)

        Another very interesting Airbus problem occurred on May 24, 2013. An airbus A319, flight BA762 taking off from London to Oslo, suffered serious damage to both engines at or soon after takeoff. The engine damage could easily have caused the plane to crash, but one engine continued running and with the other one on fire and trailing dense black smoke the plane was able to circle around over London and land safely at the same airport. As pictures taken from inside the plane during flight clearly showed, after two loud bangs the cowlings of both engines were gone, the inside of the engines were visible in flight from the cabin.

        The press the next day mumbled that a bird strike on takeoff might have caused the double engine failure, but a pilot on an airline blog who said he had hit birds many times said from the look of the plane he was positive it was not a bird strike. He was right. One immediate clue that it was not birds was that the airport had seen the plane leaving debris on the runway at takeoff. BA after the plane landed said only that it had had a "technical fault". You gotta love the airlines!

Engine cowlings not latched
       A preliminary report has been issued and it identifies the cause as a maintenance problem, the cowlings on both engines were not properly latched! The missing cowlings on each engine weighed 88 lbs! A few minutes into the flight there were big bangs heard inside the cabin as the cowling apparently tore loose. From the preliminary report it was lucky the plane could still fly and safely land because when the two cowlings tore loose, not only did they set the right engine on fire, but they caused damage to the fuselage, wings, a fuel line and even the landing gear!

Terrorism?
        This was either an idiot maintenance issue or might it have been done deliberately? While the press (to date) doesn't mention it, it could possibly have been done deliberately by a BA mechanic (a good bet would be a muslim mechanic) looking to kill a plane load of people as an act of terrorism. After the preliminary accident report, there is no evidence this was terrorism, but it can just as accurately be said there is no evidence it was not terrorism! In the preliminary accident report there is no mention of where the overnight maintenance was done and who did it, who was responsible for latching the cowlings. If his name was Mohammed, I would think it might be a red flag.

Cowling latches are re-occurring problem on A320
      A review of airbus records shows improperly latched engine cowlings is a systematic problem on the A320 family having happened 32 times. Airbus says it plans to do nothing about this as some regulators fume.

        Looking into this the problem I find the engines of the plane are only 2-3 feet from the ground and Airbus designers (in their infinite brilliance) put the latches for the engine cowlings on the bottom of the engine! This means after a routine overnight oil check someone must get down on the ground and slide under each engine to close the latches. It also means if they are left open, it might be missed. It says in the accident report that on a pilot walk-around he is supposed to look at the engine cowlings, but that he needs to "crouch down" to see if they are latched. No wonder planes have taken off (presumably) over thirty time with the latches open, and this has caused damage to planes before. This is apparently the worst incident of this type. Not only were the cowlings loose on both engines, but this is the first time when they tore off they have caused an engine fire.

        The engine on fire had its two fire extinguisher bottles discharged, but they did not put out the fire, the engine was still burning when the plane landed with considerable damage. There was speculation on an airline blog that the fire extinguishers may not have been effective because the cowlings were gone, the fire extinguisher material not contained.

Idiotic maintenance
        If this was an maintenance issue, it was an idiot maintenance issue. Almost for sure here the same guy worked on both engines, and he was responsible for the incorrectly latched cowlings. As a poster on an airline blog pointed out, there is a simple fix for this sort of problem and is already in use by some airlines (Lufthansa). When engine work is done, require different mechanics work on the two engines! This would greatly minimize the possibility of a systematic double engine failure like this one. (Of course there is no mention of this in news stories to date.)

        The maintenance done appears to have been minor. It is described as 'overnight maintenance' to check an oil level in a generator. Without giving any details the report says they have a photograph of the plane after maintenance and before the flight that shows that both cowling are unlatched.

Passenger view
        A UK newspaper talked to passengers on the flight about the preliminary accident report. One passenger said this:

        "We knew something was wrong right on takeoff as we saw the cowl door ripped off, just as the wheels came off the ground. I find it strange that the report says that crew weren't initially aware that anything was wrong. We were all shouting."

        "Due to the low ground clearance of the (engine) nacelle, fastening the fan cowl door (four) latches usually requires maintenance personnel to lie on the ground to access the latches. The fan cowl door latches are difficult to see unless crouched down so that the bottom of the engine is clearly visible."

BA762 report showing unlatched engine cowlings
Accident pictures show the cowling that came off is the large metal piece 'behind' the gap
(source --- http://www.aaib.gov.uk/cms_resources.cfm?file=/AAIB%20S3-2013%20G-EUOE.pdf)

        "The Airbus A320-family Flight Crew Operating Manual (FCOM) Standard Operating Procedure (SOP) PRO?NOR-SOP-05 for the exterior walk-around includes a check on each engine that the fan cowl doors are closed and latched. To perform this check it is necessary to crouch down so that the latches are visible."

Cowling damage
        One of the space shuttles was brought down by a small piece of foam breaking off  and damaging the tail that it hit. Look at the size of the pieces of metal that ripped off the A319. There are four semi-circular pieces each 5-6 feet wide and 10-12 feet long. Accident pictures (below) show the cowling that came off is not the ring on the front of the engine (as I first thought), it is the large metal skin over the engine behind the front ring. They are huge, made of metal and weigh about 80 lbs! They could do a lot of damage to the plane when they rip off, not only to the engines, but by hitting the wings, landing gear, fuselage, and tail as they fly by. And in fact they did hit all these areas and damaged them says the accident report.

Significance of the accident
        One poster to an airline blog summarized by view thusly:

        "When the airframe/engine designer makes a mistake with a vulnerable design, those listed above also need to catch it. With random and unpredictable damage to the fuel system, hydraulic system, airframe and U/C in this instance, the outcome could have been much worse.

        A critical weakness has been exposed, and the overall management of this systemic failure needs to be recognised and addressed. This is about much more than six-monthly drills in the simulator."

        "I can't believe the length of this thread. It's simple. The last guy to do maintenance and the pilot who did the walk round both failed to do their jobs properly. It's as simple as that." (there is some talk on the blog that possibly the engines were being worked on at the gate and that cowls were open when the pilot did his walk around.)

        "Why all the talk of getting on the knees to properly check the cowls?
Whilst I fly (an A319) with CFM engines, the height is the same and it is perfectly easy to crouch down and have a good look to check that the latches are secure - it isn't like we need to lie on the ground!"

        http://www.pprune.org/rumours-news/515531-incident-heathrow-49.html

Preventing the problem from happening again
        A poster said unlatched cowls rarely happens on the equivalent Boeing plane because on that plane an unlatched cowl is "blindingly obvious". This leads to a technical fix, which I would think would be relatively simple to implement. Install a spring in the A319 on one of the cowls (near the hinge), then when unlatched the cowl would hang open a little. This would like the Boeing make it 'blindingly obvious' the cowls were not latched.

        Other possible fixes would be to add a warning light in the cockpit that the latches are open. One poster suggests change the procedure with some sort of tag system, a tag on the engine (or possibly in the cockpit) that the engines are open. The latter sounds simple and very reasonable to me, and I suspect something like this will be recommended by airbus on one of the regulatory agencies.

Video of plane on fire
        Video of the plane flying over London on fire and trailing smoke

         http://www.youtube.com/watch?v=Hcwyg4EDJeU

Pictures in flight and upon landing

=================================================================================================

        In a five week period of Jul and Aug 2013 three airliners have crashed while landing at US airports. While loss of life has been minimal, this is mostly dumb luck. The Asiana plane that broke off its tail hitting rocks at the beginning of the runway in SF could easily have flipped over on its back while sliding down the runway and rising into the air doing a 180 turn. This would have prevented the slides from opening could easily have trapped all the passengers in a burning airplane. An Airbus A300 can hold 375 passengers, but only the two pilots were killed in a horrendus UPS airbus A300 crash landing in Biringham Al when the plane hit trees on a hill about a mile from the airport and then hit smashed into the ground breaking into pieces and burning. The reason is only that the plane was owned by UPS and so was full of packages rather than people.

        At present all indications point to pilot error as the cause in all three cases, lending support to the thesis that airline pilots don't know how to fly anymore, or to be more precise don't know how to manually fly highly automated modern airliners.
=================================================================================================

NTSB releases summary report on the cause of Asiana flight 214 crash (6/25/14)
        Here's my take on the NTSB summary report just issued about what happened in the cockpit of Asiana's flight 214 prior to it crashing into the seawall at San Francisco airport last summer knocking the tail off the plane killing some of the passengers and injuring many. (Full reports is still weeks away.)

        There are THREE senior pilots in the plane, sunny day, no wind, simple approach over water, and these three jerks can't manage to land a highly automated Boeing 777, which is working perfectly. Asiana encourages their pilots to fully use the planes automation, which means on landing the pilot steers the plane, but the plane's computer normally controls the speed and keeps the wings level. In other words the plane is half controlled by the computer during a normal Asiana landing.

      A few miles out the flying pilot, who is being trained on the 777, monitored by the other two senior pilots, by mistake engages the autopilot, which ramps up the throttle to begin a climb to its programmed 3,000 feet. In and of itself this is not a serious problem as they are miles from the airport and the pilot immediately pulls the throttle back to keep decending, but in overriding the auto-throttle he has shut it off, and the investigators in talking to him later find out he doesn't understand this. He doesn't understand how the auto-throttle works in a 777. So in they come assuming the computer is controlling speed, none of the three pilots paying any attention to the speed, which pilots on the pilot rumor site find incomprehensible. The speed drops and drops to 105 knots, far, far, below target landing speed. At 200 ft (10 sec out) they realize they aren't going to make it and need to go around, and the report dryly notes they piss half this time before they throttle up the engines at 100 ft (5 sec), and when the nose rises, the tail dips smashing into the rocks.

     There are check points in all landings. At a few miles out, if a plane is not lined up on the glide path ('stabilized'), airline procedures call for a go around. They weren't stabilized at the check point, but they kept coming anyway (a fly around probably goes on the pilot's record!). When the autopilot switches modes, one of the pilots is supposed to call this out, so all the pilots know, and of course, they didn't do this either. Three yutzes dressed up in pilot uniforms.

Here's a narrated simulation of the landing released by the NTSB (June 14)

         http://www.jacksonsun.com/VideoNetwork/3639820265001/Watch-NTSB-s-animation-of-Asiana-Flight-214-crash

My comments
       In an airbus during the latter stages of a landing like this the plane's throttle would have automatically ramped up and the nose pitched up to avoid a low speed stall. But Boeing's philosophy is the pilot rules, if he wants to stall a landing airplane he can, and that just what the Asiana flying pilot did. Asiana claims the switch off of the auto-throttle (by the override early in the decent) is too subtle (apparently just a light change) and is laying a trap for the pilots. I suspect there is some truth to that.

        The big picture here appears to be that Asiana pilots get used to just not concerning themselves with speed as during their standard landing, speed is controlled by the plane's auto-throttle, so when it got switched off without any of the three pilots (apparently) realizing it, it led to disaster. Another contributing factor may have been fatigue. This plane had flown 14 hours from Korea, and while it was morning in SF, it was 3:00 AM pilot time. Still I don't see how this provides any excuse for repeatedly not following Asiana landing procedures. A go around was called for miles out when they couldn't get themselves on the glide path, but these cowboys just kept coming on in. (I wonder how often this happens on other flights?)

        The Boeing 777 is not a new plane. It's been in production for 20 years (and is still in production) with 1,100 made and an excellent safety record.  It's a two engine wide body plane for long haul flights carrying up to 300 passengers. The flight that crashed was a 10.5 hour flight. Wikipedia says the 777 was Boeing's first fly by wire plane. It's also the last of the aluminum airliners. It's structure is 70% aluminum, and it was built with a very high strength aluminum alloy developed for it.

My summary of flight 214 crash (7/23)
        I summarized the the emerging picture of the SF Asiana flight 214 crash in emails to family and friends about two weeks after the crash as follows:

       While it has disappeared from the news, I have continued to collect the details (for an essay) of the Asiana flight 214 crash at San Francisco about two weeks ago, and an interesting picture is emerging: One crash, three screw ups!

Screw up #1
        The flying pilot, who has only made a few landings in the Boeing 777, is coming in way too slowly on a visual approach, and he continues to correct vertically and laterally. There is confusion about whether the auto-throttle is on, the trainer pilot thinks they are flying a 'stabilized' approach meaning the auto-throttle is controlling speed (it's not). About 8-9 seconds out (100 to 125 feet altitude) one of the non-flying pilots first recognizes the speed is (way) too low (112 knots, 25 knots below target!) as a voice on the cockpit voice recorder can be heard saying 'more speed'. The throttles are pushed forward, but the plane's speed continues to drop activating a stall warning. The flight data recorder shows it goes as low as 103 knots at three seconds out (vs target landing speed of 137 knots) and has only increased to 106 knots at impact even though the engines have increased from idle to 50% power.

         These are the facts, but what happened? One speculation is that the flying pilot was a 'biggie' at Asiana. (His bio shows he was an experienced airbus pilot, but Boeing controls are quite different from those in an airbus.) The trainer pilot, who is the pilot in command, had never flown with him before, and this was his first flight as a trainer. He may have hesitated for a few seconds before grabbing the controls, expecting the 'biggie' trainee would react to the 'more speed' suggestion and either correct or go around. The flying pilot was new to the Boeing plane, so it makes sense that he didn't yet have the feel for how much to push the throttle forward to make a correction. Also I read an article about the frequency of go arounds that said short haul pilots typically have 1-2 go arounds a year, but a long haul pilot may only go around once every few years. So it might be that a go around goes on your record and might trigger an internal review, so pilots like to avoid it.

Screw up #2
          The evacuation of the passengers was delayed for 90 seconds even though the right engine torn from the wing is now resting against the body of the plane and is on fire! The Wall Street Journal and PBS aviation writer, ANDY PASZTOR, goes ape-shit about this, calling the 90 second delay inexplicable. He said all the aviation experts he talked to said it was obvious that in a crash of this severity an immediate evacuation was called for. To put 90 seconds in perspective to get FAA certification a fully loaded plane must be able to be fully evacuated in 90 seconds with half the exits blocked. So the plane, which is already on fire by the time the evacuation is ordered, could have been MOSTLY evacuated (only 2 of 8 slides functioned) by the time the evacuation started!

        In NTSB press conference Q&A Deborah Hersman, chairman of the NTSB, was asked specifically about the 90 second delay before evacuation ("what happened here?"), and after a little verbal dance, she did not defend the delay and was indirectly critical of the pilots.

          What the hell happened here? The available (fragmentary) evidence is that none of the three pilots comes out during the 90 seconds to check on the passengers, look for fire, look for structural damage, open a door to see if fuel is leaking, etc. The all appear to just sit there! Ok they are talking to the tower, but how many pilots does it take to talk to the tower? According to the NTSB after denying an initial request from chief flight attendant to evacuate, they only allow an evacuation when later another flight attendant comes into the cockpit to tell them she can see fire out the window. Look at the smaller attached photo. I captured this from a video (taken by someone in the terminal) showing the slides just expanding, so this is the very beginning of the evacuation, no one yet is out. Look at the black smoke that is billowing around the front of the plane. How could the pilots just sit there with smoking billowing outside their window (and very likely they could smell the fire too) and not begin an evacuation? Also look at the photo of the seats in the rear of the plane that the flight attendant over the intercom told the passengers to remain seated in! It was only luck, because it took a while for the fire to get into the cabin, that this 90 second evacuation delay didn't kill a lot of the passengers.

        It's hard to come to any other conclusion here but that the three pilots in the cockpit, who were not injured (pilot in back did break a rib), just sat there dazed, thinking only about themselves. They know they caused the crash, so they sit there moaning about the loss of their careers and coming publicity they will face and not giving a shit about the passengers.

Screw up #3
        Now we come to the SF airport firemen. They wait years, maybe a lifetime for a big crash, and this is their opportunity, so what happens? Well they apparently ASSUME that all the passengers are still in the plane, even though there is trail of debris extending 2,000 feet down the runway, including the landing gear, engines, tail rudder and stabilizer. Also there is a hole so big at the back of the plane that you can just walk though into the cabin, which is how some of the passengers exited the plane and how some of the firemen entered it.

       One, it is now confirmed by the coroner that the fireman killed a surviving Chinese girls who was lying on the ground near the plane by running over her with the fire truck "at least once" (I love that admission: 'at least once'). Two, there are several severely injured flight attendants and a passenger 2,000 feet away that were ejected when the tail came off. Some passengers have found them and are screaming and waving their arms to get the fireman's attention, but to no avail. The passengers resort to calling 911 saying that there are survivors badly injured and barely alive that have been here 20-30 minutes and no one is coming to help. Not the best day for the firemen. (update --- NTSB report says neither of the two medical buses at SF airport ever arrives at the scene, even though there were scores of severly injured people.)

Issue #4
        Is there a weakness in the Boeing 777 flight control that it didn't (effectively) warn about the low approach speed? I think the answer is yes. This has gotten zero press, but it seems to me the Boeing flight controller should have done more to warn the pilots the approach speed was very low.

Boeing to be sued (update 7/28/13)
        Story in San Jose Mercury News is a lot of the injured passengers plan to sue Boeing, so their lawyers are likely going to research and argue that the plane did not sufficiently warn of the low landing speed.

        Speed is continuously displayed (along with altitude and the tilt of the wings) on the main display in front of both pilots, so to see the speed all the pilot has to do is look at his instruments. But if the pilot is doing a visual approach, as the Asiana pilot was doing here, it means taking his eyes off the runway and looking down. The only specific warning of low speed here seems to have been the plane's stall warning (stick shaker) that went off at the very low speeds just a few seconds out. I read an airliner's target landing speed is typically 130% of stall speed, so depending on a stall warning to indicate too low a landing speed is a pretty crude. (update --- The NTSB speaks of another warning the plane gives of an impending stall. As speed dropped lower and lower, the pilot kept pulling back on the stick to increase the angle of attack, but the plane warns the pilots something is wrong by increasing the force required to move the stick. It was 40 lbs and rose as high as 80 lbs.)

        I know very little about how the Boeing flight control system works, but following up on a comment the NTSB chairman made, I can make a suggestion. She said that during the approach there is an "automated call out" of altitude (200 ft, 100 ft, etc). My suggestion is the call out should be altitude and speed. A simple change, but it might have jogged the pilots earlier into recognizing that the auto-throttle was not controlling speed as they thought, in other words they were flying an unstabilized approach, and a recognition of this fact a little earlier would almost for sure have prevented the crash by giving them a few more seconds to correct or initiate a go around. I predict that Boeing, based on this accident, will (quietly) make some improvements in pilot warnings for low speed.

screen capure from video showing two left side slides unfolding.
Note the dense black smoke coming from right engine adjacent to body of plane
prior to anyone leaving the plane, because of 90 delay starting evacuation
(source --- http://www.youtube.com/watch?v=SAi6cRI-rq0)
 

'Stay seated in your seats' the passengers were told after the plane came to a stop!
photo of rear of plane taken prior to the fire damage to the ceiling (photo from NTSB)

Timeline
        NTSB press conference released data obtained from flight data recorder (137 knots target landing speed)

            73 seconds, 1,400 feet             170 knots
            54 seconds, 1,000 feet             149 knots
            34 seconds, 500 feet                134 knots    trainor pilot realizes plane too low (3 red, 1 white)
                                                                                Flying pilot tells NTSB there was bright light, but he quickly looked away and
                                                                                was able to clearly see his instruments including the 'speed' (but this would
                                                                                not tell him that auto-throttle was not engaged, since speed at 500 feet was
                                                                                almost exactly at the target landing speed.
                                                                                NTSB says based on interviews that from 500 feet to 200 feet the pilots were
                                                                                concerned not only with being too low, but with lateral correction (lining up with runway)
                                                                               Automated 500 foot call out.
                                                                               Cockpit voice says landing check list complete. Question was asked whether the
                                                                      auto-throttle setting is on this check list, (seem like it should be) and Hersman
                                                                               said she didn't know.
            18 seconds                                                  200 feet --- automated call out
            16 seconds, 200 feet                118 knots
                                                                               plane not centered on runway and pilot trys to correct and plane still too low (4 red)
                                                                                     In NTSB interview trainor pilot says it was at 200 feet that he realized
                                                                                     that the auto-throttle was not holding speed. He reached to push the throttle
                                                                                     forward and he said, "he established a go around attitude".
              9 seconds                                                  100 feet --- automated call out and and almost immediately after this
                                                                                is the first cockpit voice comment about speed
             8 seconds, 125 feet              112 knots   (throttles started     to move forward)
                                                                               (crew member calls for more speed.  This is first mention of speed
                                                                                        on the cockpit voice recorder.)
              4 seconds                                                  (stick shaker activates --- close to stall)
              3 seconds                               103 knots    1st call for go around (engines at 50% power and increasing)
           1.5 seconds                                                  2nd call for go around (by different crew member)
                 impact                                106 knots    (landing gear and tail hits seawall and tear off)

NTSB in different press conferences using data from cockpit voice recorder on one day and and flight data recorder a different day gave numbers that around 16 seconds and 8 seconds that slighly disagree (by a second or two).

My Overview
        My main interest in accidents like this is the interaction of pilots with their flying computers, but that requires taking a close look at pilot actions. How much blame for the accident goes to the pilots, how much Boeing? What is known at this time, prior to a final NTSB accident report not expected until early summer 2014, comes mostly from several long press conferences the NTSB had every day while on site (all of which I listened to). During the latter NTSB conferences some selected data from the cockpit voice recorder and the flight data recorder and also from pilot interviews done by the NTSB was read into the public record by the NTSB chairwoman (Deborah Hersman).

        In a normal landing a decling airspeed flattens out to the target landing speed usually about 30-45 seconds from touchdown when the plane is about 1 to 1.5 miles out and at an altitude of about 500 feet. If the approach is 'stabalized', apparently the most common approach, the target landing speed is entered into the flight controller by the pilots, and the auto-throttle then flares out the speed and regulates it at the target by adjusting the engine throttle (while the pilots steers up/down and right left. In an a full manual, unstabilized approach the pilots also control the throttle.

        The problem begins on flight 214 where at about 30 seconds from touchdown (500 feet) where the target speed is reached, but there is no flare and with the engines still at idle the speed continues to decrease. One pilot later tells the NTSB he thought the auto-throttle was in control, in other words he thinks that they were flying a stabilized approach, but they aren't (unfortunately NTSB doesn's say which pilot says this). From 500 feet to 200 feet (period of about 15 seconds) the speed continues to fall and at 200 feet it is 118 knots, almost 20 knots below target landing speed of 137 knots. It was at this time (200 feet) that the flying pilot (experienced Airbus captain, but new to Boeing 777) tells NTSB he realized speed was not holding, and he reached for the throttle. On the cockpit voice recorder the 3rd pilot in the jump seat is recorded as saying (when?) more speed.

        Problem one, with speed not stabilizing at 500 feet and continuing to fall to far below the target speed, how come not one of the three pilots in the cockpit notices the speed too low and falling until they are halfway to the runway at 200 feet? It sort of looks like the flying pilot and trainor are occupied with him trying to visually line up the plane and get it on the glide slope. The 3rd pilot in back was probably thinking about what he wanted for lunch! Some, or maybe all of them, think the auto-throttles are controlling speed so a good guess is they just don't see a need to check it.

Boeing flight controller
       Here is where I fault the Boeing flight controller. Why doen't the plane either warn, or at least inform, that speed is low. An obvious way to do this is for the automated call out voice to say both alitude and speed. I have seen not a single article suggesting this or faulting Boeing for not having some sort of landing warning about speed and altitude. I don't see this is as simple. It can't be and annoyance or give false warning, but I would think just supplementing the instruments with an audio speed reading would be clean. After all why is there an audio call out for altitude?

Some Boeing airplanes have a 'low airspeed' warning
        "Following the 2009 crash landing of a Turkish Airlines Boeing 737-800 in Amsterdam -- "under very similar circumstances as Flight 214," Boeing retrofitted 400 Boeing 737s with a voice command warning of "Low Airspeed, Low Airspeed" following recommendations by the Dutch Safety Board, according to the lawsuit. The 777 that crashed at SFO apparently had no such voice warning for the three pilots who were inside the cockpit at the time of the crash." They go to point out this is a software upgrade.

        So what the hell happened in the last 16 seconds? Did the pilots really recognized the speed was far too low at 16 seconds, or was this recognition only at 8 seconds? They appears to have used most of the available time with nudges to the throttle to make a speed correction, but didn't speed correct it contineud to fall? It's hard not to point at the flying pilot's unfamilarity with the Boeing plane here. I'm sure the Boeing throttle have a completely different feet from the Airbus. For all we know in the 8 or so previous landing he had made in the Boing 777 they may have all been stabilized, he may never really have played with the Boeing throttle before. So why then did the trainor pilot, the pilot in command, not quickly take over? He says he reached for the throttles, so why then was the correction to airspeed non-existent? It's hard here not to point to the fact that this was the first time he had been a trainor, that he may have waited too long for the flying pilot to fix the speed, and by the time it became obvious that the speed wasn't being fixed, they were headed for the rocks.

90 second scandal
        WSJ aviation safety writer, ANDY PASZTOR, appearing Fri on pbs news was very critical of the 90 delay before the evacuation of the plane even got started. He said he discussed this with other aviation safety experts and they said considering the severity of the crash the delay was "inexplicable". Sullenberger said that delaying evacuation 'for some number of seconds' is reasonable to contact tower, but Sullenberger didn't explicitly defend the 90 second delay.

        From what is known of the pilots actions after the plane came to a stop, it looks inexplicable. Sullenberger and others say standard airline procedure would be to contact the tower after an accident. Ok, but there are THREE pilots in the cockpit none of whom were seriously hurt. How many pilots does it take to talk to the tower? After the two hard hits plane took and 2,000 feet slide down the airport on its belly while also doing a 360 degree air turn, you would think one or two of the pilots would immediately come out of the cockpit into the cabin to check on the passengers, talk to flight attendants, assess the damage to the cabin, check for fire, perhaps open one door to see if fuel is leaking out on the ground. If they didn't do that, and the available (fragmentary) evidence is they didn't, on what basis did they delay the evacuation for 90 seconds, denying a request for evacuation by the flight attendants?

        90 seconds is a lifetime here. For a new model plane to be certified it must pass a test for a full plane to be fully evacuated in 90 seconds with luggage blocking the asile and half the exits blocked. This plane could probably have been largely evacuated before its evacuation even began. I say largely because only two of the eight slides functioned, however some passengers got out through the hole in the tail, and there were some trapped and severly injured people in the rear of the plane where on one side the floor buckled and the seats were all askew. Obviously, a huge risk in the delay was the risk of fire, and SURPRISE(!) during the 90 seconds a substantial fire did start, in the right engine with heavy black smoke and flames licking the outside of the fuselarge. The pilots were very luckying that most of the passengers got out before the fire got into the cabin, where in spite of the several fire trucks spraying it largely destroyed the top of the fuselarge.

        There is some evidence that the pilots did not come out during the 90 second delay. Soon after the plane comes to a halt a flight attendant sitting near the cockpit goes into the cockpit to ask for permission to evacuate the plane. The pilots say wait, request denied. The flight attendant returns to the cabin and tells the passengers over the intercom to stay in their seats. PASZTOR is incredulous here, saying moaning badly injured passengers are told to stay in their seats! (Just look at the NTSB photo showing what the seats in back of the cabin looked like, there were the seats that passengers were being told to stay seated in!) There is no mention of the pilots ever talking directly to the passengers! The other piece of evidence that all three pilots probably remained in the cockpit until the evacuation started is that they don't seem to know that the right engine is on fire, a fire that can easily be seen out the right side windows. According to the NTSB what triggers the evacuation is that a flight attendant seated on the right side of the cabin sees fire out the window, and she sents a flight attendant into the cockpit to tell the pilots there is fire, and then they order the evacuation.

        However, there must be more to it that this. From photos of the 777 on the ground it appears that the cockpit windows only allow view forward, so unless there is some sort of outside camera (and it is still working!), I don't think it would not have been possible for pilots in the cockput to see the right engine that is on fire directly, but look at the photo below taken just when the slides are extending. It shows the entire front of the plane is enveloped in heavy black smoke, so how the hell could the pilots in the cockpit not know there was fire all the while they were still holding the passengers inside the plane! Are they just in a daze? All they had to do was look up and out the (right) window to see huge volumes of black smoke, and they could likely smell (and maybe hear) the fire too. If pilots had come out into the cabin and looked out the right side windows, it would have been clear where the smoke was coming from as the right engine torn from the wing and was now nestled right against the fuselage and was on fire. The first reports of the pilots being in the cabin is that it was the pilots who punctured and deflated the two slides that expanded inside the cabin.

        This whole scenario (painted by NTSB) I find has a lot of strange elements. Communication between the flight attendants and pilots is not electronic, it is all done by flight attendants who must walk forward into the cockpit. There is no mention of the pilots ever talking directly to the passengers, though the intercom in the cabin must be working because the flight attendants used it to tell the passengers to stay in their seats. The story as the NTSB tells it is that what triggers the pilots to order an evacuation is a (2nd) flight attendent coming in to tell them they see fire in the right engine looking through the windows. But the smoke is so heavy and dense around the cockpit even at the start of the evacuation that it is hard to believe that they didn't already know there was fire, if not where the fire was. Whether evacuation was ordered immediately after the flight attendent tells them about the fire or there was more delay, the NTSB didn't say. There is video footage (taken by a passenger in the terminal) showing the slides unfolding, and from this photo it can be seen that huge clouds of heavy black smoke were rising from the right engine fire before anyone got off the plane. Passengers were very lucky the 90 delay forced on them by the pilots didn't lead to a huge number of fire deaths!

        It's hard to come to any other conclusion here but that the three pilots in the cockpit, who were not injured, just sat there dazed, thinking only about themselves. They know they caused the crash, so they sit there moaning about the loss of their careers and coming publicity they will face and not giving a shit about the passengers.

SF airport firemen
        This was not the finest day for the firemen of SF airport. At first there's a comment from coroner that it appears one of the dead passengers (16 year old Chinese girl) may may have run over. A week or so (this tells you a lot about how the SF airport fire dept takes responsibility because it later came out that the fire supervisor knew within minutes that a fire truck had run over a body!) later the airport people confirmed that a fire truck did indeed run over a passenger "at least once" (the implication, I guess, is that they may have run over her going forward and then later backed over her!), but at the time it was not known if she was already dead or not. Two weeks after the accident the headlines are that the coroner says she survived the accident and that the fire truck did indeed kill her. Not the firemen's finest hour.

        I saw one story that gave a plausible explanation of how this might have happened. She was reported to be lying on the ground near the plane. How this came to be has not been explained. Did she maybe tumble out the hole in the back, or was she just injured and whoever carrier her out laid her on the ground. Anyway the story goes that about 2" of form were spayed by a fire truck and she got covered with the foam. Then another fire truck  (presumably) getting into position to fight the fire did not see her with the foam covering her and ran over her (at low speed it was reported).

(update 7/28/13)
        More has come out about the fire truck hitting the Chinese girl, and it looks even worse for the firemen.

        Lawyers for the dead girl's family say she was set on the ground by several firemen and left to fend for herself. The story in CA papers is that a supervising firemen looked at her on the ground, before she was covered with foam and hit by firetruck, and decided she was dead, so they didn't take her to the triage area, which was far from the plane. Judgements have to be made and firemen initially have to focus on the living, but this sounds very odd. The coronoer says she was not dead at that time. Why are the firemen deciding who is dead, who is to get treatment, who the doctors even get to look at?

        After the firemen having decided she was dead, she was apparently just left on the ground and later got covered with foam. The story goes that two fireman got out and drove a truck around her, prior to her being covered with foam, when they repositioned the truck to better fight the fire. She gets run over by a different fire truck that arrived on the scene late, driven by a single firewoman (identified in the article) who was out of the firehouse when the plane crashed.

(update Aug 5,13)
        The link below is a San Francisco Chronicle article has great detail on how the chinese girl came to be run over by the firetrucks, it is now reported she was run over twice! The new info comes from a helmet video that the fire supervisor wore.

        Briefly there appears to have been a horrible screw up in communication among the firemen. A truck leaving from left side of the plane (because it ran out of foam) was heading toward the girl, but spotted her and steered around her. They notified their supervisor there was a body on the ground (near left wing). But the fire chief supervising the operation, he is the guy wearing the video helmet, is never told about the body/survivor on the ground. He is told everyone is out of the plane. He calls for a second foam truck to take position near the left wing to replace the truck that left. This is the truck driving by the single woman fireman who was out of the barn at the time of the crash, and when she runs out of foam and leaves, she does not see the body/survivor and runs over it. (It's not too clear from the story below, but headline on other stories is that the girl was indeed run over twice.) The fire supervisor later comes up and sees that the tracks of the truck in the foam go right over the crushed body of the girl.

        Thus the fire supervisor knows for a fact within minutes that one of his trucks has run over a body. He doesn't of course know whether or not she was dead or alive at the time, this information comes only later from the coroner, who says she was alive until run over. It is very revealing that in the news stories the next day or two the fact that a firetruck had run over a passenger is concealed from the press!
 

        http://www.sfgate.com/bayarea/article/Video-sheds-light-on-Flight-214-passenger-s-death-4706576.php#page-2

Slides
        This crash revealed a (possible) problem with the Boeing 777 slides. Only two of the eight slides were used during the evacuation, these were the two front slides on the left. Two of the slides inflated inside the aircraft trapping and injuring the flight attendants sitting near these doors (one had her leg broken). There's no mention of the inside expanding slides affecting any of the passengers, so it must be that they only partially inflated inside. The NTSB says the flight attendants said in their interviews that the slides that inflated inside the plane inflated not when the doors were opened, but on the '2nd impact', i.e. when the plane hit the ground again after rising up and doing 360 turn in the air. The two slide that inflated inside were the front slides on the right side (1R and 2R). The NTSB did not talk about the four rear slides. This is where the most damage was, so maybe it was not possible to open these doors.

        Relistening to Debra Herseman discuss the evacuation she described the slides at doors 1L and 2L unfolding as those doors were opened 90 seconds after the plane came to a rest (29:28), then she said without giving any details that passengers also evacuated from door 3R, this would be the door just behind the wing on the right. Photos show no slide at this door, but the door looks to be only a few feet off the ground and there is pile of debris right below the door, so people might have step down and get out. Post fire photos show door 4R, which is very close the sheared off end of the plane, also open with no slide and very near ground level, but when this door was opened is unclear. Exit from door 2R was blocked by the burning engine that was right in front of the door.

        I read that slides in planes are not very reliable with a 30% failure rate!
----------------------
        One of the pilots said in his NTSB interview he thought the auto-throttles were managing speed. It seems the pilots get so used to the reliable automation in planes that it's hard to really monitor as they are supposed to. In a later press conference the NTSB said the trainer pilot told them in the interviews that his understanding was that the auto-throttle was set to 137 knots and that it was controlling the speed, in other words the trainer pilot thinks they are flying a  'stabilized' approach.

        I am bothered that the Boeing plane didn't (effectively) warn about the low speed. The backup to the flying pilot is the other two pilots, but they all should be backed up by the plane. The only warning from the plane (apparently) was the stall warning, which for a full plane at sea level is far below target landing speed. NTSB said there are a series of automated 'call outs' when landing, which I guess means a voice speaking '200 ft', '100 ft' etc. Why not say '200 ft, 118 knots', which was the case here, already 19 knots below target landing speed. If pilots had been alerted to the low speed just a few seconds earlier, a crash would have been avoided.

        WSJ aviation safety writer, ANDY PASZTOR, appearing Fri on pbs news discussed two aspects of the crash that he and other aviation safety experts consider "inexplicable". One is why three pilots didn't notice the slow speed of the plane, basic airmanship 101.  My view is that it is a combination of two things. 1) some pilots really don't know how to fly manually anymore, because they almost never fly manually, and 2) their supposed primary job of 'monitoring', which is what they do 97% of the time they are 'flying', is so boring given that the planes automation is so all encompassing and reliable, that some pilots just zonk out, and it almost never matters.

        ANDY PASZTOR's other inexplicable aspect of the crash is the 90 second delay exiting the plane, even opening the doors. Flight attendants, who had to go into the cockpit and ask (!), were told by the captain NOT to evacuate the plane, and passengers were told over the intercom to stay in their seats for a minute and a half! Why? Sure in an ideal world it might be better for rescue people to arrive first, but that needed to be traded off against the major risk of fire, not to mention badly injured people being told to stay put, not to mention that passengers might have (and did?) would open the doors on their own. Did the captains even ask about the passengers, there is no reporting that they ever did! Did they come out into the cabin to look, to see that the tail was gone, there is no reporting that they did. Pasztor says you don't exit a large jet liner with slides lightly because many people can get injured in the crush and on the slides, but this accident was so horrific all the safety experts he talked to said it was obvious that the door should have been opened immediately.

        My comment is that the pilots know they have been in a horrible crash. They should be able to figure out that the landing gear is gone, because they are closer to the ground than normal, but I doubt they can see the engines from the windows of the cockpit. It's hard not to suspect the pilots are more concerned about the end of their own flying career than the lives of the passengers! It's been widely reported that they never called the tower to report they had been in a crash, the tower called them (thought this may be a matter of a few seconds in timing).

Picture forming (Tues)
        After three days of investigation, two long NTSB press conferences, and many passenger interviews a picture is forming for what happened. The pilots believe they have set the auto-thruster to hold speed at target of 137 knots during approach (a common practice), but for some reason that auto-pilot doesn't hold speed. No yet knows if it was not set correctly or it just didn't work. (In later press conferences, NTSB said there is no hint there was any proble with the auto-throttle and engines.) From 500 ft (34 sec) to 200 ft (16 sec) the two pilots in the flying seats, trainer and flying trainee, who has never before landed a 777 at SF, are concerned with lining the plane up with the runway and getting on the correct glide path (lights show them they are low). It is only at 200 feet and 16 seconds from impact that any of the three pilots in the cockpit realizes that speed is not being held and has dropped dangerously low.

        The last 16 seconds are not clear. One report has the throttles being pushed forward at 16 sec and another at 8 sec (no info on how long it takes the engines to power up). For whatever reason the engines, which appear to be responding normally, don't significantly affect the plane's speed in the last 16 seconds. The plane's speed continues to slow until three seconds before impact (to 103 knots) and at impact speed has only increased by 3 knots (106 knots). Maybe the delay in speed has something to do with the plane also having to also adjust its angle upward. In the last 1.5 seconds the pilots make a decision to go around so the throttles are then (presumably) thrown full forward, and as the plane rotates up with engines at half power and climbing (causing a spray of water against the windows) the landing gear and the tail strike the seawall and are torn off.

        If there is a low speed warning, the NTSB has not mentioned it, nor anyone else, so there may be a hole in the Boeing flight control software. The first warning from the plane appears to be the (stick shaking) stall warning at four seconds with speed approaching close to 103 knots.

        I read Boeing has done a study of many 'unstabilized" approaches (i.e. no auto-thruster) and concluded that if at 200 feet (16-20 sec out) the plane is not already properly lined up and at the right speed, then the landing will be off, either too fast or too slow. Boeing has written this up and made it available to the airlines.

Update Wed (7/10/13)
        20 people remain in hospital, 4 with servere injuries. NTSB now says that of the four cabin attendents sitting in the rear of the plane, three were thrown out of the plane on the first impact. One has massive head injuries, another a broken leg. Two more cabin attendents were put out of action (and at least one injured) when two of the slides on the right expanded INSIDE the cabin on the 2nd impact. Other cabin attendents then had to rescue them.

        There is an unexplained 90 second delay after the plane came to a stop before the captain ordered an evacuation. Curiously no passengers has commented on this. When a cabin attendant goes into the cockpit the captain tells them NOT to evacuate, but to stay in seats. Evacuation is order by the captain only after a cabin attendent see fire outside (in right engine next to body) and sends someone from middle of plane into cockpit to tell them about the fire! NTSB is giving no explanation for the 90 second delay. 90 sec is huge, because the test for a new airplane is evacuation of a fully loaded plane with half exits blocked in 90 seconds. (Maybe there are reasons to wait for emergency people to show up, this took two minutes, but the trade off is fire, and fire did indeed start and apparently the crew in the cockpit didn't know about the fire. (In practice here the 90 sec delay did no harm as all passengers were out before the roof started burning, but this is hindsite.)

       The tantilizing tidbit at the Wed NTSB press conference is that in the last two and half minutes of the flight, the flight data recorder shows both the flight computer and auto throttle were in "multiple" modes. The implication is this is strange, but there was no further comment, except to say like all plane automation it is complicated. For example, the auto-throttle alone has five modes.

(update Thur 7/11/13) -- 5th and last NTSB on scene press conference
        NTSB says flight data recorder shows the engines, auto-thruster and auto-pilot all appear to be responding normally.

        Firefighter who entered plane at door 2 left said seats in that part of the plane look pristine, no apparent damage at all. As he walked aft there was more and more damage, a "stark" difference between the front part of the cabin and the rear part.

        The landing gear cleanly separated from the plane, as it is designed to do. Also the importantly the fuel tanks of the plane did not breech. There was no fuel fed fire. As I earlier speculated NTSB chairman seems to be saying it is important that the landing gear separate from the plane otherwise it might very well have breached the fuel tanks.

        Newly released 911 calls show uninjured passengers have wondered back toward the tail and found several severely burned people thrown from the plane, but they can't get their attention of the firemen who are all at the plane, so they call 911. One woman tells 911 we have been on the ground 20 to 30 minutes and still no ambulances for people on tramac. Seems to me the first responders here have explaining to do. Not only don't they look for people who might have been ejected at impact (there are several still alive who get no help for 20-30 min), but they (apparently) run over one them with their fire truck. A later story is that one of the two Chinese dead girls was found near the tail, but the other was found near the plane. It was the girl near the plane that had been run over by the fire truck and this is maybe what killed her.

        Final accident report will come in about 12 months.

Seats
        All the passenger seats remained in the plane says NTSB (and post crash pictures seem to show them upright). However, it appears that the three cabin attendents found injured on the runway were very likely sitting in rear jump seats that were ejected from the plane as the tail tore free (taking the galley with it). That leaves the two dead Chinese girls. What happened to them since their seats did not leave the plane? One passenger reported she saw one of the Chinese girls take off her seatbelt before the landing.

Update Tues (7/9/13)
        Bad news --- hospital says two flight 214 patients are paralyzed. 39 remain hospitalized (at seven different hospitals). I was probably right in my speculation about the 'road rash' survivors. News reports today are that two flight attendants sitting in the rear were thrown out of the plane onto the runway when the tail ripped off, but survived.

Pilots say they were depending on auto-throttle to control landing speed!
       ** A key fact has just come, probably the key to the accident. A a poster had earlier noted, it is common when a 777 is being 'manually' landed that the flight computer controls the speed (and I think the trim). Sure enough the pilots tell the NTSB that they thought the auto-throttle was controlling the speed during the approach, this probably explains why they weren't paying attention to the speed! Either the auto-pilot didn't get turn on and set right, or it malfunctioned. (Whether the plane's electronics are in good enough shape to allow such testing has not come out, but looking at the plane and with no injuries to the four captains in the cockpit, it probably is.)

        Another possibly relevant fact about pilots has also come out. Not only was the flying pilot with 8 landings still considered a 'trainee' on the 777 (apparently about 16 landings ends the trainee phase), but the copilot designated as his trainor was taking on the role of trainor for the first time on this flight.

        Fire officials at SF airport now acknowledge that one of their fire trucks may have run over one of the two teenage girls thrown from the plane. At noon on a sunny day with stuff from the plane strewn all over the place, they don't see a body as they drive up to the plane and run over it? Now there was a major screw up. If she wasn't already dead, I'm pretty sure a fire truck running over you would kill you.

Update late Mon 7/8/13)
        NTSB says the flight data recorder shows the plane speed at three seconds before impact was only 103 knots (vs 137 knot target). This is one second after the stick shaker activated indicating the plane was close to stalling. The airplane hit the ground at 106 knots with the engine power having  increased from idle 50% at impact. Part of the tail was found in the water of the bay confirming that the tail struck the seawall.

        As a crash consultant (below) notes, "When airplanes are very slow like that, even if they are not stalled, they can develop a sink rate that it takes a lot of power to arrest.”

214 flight profiles
        Found this interesting set of flight profiles for flight 214 landing in SF for day of crash and several days prior (original source unknown). Three other flight 214 SF landings show that speed decline normally flattens out to landing speed (140 to 145 knots) at an altitude of 600 to 800 feet. On the day of the crash there is no hint of the speed flattening, consistent with reports that the engines were at idle.

        The minimum speed shown here is about 116 knots, but the flight data recorder showed that in close the speed dropped to 103 knots and was at 106 knots at impact. This data is generally consisten with the values given by NTSB, except at 500 and 1,000 feet shows speed about 10 knots higher than values given by the NTSB. The data also shows the glide path was pretty normal most of the way down, while NTSB data shows it was clearly low in close.

Inexplicable 90 delay on exit
       After the plane comes to a stop, there is an inexplicable 90 second delay before door are even opened, while passengers are told to sit down and the cockpit crew talks to tower. Since 90 sec is the time a full airliner is rated to be evacuated (with half exits blocked), the entire plane could have been emptied, before it began! This is view of WSJ avaition safety writer, ANDY PASZTOR, who says has talked to a lot of safey experts about this.

         http://www.pbs.org/newshour/bb/nation/july-dec13/plane_07-12.html

(Update Mon 7/8/13)
         Information about the flying pilot background has come out, and the NYT has done more passenger interviews and put together a picture of what happened in the cabin.

Flying pilot
        The flying pilot it turns out, while he had 10,000 hours flying time, was new to the 777. He had only 43 hours in the 777, eq to about four flights, and this was his first time landing in SF. (What the hours don't tell us is how many times has he actually landed a 777.) This could tell us a lot. He might not have had the 'feel' of the throttle, when a little more power was needed near touchdown he may not have known how far to push the throttle forward.

Critical 5.5 seconds  (update ---or is it 14.5 seconds)
        What the hell happened in the cockpit in the last few seconds? Seven seconds before impact someone notices the speed is too low and says 'more speed', but the flying pilot (apparently) either doesn't react (or react properly) for a critical 5.5 seconds. This is a long time! Three seconds after the 'more speed' comment, the plane stall warning (and stick shaker) goes off, so in these three seconds there has been no (effective) speed increase. And it takes 2.5 more seconds (1.5 seconds before impact) before someone says 'go around' and the engines are gunned. This scenario is consistent with a pilot who is unfamilar with the plane and who doesn't have a feel for the throttle.

        A graphic in the NYT Mon shows the plane didn't follow a smooth glide path, it was coming in under the recommended path, near the end getting on the correct path, but apparently at that point with too little speed. Again consistent with a pilot who has no feel for control of  a 777. Since this is long haul plane with over ocean legs of 10-12 hours, a pilot with only 43 hours of flight time could hardly have landed this plane more than four times. Since he was a junior pilot, it might very well be that this was the first time he ever landed a 777. It was a clear day, a long runway, maybe this was his first chance. We will see.  A story later on Mon in NYT with info from the Korean airline says that the pilot had landed the 777 eight times before (seems high to me), that he was 'in training' and a skilled 777 pilot was sitting in the other seat.

        One of the more dramatic passenger stories is that a window passenger says when the plane tipped up and the engines came to life to go around they were so close to the water that a wall of water was thrown up on his window. (This is evidence that the engines did respond to a strong throttle command.) It was apparently the tipping up to go around while so close to the water that caused the tail to smash into the rocks. It is curious that so violent an event as the tail hitting the ground hard and being ripped off the plane was heard by some passengers in the front of the cabin as a small thump.

        (Update tues/wed) At 16 seconds (200 feet, 118 knots) at least one of the pilots realizes they are way below target landing speed. Does he understand that the auto-thruster is supposed to be holding the speed? Does he say this out loud? Seems like the pilots at that point should know something is wrong, so why do futz around for another 14.5 seconds before calling a go around?

(update Tues 7/9/13)
        Two interesting comments about the pilots show reaction to the slow speed:

        “It sounds like they let the airplane get slow and it came out from under them,” said John Cox, a former Air Line Pilots Association air crash investigator. “When airplanes are very slow like that, even if they are not stalled, they can develop a sink rate that it takes a lot of power to arrest.”

        Rory Kay, a training captain for a major airline who flies internationally, said, “We’re all wondering the same thing — why no reaction?” (from WP)

        She told of several dramatic moments during the evacuation, including putting out fires as she ushered passengers off the plane. "When Lee saw that the plane was burning, she was calm. “I was only thinking that I should put it out quickly. I didn’t have time to feel that this fire was going to hurt me,” she said."

        "Lee, 40, said she rushed into the cockpit to check if the pilots were alive, and when they said they were OK, asked if she should evacuate the flight. She was initially instructed to hold off (what?), and she made repeat announcements asking passengers to remain calm, recalled Lee, who has worked for Asiana for 18 years. “Then I heard, ‘Evacuate!’ After that, we followed our training, and began yelling ‘Emergency evacuation!’ and proceeded to evacuate the plane.”

        Near the third and last exit were many Chinese passengers, who didn’t seem to realize what was going on, she said. “They were doing other things. I yelled at them to hurry outside, ‘Go! Go! Go that way!’” she said.

        As the crew scrambled to get passengers off the plane, the evacuation slide on the first exit to the right side of the plane inflated inward, pinning a flight attendant and nearly suffocating her, Lee said. One of the pilots rushed into the cockpit to get a “crash ax” to deflate the slide.

        It was then that flames erupted around row 10 on the right side of the plane, and she heard screams from a colleague asking her to save her life. A second slide had inflated inward near the flames, pinning a flight attendant's leg. “I grabbed a knife passengers had eaten with from a cart and handed it to the co-pilot, and he punctured it,” Lee said. (A slide was deflated with a plastic lunch knife?)

        Lee then grabbed a fire extinguisher and handed it to the co-pilot who tried to put out the flame. The co-pilot evacuated with the flight attendant whose leg was pinned.  A pilot carried out a woman with a leg injury.

        USA Today story on the interview add this:

        "In some areas of the plane, however, The New York Times reports passengers had to take the lead as attendants worked elsewhere on the aircraft. Benjamin Levy, who sat in seat 30K, tells the Times he helped open one of the emergency exits and helped direct as many as three-dozen fellow passengers off the plane. "We had to help each other out," Levy tells the Times. One passenger in business class did have good things to say about Lee.

        Not one passenger interviewed mentions the crew. There were 12 cabin attendants on this plane. I expect two in the rear may have been grievously injured by being dragged on the ground, but that leaves 10 more. And did any of the four captains come out of the cockpit to help, no one mentions them. (When the plane went down in the Hudson, Sullenberger walked the plane at the end to check that everyone was out! Apparently the Korean captains, all four of them, couldn't be bothered!) It was the passengers that opened the emergency doors. It was passengers, some staying late in the smoking plane, that helped the injured get out. Where the hell was the damn cabin crew? That is their primary job, not serving dinner, it is safety! (Maybe with more passenger interviews, their actions will look better.)

        Passengers sitting in the back of the cabin talk about seeing and helping injured people, one lady with her leg crushed, one lady unconscious. The unconscious lady was gotten out by arriving fireman who entered the plane through the hole in the back.

Bogie mystery
        The (distant) video, simulations, and simple physics lead to the scenario that the plane was probably pancaked onto the ground just after it's tail catches on the rocks and is torn off. It later during the slide rises into the air a little (seen in video and many passenger comments) and pivots around, crashing hard into the ground a second time before coming to a stop. My question about this scenario is this, Why wasn't the landing gear, two huge six wheel bogies on strong supports, which of course was down at the time, driven up into the body of the plane? Unlike the engines which got torn off, the landing gear is right under the center of the plane.

        Maybe this is good engineering. It could be that the struts are designed to collapse, but I doubt it, seems to me this would cause more deaths than it would save. Are they designed to easily snap off, again hard to believe, but we can see some of the wheels at the beginning of the runway where presumably the plane pancaked down. Maybe if they are driven up, the length is short enough that it punctures only the baggage compartment. On second thought I doubt this is right. A big bay is needed in the belly to hold the landing gear so my guess is the landing gear bay is beside the luggage compartment not below it. A mystery (to me)!!

NTSB interview (Sun evening)
        Finally some data, apparently the NTSB has listened to the voice cockpit recorder. An NTSB spokesperson said a few seconds before the crash the plane was flying so slowly, "well below" the target 137 knots, so slow the stall warning stick shaker went off. 7 seconds before impact there was "call to crew members" to increase speed (other reports says this is some one in the cockpit saying this). 4 seconds before impact the stick shaker can be heard on the recording. 1.5 seconds before the crash the voice cockpit recorder shows someone in the cockpit calls for a 'go around' (landing abort). If the abort started just before impact, it would make sense that as the planes nose started to rise and engine power was applied, it would be the tail that was lowest explaining why it strikes the seawall. And it's not hard to see if the tail struck the huge stone seawall with the plane traveling at 140-150 mph it might easily get torn off.

        Then in the Huffington post article there is also this (from some consultant):

        "The plane's Pratt & Whitney engines were on idle, Hersman said. The normal procedure in the Boeing 777, a wide-body jet, would be to use the autopilot and the throttle to provide power to the engine all the way through to landing, Coffman said."

Key?
       Or maybe the two are linked... Maybe for some reasons the pilots think that the computer is controlling the throttle and airspeed, as it (apparently) usually does on landing. This would then explain why they aren't looking at the airspeed, and so don't notice the airspeed has dropped far too low as they are approaching the runway. Maybe they have forgotten (or didn't know) that the 'glide path' system at a major airport that would normally warn them of an incorrect approach is not working.

        One retired pilot looking at the damage said this is a 'no brainer', "(It) is very obvious what happened, said Mr. Herbst who flew commercial airlines for 41 years before retiring three years ago. "They landed short of the runway. They were too low for the flight path and the tail of the aircraft hit the sea wall." Some passengers report the engines surging at last minute.

(update Sun 7/7/13)
       Headline Sun is Asiana airline is blaming the pilots. Nice guys. Pilots complain that management always shifts blame from themselves to the pilots. At this point Korean investigators have probably not gotten to US yet. The plane is still sitting on the runway, no one has had time to really look it over. How do they know if the engines were responding normally? They don't.

        "For whatever reason, the pilot did not have enough power available to correct the rate of descent that brought him into contact with the ground before he wanted to be there," Jim Tilmon, an aviation expert and former airline pilot, told CNN."

        Sun evening there are simulation(s) of the landing now showing up on TV. One is incredibly sloppy. It shows the right engine ripping off and being left behind as the plane careens down the runway, but the right engine was not ripped off and left behind, it stayed with the plane ending up right next to the body! Gees! These simulations assume that the plane with its nose up hit its tail into the (huge) stone wall jutting into the bay and this knocked the tail off the plane. This does make sense, explaining how the tail got ripped off and why the (huge) horizontal and vertical stabilizers ended up near the beginning of the runway. It also fits with passengers sense and the amateur video. The tail hitting the ground would pancake the plane into the ground (sliding fast) and a few seconds into it slide the video shows it lifted up a little and pivoted around about 180 degrees as it came to a stop.

        The body strength of the 777 (about 9% composite) is impressive as the plane fuselage sliding at high speed could easily have broken in two, which would of course, have meant a lot more deaths.

        Still no sign of the left engine. One helicopter taken photo of the debris pile was marked up to show all the parts.

        A passenger tweeted that most people seemed fine and he posted a picture (below) showing people walking away from the plane some carrying their luggage! He was probably in the front of the plane. Other passengers said passengers in the back of the plane got "hammered", and hospitals are saying there are a lot of passengers with spinal damage. Two known dead and ten reported with critical injuries. One report is that two bodies were found on the runway. (They turned out to be two Chinese HS girls, part of a large group of Chinese students coming to US for summer.) Did they fall out of the tail? From pictures the tail snapped off aft of the rear door and (well) aft of the last row of seats. The fire chief at the airport says two dead and all passengers accounted for, so apparently everyone else at least made in onto an ambulance alive.

        More interviews with passengers say when the passengers were evacuating there was smoke, but not yet any flames. With the two impacts to the ground a lot of the luggage came out of the overhead bins, so it had to be tossed or climed over. Not a minor issue when there are 300 passengers to exit, with smoke, and only two slides deployed, both on the same side of the plane. No mention of how long it took for 300 people to get out with only two slides. Also no one comments on the conflict between all the injuries and how all the passengers got out (seemingly on their own), no stories of people trapped or being carried out by others. Passengers contine to say they saw five people badly injured, but there is never a comment on what there injuries are, and as yet no comment from the hospitals either.

        TV news Sun night has interviews with doctors and more passenger interviews. Two of the five most seriously injured passengers suffered 'road rash' (probably huge loss of skin and injury), the implication being they were scraped along the ground. My guess is these two injured people will turn out to be two of the cabin attendants who were in jump seats in the rear. The two dead girls are said to have been thrown out of the back of the plane when the tail snapped off. One passenger sitting near the back said when he looked toward the back from inside the plane where the gally should have been he could see the runway. TV news also mentions that the rescue crew may have run over one of the girls thrown from the plane!! (This is mentioned again in Mon NYT story and credited to the coroner looking at injuries on the body.)  There are reports that other severly injured people, besides the two dead girls, were also thrown from the plane. One passengers says he saw survivors walking back from about 500 yards away. There are also reports that several severely injured people lay on the ground for 30 minutes before ambulences got to them.

Video and simulation
       Amateur video of flight 214 landing and careening down the runway has surfaced. Taken from far away so not too much detail, but you can see the high angle of attack before the plane touches down.

         http://www.youtube.com/watch?v=EJm_4FpiKhA

        Below is a very nice simulation of the crash. It shows along not only flight 214's position and orientation, but along side a shadow plane showing where it should have been. It is billed as very accurate and as far as I can tell it is (except for all the fire after it stops). It also explains one minor mystery, what happened to the left engine. It shows the left engine tears off immediately and rolls away strongly left, where it might have even rolled off into the water. Google earth shows planes normally touch wheels about 1,000 to 1,300 feet down this runway, and from pictures it can be seen the plane ended up about 2,000 feet down the runway (off to the left).

        The simulation shows how low the plane was in the last 15-30 seconds, and consistent with the video and sketchy data releases it shows in the last 8 seconds or so the plane nosing up to go around, but not gaining any altitude. It shows something else too that is interesting. In the last 10 -15 seconds there is a clear visual reference (if the pilots looked sideways out the windows) that they are much too low and slow because they are flying alongside a pier that project out into the bay 3,000 feet.

            http://www.youtube.com/watch?v=shF_2neUyFM

Crew response
        And how did the crew (of 16!) respond after the crash. Well I see zero comments from passengers that they helped or did a good job, and from one passenger there is this:

        "Levy described the crew as “overwhelmed” by the “chaos” that erupted on board after the tail ripped off, adding that he and other passengers ended up escorting survivors off the plane to safety."

        Curiously there is almost no mention of any passengers being affected (in any way) by the fire. It is like the fire broke out after everyone was off the plane. (No, look at the photo above, while passengers are seen coming down the right slide and smoke is billowing up from the fire in the right engine. It does not appear to have spread to the body yet. This fire risk to passengers is mostly due to the idiot 90 second delay before the pilots authorized an evacuation!) Also interviews with  first responders say that then they went up the slides and to carry out four injured people there was substantial fire and smoke in the cabin at that time.

Slide performance
        One aspect of the 777 where the plane did not perform well is the slides. This is a big plane with 8 doors and 8 slides (numbered 1-4 R,L starting from front), yet only two of the slides worked properly (1L and 2L, see photo above). Ok, maybe we can give a pass to the two rear doors what were near where the tail was torn off, but what about slides 3R, 3L, never any mention of them by NTSB. The real scandal is that slides 1R and 2R expanded insidethe plane (totally unexplained), each trapping and nearly sufficating the flight attendent sitting next to that door, and no doubt badly screwing up the evacuation. (No mention as to whether the right slides were triggered when doors were opened or just went off on their own.) Photo below shows the burning engine was right outside door 2R, so it would have been unusable, and it may
'explain' why its slide expanded inside the plane.

        It might be that slides 3 and 4 didn't come out because the plane in the rear is so low to the ground. It's hard to judge the height (from picture above) of door 3L, but it looks like 4L is barely a couple of feet above ground. It was also possible to get out of the plane through the hole in the rear and some passengers went out this way. The photo below taken from the right side shows how crushed the rear of the plane was. This is where nearly all of the injuries were, and NTSB says the floor was torn up on right, rear. You can see here the you basically step out of the #4 doors onto the ground.

        NTSB says the first responders showed up about 2 min after the plane came to a stop, which would be about 30 seconds after the evacuation started.

Curious coincidence
       A previous Boeing 777 crash (Flight 38 from Beijing in London, Jan 2008) was also the plane touching down just short of the runway. This accident curiously (or not so curiously!) appears to be remarkably similar to the San Francisco accident. In London the plane stalled just as it was about to land and skidded off the runway into a field with very similar damage to the plane (see below). In the London case, like SF the plane was badly damaged, but in London no one died though there was one serious injury. A pattern? In London the pilot reported coming in for a landing moving the throttles forward, but the engine thrust did not increase. The official cause of the London accident was put down as ice in fuel system of the 777 (related to the Rolls Royce engines). Rolls Royce subsequently made changes to the engine fuel system.

        There is a Wikipedia page for the Flight 38 London accident, and it says some people are unhappy with the official explanation. They think a simultaneous loss of power in both engines is unlikely to have had a mechanical cause. They speculate it more likely to have been a problem in the plane software, in the Boeing 777 flight control system.

        Sullenberger's comments on this accident is that SF airport might turn out to be a contributing factor. Due to construction there its glide path equipment was off during the accident and will be off most of the summer. Also he notes SF airport has some difficult features since there are shifting winds, and it is surrounded by water, featureless terrain, making depth perception difficult.

64 dollar question
       I read the pilots, not the computer, would be flying the plane on final approach (I think this is right). The NYT article on Sun says the plane was coming in too slowly, so the 64 dollar question is did the flying pilot not push the throttles forward or did he push them forward and the engines did not respond!

        The black boxes and cockpit voice recorder have both been recovered and have been flown to the labs in Washington for analysis, so maybe we will get the answer pretty soon.

Precision approach path indicator (PAPI) lights
        NTSB has done a lot of talking about PAPI lights. It turns out that when landing at a major airport under visual flight rules (and with no electronic guide slope equipment) the key way a pilot knows he is on the correct glide slope is by looking at four dual color lights that are precisely aimed up at the glide path angle. If too low, the pilot sees all four lights as red, if too high he sees them as all white, if a little low he sees three red and one white, etc. The sweet spot is to fly the angle that shows two red and two white lights.

NTSB briefings
        Here is a 30 min video of the first (Sun) briefing by NTSB chairman  Deborah Hersman who is very impressive.

         http://www.youtube.com/watch?v=XLYeUbeyfOg&feature=youtu.be

        I heard one new piece of information on the video. While the glide path indicator was out, two other pieces of information are provided for the runway to help pilots stay on the glide path. One is a localizer, which was working, this provides right/left information. The second (also working) is localizer lights that have three different appearances for above, below and on the correct glide path.

        The YouTube video above has a lot of technical comments by (what appear to be) pilots. One from a poster named 767Captain says this:

        "Based solely on Prelim, this seems to be a classic un-stabilized approach that went too far. Engines at Flight Idle below 1,000 feet? Poor airmanship, poor planning. Stick shaker? Unforgiveable!!"

        New information is that examination of the rocks and debris field shows the landing gear hit the rocks first, then the tail hit. This probably answers one of my mystery questions, why wasn't the landing gear driven up into the cabin when the plane pancaked down. The answer is that the landing gear was probably ripped off and left behind before the plane hit the runway.

        She reviewed the background of the pilots. Three pilots were in the cockpit during the landing, the 4th was seated in the cabin. The flying pilot has an impressive resume and is rated in Boeing 737 and 747 with years as a captain. For the last 8 years, however, and just prior to his training on the 777 he has been flying an airbus as captain (and also airbus ground instructor). My comment is this might be relevant in that the Boeing and Airbus cockpits are so different.

         The trainor pilot (non-flying pilot) was the pilot in command. He had lots of experience in 777, but this was his first flight as a trainor and the first time he had flown with the flying pilot. (again, may be relevant, the two pilots don't know each other)

        From 500 feet to 200 feet the trainor pilot could see from the lights that they were low. He told NTSB it was at 200 feet with all four (papee) lights red (too low) and speed in cross hatched area that he realized the auto-throttle was not holding speed, and he reached to push the throttle forward, but that the flying pilot had already done so.

       Hersman (in a not so suble way) took a shot at the two non-flying pilots. She points out regardless of the auto-pilot setting or its performance monitoring of speed is one of the critical aspects of landing and the two non-flying pilots in the cockpit have a monitoring role.

      One passenger said she saw that one of the two Chinese girls killed had unbuckled her seat belt. (reported, but NTSB cannont confirm this)

Expert analysis
        From outside consultants (take with a grain of salt).

        -- "The pilot flying the plane had turned off his flight director, while the training captain had his flight director on, Hersman (NTSB) said. The flight director computes and displays the proper pitch and bank angles required in order for the aircraft to follow a selected path. In most airliners, an autothrottle will not turn on if one flight director is off and one on because it has to work in harmony with the flight directors — both need to be either on or off, Moss said. From what Deborah Hersman said, it appears very likely the pilots were confused as to what autothrottle and pitch mode the airplane was in. It’s very likely they believed the autothrottles were on when in fact they were only armed."

        -- "Most airlines would require all four pilots to be present for the landing, the time when something is most likely to go wrong."

                        -- Unstabilized approach is major cause of landing accidents
                        -- Approach should be stabilized by 500-1,000 feet. One of the criteria of stabilization is:
                                    "The thrust is stabilized, usually above idle, to maintain the target approach speed
                                               along the desired final approach path"
                      -- ** Callout criteria
                                  Non-flying pilot at stabilization height (500 - 1,000 ft) and "below" is supposed to call out if the speed is 5 knots
                                           below the target! (This clearly did not happen in flight 214. It is at 200 feet that the non-flying pilot realizes
                                           to speed is too low and at this time it is 19 knots below target!)
                    -- If the aircraft is not stabilized on the approach path in landing configuration, at the minimum stabilization height,
                              a go-around must be initiated unless the crew estimates that only small corrections are necessary to rectify minor
                              deviations from stabilized conditions

Real world of landing
        Here is an eye opening chart. While manuf and airline talk about initiating a go around if speed is <5 knots low (or >10 knots high), look (below) at a bunch of landing speed Asiana flight 214 over a few months. The final speeds are all over the place, and on May 15 an Asiana flight landed (safely) at the same speed as the one that crashed, though it was not sinking rapidly like the July 6 flight was. (However, the scaling seems to off. NTSB said the landing speed of 106 knots (122 miles per hour), whereas below shows 105 mph! Would agree if the vert axis should have been knots)

Update on pilots (7/18/13)
        Pilots have returned to Korea and are reportedly in hospital for 'psychological' reasons in advance of being interviewed by air officials in Korea. WSJ is reporting (2 or 3 days ago) they may face criminal charges related to the accident.

Update on pilot skill (7/28/13)
        Head of SF airport says the go around rate for Asiana landings at SF is 6-8 times higher than other airlines. He is concerned that their pilots are not well trained. However, the article goes on to say that only 0.5% of SF landing are Asiana and only a few months data were reviewed, so I suspect the data is thin.

Crash video and crash simulations
        There are two remarkable videos. One is an amateur video taken from a distance showing the whole landing. I have looked at the close up in bursts and I can't see the actual strike or the tail coming off.

        The second (below) is a just a few seconds embedded in this ABC news video. At about 1 min in an amateur recording from the terminal caught the two slides deploying and the first people coming off.  With no landing gear doors of the plane were not that high, so the angle of the slides is low and it looks like the first passengers off are not sliding, but running down the slides. According to the NTSB the pilots delayed the door openings and evacuation until 90 seconds after the crash.

         http://www.youtube.com/watch?v=SAi6cRI-rq0

        It's quite amazing. There are a bunch of what purport to be simulations of the Asiana flight 214 crash. They vary in quality all over the lot from one that is quite good to complete garbage.

Why did so many survive?
        Was this almost a crash with a huge loss of life? Flying magazine web site has this speculation:

        Why did so many people survive? Answer: The truth is, this was dumb luck. It’s almost certain that nearly everyone on board would have perished if the airplane had flipped onto its back after having done its mid-air 180-degree turn. If that had been the case, the slides wouldn’t have worked, the exits would likely have been blocked, and there would have been no escape.
http://www.flyingmag.com/blogs/going-direct/5-mysteries-asiana-214

Approach slope
       The distance from runway (above) was not given in video, but for 34 sec out at 134 knots it calculates to be 7,684 feet or 1.45 miles, equivalent to an 'approach slope' of 3.7 degrees. Wikipedia says a typical (flat terrain) airliner appoach slope is 3 degrees, but because of obstacles at some airports it can be steeper. It is 5.5 degrees at London City airport, but it takes special crew certification to fly this steep of a decent. On Jet Blue blog an article about radio based ILS (Instument Landing System) says its 'guide slope' antenna sits 700-1,000 feet down the runway (off to side) and is angled upward at 3 degrees 'in most cases', then the article add, "If it’s a sunny day or clear night with high visibility, the ILS isn’t really needed."

Gallery of images

(update 1/6/14)
        A USA Today Oct 2013 new story updates the story of Southwest 345. After Southwest finished their internal investigation, they fired their 13 year captain who took over control of the plane about 30 sec from touchdown (assuming reports of 400 ft altitude are right, some stories say "400 feet from the tarmac", which would make a hell of a difference!). He landed the plane on the nose wheel breaking the plane. (At 3 degree guide slope 400 ft up is 7,600 ft out and 32 sec from touchdown.)

        -- "An investigation by the National Transportation Board concluded that the captain suddenly took over from the first officer about 400 feet from the ground as the Boeing 737-700 approached LaGuardia. The jet then landed on its nose gear, which collapsed and sent the plane skidding to a stop in the grass near the runway. The NTSB said in a July 25 statement that the "evidence from video and other sources is consistent with the nose-gear making contact with the runway before the main landing gear."

        -- This was the first trip the flight crew had flown together.  (I wonder how many crashes have as a contributing factor that the captain and first officer don't know each other.)

        -- Southwest pilots told investigators the wind changed direction as the plane was landing, shifting from an 11-knot tailwind below 1,000 feet to an 11-knot headwind on the runway. Pilots consulted say this wind shift could have contributed to a nose up orientation. NTSB says plane went from 2 degrees nose-up at 32 feet off the ground (3- 4 sec from touch down) to 3 degrees nose-down seconds later (at touchdown).

        -- Plane's touchdown speed was 133 knots. It skidded about 2,100 ft for about 19 seconds.

(update 8/16/13)
        In July 2013 a second airliner crashed while landing at a major US airport, this time a nose wheel collapse while landing at Laguardia. Both crashes appear to be due to pilot error. Both occurred during the day, in good weather, and the NTSB says, based on review of the flight data and cockpit recorders, neither plane showed any signs of engine or mechanical trouble.

        As a Seattle aviation writer noted, the NTSB is acting differently in the two accidents. The NTSB had daily press conferences for nearly a week on the SF tail bang crash, but has clammed up in the case of the Laguardia nose wheel landing crash, releasing no info from flight or cockpit recorders, saying only that that the plane suddenly pitched down landing on its nose wheel, which is not designed to take that kind of stress.
---------------------
        Within weeks of an Asiana flight crash landing at SF a Southwest 737 crash landed at LaGuardia. It was far less serious with only a dozen or so people with minor injuries, still the plane skidded 2,100 feet down the runway streaming sparks when its front nose wheel collapsed. Not only did the front landing gear and front of the body sustain damage, but the nose wheel was driven up into the plane's front avionics bay where it could do a lot of electrical damage.

(Update 8/10/13)
        Two recent developments. NTST says (in effect) there was nothing wrong with nose wheel, it collapsed from 'stress overload'.

        The more interestingly development is that it was announced that the pilot took control of the plane away from the first officer who was the flying pilot very late in the approach. The change in control occurred at 400 ft altititude, which from the simulations above means they were 30 seconds or less from touchdown. Observers say a pilot switch this close to landing is very unusual, and if there is a problem this late in the approach it would normally trigger a go around. Both pilots were expeerienced, but they did not know each other, this was their first flight together.
---------------------------------
Why nose wheel collapsed
        Within days of the 7/22/13 LaGuardia crash the NTSB said the evidence, apparently from flight data recorder and video of the landing, is that the plane landed on its nose wheel. This is bad practice as the the heavy rear landing gear should always touch first and the plane should then gently rotate down onto the much smaller nose wheel. The NTSB says when the plane was 32 feet above the runway and four seconds from touchdown (134 knots) it was tilted 2 degree up, but when it hit the ground seconds later, it was tilted 3 degrees down causing the nose wheel to touch first.

Shades of Asiana 214
        It will be interesting to see if the pilots were doing a stabilized landing or not, whether this another case of pilot error or is a problem with the plane.

        There are some striking simularities between this crash and the SF Asiana crash. One is a delay in opening the doors with smoke in the cabin, how long is not yet known. Two passengers in a post crash interview said, the "worst part was the delay in opening the door when smoke was entering the cabin and making it difficult to breath." The source of the smoke here was probably the fireball seen on video as the plane scraped down the runway for almost half a mile.

        Another simularity: I only see two slides, both on right side, though it looks like the plane has (at least) 6 doors. No one in the press has commented on why only two slides. A 3rd door on the right without a slide appears to be over the wing. There are no slides on the left side. No obvious reason why not (except maybe minimizing repair costs to Southwest!!), since the plane ended up on grass between the runway and taxiway. In fact as seen in the photo below with passengers exiting there is only ONE slide opened. Other photos show the slide on the right front was later opened.

        A blog by a 'couple of aerospace enegineers' (flying professsors) is wondering whether this Southwest crash was another (like Asiana) unstabilized approach.

        At least two passengers were videoing the landing. The shock and impact of the crash can be sensed (and heard) in the video below, which observers think is this flight, though it was not identified by the YouTube poster. Not exactly a smooth landing! I count 12 seconds before the plane came to a stop. The video continues on for about 1:10+ (at least) after the sliding stops and passengers are still on the plane as there is a quick shot of passengers standing in the asles. The word smoke can be heard. At 1:37 into the video there appears to be a break or jump, followed by a shot out the window of firemen spraying.

Dangers of the slides
        Here's an interesting quote on the danger of slides from the fire chief at Logan airport. When a wheel caught on fire in a Logan landing, the firemen talked to the captain and convinced him not use the slides ("we averted a needless evacuation"), but to wait until a truck with stairs arrived. (Of course very likely there was no ongoing fire here).

       "Whenever the slides are used, he said, “At least 10 percent of the passenger load is going to be injured, some very seriously”,  Robert J. Donahue Jr., Logan airport fire chief.

        What I wonder is the source of these injuries: Is the slide rate really fast? Do people fall off the slides? Maybe ram into each other at the bottom? Maybe people not in the best of shape just tumble onto the slides and get arms and legs twisted and broken? You read almost nothing on this in the general press.

        "They're told to stay seated, a woman — presumably a member of the cabin crew — telling them: "We are not at the gate." (god, this is a stupid comment!)

        Amid growing hysteria among passengers the 90-second video cuts to a view looking outside a window as the plane is seen hosed down by fire officials.

        A woman is heard calling to "keep the doors closed" as passengers are heard coughing."

        Three weeks after the Laguardia crash landing a 3rd airliner crash lands in US. This was a UPS A300 airbus cargo plane, flight 1354 landing Wed 8/14/13, and while only two people (captain and first officer) were killed the plane, the plane ended up in pieces totally destroyed and burned, so if it had been full of passengers instead of cargo this would have been a horrific airline accident. So now in a period of about five weeks three large planes have crashed in USA all while landing.

Timeline
        This timeline comes from NTSB in its 2nd to last press conference based on a first look at the data from the two UPS black boxes. The ground impact reference is taken to be the end of cockpit voice recording, which is a little arbitrary as the flight data recorder ends a few seconds earlier. The ground impact with the plane coming in at a shallow angle may have taken a few seconds. (Look at how far and long the SF flight traveled after knocking off its tail.)

        The plane is coming in in the dark with rain and low clouds with auto-pilot and auto-throttle on. Captain is the flying pilot. He has worked for UPS for 23 years and has over 3,000 hours in the the A300. Flight was an overnight series of short hops with a long layover. It started at 9:30 pm at Rockford Il to Peroria Il and on to Louisville, Ky. Louisville is a UPS hub so plane had to be unloaded and loaded. (UPS provides rooms for pilots to sleep during this process). The final hop (1 hr) was Louisville, Ky to Birmingham arriving a little before 5 AM while still dark. The approach speed is 140 knots (normal). Time ref here is end of cockpit voice recording:

                     2 min            cleared to land on runway 18 (not the runway normally used in Birmingham by the UPS A300)
                                                     (This short runway with the hill in the approach is disliked by some pilots and can be tricky to land on)
                    16 sec            'Sink Rate' audiable warning (first of two Sink Rate warnings)
                    13 sec            copilot says 'runway in sight'
                      9 sec            sound consistent with impact (trees?)

Interpretation
        My interpretation of the autopilot and auto-throttle being on is that the computer is doing the approach, which makes sense since they are approaching blind in dark with low clouds and rain. They only sight the runway about 1.2 miles out. They get a 'Sink Rate' warning a few seconds before they break out of the clouds, but this may not have been cause for alarm as a fairly steep approach is probably needed into runway 18 due to the hill a mile away, also there is no 'Pull Up' warning which would occur if the approach angle were even steeper.

        Now here comes the disaster. As they break out of the clouds, they are only 4 seconds from hitting the trees! I bet in the dark and rain the top of the hill with the trees and a few houses was almost pitch black, so the pilots were basically screwed by the approach the computer was flying. They had little (if any) time to react. Even if the 'Sink Rate' warning alarmed them, they still had a maximum time to respond of 7 seconds. When they break out, they are only 900 feet (laterally) and 4 seconds from hitting the black trees looming straight ahead. Maybe a rapid pull up might have saved them, or maybe not. I read it takes time for the turbines in big planes to spool up.

Is this just a badly designed approach + tolerance error?
       In an airline blog I found this: there is a database entry from 1999 from a plane flying (in daytime) a guided approach to this same runway (#18, from north). Pilots were concerned, reporting that they had come very close to the top of the hill, estimating their were cars only 80-100 feet below them. Of course the trees involved here (brief glimpse of them in video) might be 30-40 ft high. Also Google Earth shows the road is depressed maybe 6-10 feet from the adjacent fields. The first reaction of other pilots familiar with this airport is that you need to manually fly this approach, in other words don't trust the automation here.

        The same airline blog reported charts gave the approach angle for #18 north at 3.28 degrees, just slightly steeper than the usual 3 degrees. This approach slope would put the plane 303 feet above the runway at one mile out [303 = (tan 3.28) x 5,280 ft], which would obviously be a problem if the height of hills here were 200 - 250 feet. (I can't find any hard data on the hill heights. The airline blog said Birmingham runway is 700+ ft above sealevel.) The neighbors living on and near the hill have apparently long been concerned with the planes flying so close overhead. The local newpaper reported a neighbor saying, "We've been trying to get the airport to buy up the rest of these houses (on the hill) for years," he said.

        This all adds up to a picture of a poorly designed automated approach to this runway. Either it should be steeper or automated landing should not be allowed. Add in a little tolerancing deviation, which can't be avoided, maybe even some tree growth, and this could be the reason the computer flew the plane through the trees and doomed the pilots and the plane.

(Earlier) picture forming (8/20/13)
        From the few facts released by NTSB and comments of pilots who land on this Birmingham runway a picture is forming. Unlike the previous two airline crashes where the pilots were doing a manual landing and (apparently) messed up, it's beginning to look like here either the pilots didn't use the planes automation correctly or maybe the code for an automated landing on this runway had a flaw. The NTSB is saying nothing appeared to be wrong with the plane mechanically, and rather than manually landing the plane as in the previous crashes, here the computers were (in effect) flying the plane and doing the approach. The NTSB says both the autopilot and auto-thruster were on until the end of the recording (or within 1 second of the end).

        I am not a pilot and don't understand fully what it means to do an approach (and landing?) with autopilot and auto-thrusher on, but it sure sounds like the plane's computers were flying the plane, and it took the plane so close to the top of the hill that the plane actually flew through the trees there. The speed (about 140 knots) seemed right and the NTSB says autopilot and auto-thruster on during an approach are not unusual. A warning heard in the cockpit of 'sink rate' was probably triggered as the ground on the far side of the hill rose up. Do planes have downward looking radar that might have triggered this?

        If the computers are flying an approach (and possibly) landing does the pilot have an active role? The autopilot I assume at a minimum would turn and line up the plane with the runway, the auto-thruster would be controlling speed, but does the pilot using the PAPI lights possible still control the vertical decent path, or does the autopilot do this too? Is this a computer landing or just a computer controlled approach with the pilots expected to take over at some point?

        The big question I guess is did the pilots misuse the automation, or was there a bug in the automation? It appears the computer code flying the plane just didn't know about the hill, like something was missing or wrong with its terrain maps. Did the pilots select or somehow set up the automation incorrectly, or was there a major bug in its flight control code?  Whose responsibility is it to input and verify the code for automated approaches/landing as various airports and runways. While I supposed this could be airbus, it's more likely. I would think. to be the responsibility of the owner of the plane, in this case UPS. Since runway 18 was rarely, if ever, used by UPS planes landing in Birmingham, it could be their code for landing on this runway was flawed and the bug had lain undiscovered. This explains why the NTSB in a matter of days borrowed a similar plane from UPS for a landing test. It certainly does not seem unreasonable that if an automated approach on this runway was approved, that the pilots used it this day, since it was dark with low clouds and rain.

        But regardless there remains the issue of why the pilots, if they had a few seconds warning from the 'sink rate' warning, didn't respond and grab the plane from the computer (they might have, NTSB was vague) and go around, especially since this was a landing in predawn darkness and they probably had the airport and sky nearly to themselves. Andy Pasztor in WSJ writes that the first of two sink warnings occured "7 seconds before initial impact", and he says this warning comes from the plane's 'collision-avoidance system', but from Wikipedia it's probably from 'ground proximity warning' system. Though there is something odd here. If the ground was closing fast (due to the hill), from Wikipedia the warning seems like it should have been 'terrain, pull up', as this means an excessive terrain closure rate. The warming 'sink rate, pull up' means an excessive decent rate, but how does this happen if the computers are flying the plane?

        If 'initial' means the tree hit, then they had some warning, but not much just 7 seconds to realized what was going on and to try and pull up (just the tiniest climb would have saved them from hitting the trees). I can't find the height of the hill, so I don't know if the altitude would have read correctly. Of course, as pros they should know the terrain of Birmingham that there are hills not too far from the Birmingham airport, so I would think a collision-avoidance 'sink' warning would almost instantly scream to them: 'hill'.

        From Google Earth and a marked up map on an Al site, this hill with the trees is just about exactly one mile from the end of north-south runway 18. At 140 knots a plane on final approach would fly this distance in about 22 seconds. From the impact zone marked on the map it looks like the plane flew maybe 1/5th (or less) of the last mile, which would mean the tree strike on the flight data recorder would have occurred about 4.5 seconds before the plane hit the ground and broke up. (This is reasonably consistent with NTSB data which has the flight data recorder cutting out maybe 5-6 sec after the intial (tree) impact and cockpit recorder in 9 seconds.)

        As I write the accident was only two days ago (8/14/13), but NTSB preliminary look at the wreckage and black boxes says they found no evidence of fire or engine problems prior to the plane hitting trees. Later the NTSB says no evidence of control problems. There was no distress call from the pilots. The cockpit voice recorder shows an audible warning 'sink rate' seconds before the crash, whether this was before or after the tree hit is not clear at this time. There's a timeline problem here because the plane hit the tops of the trees (ingesting wood and damaging the fuselage) and continued flying for xxx seconds (less than 30 sec because the trees are described as one mile from the runway) before hitting the ground and breaking up.

Autopilot on
        The NTSB is now saying something I find to be strange, that the flight data recorder is showing the autopilot and auto-throttle were engaged until either until the end (presumably the plane hitting the ground and breaking up) or 1 second before the end of the recording. To try and explain this one news story speculates: 'There might have been an error with the plane's autopilot or other navigational aids, or perhaps the pilots incorrectly programmed or understood the plane’s automated systems.'  'Pilots frequently keep autopilots and auto-throttles engaged throughout landing approaches, Mr. Sumwalt (of NTSB) said'.

        What it smells like to me is that the automated approach was OK except for the presence of the hill. One thought that pops into my head, though I have not seen this mentioned in any news story, is that the approach path being used by the autopilot was for the longer (east-west) runway in Birmingham. This was a short flight from a UPS distribution center (45 min away). I bet a UPS plane fly this route daily and always lands on the long (12,000 ft) runway that airliners this large normally used. This night the longer runway was down for maintenance. This scenario would require that the autopilot not know what runway is to be used, and thinking about it, this doesn't make a lot of sense unless it's perhaps flying down a radio guidance beam? Apparently not, 'The UPS freighter was following a so-called non-precision approach because the runway it was using didn't have a glide-slope indicator.'

        News stories are that the NTSB has borrowed a UPS airbus similar to the one that crashed and plan to fly into Birmingham airport on the same runway, probably to test how the autopilot and auto-throttle behave while landing there.

Experts comment
        Hiatt, a former Delta Airlines pilot, said he had touched down on that runway (runway 18 at Birmingham) many times himself. "It is not a full instrument landing. You have to visually fly into that runway," he said. "Sometimes it takes nuance to land there. You have to realize that hill is there or you could come in too low." Sounds like he is saying (for some reason) autopilot should not be used on this runway. This would explain why the NTSB wants to see and test what UPS landing instructions are for this runway.

NTSB site and press conferences
        The NTSB has put up a page just for this accident, and they said everything they release will go on this page

        http://www.ntsb.gov/investigations/2013/birmingham_al/birmingham_al.html

       8/17/13 (17 min) http://www.youtube.com/watch?v=-6HwSeKOWPU&feature=youtu.be
       8/16/13 (22 min) http://www.youtube.com/watch?v=Tb57DXKifpU&feature=youtu.be              (sink rate warning)

Sink rate warning
        Here is a crude graph of the FAA Sink Rate' cut in warning threshold from Wikipedia. Notice there are two possible warnings. First threshold triggers an audible warning of 'Sink Rate'. If the sink rate gets higher, maybe 20% above this threshold, the audible warning changes to 'Pull Up'. The UPS plane only got the 'Sink Rate' warning.

        The Sink Rate (ft/sec) warning threshold depends on altitude. As I eyeball this crude graph, I get the Sink Rate threshold as 20 ft/sec (@ 250 ft altitude and 28 ft/sec at 500 ft altitude. For reference a typical (flat terrain) 3 degree approach the plane at one mile out would be at 276 ft altitude (5,280/19.1) with a time to runway at 140 knots (161 mph or 236 ft/sec) of 22.3 sec (5,280 ft/236 ft/sec). This would be a decent rate of 12.4 ft/sec = (276 ft/ 22.3 sec). This fits with the graph, putting the threshold about 165% higher than a typical flat approach, and implies a warning if the approach slope (at same speed) steepens to near 5 degrees.

        I'm not sure the 'Sink Rate' warning meant much to the UPS landing. As best I can read the above curve, a Sink Rate warning might be triggered if the UPS plane was coming in at an approach angle a little below 5 degrees. This is pretty steep, but not really grossly excessive and landing on runway 18 at Birmingham with a hill (height ???) about a mile from the runway likely requires a relatively steep approach.

Calculations
        The trees are just about one mile or 5,280 feet from the runway (confirmed by Google Earth). For a typical (flat terrain) approach angle of 3 degrees a plane is dropping 1 foot in altitude for every 19.1 feet forward [arctan (1/19.1) = 3 degrees], so that implies an altitude of 276 feet at one mile out. For 4 degree slope altitude at one mile would be 368 feet. NTSB says plane was flying an approach of 140 knots, so time from trees one mile out to runway would normally be (22.4 sec = 5,280/236 ft/sec @ 140 x 1.15 mph).

Photos
        An Alabama web site had dozens of pictures of the wreckage and tree damage.

NTSB prelim report is issued (9/9/2014)
        It's about 13 months since the accident, and I just heard on the radio that the NTSB report on the accident is out and it blames the pilots ('faulty approach' and 'failure to go around'). I find this surprising, so I am going to have to read the report, maybe check the WSJ article to see what their aviation reporter has to say. A look at the NTSB site shows what is available now is only a synopsis of the report, it will be several more weeks before the full report is released.

        As I start to read the report, I am very puzzled because the pilots are criticized for flying an "unstabilized" approach". What?  I thought the early NTSB reports said the auto-throttle and auto-pilot were on, doesn't this indicate a stabilized approach? Here's the key paragraph from the press release:

        "The NTSB determined that because the first officer did not properly program the flight management computer, the autopilot was not able to capture and fly the desired flight path onto runway 18. When the flight path was not captured, the captain, without informing the first officer, changed the autopilot mode and descended at a rate that violated UPS's stabilized approach criteria once the airplane descended below 1,000 feet above the airport elevation."

        The approach they flew is described as "non-precision". They were flying a "localizer" approach to runway 18 and the pilot had been briefed on this before takeoff. This means there is "lateral guidance" from the airport (localizer) with "vertical guidance" provided by the flight management computer on the plane. (This doesn't sound like manual flying to me.)

        Here are the key vertical profile charts. It looks like the pilot is 'flying' the vertical decent by changing the computer sink rate commands. He is originally above the 3.28 degree glide path, so increases the sink rate a couple of times to -1,500 fpm. It stays at this level for a minute or so bringing him quite a ways below the glide path. As they are about to break out of the clouds (1.4 miles from the runway), there is a 'sink rate' warning (25 sec). Three seconds later the pilot lowers the sink rate to -400 fpm and calls out "got the runway" (28 sec). However, it takes a few seconds for the plane to respond, and at this point they are way below the glide path hitting the trees 1.0 mile out (33 sec). At  1 mile out they should have been (if on the glide path) about 450 feet above the runway, which would put them 250 feet above the trees on the hill, but they are really at 200 feet, so they hit the trees.)

        Seems to me the key here is what information is the plane providing about altitude vs the glide slope. The report only says the "crew did not recognize cues that the approach not set up properly." How do the pilots know that are so low, most of the decent is in the clouds. (I have yet to see anything on this in the report.) With that uncertainty it looks like they had only about 5 (runway visible) to 8 seconds (sink rate warning) to recognize the peril and to go around. I suspect it would have been tight, and if SF is any guide is they had rotated up so close to the top of the hill, they might have dragged the tail through the trees.

----------------------------------------------------------------------------------------------------------------------------------------

        The deadliest airline crash worldwide in 2013 appears to be another case of pilots not knowing how to fly a plane manually.

        Kazan pilots in a go around in early evening take over manual control of a Boeing 737. For 25 seconds they steeply climb out with engines at full thrust and landing gear extended reaching a pitch angle of 25 degrees. The flight data recorder shows the maximum angle of attack was never exceeded, but during the climb the drag of the steeply pitched wings and landing gear caused the air speed to drop from 150 knots to 125 knots. At this point (2,300 feet altitude) the pilots over-correct retracting the landing gear and throwing the plane into a steep dive that reaches 75 degrees as the plane slams into the airport grounds 20 seconds later killing all 50 people on board. I see on an avaition blog that pilots have a name for this: Somatogravic illusion.

        -- Somatogravic illusion occurs when the brain, in the absence of visual references, misinterprets the sensations caused by rapid acceleration, during a climb, as excessive pitch. This can cause pilots to react with sharp nose-down input, enough to push the aircraft into a dive at low altitude.

        -- The commander of a Boeing-737 flight that crashed in Kazan killing all 50 people on board had probably never previously made a go-around maneuver in a real flight, Aksan Giniyatullin, General Director of Tatarstan Airlines, told reporters on Tuesday.

----------------------------------------------------------------------------------------------------------------------------------------

(1/17/17) update
        Search area for flight 370 having been 100% searched, taking over two years, and nothing found the search is officially terminated. The three governments having spent 150 mil have run out of money and have had enough. A new analysis of satellite data just two month ago suggesting the search be moved 200 miles north was too late. It will not be funded. All that is known is that the plane (almost for sure) crashed in the Indian ocean. The confirmation being about 20 (small) pieces of the plane that washed ashore on the Africa's Indian ocean beaches.
-------------------------------------
        Yes, an actual news story today on flight 370. It contains some unintented comedy. The story is how somebody following the story using a satellite has detected that the search ship has recently relocated to an area 200 miles north outside the search area. Then we get this, "The Australian search team itself conceded a couple weeks ago that the identified search area “is unlikely to contain the missing aircraft.” Really? Do you suppose, maybe, that's because they searched the entire area for 27 months and the plane isn't there! The story continues: "They now think the plane is north of the original search area. But officials say without “credible evidence,” a new search won't be approved". Do you suppose that is because they spent 150 million dollars and over two years with a ship searching the ocean without finding anything in what the 'experts' figured was the most likely area? I've thought from the beginning the search area was very questionable because it depended on a raft of assumptions, many of which were little more than guesses.

(nov 2016)
        Well they finished searching the seabed in the designated area and the plane is NOT there. The search area location was dependent on a lot of assumptions about the flight path, how the plane  was configured and whether or not it was piloted.  Any one of these assumptions could be wrong, and the evidence is now saying that very likely one or more of the assumptions was wrong. 2.5 yrs of searching and still up shit's creek.

(8/28/16)
        A news reported dated 8/22/16 says 110,000 of the 120,000 aq km search area has now been searched 'without results'. If the plane is not found in the remaining 10,000 sq km, the search will be terminated. If the recent speculation that the pilot somehow hijacked his own plane and continued to fly it, then one of the assumptions built into determining the search area is undermined.

(8/5/16)
        New news is a flight simulator owned by the pilot has been found to contain routes over the Indian ocean not flown by Malaysia Air. This raises the possibility that the downing of flight 370 was a murder suicide, that the pilot flew the plane into the water.

(7/15/16)
        Reading about semiconductor companies I stumbled on the fact that Freescale Semiconductor (formerly Motorola semiconductor) based in Austin Tx with 17,000 employees lost 20 employees on flight 370.

(5/13/15 update)
        Five pieces confirmed from flight 370. including a piece of a wing, have now shown up in and around south Africa, some on islands off the coast, one piece in South Africa itself. And it is telling them nothing except that the plane did indeed go down somewhere in the Indian ocean.

(3/9/15 update)
        Well, seven months since my last update, two full years since the plane disappeared, and still no plane, . A couple more small pieces of wreckage have turned up on east coast of Africa, and the French have confirmed that at least one piece came from flight 370, so it's somewhere in the Indian Ocean. A recent article in NYT said if they don't find it in next few months the search is going to end. As of Feb 16  75% of the search area has been searched.

(8/2/15 update)
        While not confirmed yet, it looks like the first piece of the wreckage of flight 370 has finally been found. What is thought to be a piece of its wing (10 x 4 ft) has washed up on a beach in Reunion Island. Reunion Island in the indian ocean is about 400 miles east of Madagascar and 3,600 miles from Australia. A search of Reunion and nearby Mauritius beaches might turn up more stuff from the plane. The timing and location are generally consistent with the search area off the west coast of Australia where the plane is thought to have gone down. It's unlikely that this bit of wreckage will do much more than confirm that the plane is in the indian ocean and perhaps say something about the speed of the impact, which is probably not very important.

(4/16/15 update)
        Flight 370 in headlines today. Nope, plane still not found. The current 'high probability' search area is 23,000 sqmil that has been 60% searched and no plane. The governments doing the search announced today that if it's not found when the remaining 40% is searched, they will double the search area and this expanded search will probably take another year. A map on the BBC site shows the current search area along an arc and the expanded version will be a wider track the same arc. Eyeballing the map is looks like the length along the arc being searched is roughly 750 miles, so doing the math that means the current width being searched is about 30 miles [30 x 750 = 22,500], and if the plane is not found, next year they will widen the width to 60 miles.

Fire in electrical bay theory
        While looking for flight 370 updates I came across a long March 2015 article in the Daily Beast which makes a credible case that this was not a case of the pilots (or hijackers) deliberately going off course to crash six hours later in the Indian Ocean. (There was a similar article, by a pilot, in March 2014 in Wired.) The author, Clive Irving, has talked to a lot of airline technical managers and a weakness of the crazy pilot theory is that to make the plane invisible both the transponder and ACARS were turned off. Transponder turn off is easy, just a switch in cockpit, but deliberately disabling ACARS means going down a hatch in full view of the passengers to the bay below the cockpit and pulling breakers. One airline technical chief told him none of my pilots would know how to do that. But say a fire in the electrical bay started just after the last communication of the pilots with the ground, it might have taken out both systems. The turn of the plane could have been the pilots heading for a nearest airport (Langkawi) before they pass out from hypoxia (sudden or gradual depletion of oxygen inside the cabin and cockpit). He says the autopilot electronics in the electrical bay is 15 feet away. Lack of oxygen takes out the pilots and will snuff out the fire too eventually, the plane then becomes a zombie and flys on autopilot until it runs out of gas. This has been known to happen. In 2005 the pilots of Helios Airways flight 522 passed out due to lack of oxgyen and the plane flew on until it ran out of gas and crashed. (I haven't checked the details about the turn of the plane. The author argues that the early claims that the radar showed plane had soared to 40,000 ft at one point (indicating active piloting) were simply wrong, that Malaysian offiicials simply did not know how to interpret the radar data.)

        The problem with this scenario is that the plane is thought to have made three big turns. It explains pretty well the plane turn around, but if the radar is right after going over the island the plane turns NW and flys between two islands, then once into the indian ocean the plane is thought to have turned again to the south. So the key point, which I don't see in these articles, is the radar right?  Maybe it's not right. This was radar reflections from an unindentified plane. When I look at google earch, if the plane had stayed on its return course to Langkawi with the pilots passed out it would have flown over Sumarata and ended up about in the same place in the Indian ocean west of Australia. The semi-hard data that could confirm or not whether the plane turned NW to fly around Sumarata or over Sumarata is the sequence of pings. I don't know if anyone had specifically addressed this question.

         http://www.thedailybeast.com/feature2/2015/flight-370-did-not-disappear.html

(3/2/15 update)
        It's now almost one year since the plane disappeared and (surprise!) it has still not been found. Seaching for news I came across this statement: "Australian Transport Safety Bureau, says that as search teams scour the depths of the Indian Ocean for any sign of Malaysia Airlines Flight MH370, he is confident they will find the plane, if the aircraft is in the areas where they are looking." I love this statement, 'They are confident they will find it if it's in the area where they are looking'! O, yea.  And there's this: "Soucie, a former FAA accident investigator, is not optimistic that the deep-sea search teams will find what they're looking for. "I know that they've searched in the most probable areas where it would have been (7th arc), and it's not there," he said. The same article notes that 40% of the planned (7th arc) search area has been searched to date, and three ships are continuing to scan the area with towfish.

Australia issues 55 page report (update 6/25/14)
        Australia Transport Safety Bureau (official search team) has just issued a detailed 55 page report on the crash. They review all the facts of the case and are recommending a 60,000 sqkm search area for the next year. (For perspective this is x70 larger than the area searched by the deep diving robot in spring 2014, which took weeks.) Their flight path simulations, all of which are consistent with crossing times of all seven satellite arcs, actually extend over a million square km (!), but there is only money to search the central 60,000 sqkm (orange). The headlines of the concurrent news stories (passengers die of lack of oxygen) were unrelated to what was in the report.

Died from lack of oxygen?
        The headlines of the announcement news stories were that 'everyone on the plane probably died of lack of oxygen'. My take on this is that this story is little more than rank speculation, a poor fit to some of the facts. It seems to be based on one, a fact of no communication for six hours and two, a guess that that the plane may have flown straight during this time. Was this supposed to have happened when the plane flew to 45,000 feet' for 23 min? The articles are not clear on this point. The 45,000 feet climb is based on radar tracking data from early in the flight. The problems here are that plane dove down to 12,000 feet after 23 minutes up high, and when radar contact was lost the plane was not heading south but NW, so the plane had to have made (at least) one turn later. So I guess they speculate the pilots might have released the plane's pressurization at cruise altitude after putting it on a southern path. Passenger oxygen I read runs out in 15 min, pilots have an extended supply.

       The only hard facts are the 7 pings received roughly one hour apart (story until recently), that after it turned off its planned route, there was zero communication from the cockpit (none from the passengers) and the plane's transponder stopped responding soon after. There is radar tracking data for the early part of the flight that shows two turns. That's it, that all the hard facts they have. When they combine this will radar data showing the plane climbed to 45,000 feet, and one story says it stayed at the altitude for 23 min, they spin a story that IF the pilot had released cabin pressure everyone would be soon dead (oxygen flow isn't enough at such low pressure and runs out in 15 min). This they say 'explains' what they somehow intuit is a long straight flight south (at last radar contact the plane was heading NW!) over the ocean on autopilot. Certainly it's possible, but can you say speculation!

        Dipped into the report I was puzzled when read the primary search area is ON the 7th satellite arc, and also it is very narrow (93 km wide). What? Maybe I am missing something (see below), but doesn't the satellite data just indicate at a specific time it was on the 7th arc and never made contact an hour later (potential 8th arc). Don't satellite contact points an hour apart indicate the search area should be something like 500 miles wide? How can they possibly look at the plane's fuel consumption, when the don't know the altitude and speed it was flying, and conclude it must have run out of fuel just when hitting the 7th arc? A miracle? Someone on the pilot rumor network also said they are ignoring the fact that an airliner at cruise altitude can glide100 miles without fuel.

New satellite contact information
       Their current thinking that the plane likely went down ON (near) the 7th arc is based new satellite communication times and whether the ground or the plane initiated the contact. Most of the handshakes were initiated by the satellite, but the last handshake at 8:19 am was initiated by the plane itself, only 8 minutes after an 8:11 am contact initiated by the satellite. This they argue is a vital clue to define the search area for the next year, because a satellite contact initiated by a plane is unusual. One of the few things (they argue) that could have triggered it was a drop-out in power for a minute or so expected between the 2nd engine running out of fuel and while waiting for the tail emergency turbine generator (small jet engine) to spin up and stabilize. However, a footnote in the report undercuts this argument, because the emergency turbine generator doesn't have its own fuel supply, its share the fuel tank of one of the engines, so the report says it is unclear if it will ever power up and if it does probably flames out soon thereafter.

        The bottom line is that they are making all these simplifying assumption really for one purpose: to define a search area that is practical for the next year, one that can be funded and searched. It's 60,000 sq km (650 km along an arc x 93 km wide), extending along the 7th arc. This is far south (1,000 or so miles) of the last search area when underwater pings were detected.

Tucked away on p16 I find the key assumption defining the new search area

        -- The JIT additionally had more confidence that a 7th arc was a fuel exhaustion point.

        -- The aircraft satellite transmission associated with the 7th arc is ASSUMED to have been triggered by power interruptions on board the aircraft caused by fuel exhaustion. The time of this transmission is consistent with the maximum flight times expected for MH370. (Here is the key assumption. They are assuming the plane initiated a contact (7th) when it ran out of fuel and its generators shut off.  If the analysis from Boeing and the spacing of the pulses backs this up, clearly this is a significant step forward.)

New satellite ring data
        Here's the important new satellite ring data from the report. Contact between the plane and the satellite could be initiated by either, five were initiated by the ground station and two by the plane. The contact below (6th ring) at 011 was initiated by the ground station. 8 minutes later the plane it initiated contact (7th ring). The theory (guess) is that this contact was initiated when the planes engines stopped and it lost generator power. (Compare these rings to those published in March 2014 (below), and you can see they are totally different.)

    The arcs are pretty much an indication of east-west location of the plane at the marked times. From 1825 to 1841 the plane moves substantially west. 1941 and 2041 arcs are very close so for this hour the plane must be flying along these arcs (assuming it didn't double back). This is useful information because it localizes the plane about halfway through the flight. For the next four handshakes, next three hours 38 min (2141 to 0019) the arcs space out to the east, so in east-west terms the plane is flying east toward Australia.

Satellite communication log

1) handshake initiated by the aircraft                                   1825.27
-- Unanswered ground to air telephone call                         1839.52
2) handshake initiated by the ground station                         1941.00           (+ 1 hr, 16 min)
3) handshake initiated by the ground station                         2041.02           (+ 1 hr)
4) handshake initiated by the ground station                         2141.24            (+ 1 hr)
5) handshake initiated by the ground station                         2241.19            (+ 1 hr)
-- Unanswered ground to air telephone call                         2313.58
6) handshake initiated by the ground station                         0010.58           (+1 hr, 30 min)
7) handshake initiated by the aircraft                                    0019.29           (+ 8.5 min, 7th arc)
-- Aircraft did not respond to log-on interrogation from       0115.56           (+57 min)
the satellite earth ground station (failed handshake).

        But later in the report the confidence of this is undercut. Now the satellite data info is listed last with aircrast performance limitations and its turn to the south (location unknown!) are ranked higher in putting the search path ALONG the 7th arc.

-- Three factors were important in defining the search area along the 7th arc:

        * The position of the turn to the South from the previous North-West heading along the Malacca Strait
        * Aircraft performance limitations
        * Analysis of the satellite-communications data

There was uncertainty associated with each of these factors.

         http://www.atsb.gov.au/media/4911984/ae-2014-054_mh370-report.pdf

Here's a summary of the report written in an email to engineering colleagues (7/1/14):

          I read the recently issued 55 page report by the Australian search team. It is a detailed analysis of the satellite data leading to a proposed search areas for next year. It has some interesting new data which if their guess is right narrows down the search area.

         Here's the new data. Earlier the plane-satellite intercept arcs (see attached) were shown as an hour apart. The revised map (see attached) shows the spacing is not regular and two of the seven handshakes were initiated by the plane, not the satellite. One of those initiated by the plane was at 0019, its last contact and just 8 minutes after the satellite initiated contact at 0011. They argue contact by the plane to the satellite is unusual and only a few things can trigger it, one of which is a drop out in electrical power.

         They think, therefore, that the plane's 0019 contact, and its associated 7th arc, is most likely the plane signaling I have just switched to backup power since the last engine has just run out of gas. The entire search strategy for next year hinges on this assumption! They believe the plane crashed not between the satellite arcs, but ON the 7th satellite arc. The location of this arc (and all arcs) are known to 5-10 km, confirmed by using the satellite handshakes for other planes on same day over the Indian ocean to predict their flight paths, and they match up quite well with the known flight paths.

         The bad news is the 'narrowed' search area 'on' the 7th arc is still huge. Flight path simulations show the 'run out of gas' points stretch out for 3,000 km along the arc! Funding constraints limit the search area for next year to 60,000 sqkm, so they can only search the center 600 km of the arc with a rather tight constraint on width (100 km). The fight path simulations show a possible crash area of over 1,000,000 sqkm, And this depends on their interpretation of the last contact being the plane saying 'I have just run out of gas' being right. If it is wrong, then the search area is half the Indian ocean, so the plane will never be found.
                                                                                                             Don

Here is my scenario (3/27/14)
        While writing up Malaysia flight 370, I noticed something that has received almost no press. A week or so ago, when it was thought that maybe there was a fire on the plane, an aviation expert identified an island just off the west coast of malaysia, called Puala Langkawi, with a long runway and an approach over the sea that he said would be a good target to land. On the map (below) this island is right along the path between points 3 and 4 where the plane was tracked by radar. So my scenario is this:

        At point '3' on the map flying along normally, either the pilots get into a fight or someone starts knocking down the cockpit door. The pilots immediately program in a turn toward this island to land. It's the closest airport with a long runway, slightly shorter than returning to Kuala Lumpur or going on to Ho Chi Mihn City. The plane flys along on autopilot toward the island overshooting it because the bad guys by now have won the fight. By point '4' the bad guys are flying the plane, and it begins complex series of climbs and turns to avoid being detected.

        For first few days ships searched the sea below the point on the route where the plane transponder cut out. However, it turns out the ACARS system was not totally off the air, while no ACARS data was being sent, there remained a handshake (or pings) between the plane and the satellite once an hour. Those pings continued for about seven hours showing that the plane was intact for seven hours, about the time it had fuel to continue flying. But the arrival time of the pings provide data too. Pulses like this travel at the speed of light (about 1 nsec/ft) so an arrival time at a satellite gives a (loosely toleranced) circular path on earth from which the ping could have come. These circular arcs are somewhat west of the last radar location of the plane, but generally consistent with the time profile of the flight and the plane's speed and fuel load. The width of each arc is unfortunately pretty wide, looks to be maybe a couple of hundred miles on either side of the center since this satellite is very high in geosynchronous orbit, and the timing is not precise.

Cockpit voice recorder black box unlikely to be of help
       A discouraging aspect of this search is that the cockpit voice recorder black box is expected to reveal little, maybe nothing, since the recording only captures the last two hours of flight. Here the diversion (or hijacking) is known to have occurred about six hours prior to the last received ping. Whether anyone was alive or flying the plane in the last two hours is an open question, but for sure there will be no info there during the critical time the plane went off radar and changed course. The other black box, flight data recorder, has 25 hours of data, so it will show what the plane did. While this may rule out fire or other problems with the plane, this black box is unlikely to shed much light on WHY the plane did what it did if it was mechanically OK and being flown by a pilot. There's also a good chance these black boxes won't be found. Any wreckage found now will have drifted hundreds of miles from the crash site. There is only 30 days (spec) of battery life for the boxes to ping, and 12 of those 30 days are now used up, and to top it off the ocean in this region is far from land and 2-3 miles deep. Search planes from Australia take four hours to get to the search site leaving only two hours to search.

        Below is the best data I have found on the crash. The arcs are labeled with the ping time. Notice that if a simplifying assumption is made that the plane is flying straight and level and at its normal cruising speed you can roughly figure out the route of the plane (as has been done in this figure). The likely flight path line needs to be angled so that distance between arc (center) crossings matches the distance the plane would cover in one hour at its normal cruising speed. Clearly this is not very precise but still useful, because the crossing of the line with the last ping arc turns out to be consistent with the fuel load the plane carried, so this provides a center for a likely search area. However, this search area is so large, that the only possible way to search it is with satellites, looking either for an oil slick or wreckage. It was in this search area yesterday that two large floating 'things" have been seen on satellite images.

Hellava mystery
        This disappearance has everything. Not known for sure if it is an accident or hijacking, though hijacking is now suspected. No distress call from cockpit, no phone calls from passengers, no obvious motive, no one claims responsibility, two passengers (from Iran no less) traveling and allowed to board with stolen passports, a copilot (who an old photo documents) sometimes lets pretty girl passengers ride in the cockpit, a big load of flammable lithium ion batteries as cargo hole (fire risk), disclosed two weeks after the plane disappears! No apparent weather issues. Within two minutes of the last communication with traffic control, the plane's transponder goes dead (pilot could have pulled a breaker to kill it) and someone programs a change of course into the autopilot. (How the later piece of information is known I have not seen disclosed.)

        Further tracking is by military radar, which in real time raises no alarm, and later information from the military tracking dribbles out due to military secrecy. Radar tracking shows the plane soon after it turns west climbs to 45,000 feet, above its rated altitude (though the reliability of this radar report is questioned). (Speculation here is this could have been combined with depressurization of the cabin to disable or kill the passengers. I read that a pilot can depressurize the cabin. The oxygen masks will drop (trapping passengers in their seats), but passenger oxygen runs out in 15 min.) The plane later drops to 5,000 feet while traveling across land, there are a lot of eyewitnesses in northern Malaysia (or southern Thailand) seeing a low flying plane with its lights on.

        After radar contact is lost, the only hard information on the plane's location is from hourly ping contacts, which are reported to contain a plane identifier, picked up by a geosynchronous satellite over the Indian ocean. These pings only shows a loosely toleranced distance between the plane and the satellite,     which tells us only that the plane is on some arc (circle) drawn around the satellite's (projected) location. But these pings contain some HARD information. They continue until 8:11 am, indicating that for six or so hours after the plane is gone from radar, it is still intact. Also the arc paths shift every hour (at least for the last four contacts, between 5:11 am and 8:11 am) showing the plane has not landed, it is still flying. And the last ping time is consistent with the amount of fuel the plane had to fly 4,300 miles from Kuala Lumpur to Beijing. (I read this route was a milk run for Malaysian airlines, they fly it twice a day.) So the different arcs vs time show the plane was flying either north and/or east, or going south and/or east. The southern route is favored as it far out in the Indian Ocean away from radar.

Nice summary
        "There is no evidence of pilot error, pilot suicide, hijacking or any kind of terrorist event, nor is there evidence of a mechanical malfunction, fire or decompression. There is, in essence, no evidence of anything other than that the aircraft did not go to China as planned but rather flew in a zigzag fashion into the southern Indian Ocean." (DeLisi, the NTSB official, 3/29/14)

        Using this new doppler shift data the satellite engineers were able to rule out the northern flight paths. When I look at the figure below I see symmetry north and south, so I would think that travel along the northern and southern arcs would generate the same doppler shift, so how were the northern arcs rules out? Here things get a little murky, but apparently the key is that the satellite is moving too, in a figure eight with a period of a few hours. This (apparently) breaks the symmetry and allows the doppler shifts from possible north from south flight paths to be separated. The satellite people validated their analysis by looking at pings from aircraft traveling known routes in this region. Bottom line: new doppler satellite data says the flight was moving on a flight path intersecting the southern arcs.

Fire?
       An interesting point that can be seen in the figure above is that the flight path (known from radar) crosses right over (between 3 and 4) an island off the west coast of northern Malaysia called Puala Langkawi. This island has a 2.5 mile long runway with an approach over the sea. The map shows the distance from the turn at '3' is probably a little less than going back to Kuala Lampur ('1'). (I checked the Kuala Lampur airport. It is south of the city where it is fairly rural and has a runway about the same length, but its approach is over land.)

        This airport was identified earlier by an aviation expert as a (possible) target place to land if there was say a fire or disturbance on board, the over sea approach he argued was a plus. It is rather curious that the plane would sharply turn (flight controller reprogramed) and go right over what may be the closest possible landing airport. This would be perhaps be consistent with crew becoming disabled, say by toxic smoke, before reaching the airport, but does not explain the subsequent changes in direction later.

Fight?
       However, it does look (to me) like the path is consistent with some sort of struggle in the cockpit. The first thing the pilots would probably do when challenged (say someone knocking down the cockpit door) is to reprogram the plane to turn and head back for the nearest airport. I don't see any long runway airports on the east side of Malaysia on this path, nor do I see any runways on the southern tip Vietnam, so going to Ho Chi Minh City is just as far. The pilots lose the fight, the plane overshoots the airport, and by position '4' a new pilot is flying the plane.

Speed is still a guess!
        This doppler data led the premier of Malaysia a couple of days ago to 'officially' announce that the plane had crashed in the Indian ocean. This is a pretty firm conclusion since even with some (southern) flight path uncertainty there is no place that deep in the Indian ocean to land a plane. However, what is obscured in the popular reporting is that the doppler data is apparently not good enough to give a speed for the plane, it was merely used to differentiate between possible northern and southern flight paths.

        It is reported that the two flight paths below (dotted) were for assumed speeds of 450 knots (518 mph) and 400 knots (460 mph). Why so slow? An aviation expert noted that the plane at one point on radar had dropped down to 12,000 feet. If altitude is lower, an airliner can fly somewhat slower. (Flight 447 article has a plot showing the envelope of an airbus speeds vs altitude. It has roughly a triangular shape, a plane at cruising altitude has to fly fast to remain in the air because the air density is so low.) He suggested at 12,000 feet the plane might have been flying 310 knots (357 mph), and that it's fuel range here would be longer than at normal cruising altitude. A slower speed angles the flight path more eastward bringing it closer to land.

        Here is an interesting plot. It is the (corrected) ping carrier doppler frequency shift for the whole nearly eight hour flight. It makes a very strong case that the plane flew south deep into the Indian ocean. Note the time between pings varied (blue dots) with eleven pings received from the plane.
---------------
        (update 4/18/14) A Popular Mechanics editor in Slate argues the underlying assumption of the curve below have remained hidden. No one has been able to reverse engineer it, especially to come up with its northern route. Three weeks later not one piece of debris has ever been found. The only hard evidence has been the pings, which were pretty strongly identified as being from the black boxes (though as some posters noted the carrier freq was a little off) and they have now died away. Progress depends on a robot finding the wreakage, but the robot is operating at or below the limit of its 3 mile depth. He thinks all this taken together means there might be some possibility the plane did not crash in the Indian ocean, that it went north over land.
http://www.slate.com/articles/technology/future_tense/2014/04/mh370_inmarsat_the_fuzzy_math_behind_the_search_for_the_missing_airliner.html
---------------

Whoops -- Pings are located where? (4/10/14)
        While not officially announced, insiders are saying it is very likely that pings from black boxes have been picked up, and the 'ping location' is the tiny dot at the end of the 1,670 km arrow. Whoops! This is far, far north (and somewhat east) of where it had been guessed the plane came down. That guessimate, which informed the earlier Indian Ocean search, was south and far west of Perth. The earlier search areas were based on an ASSUMPTION that the plane probably flew straight, high and fast until it ran out of fuel. If in fact the plane is in ping zone, which is far north of Perth off the northern west bulge of Australia, then it is 1,000 - 1,500 mile more northerly (and more easterly) than the earlier thought. This means the earlier assumption about how the plane flew must have been wrong. Since it didn't travel nearly so deeply into the Indian ocean, it must have either flown low and slow, or it didn't fly straight.

Nothing has been found in search area (update 2/26/14)
        It's now two weeks since pings were 'supposedly' heard in a tiny area. Since the pings died away, I get the impression that the search area has been swarming with ships and planes, plus an underwater submersible has been doing a search pattern for over a week. It has seen nothing. Don't remember the original ping search area, but I thought it started out quite small, something like 20 miles square. A recent article describes the current search area as almost 300 miles square (80,000 sq miles). If I am remembering right, this means over the last two weeks it has been hugely increased (by two orders of magnitude).

        What I find remarkable, and may be very telling, is that with all the assets in the search area not one single piece of physical evidence has ever been found, not one scrap of debris, no oil slick, no nothing.

        It's beginning to smell like this may be another wild goose chase. Everything hinges on 'pings', the only piece of hard evidence. Were they real, from the plane?  As far as I know, it has never been revealed how this ping search area was located in the first place. Nor do I see anything anymore on how certain the experts are that the pings were real. At the time multiple experts were saying (off the record) they were nearly positive that the pings were from the black boxes. The carrier frequency was 10% off, but hell the argument was reflections do strange things to sound, though changing a carrier frequency seems to me to be very unlikely. Problem is no raw data seems to have been released. Just what does one of these pings look like, how embedded in noise is it, how many cycles are there?

Ping waveforms
        Wait, there is on YouTube what looks like the actual ping sounds recorded by Sky News. This looks like the real deal to me, includes pictures of the hydrophone being lowered into the water, and there is sophistacated processing of the ping sound.

        -- "The frequency of the sound detected from the ship was 33 kilohertz, which is below the 37.5 kilohertz the pingers are designed to emit, Gibson said. A failing battery or damage to the unit may cause a frequency shift, Anish Patel, president of Dukane Seacom, a unit of Hollywood, Florida-based Heico Corp. (HEI) and the maker of the pinger, said in an interview."
http://www.bloomberg.com/news/2014-04-07/hearing-pingers-is-one-thing-finding-them-may-be-another.html

        -- I found the spec of the black box pinger at the web site of the company who above who manufactured it. Carrier spec is 37.5 Khz +/- 1 khz, so a 33 khz signal is out of spec. The minimum pulse width is 9 msec, which would be over 300 carrier cycles each ping, so the frequency should be accurately measurable, which is consistent with what I think is a narrow frequency spike in the green waveform below. The pinger + 30 day battery weigh only 7 oz. That shows you how much emphasis airline people put on safety!
Dukane Seacom pinger spec: http://www.radiantpowercorp.com/dk-series-underwater-locator-beacons.aspx

                    1) Were the several ping recording in the same area, or were they far apart?
                               OK, report here is four ping recording were within 17 miles of each other. This is encouraging.
         http://www.cnn.com/interactive/2014/03/world/malaysia-flight-map/

                    2) Why the hell if the pings are real and close together has the search area been moving every day since. It is has been reported to be
                             be 80,000 sq miles (about 300 miles square) recently? Is this based on ocean currents?

SkyNews ping sounds:   https://www.youtube.com/watch?v=el61KlF-NWs

Another possible source for the pings (update 5/13/14)
        Poking around the pilot rumor site for new ideas I found a very interesting discussion about another possible source for the pings. Turns out that acoustic pingers like this have been used for years to track large sea creatures (whales, turtles, etc). They are also used on nets. Some of them reportedly ping about once a second, use carriers in the 30-40 khz range, with pulse length of 10 msec. The pilot site pointed to the article below in Malaysian Insider, but what makes this all very credible to me is this quote, which if it is REAL could be very important.

        "Dr David Gallo, a senior scientist at Woods Hole and co-director of the successful search for the wreckage of AF447, wrote in an email to me (author of paper below): “I don't know any underwater acoustic people that think the pings have anything to do with the plane.”

         www.seaturtle.org/tracking (not responding)

I checked the Woods Hole site and there is no doubt that David Gallo works there and has excellent credentials. Here's his Woods Hole bio

Dr David Gallo, a senior scientist at Woods Hole (bio from Woods Hole site)
        Director of Special Projects at Woods Hole Oceanographic Institution, Dr. Gallo was one of the first scientists to use robots and deep submersibles to map deep-sea mountain ranges and continues to help develop new undersea technologies. Most recently, he was co-expedition leader on a mapping mission to the RMS Titanic's wreck site. He is passionate about communicating ocean science to the public and has done so on television, in classrooms, and in boardrooms around the world.

        The main stream press is now reporting that a new team of ping experts has ruled out, or is downgrading two of the four pings from the same area. A captain of one of the research vessels is quoted as saying we are positive the pings are man-made, but we are not positive they come from the plane's black boxes.

        Indirectly the search team is indicating they don't have faith in the ping data. If they believed the pings were from the plane, they obviously would be getting better, deeper diving robots to search the same general area where the pings were detected. But without explanation this not what is happening. Today the announcement is that the sea floor search is to be expanded to 60,000 square miles, equivalent to a rectangular 250 miles on a side, a search to take months and cost millions. Why the hell do this if the pings are from the plane?

Hard data falling apart?
        This is all very significant, because the pings were the only (supposedly) hard data indicating the location of the plane, and there are now many lines of evidence that seem to indicate its credibility is fading away.
------------------

Bluefin-21 underwater vehicle
       The news reports don't describe the capabilities of the Bluefin (of course), so I searched it out. Turns out this thing is made locally, by Bluefin Robotics in Quincy! It's a tube 16 ft long and 21 in in dia. It doesn't have a camera. It searches with side scan sonar: 100 Khz to 800 Khz made by EdgeTech. With processing some pretty high quality images (see below) can be obtained from its side scan sonar data.

        The only detail spec on their site for Bluefin 21 is on a customized version for US Navy in shallow water. It can travel for 18 hours @ 3 knots, which would be a search path about 60 miles long. When I work backward from the 15 sq miles it is reported in can search in a day, I find it would take (best case) four passes to cover one sq mile, which means the radar can look out about 600 feet to each side. The is generally consistent with the spec: 7.5 cm resolution out to 75 meter and range to 150 meter (500 feet) with lower resolution. Obviously here since a huge object is being searched for resolution is being traded off for max range.

Bluefin-21 sonar side scan image (not flight 370)
(from Bluefin web site)

        Latest aviation puzzle is a private one engine plane that flew for hours with all aboard incapacitated or dead, beginning in western NY heading for Florida, overflying Cuba and crashing 14 miles off the coast of Jamaica in deep water when it ran out of fuel. A lot is known about this case. The pilot first radioed he had a problem at 10:04 am, about 1.3 hr into the flight ('incorrect indication in the plane'), and said he needed to descend to 18,000 feet. Asked if he wanted to declare an emergency, which would have raised the priority of his request, he said no. The air traffic controller approved a decent to 25,000 feet and a few minutes later instructed left turn (to avoid traffic below) and a decent to 20,000 feet. The first decent to 25,000 feet was made as was the left turn, but the plane stayed at 25,000 feet and the pilot became unresponsive.

        Two jets were sent up (10:40 am) and one of the pilots got a good look into the cockpit. He reported the pilot was slumped over. He got so close that he could see the slumped pilot's chest going up and down (I heard the jet pilot's recording) so at this point in the flight the pilot was still alive and breathing. Jet pilots radioed to them to put their oxygen masks on. What time exactly the pilot was seen still breathing has not come out, but was probably somewhere around 11:00 to 11:30 am since ABC news reports the jets were scrambled at 10:40 am. The windows were beginning to frost up, which I read is an indication of loss of cabin pressure. The plane was flying at 25k at this time.

        There are more puzzling aspects to this case. There were two on board, a (rich) married couple, Larry Glazer and wife Jane, both 68, who own and manage 60 buildings in Rochester NY. This was their company plane and both of them are experienced licensed pilots, so there were two pilots aboard this plane. (Not clear at this point who was the pilot, though some reports say Mr. Glazer.) The french made Socata TBM-700 plane was nearly new.

        First reports are the plane was at 28k altitude when the pilot requested 18k. The air controller approved a drop to 25k and the plane responded, when later the air controller approved a left turn and a decent to 20k, the turn was made but the plane (apparently) stayed at 25k and flew on. There were no more communications from the plane. Wikipedia says this plane has a service ceiling of 31k and cruise speed of 290 mph (252 kts).

        -- Forum poster:  "By the way, the pilot (here) he had right to make emergency descend without even asking anybody for permission if he felt he was in dire situation".

        -- This one engine, high performance plane, which can cruise at high speed (290 mph), is described as being a 'turboprop'. I didn't know what a 'turboprop' was, so off to Wikipedia. Turns out a turboprop plane is powered by a (rotating) turbine engine. The turbine's rotating axis is mechanically geared down and connected to the propeller with nearly all the power of the flowing gases extracted to run the propeller. The propeller of a turboprop is described as fixed speed with a variable blade pitch. A turbine is more reliable than a piston engine and has good efficiency too, so many commuter type propeller planes (and some military planes too) are turboprops.

        -- Youtube videos show people in a low pressure chamber simulating 25,000 feet pass out or become unaware of the danger (they don't put mask back on) in just 2 to 5 minutes. National Geographic describes 25,000 feet and above as the death zone. At 29,000 feet oxygen is 1/3rd normal and at 18,000 feet 1/2 normal. Unpressurized planes fly to 10,000 feet. Wikipedia has a page on 'Time of useful consciousness', and it shows 20-30 min of useful consciousness at 18,000 feet, 3-6 min at 25,000 feet and 2.5 to 3 min at 28,000 feet. These times fit with what is known of the pilot's response. It also shows that a decent to 18,000 feet was not enough if the plane has lost all cabin pressure.

        -- ABC video (below) is well done with timeline and audio recordings of both Glazer speaking to ground control and a jet pilot who reports seeing him breathing (probably around 11:00 am as the jets were scrambled at 10:40 am). This doesn't mean he's OK or could recover, by breathing the thin air of 25,000 feet for nearly an hour he may very well have suffered permanent brain damage at this point from lack of oxygen.

         http://abcnews.go.com/WNT/video/mystery-sky-runaway-plane-pilot-appearing-unconscious-25303119

--------------------------------------------------------------------------------------------------------------------------------------------------------------------

        Japanese accident investigators today issued final report on a 2011 incident. The only pilot in the cockpit while flying at cruise altitude mistakenly turned a wrong knob, thinking he was opening the locked cockpit door, that screwed up the rudder position. This inducing a steep dive with one (or two) huge rolls that nearly inverted the plane, over stressed the airframe and was on the edge of causing a high speed stall. I had not heard of this incident (no crash, only two flight attendants with minor injuries) until I saw a small article by Andy Pasztor in the Wall Street Journal. What's interesting here is three things: odd way this incident was triggered, another case where a pilot with minimal training didn't do the right thing when faced with a high speed stall, and on the positive side, how the Boeing plane was able to recover from extreme conditions for an airliner that even exceeding Boeing's stress limit for the plane, yet with no damage and normal flight resumed.

        There was one pilot in the cockpit, co-pilot, the pilot having left to take a pee. The plane is cruising at 41,000 feet at night and when the captain returns from the toilet and signals the copilot to open the door. The copilot, relatively unfamiliar with this plane, in trying to unlock the door has in fact turned the wrong knob. What he has done is dialed an offset into the rudder, which send the plane into a steep dive. The dive angle reaching 35 degrees with one (or two) huge rolls. When an airliner is turning in normal flight, the maximum role never more than 30 degrees. This plane rolled to 132 degrees! Pretty damn close to inverted. During the incident the angle of attack rose so high the plane was close to stalling and the stick shaker was activated. The dive angle at one point is 35 degrees. The co-pilot relatively soon realizes what he has done and for a minute and a half he struggles (manually) trying to level out the plane working (with or against) the ON auto-pilot that before it withdraws.

        The copilot had mostly flown the 737-500. The report gives the following explanation about how he turned the rudder knob while thinking he was just activating a switch to unlock the cockpit door. The door lock of the Boeing 737-500 is similar to the rudder trim control of the 737-700 (this aircraft) in "placement, shape, size and operability" (Really?  Boeing has two switches that look alike, in the same spot, and on some 737s it opens the cockpit door and in other 737s it is the rudder trim control? If true, this sounds like a big screwup by Boeing. (Pasztor makes no mention of the Boeing design aspects in his article.)

        Well it's not true! Check out the pictures from report below showing the switches. This statement in the report about placement and shape, etc is just not true. (Smells of providing an excuse.)

        The plane's motion was very complicated with the rudder offset, the autopilot correcting and later the pilot making inputs. The plane rolled left 131.7 degrees and reached a downward pitch of 35 degrees. All the time stick shaker is going on/off intermittently. The dive increased the plane's speed and when it t leveled out, it was not flying at .828 speed of sound, but 0.82 is the plane's maximum speed, so it was in an overspeed condition. During this dive and roll the plane pulled 2.5g, which pined flight attendants an dropped the standing captain to the floor. All this took about 1.5 minutes as the plane dropped from 41,000 feet to 35,000 feet. During the dive bank angle alert and over-speed warnings were sounded audibly, which the captain heard from outside. The forces on the standing pilot outside the door pushed him to the floor. At this point the captain got back in (curiously he was able to open the door from the outside says the report!), and took over control of the airplane, resetting the autopilot. The copilot by this time had realized what he had done (offsetting the rudder) and had pretty much recovered, and he told this to the pilot as he sat down.

       Apparently it is quite unusual in a short haul 737 for one of the two pilots to leave the cockpit. The copilot has been left alone only once or twice in a year. The flying co-pilot, now alone in the cockpit, was supposed to put on his oxygen mask since the plane was above 25,000 feet, but he didn't do it. He later said that only once had he flown with an oxygen mask on.

        The reports main conclusion is that (clearly startled) copilot had never received any training on what to do for an upset and stall at cruise. The autopilot and auto throttle do all the fly up high and training is all about teaching the pilots to use this automation. From interviews the copilot apparently realized in a few seconds when he could see in a camera that the pilot was standing outside the door, but could not open it, that that he had had probably turned the wrong knob, and suspected  he might have turned the rudder trim offset knob (both knobs need to be depressed and rotated). If he had turned the rudder offset, he knew it would bank the plane, and when he saw the plane was banking he grasped the wheel to correct the bank. It appears that the copilot did pretty much regain control, leveling the wings and correcting the rudder trim, prior to the captain returning.

        Curiously the copilot claims he doesn't remember most of the warnings (what the stick shaker went off?), and most puzzling he claims he experienced no g effects, this while the captain and flight attendants were driven to the floor. Surprisingly not only were none of the 117 passengers, who were all in their seats, not injured, they all remained calm. They experienced brief violent shaking and 2.5 g and still remained calm? The explanation must be these passengers are Japanese!
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

(3/17/15) A BBC article today reports the AirAsia body search has been officially ended with 106 bodies found and 56 bodies missing. Two more bodies showed up in March 1,000 km from the plane. The article also contains this tantalizing titbit: "The plane's two "black box" flight recorders were also found. They revealed several alarms were "screaming", drowning out the sound of the pilots' voices." What? If this is true, it points out a very bad flaw in the location of the microphone in the airbus.

      (2/28/15) Two full months after the crash and a month after it was located the fuselage of the plane has been recovered and no more bodies were found inside. The bozo owner of Air Asia had told relative recovery of bodies was #1 priority weeks ago. Now there's a worthless statement, because 60 bodies, about 1/3rd of all the people on the plane, are still missing, apparently washed away by the ocean tides. I think I remember reading a few bones of someone on the plane washed up 600 miles away, so that's probably what's going to be happening for the next few years. WSJ says authorities are thinking of calling off the search for more bodies.

      (2/7/15) This must be one of the slowest, and incompetent, airline recovery missions of all time. The cockpit of the airliner broke off in the crash but came to rest a mere (reported) 20m from the fuselage. The divers have been cofutzing around with the fuselage for what two weeks or so, trying to raise it, recovering a body or two from inside. Finally the headline today is that the two pilots have been found. Guess where, inside the cockpit ands still strapped in their seats! One has been recovered, they will go after the other tomorrow.. A few days ago after weeks of saying they thought most bodies were inside the fuselage the military which was running the recovery picked up their marbles and went home, saying they couldn't recover the fuselage, even though weeks ago they had it near the surface. And as they left they said there aren't any bodies inside. How do they know (or don't know)? This of course is never reported. What is known is that more than a third of the passengers, about 60 bodies, are still missing. It is now more than five weeks since the crash in waters only 100 feet deep easily reachable by divers. I guess the billionaire's owner of AirAsia telling the families that recovery of the bodies was priority #1 was just a little joke. If he is doing anything to fund the recovery effort, it never gets reported.

    (2/3/15) Not only is the fuselage still on the bottom, but it was the Indonesian Navy that had been trying to lift it and they have given up and left. And when they withdrew they reportedly said this, there is "no indication that victims remained inside the main body of the Airbus  A320". Really! This can only mean the fuselage is totally smashed open and/or all the seats have been torn away. How come it took weeks for anyone to notice this? Over 70 bodies are still missing.

        Investigators are now saying there is no evidence (yet) that the pilot was out of his seat and pulled a circuit breaker. The earlier report came from Reuters who had seen the preliminary report and found circuit breaker on a list of items to investigate, but there were 30-40 items on the list, so at this point the circuit breaker pull is unconfirmed.

      (2/2/15) The fuselage is still on the bottom and 78 bodies are still missing, but NBC News reassures us the Indonesians are still looking. Gee, do you think they might still be in the fuselage? Today's news is that 2 bodies were actually pulled from the fuselage and five more were found on the ocean bottom nearby. No new tape leaks. However, posters are focusing on the leaked comment that when the plane initially turned left it 'wobbled'. This they suspect is a 'pilot in the loop' oscillation as the plane had probably dropped into Alternate Law. One poster noted there is a huge change in roll sensitivity of the stick at high altitude, and this is something 99.9% of pilot have never experienced, because, of course, the computer always flys the plane in cruise.

Flight Augmentation Computer
        There are two of these computers on an airbus, one backs up the other. It does flight envelope protection (min/max speed computation, alpha floor protection), controls yaw (rudder trim), windshear detection and low energy warning. If it is reset with reset button, the fight envelope protections remain in place. Several posters have noted it is not allowed to power this computer down in flight. You do this only if smoke is coming out!

Big Picture
        It is now what about five weeks since the plane disappeared off radar. The idiot billionaire owner of AirAsia said early on that recovering passenger bodies was to be  #1 priority, which turns out to be total BS. The plane goes down in 100 feet of water, fairly near land, not far from where it disappeared off radar, the black box pingers are working allowing them to be searched out by hydrophones and the rest of the plane is not far away sitting on the bottom. In spite of all this it takes weeks to locate the plane, and the only part of the plane that has been pulled off the ocean floor is the tail, the fuselage and cockpit remain on the bottom, presumably with about half of the passengers still inside. (One article noted that the faces of the passengers have all been eaten off by sea creatures at this point.)

        The big news leak for today is the tapes show why the copilot was manually flying the plane. There apparently had been intermittent (spurious?) warning from an aux computer (flight augmentation computer). Just before the crash the pilot got out of his seat and pulled circuit breakers shutting down what some reports say is the entire flight control system hoping to reset it. If so, whether shutting down the entire flight control system was by design or by accident was by design or by accident remains to be see. Cox, a former airbus pilot and consultant to the TV news, says in a highly automated plane like the airbus you don't do things like this in flight. Posters on the pilot rumour network not that both pilots at the time should have been strapped into their seats since the plane was just entering a zone of big thunder storms. No word on why the flying copilot then began a steep climb, so steep that Cox says the passengers would have been pulling two gs (really?). Maybe the captain only thought the aux computer was going to be powered down, so the copilot was surprised when he had manually control. If so, then this case gets still closer to flight 447. Maybe with the system going through a partial reset he didn't have control. Who knows!

        Airbus pilots say the Flight Augmentation Computer has a 'reset' button, so observers are very puzzled as to why the pilot was doing something so extreme as powering it down, should be done only in an absolute emergency one airbus pilot noted, especially as the plane was entering a zone of big thunder storms so the pilot had to get out of his seat to reach the panel with the circuit breakers.  However, a posting on the pilot rumour network shows that resetting of the airbus autmentation computers, which had shutdown autothrottle and dropped into alternate law, was done sucessfully in a flight out of Denver.

     (1/29/15)  Finally some information from the black boxes has leaked out. As the plane began to asend (32,000 => 37,400 ft in 30 sec) the stall warning came on, and it stayed on until the end.  It WAS a high speed stall triggered by a climb! The french copilot (with 2,275 hr) was flying the plane as it began to get into trouble and reports are it climbed because he pulled his stick back, but sometime during the climb and stall the pilot took over. The plane is thought to have gone into a spiral decent. The copilot response was exactly the opposite of the new Airbus procedure to get out of a high speed stall, which is to put the nose down (using rudder) and lose altitude to reduce the angle of attack, only then is power slowly applied to pull out of the dive. The investigators are saying the plane was fine, which people are interpreting as no icing of the pitot tubes. The fuselage is still on the bottom and 90 bodies are still missing.

(1/29/15 email overview)
        Here's an off the wall story. Information from the black boxes of the AirAsia Airbus that crashed a month ago into the ocean shows it was being flown by the co-pilot, who had relatively little experience flying the airbus. This guy is reported to have left his job as an engineer at Total to train to become a pilot.

        The boxes show that as this guy turned (probably to avoid storm clouds) he pulled the stick back causing a steep climb that slowed the plane triggering a high speed stall. The recommended Airbus procedure to get out of a high speed stall is to put the nose down and dive, this idiot did exactly the opposite. At some point the pilot took over, but the plane got into a downward spiral with cockpit voice recorder capturing  "stall, stall" all the way down.

        For the co-pilot to have been able to stall an Airbus somehow all the plane anti-stall protections must have been shut down. No info on how or why this happened. Looks like another case of pilots, who virtually never fly airliners during the cruise part of a flight (computer flys in cruise) being unable to do so in an emergency. More proof that a lot of pilots don't really know how to fly anymore. If the autopilot shuts off in cruise, your life is at risk.
                                                                                                   Don

      (1/21/15) Fuselage still on the bottom and no bodies recovered from it. Officials using radar data (unclear if this is confirmed by the flight data recorder) are saying today the plane after making the approved left turn climbed from 32.000 to 37,600 feet in 54 sec, a sustained, average climb rate of over 6,000 ft/min, far in excess of the 1,000 to 2,000 ft/min that airlines are rated for. 6,000 ft/min is more like what jet fighters can do. (Also they had no permission to climb!) With such a huge climb rate, the plane, of course, lost a lot of speed and it stalled! It then began to fall at a rate of about 8,000 ft/min, which if sustained, means it would take 4-5 minutes to fall out of the sky. This is 4-5 minutes that the pilots would have to get the nose down and lower the angle of attack, which is the new recommended Airbus way to exit a high speed stall. The reporting says the plane disappeared from radar at 24,000 feet. Why? No explanation is given as to why it disappeared. Preliminary looks at the wreckage do not seem to show a breakup in midair.

        The 6,000 ft/min is so far out of the airbus rated performance envelope that if the computer was in control it would not have been allowed regardless of what the pilots did. Therefore it's a good guess that for some reason (frozen pitot tubes?) the pilots were suddenly forced to begin manually flying the plane. It's beginning to look more and more like the Air France flight 447's high speed stall and crash into the Atlantic!

       (1/20/15) At sea little has changed in last 2-3 days. Fuselage is still on the bottom, and no bodies from it have been recovered. CNN showing video of the fuselage says it's about 100 feet long, which since the Airbus A320 spec length is only 124 feet and the tail is gone (and maybe the cockpit too), this single piece of wreckage must be virtually the entire passenger compartment. Investigators have revealed a little about what's on the cockpit voice recorder, saying they hear no strange voices or gunshots, so conclude no terrorism.

        (1/17/15) Coming back from a few days vacation (in NYC) I find the body of the plane has been definitely found as confirmed by photos taken from a submersible. The news reports are it was found on Wed (1/14/15), so the earlier reported sonar locations were apparently all BS. However, divers have still not been inside the plane and hence no bodies from inside have been recovered. This in spite of the president of Air Asia saying weeks ago that recovering bodies was the number one priority. The body of the plane with a wing attached was found 3 km from the tail. Divers going down near the body think the cockpit and an engine may also be nearby. The plan now is to use balloons to raise the plane to get access to the bodies. Data has been successfully recovered from both of the black boxes.

        (1/13/15) Both black boxes have now been recovered, one of them reportedly found under a wing, but the body of the plane still has not been found or has it?. The BBC today: "Forty-eight bodies have been recovered so far, but most of the victims are believed to still be inside the fuselage, which has not been found." What about the sonar images of last week thought to show the fuselage of the plane? Well that just goes unmentioned. Two days ago Reuters and others headlined that the fuselage of the plane was thought to have been found. This is (apparently) based on new sonar scans. Curiously there is never any mention of the how far away from the recoved tail is the (supposed) fuselage.

        (1/11/15) Same story -- "Another day and though they can hear the black boxes pinging, and the water is only 100 feet deep, and the boxes are painted bright orange the divers can't find them. "They have raised the tail and the black boxes are not in it. Everyone hedges about whether the pings they are hearing are even from the boxes. It's been about a week and still no visual confirmation that the sonar images are the body of the plane. I find this mind boggling. The press stories never explain what the issue is here. There are supposedly dozens of ships and a huge bunch of divers out there, so how come no one has gone down to look at the sonar location? The sea is only 100 feet deep.

        Late this same day the headlines are that the black boxes have been found, but the story has a weird twist. The boxes are about 1 km (other articles say 1.5 miles, still others 2 miles) from the tail, but they have not been recovered because they are reported to be under a large piece of debris from the plane, which is thought to be a wing and/or parts of the engine. Think about this. The black boxes are in the tail and the get torn loose, presumably when the plane breaks up, and they travel 1 km from the tail and a wing falls on them! Give me break... This crazy story is reported without comment..

         (1/9/15) Another day and though they can hear the black boxes pinging, and the water is only 100 feet deep, and the boxes are painted bright orange the divers can't find them. The pings are coming a half mile from the tail. How the boxes got out of the tail is unexplained. The tail hasn't been raised either though floats have been put under it. Another day and still no one has gone down to check on the sonar images they think is the body of the plane. How hard can it be to see a plane in 100 feet of water when you supposedly have (GPS linked) sonar images of it?

         (1/8/15) It's now Thur and some progress. One time a ship heard pings from the black boxes and the tail with the black boxes has definitely been found and visited by divers. The tail is now reported to be just six miles from the last radar contact location of the plane. But even though the divers have been on the scene for two days the bad weather and silt in the current below and the tail upside down have blocked recovery of the boxes. There has been no visuals on the rest of the plane by divers or submersibles even though for five days they have had a sonar location of five big pieces. No explanation for why this is, especially in light of a statement from the owner of Air Asia that recovering bodies, most of which are presumed to still be in the fuselage, is the highest priority. Some observers are not so sure the sonar images are of the plane, as there the sea floor of the java sea is littered with sunken ships many from a big battle there in WWII. 41 bodies have been picked up, but these were all floating on the surface.

        Later in the day the story has changed. Pings are being heard from the vicinity of the tail, but not in the tail, suggesting the black boxes may have been thrown from the tail. As a crane is prepared to raise the tail, there are reports that the tail might be in two pieces.

        (1/4/15) It's now Sun, a full week, and they think they have found the plane because they have sonar images of five large objects. Any pings heard, nope, any pictures, nope, any divers gone down, nope. The news story has this little detail without comment, which is that search planes seem to see wreakage on a beach (presumably on Borneo). Now unless the plane crashed right next to a beach if true, that must mean the plane broke up in the air.

        (1/2/15) It's now Fri, six days and counting, and they still haven't found, or even heard from, the freaking plane.

        (1/1/15) It's now Thur, there is an amarda on the sea, and they still haven't found the plane that went missing on Sun. Yes, they are recovering debris and some bodies from the surface, but the search for the black boxes is on hold, because they haven't yet found the body of the plane. No pings from the boxes have been detected, though it's not clear how many ping detecting ships are on site, if any.  They have a logical search area, backtracking from the debris field to the last radar location of the plane. It is thought that the southern flowing ocean currents in the region could have moved the debris 60 miles south. A story by Reuters says the working assumption of investigators is that the plane had a high speed stall.

        (12/30/14) Finally on the 3rd day of the search (with 12 planes and 30 ships searching) a debris field and several floating bodies have been found in the water. Looks like this indentification is solid as an airliner door has been seen, the colors match those used by AirAsia, and Indonesian TV is showing bodies in the water, even a helicopter crew member being winched down near one of the bodies for a closer look. And WP reports the debris is only six miles from the last radar location of the plane (by next morning this was changed to 60 miles).
-----------------------
        Another AirBus packed with passengers has fallen out of the sky during high altitude cruise (32,000 feet) with no distress call, and as of now, two days of daylight searching, no wreckage or debris has been found even though authorities think they have a pretty good idea (100 mile search area) where the plane went down (Andaman sea north of Malaysia). An airliner falling out of the sky is not common, only 10% of airline accidents occur during cruise. The head of the Indonesia agency running the search says he thinks the plane is "at the bottom of the sea", which (thank goodness) is reported on average to be only about 150 feet deep. However, on the 2nd day the search area has been expaned to include land.

        The popular press is focusing on weather since the plane dropped off radar five minutes after the plane requested @ 6:12 am (local) a turn (approved) and climb from 32,000 to 38,000 feet (standby) because of thunder storms in the area. This was the last transmission from the plane. Two minutes later @ 6:14 am tower attempts to reach plane (to approve a partial climb to 34,000), but no reponse on 2-3 attempts. The tower asks local aircraft for help in reaching the plane. @ 6:16 the plane is still on radar.  @ 6:17 am it is gone from radar.

        However, there is speculation on the pilot rumor site that this might (possibly) be like Air France flight 447 over the Atlantic all over again [freeze up of the pilot tubes, leading to incorrect air speed, auto-pilot cutting out and inexperienced pilots suddenly handed manual control causing a high speed stall from which they never recover]. For one thing the pilots on the site say climbing to get over a thunder storm is a really bad idea in the tropics. Reinforcing the stall theory is that while the pilot had lots of experience (20,000 hr) the first officer had few (only 2,000 hr), so maybe the pilot was out taking a leak.

        Of course the pilots on the site repeatedly say the high speed stall lessons of flight 447 have been drilled into the heads of (at least western) pilots by the airlines. On pilot even said he knows a pilot that had the nose up and power setting for flying without a speed sensor put on a laminated card that he sets on the console for every flight. Also mentioned on the site is that some Asian airline (not known if this included AirAsia) have first officers who have paid the airline to fly to get experience

        Other possibilities thrown around to explain the lack of a mayday call are an explosion causing a sudden breakup of the plane or a pilot suicide. One poster noted that most scenarios that prevent communication, like a bomb or sudden breakup from weather, would cause a lot of debris, and most scenarios that don't have create lots of debris imply control and hence communications should be maintained, concluding there are "simply not that many explanations for sudden loss of all communications and no debris - especially in a small area."  However, I can think of two. I don't think the Air France fl447 pilots communicated as they struggled with loss of control for several minutes. One poster suggested that maybe the plane was hit with lightning that fried the electronics and it has glided out of the search range. Even though the plane dropped off the radar just after dawn, leaving 12 hours of daylight for search, the search area is not very close to land and that land is rural, so given time to organize a search it is likely few ships reached the area before nightfall. Another 24 hours should tell the story. If the plane or debris are not found by then, something weird is going on. A lot of issues will be quickly cleared up if the wreckage can be examined and the black boxes recovered.

High speed stall?
        WP published (supposed) profiles of the flight's altitude and speed for its 40 minute duration. I have seen no one comment on them, but I found the speed profile odd. The altitude curve was clean, a nearly linear rise to 32,000 feet and then perfectly flat. The speed profile however was full of noise for the whole 40 minutes. I am not a pilot, but I find this odd. My understanding is a flight profile is normally programmed into the computer, and it flys the plane adjusting the auto-throttle as necessary to maintain the desired speed, but that did seem to be happening here. Was the auto-pilot not engaged? Or was the turbulence during the whole flight so high that it could not control the speed? (This seems unlikely.) When this is coupled with a leaked speed that showed the plane flying quite slowly (407 mph) near last contact, it looks more ominous. Is it possible that like the SF airport tail drag crash the pilots thought the auto-pilot was in control, so no looked at speed?

        A consultant on the BBC points out that with the plane already flying slowly (but within the plane's profile for that altitude), if the plane flew into a storm cell with a strong updraft, it could quickly stall the plane. The reason is that from the plane's point of view the incoming air would suddenly shift direction, appearing to be coming not from the front, but from an angle somewhat below the plane. If that angle was high enough, say 20-25 degrees or more, it raise the angle of attack on the wings so high that much of the lift of the wings is lost, a high speed stall, and if the pilots down understand what is happening (a la flight 447) the stall would probably not be exited and the plane would rapidly fall from the sky.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        At first I wasn't sure this crash was worth following, but not only does it have some of the most spectacular photos ever while going down, but the reason for the crash turns out to be very interesting.

Email summary (2/8/15)
        I have followed the recent plane crash in Taiwan. This is the crash with the dramatic video of this huge two engine plane just barely making it over a bridge before crashing into the river below. The data from the flight data recorder was online within days, so I've been reading what posters on the 'pilots rumour network' make of it.

        This accident was a classic screwup by at least one of the pilots. (There were THREE senior pilots in the cockpit.) When there's an engine problem in a two engine plane, it's just basic airmanship that pilots know how to quickly identify which engine is going bad. Turboprop engines are far less reliable than jets, so engine problems in this type of plane are not uncommon. Pilots have a saying on an easy way to do this: 'Dead leg, dead engine'. What this means is this. If one engine is not pulling correctly, the plane will begin pull right or left. To keep the plane flying straight the rudder (in tail) has to compensate. This is either done manually by the pilot (dead leg because it takes high force) or in big planes automatically by the flight computer. The rudder is controlled by foot pedals in the cockpit. So bottom line pilots can figure out which engine is not thrusting correctly simply by the feel of the rudder pedals. The don't need to look out the window, listen to the engines, or even look at their instruments, the position of the rudder pedals tell the whole story.

        Pretty simple, hey, but I guess it was beyond these pilots, because what they did was turn off the GOOD engine! That caused the plane at 1,300 feet after takeoff to become a heavy glider. They repeatedly tried to restart both engines and the curves in the last few seconds before the crash seem to indicate one was beginning to power up, but by that time the plane was out of control having stalled by having to climb over a building, and it was too late. The flying pilot, however, should get some credit, he avoided hitting a tall building, which would have killed everyone, and got it down (hard) to the river. While the bulk of the 56 people on the plane were killed, including the pilots, 15 passengers did survive.

        This is probably contributing cause(s), but these are not known for sure at this time. There are, however, stories floating around that the plane had earlier had trouble with one of its engines, so the pilots were on the look out for trouble in that engine. The kicker is that the engine, which in the words of the pilot 'flamed out' on takeoff, was not that engine. The theory (unconfirmed) is that the pilots proceeded to shut down the engine which they prior to the flight had doubts about, even though the data indicates the engine was working normally and was keeping the plane in the air. (ATR can fly on one engine.)
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        (3/24/15)  A 3rd (or 4th) airbus fell out of the sky today with no distress call, like a few months ago in Indonesia. Today an airbus A320 operated by a german airline (GermanWings) flying from Barcelona to Duesseldorf  began to fall out of the sky within a few minutes of reaching cruise altitude (38,000 ft). No change of direction, no distress call during 8 minute fall, three queries from air traffic control are ignored during fall, weather reported good and crash happened during day. Pilot is said to be quite experienced. The wreck site has been located 5,000 ft up in a remote area of alps of southern france. Investigators have reached the wreck site already and recovered at least one of the black boxes. At this point this is all that is known.

        One poster on pilot rumour networks says this: Someone shoots pilots and crashes plane into mountain is ONE scenario. COCKPIT Fire, loss of consciousness OR PARTIAL loss by crew after they started a descent is the other. Everything else doesn't make sense. (seems about right)  Headline: "White house says no indication of terrorism (at this time)'. God, how can they say this, they have no data, and a bomb quite nicely fits the facts as known today.

    (3/28/15) This (so-called) accident has been 'explained' far sooner than any accident I have ever followed. For last couple of days the newspapers have been full of stories starting with the French prosecutor, followed up by the CEO of Lufthansa, that the copilot with only 600 hours (100 hours in Airbus) left alone in the cockpit by the pilot, presumably leaving to use the rest room (on a two hour flight!), locked the door and (deliberately they conclude) put the plane into a moderate steep, but controlled dive. All this is based on the full 30 minutes of the recovered cockpit voice recorder. There is one hole in the officials' case that the copilot deliberately killed crashed the plane, which is that the CVR shows he said not a single word in the ten minutes or so that he was alone. He can, however, be heard breathing, and his breathing the investigators say sounds normal, not like he was having a heart attack, but clearly they cannot be 100% certain that he was not impaired in some way. Apparently the CVR pickup quality was pretty good because not only can the copilot be heard breathing, but the pilot outside can be heard banging on the door (harder and harder), and near the end terrain alarms are going off and the passengers (seeing the mountains getting closer and closer) can be heard screaming. (What a horrible way to go....)

        The circumstantial case is strengthened in that his history and a home search show he may have had depression or mental issues, and the headline today is maybe vision issues. Supposedly he even had a 'note from his doctor' he was not fit to fly on the day of the crash. What the note said has not been publicly released. (Who other than a school child has a 'note from their doctor' that they are unable to work.) On the CVR the tone of his conversation during the flight supposedly changed from normal to 'curt' when the pilot began discussion something about the upcoming landing, but I find the public comments here far too vague to draw any conclusions. However, the circumstantial case against him is weakened by the fact that he was a flying enthusiast from the time he was 14, training at a local glider club, was a marathon runner, had no known religious or ideological affiliation, and lived with his girlfriend. He father is reported to be a 'successful' businessman, translation he probably grew up comfortably. Critically, however, no information from his girlfriend or parents has been made public to date.

        When you think about it, after high strength doors controlled from the inside  were installed in planes after 9/11, it has never made any sense to leave a single person alone in the cockpit when all the airline had to do was ask a crew member, or other travelling pilot, to step inside for a few minutes when the pilot was out taking a piss. What would this cost? Virtually nothing, but the European airlines have been too cheap to do it, until now of course. I read a 2nd person entering is required in the US, but the European airlines give the 'excuse' for not doing it, that it was required by European regulations. Posters on the pilots rumour network think a second person would be effective to prevent what appeared to have happened here. The argument it is one thing to do something that will lead to your death, but an all together different thing to attack someone so that you can commit suicide. There are physical risks to a single pilot left alone too that are mentioned on the pilots rumour network. A single pilot left alone is supposed to put on an oxygen face mask, but it is not unheard of that maintenance screws up and the tank that should contain oxygen contains nitrogen.

CEO of Lufthansa should take responsibility and resign
      In my view the little CEO of Lufthansa should take responsibility and resign (after making sure his pension is nice and firm of course!). It appears that his airline's (stupid) penny pinching policy of not having a member of the crew step inside the cockpit for few minutes when one of the pilots leaves, allowed a nutjob, unstable pilot, which Lufthansa had hired and trained, to go berserk and take control of the plane, effectively acting like a terrorist, deliberately destroying the plane and killing 150 people. In other words I believe he has some personal responsibility for the death of 150 people, both for putting cost over safety by not implementing the two people in the cockpit rule, and for hiring an unstable young nutjob with very few flying hours to pilot one of his airbuses.

(4/29/15)
            I don't understand how the CEO of Lufthansa is still on the job. Information keeps coming out about the mental illness of the pilot. Today's news obtained by a freedom of information request is the the FAA in US knew about his mental illness when he training in AZ, and only allowed him to continue training in the US because his doctors in German assured the FAA he was cured, but the FAA warned him he would be prohibited from flying if his depression returned. Turns out he was treated  for 10 months while on leave from his training with a variety of powerful anti-depressant drugs. To get reinstated in the Lufthansa training school he sent an email to Lufthansa where he admitted he had taken a long leave because he had been suffering from severe depression.

        (3/28/15) The flight data recorder was finally found, and it shows that that the co-pilot was continuing to trim the auto-pilot on the plane's downward path. This is important as it removes the (small) uncertainty that the co-pilot might have somehow become disabled. No surprise here as background checks on the pilot over the last week or two have made a damming case that he was looking to kill himself.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

(11/17/15)
        Finally the missing puzzle piece falls into place. Russia today announced that they have found explosive residue in the tail section.

(11/16/15)
        All governments are acting as though the plane was definitely brought down by a bomb, but there is still a big problem. The problem is that the crash investigation has found so far zero evidence for a bomb, meaning no explosive residue and no timer parts, both of which were found on the TWA bombing over Lockerbe Scotland. NYT article claims Egypt is politically pushing for the investigation not to show it was a bomb, so maybe the explosive evidence has been found and is being withheld.

        The pilot rumour network is still full of amateur analysis that something happened to the horizontal stabilizer, that its jack screw ripped out, possibly due to tampering, causing the front edge to fly down and the rear up. The resulting downward force on the stabilizer then ripped the rear of the plane off, which is what the amateurs seem to see in pictures of the wreckage.

(11/8/15)
        The probability of this crash being a bomb keeps rising mostly because of inputs from security people. A US congressmen briefed by security now says it was probably a bomb. The focus seems to have shifted from passenger security to the plane service crews. But there are still huge gaps in the story. Zero discussion of who could have made the bomb, what the explosive chemicals might have been, how big it would need to be, etc. Also key confirming facts are missing: explosive residue and telltale bending out of structures near the bomb. Not a hint from Egypt or Russia about whether explosive residues have been found or not. There was leak from Russia that shrapnel may have been found in some of the passengers. Clearly this is important. It probably would tend to confirm a bomb and perhaps more important the source of the shrapnel would probably provide a strong clue as to where the bomb was placed.

        However, if this Airbus crash was due to a structural failure (or gas tank explosion), it would be extremely important.  A poster to the pilots rumour network makes this good point:

        Strangely, considering this forum, this point (possibility of a structural failure) seems to have been grossly underestimated. Rather than join those running around trying to prove it was a bomb it might be best to work painstakingly to show that it could not have been a structural failure.

        The Horizontal Stabilizer and rudder broke off. It would appear that only one half of the HS (Horizontal Stabilizer) has been found, and it shows extreme structural failure breaking upward without apparent impact damage from aircraft structures. (This looks very strange to those on the forum who think they have some understanding of structures and the history of airline crashes.)

        Whether this was a bomb or not, the muslim fanatics have scored a huge victory against both Egypt and Russia and the west. US, while having no flights to Sharm el Sheikh, has already announced more stringent security on flights leaving for overseas.

        The British prime minister recently said 'more than likely than not' (> 50%) the plane was brought down by a bomb. Obama the next day said based on new information we received (probably from the british) 'it may very well have been a bomb'. These statements appear to be based largely on british intelligence, who after the plane went down, combed through their intercepted communications with local radicals and picked up 'chatter' that ISIS was planning a major attack. One further fact supported Britons conclusion, which is ten months ago Briton was very concerned about security conditions at this airport. This intelligence combined with the fact that a bomb is consistent, but not definitive, with what is known at present about how the plane broke up in the sky triggered the statements of heads of state.

        A breakup of the airframe  or explosion in the gas tank are still very viable candidates for cause of the crash. The definitive piece of evidence for a bomb, which up until now is missing, would be residue of explosives at the crash site or on the bodies. Reportedly Russia has taken a lot of explosive swabs at the site and on the bodies, which are now being buried, and returned them to Russia for analysis. It is unclear if there have been any autopsies of the bodies.

(11/5/15)
        Word today is that the data recorder shows normal flight parameters and then recording just stops. This is a disappointment as it is (apparently) at the beginning of the 20 second event. The only information this provides is that the initial event must have ripped out the power cables from the engines (where generators are) to the tail where the data recorder is. The data avoinics bay near the front must have had power longer as the plane continued to transmit its status to fliightradar24 for 20 more seconds.

        The people posting on the pilots rumour network are keeping an open mind on the bomb. There is a lot of talk about the horizontal stabilizer, that it (for some reason) suddenly deflected violently ripping out the power cables to the flight data recorder. In other words an instant big problem in the tail triggers the loss of the plane.

         Russia does plan to reconstruct the plane from the wreckage. Putin in a telephone call to Cameron is said to have advised the british to not jump to conclusions about a bomb. They need to wait for the wreakage to be examined, which will likely take many months.

(11/4/15)
        Four days later and little hard information has come out. Nothing from wreckage review, no specifics from either black box, no radar data, however burns on the bodies and tail found broken off point to an explosion (or fireball) in the rear of the plane. Several governments (including UK and US) are leaning hard towards this being a bomb. ISIS repeated their claim that they brought down the plane. Not everyone is convinced.

        There clearly was an explosion in the rear of the airplane. One hard piece of data comes from examinations of the bodies which shows severe burns of those in back but not in front. Another is a heat flash seen my a satellite (but with no exact time released!). There's still the possibility that the tail had come off first and this triggered a fuel tank explosion. UK released a public statement that it might have been a bomb and has stopped flying to that resort on red sea. US has officially said nothing, but Drudge says the US intelligence people suspect it was a bomb. It's so frustrating that Egypt and Russia are keeping silent about what the black boxes and wreckage show. The released preliminary statements are all maddeningly vague, like the cockpit voice communication was normal up to 4 minutes before the event. Is this supposed to tell us something? (4 min is a lifetime when the entire event lasted all of 20 seconds.)

(10/31/15)
        It's happened again. An Airbus has fallen out of the sky from cruise altitude with no distress call. The last time it happened a few months ago, GermanWings (3/24/15), it turned out the cause was crazy copilot who crashed the plane deliberately. As I write, the crash just happened and good data is hard to come by. The black boxes have been found, but it will be days before we know what they say. The plane was at 30,000 feet when things started going bad, and this is thought to put it far out of range of hand held antiaircraft missile that are known to exist by those fighting in Sinai. The 224 people killed (nearly all Russia vacationers returning home) make this the largest single aviation loss in Russian history.

        The only detail data available now comes from an amateur plane tracking network (Flightradar24) which receives data packets the plane transmits twice a second where the plane reports it position, altitude and ground speed. Here is a summary of the noisy data (a lot of data packets got lost) received by three stations:

Prior to 04:12:58, all is normal. (The plane has been climbing normally for about 20 minutes since takeoff and is at 30,000 feet and still climbing.)

* Around 04:13:00, there's a couple of erratic altitude readings. (There are three packets within three seconds reporting altitude 29750, 30975 and 33275, and clearly all of them can't be right. The aircraft was at 30750 just prior to this time.) The aircraft begins slowing and turning to the right.

* At some point between 04:12:58 and 04:13:05 (the exact time is hard to pinpoint because of the erratic readings), it begins descending. (5-7 sec window!)

* At 04:13:10, it's slowed (ground speed) down below 250 knots, turned 25 degrees to the right, and it's descending at the rate of at least 7000 fpm. (10-12 sec window!)

* Last received position packet, at 04:13:19.5, gives its altitude as 27925'.
* Last received velocity packet, at 04:13:22, gives its horizontal airspeed as 62 knots. (22-24 sec window)

        Only a limited number of possibilities fit these facts: bomb, missile or a sudden catastrophic structural failure. If it was too high for available missiles, then most likely this plane was taken down by a bomb, which did structural damage.  While a non-bomb/missile sudden structural failure seems unlikely, one poster on the pilot rumour networks says he think this plane, about 18 years old, had a tail strike a while back (2002) that did significant damage. Further reading of posts shows there are precedents for an incorrect repair causing a midair structural failure. For example in the case of a 747 a patch plate was attached with two row of rivets vs three that Boeing recommended. After 12,000 pressurizations the rivets in the patch failed, and the plane crashed. This dodgy Russian charter airline is not known for good maintenance, in fact the copilot on this flight is supposed to have told his wife that the maintenance on the plane left a lot to be desired. So at this point a structural failure, perhaps related to its tail repair, is a viable candidate. A careful examination of the wreakage will be crucial.
============================================================================================================================================

Torch Tower --- another high rise Dubai fire (8/4/17)
        One of the highest residential towers in Dubai (85 stores, 1,100 ft), incredible named the Torch Tower, caught on fire with flames racing up the outside due to flammable cladding. Pictures show 40 stories engulfed in flame.

        But what is remarkable here that has gotten little to no press, is that unlike Grenfell Towers, everyone got out, no one died! How was this possible? According to the UK Sun everyone was able to get out in 10 minutes. This was a night time fire, beginning at 1:00 am. One tenant is quoted as saying he ran down 50 flights of stairs in about ten minutes. The building is said to have smoke free fire exits. Pictures also show the fire was restricted somehow to a narrow vertical column, though 40 stories high. The fire was high up,  the lower half of the building not burning. An earlier Dubai high rise fire also had no deaths.

================================================================================================================================
Grenfell Tower fire London (6/19/17)
(6/25/17)
        In a detailed, devastating follow-up story in the NYT. The problem with the flammable nature of the aluminum composite cladding was well known, and had been for years not only to fire experts but to the building community.  The problem is widespread in the UK. Residents of five other buildings in the London area with the same cladding have been ordered out. The NYT article hints that 'hundreds' of buildings in the UK may be covered with this crap. The cladding used in the Grenfell Tower is called Reynobond PE and is actually made by US company Alcoa (now called Arconic). The manuf states because of its flammable nature it should not be used on building more than that it should not be used in building more than 10 meters (2-3 stories). It's almost impossible to believe that Arconic did they not know somewhere within the company that huge quantities were being used to cover tower building. I guess they didn't give a shit, the money was good.....

        A check of the Arconic site on 6/25/17 (six days after the fire!) finds no mention of the Grenfell Tower Fire even in their News section. I guess the freaking little cowards who run Arconic don't consider it 'News' that a cladding they make just killed 79 people! The NYT reports for days after the fire Arconic would not confirm that they made the cladding on the building.

        "A top (British) building regulator explained to a coroner in 2013 that requiring only noncombustible exteriors in residential towers “limits your choice of materials quite significantly.” Yea.....

        The article states that building built in 1974 was built in the 'brutal' concrete style without cladding. For 'brutal' read ugly, there is a building built in the ugly brutal style in downtown Boston next to the city hall.  Some tenants claimed the cladding was added for neighbors, so the building would not look so ugly. The management told tenants that the cladding added only a year ago would improve fire protection.The tenants were advised to stay inside their apartment instead of fleeing down the one staircase. More dead people.
----------------------------------------------------------------------
(6/19/17)
        It's too early to be sure, but it sure looks like a devastating tower fire (58+ dead, 79+ update) in London in the 24 story Grenfell Tower building has the same cause as the Dubai tower fires, building cladding with a horrible flaw, a flammable inner core that propagates the fire. Even though the building is old according to news reports the cladding was installed only last year. This is summer consistent with some tenant starting the fire by grilling on the balcony.  Here are a few photos:

        This composite timeline series of photos (below) from express.co.uk is especially useful because they are taken serially at known times. Also the lighted building right shows the photos were all taken from the same position. The fire started a little before 1:00 am (12:54 am). The first photo is about 1:30, second at 2:10, then 3:08, 3:23, 3:44, 4:20, 4:43, 5:16.

        Notice in the first photo the outside of the building left is lit up, but the inside of the building of the side facing the camera is not yet burning. This is consistent with the fire racing up the outside of the building first. In another half hour or so (2nd photo) the outside of the building facing the camera is now ablaze in a huge swath from nearly top to bottom. Also as the fire has come around the building from the left the windows in this area are now all full of fire. In the third photo the huge top/bottom fire swath is still there but a careful look shows it has advanced more to the right.

In this bank of photos the fire has worked its way around to the right face of the building, and again we now see a huge top/bottom swath ablaze on this face.

(source -- http://www.express.co.uk/news/uk/817927/grenfell-tower-fire-photographs-spread-smoke)

In the first photo in this bank even though much of the interior of the building is ablaze the right outside of the building is burning brightly. I think there can be little doubt from this photo (as well as the others) that the cladding of this building is burning intensely.

(source -- http://www.express.co.uk/news/uk/817927/grenfell-tower-fire-photographs-spread-smoke)

        I later found a good article (via Drudge) by fire experts in UK who have worked in Dubai. The 63 story Address fire is the third since 2012. There was a fire in an even taller building (86 story, The Torch) in Feb 2015. The 'Torch' building has its own Wikipedia page from which I captured the image below right. Incredibly no one has been killed in any of these fires, because the fire is on the outside, at least in the beginning.

Building covered in flammable aluminium composite panels
        As I suspected there's a flaw in the building and according to the article it's in the design, specifically in the choice of materials for the outside: aluminium composite panels made in the far-east. According to the article these panels have a sandwiched thermoplastic core that is extremely flammable, and worse it propagates the fire. A building coated in panels like this can easily erupt in a sheet of flame. Once one panel ignites, it sets the one above it on fire, which does the same. It's a runaway with a sheet of flame quickly racing up the side of the building, just as in the pictures. There have been several fires like this prior to this big one.

        Dubai has a real problem. According to the article 70% of Dubai towers are covered in this stuff, because it was cheap and looked good. Only in 2013 was the material outlawed in Dubai. Reading between the line these seems to have been a fire testing issue here. The panels pass conventional fire tests, because the core doesn't get hot enough to ignite. The manuf is thought to have known about the problem, but kept quiet.

1/1/16
       A skyscraper fire is obviously not a plane crash crash, but I am fascinated by a huge fire in a new 63 story high rise tower in Dubai (Address Downtown hotel Dubai) just hours before the new year began. At this point a day later almost no information is available about the cause of the fire or the damage, but two things that are known seem very strange.

        Surprisingly Dubai has been mapped by Google Earth street view cameras, and by turning on 3D buildings the many high rise buildings in the city pop up. There's a highway which is just lined with high rises, but this hotel that burned is not there. This hotel with its distinctive crest is part of a complex that includes the world's tallest building,  Burj Khalifa, which at 2,722 ft is incredibly tall, more than a 1,000 ft higher than the new twin towers in NYC, which are about 1,776 ft! The Address Downtown hotel is at one end of a lake and the Burj Khalifa is at the other end, so from it's location it looks like the Address Downtown Hotel must have been one of the most prominent buildings in the city. Its web site shows it was a five star hotel, 435/night. Under hotel information on its page there is no mention of the fire more than a week later. A check of availability comes up no rooms available.

        The second known fact, which appears on its face to be utterly incompatible with the pictures showing nearly the whole building sheathed in flame, is that nobody was killed or even seriously injured even though the building was occupied. You look at the fire pictures and say how is this possible?  Initial TV reports while the fire was still burning said multiple explosions had been heard. Was this a terrorist attack?

        Further mysteries are that the fire was nearly out by morning, eight hours or so later. Did the firemen manage to put it out or did it just burn itself out? It's very difficult for firemen to fight a high rise fire (remember the firemen climbing the world trade center stairs carrying small tanks), so I suspect the latter, it just burned itself out, and herein is a clue. Also high rise buildings, and like most skyscrapers in Dubai this was a new building, are designed with fire in mind. The steel is coated in fire proofing material, there is a sprinkler system, and very likely water access points for firemen on each floor.

        One observer is quoted saying the fire remained outside the building. Is this consistent with the pictures? If this is true, it's another clue, and would explain how everyone was able to evacuate the building successfully. No information is available as to how many people evacuated or how they got out.

        My guess at this point is that there was something running up the outside the building, starting at floor 20 and likely just on one side, that was extremely flammable, and this is what burned. Maybe it was a decorative item on the building exterior or even a banner or sign hung on the building, though if was the latter I would think someone would have commented on this.

        From the fire photos it looks like the post (or the right half) of center balcony on one side of the building is what is burning. My guess is that there has been a scew up in the design or construction of this building. Some part of the center balcony look like it is highly flamable. One person in the building said the air smelled like burning plastic.

        *** A Wikipedia page on the accident is up that has details (from ATC, prior to black boxes I think) on the 2nd landing attempt. At 03:40:54, when the aircraft descended to 480 meters (1,570 ft) with a speed of 243 km/h and was about 5.5 kilometres (3.4 mi) from the runway threshold, the crew decided to abort the landing." ... "The aircraft increased its speed and within 43 seconds climbed to 1,200 meters (3,900 ft) (8,000 ft was the goal) with a speed of about 343 km/h (206 mph)  Starting at 03:41:37 the aircraft's altitude rapidly decreased and it hit the ground."

        The numbers seem are a little off. The average speed is 293 km/hr (176 mph), so in 43 seconds the plane would fly 3.49 km, but it was reported to be 5.5 km from the runway when TOGA is initiated and it crashed on the runway. The runway is about a mile long, but Wiki says the plane came down just east of the approach end of the runway, meaning I guess it just about made it to the runway. However, this graphic (if right) explains the discrepancy, and it is consistent with the straight line and angle seen on the latest video from a distant camera.

        Another set of numbers is also a little off. The rescue team estimated the plane hit the ground at 400 km/hr (or 6.66 km/min) because even the magnesium alloy wheel rims which are very strong were shattered, and this seems to fit with data from Flightdata24.  But the plane had to fall from 1.2 km (1,200 m), which would take 22 seconds assuming the vertical speed climbed linearly from zero during the fall.

        There's a great new video from a distant camera that clearly shows the last four seconds of the fall. The plane comes in at about a 60 degree angle, perfect straight line, and what looks to be a uniform speed, so maybe the fall time was closer to 11 seconds rather than 22. There's also no indication on this view of any fire. Could this possibly be another suicide where the pilot just aimed the plane into the ground? It's consistent with this video.

        It is reported both black boxes have been recovered and opened and both have good data, but as yet no analysis.

------------------------
        Next day the leading speculation is that high winds on landing, specifically low altitude wind shear, caused the crash. Wind gusts were 42 mph (or knots) at the time of landing.  This then caused a wing hit short of the runway, the plane then rose up uncontrollable or possibly on fire and came crashing down near the end of the runway.

-----------------
        This may be just a weather related crash landing. At night with rain and wind shear though visibility was pretty good, residents said weather that night was bad. Two other planes coming into the airport around this time decided not to try and land and diverted. This plane tried to land once and did a go around at about 1,700 feet, then circled the airport for nearly two hours and crashed on 2nd try. But the early facts dribbling in don't seem to add up. This was a new plane Boeing 737 manuf in 2011.

        This airport in Russia is close to the Ukraine border. The Russian city of Rostov-on-Don is on a NE finger of Sea of Azov, which in turn looks like a (125 mile) bubble NE of the (600 mile) Black Sea and barely connected to it. Surprisingly this city has been mapped by Googe street view. Much of the city has sort of rural look, most of the houses made of brick. The flight from Dubai was four hours and the plane circled nearly two hours, but it is reported it may have carried 8 hr worth of fuel, so at the end it still had enough fuel to have diverted.

        The biggest weirdness is that you would expect to see a controlled crash into terrain at a low angle. The plane did in fact end up on the runway, but a video security camera clearly shows the plane coming down at a very steep angle (60 degrees) into the ground exploding in a fireball. And the wreckage pattern in daylight is consistent with the video. Wreckage is not strewn down the runway but is in a compact area, broken into tons of small pieces indicating a high rate of impact. Incredibly there is not a single large piece of wreakage in any of the photos, the plane must have hit at very high speed.

        From another camera angle it appears that the plane might have been on fire coming down, but others think this is just the landing lights of the plane. And from the security camera side viewpoint it is a steady light consistent with headlights.

Three posibilities
        One resolution may be that the plane hit hard, a wing strike is reported, at the beginning of the runway and then it rose up. However the strike could have rendered it uncontrollable, and what was caught on video near the end of the runway was the fall from altitude of an uncontrolled aircraft.

        Yet this scenario doesn't seem consistent with flight tracking data which has the go around triggered at around 1,700 ft (both times) and the plane crashing about TWO seconds after the 2nd go around at altitude was initiated. So a 2nd possibility is the pilots botched the go around the 2nd time and perhaps stalled the plane. (This is a Boeing plane not a airbus) I think I remember reading that applying full power has a tendency to nose up the plane because the engines are hung under the wings. If this isn't corrected for the plane would stall.

        Doing some reading I see that in a 737 TOGA is largely (to partially) automated. The pilot bushes two TOGA buttons and the goal is for the throttle to advance to 85%. This is either done automatically by the control system if the auto pilot and auto throttle were engaged when landing, or if not, the pilot must do this manually with guidance from the flight controller. The desired nose up during climb out is 15 degrees, which is about the angle of attack where the wings provide maximum lift. However, there appear to be sort of an emergency TOGA which is used if the plane might hit the ground. This is activated by the pilots pushing the TOGA buttons twice. In this case the throttle goes to full power. (Seems to me this is one way the pilots might have screwed up.)

        Pilots note that go arounds can be trouble if manual flying is required, but the plane had successfully done a go around two hours before.

        Never a distress call from pilots nor any indication of trouble.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

(12/15/16)
        Headline today is Egyptians claim explosive traces found on bodies. As usual with airline accident investigations done by the Egyptians everything is opaque and no one takes them at their word. For example, why in hell would it take six months after bodies are recovered to find this out? Wikipedia says their were stories in the french press that french investigators had detected TNT residue on bodies in sept. The Egyptians wanted to work with the French and issue a joint report, but the french declined because Egyptians would not give the french access to assess how the residue could have got there. However, the pilots rumour networks says today (12/15/16) that french press is reporting just the opposite, that french investigators found no exposive residue! The french accident people released a statement that it is not possible at this time to determine the cause of the accident.

        This smells like either the french investigators think the egyptians are incompetent, or maybe they suspect the residue has been faked. Bottom line, almost nothing new about this accident has been made public in the last six months. Fire or bomb? The flight data recorder stopped working at 37,000 feet, which unfortunarely is consistent with several possibilities: a breakup of the plane at that altitude or fire or bomb damage in the avionics bay. However, a quick disabling would tilt more toward a bomb than a fire. The cause of this accident remains a total mystery.

(7/27/16)
        Both black boxes have been read, but only a tidbit of information is public via a leak. NYT article says everything seems relaxed in the cockpit then the pilot says to the copilot there's a fire get a fire extinguisher. That's it, the last human voice on the recording. Of course, the relevant question for a bomb is was there a 'boom' on the recording and not only of the news articles of late July even asks the question.

        There's no info released on when the black boxes stopped working, because it appears from the debris field that that the plane broke up in flight. The debris recovered also confirms a fire with heavy soot on some pieces.  So in terms of terrorism was this some sort of thermite ignition, possibly a li-ion battery fire, something really go wrong in the avonics bay, or was the oxygen system involved in boosting the fire? I found little useful speculation on the pilots rumour network. Just need to wait for a real report with data.

        This delay is not good because if this was not terrorism, something very serious went wrong on the Airbus and this needs to be figured out. And (surprise!) the news stories say there is 'tension' in the analysis team as Eqyptian authorities are witholding information from the airbus and french investigators.

(6/1/16)
        The headline news today is that pings from one black box has been picked up by a french ship, and this was confirmed by a french official. (No thanks to the Egyptians who are supposedly leading this investigation.) The working assumption is that the range of the pings is only 1-3 miles, so the ship must be basically on top of the wreckage. The NYT story was a little unclear, but seemed to say this location is also within 3 miles of where the plane dropped off radar. I checked several news stories and not one of them mentions the dept of the ocean at this location.

(5/24/16)
        It's now five days. Even though the plane went down in the eastern end of the Mediterranean with presumably excellent radar coverage (from Egypt, Greece, and Israel) they can't find the plane!  Oh, they found a few small items floating about 180 miles north of the Egypt coast, which puts it about in the center of the east Mediterranean, but no one has picked up the pings from the black boxes. Egypt is running this investigation. It is not even clear from the press that they have got a ship out there yet with the required hydrophones. The sea bottom there is reported to be quite deep and rugged, so this might be a serious problem.

        The politicians, sans evidence, are all spouting off that it was terrorism, but the few automated messages from the plane only show a rapid event with smoke and some sort of fire can't be ruled out. After the automated messages, the plane continued to be actively flown for a few minutes. It first made a 90 degree left turn, which is standard if you need to descend quickly, the left turn is to get out of the air corridor. This was followed by a full (or near full) 360 degree turn to the right with further decline. At least this is what the Greeks say, the Egyptians say no turns. Oh, yea! Why doesn't someone ask the Israelis...

       No one has claimed responsibility. I saw one argument that an Egyptian group an wants to damage tourism in Egypt would not need to claim credit to achieve their objective. This was a flight scheduled to land at 3:00 am (!) in Cairo, so even though it was an airbus the plane was pretty much empty with only 55 passengers certainly not the usual terrorist target.
-----------------------
        It has happened again. The breaking news tonight is an EgyptAir flight (MS)804 from Paris to Cairo has fallen from 37,000 feet into the Mediterranean Sea with no distress call. It was 2:30 am, 3 hr and 40 min into the flight, 20 minutes from landing in Cairo. Only 66 people on board (56 passengers and 10 crew), which is very low for an airbus. Within 90 min of its scheduled landing time an automated distress beacon from the plane was detected, search area is 40 miles off the Egypt coast. Security is considered good at Charles de Gaulle airport where the plane took off.
-------------------------------------------------------------------------------------------------------------------------------------------------------

        I haven't seen the 2016 movie Sully with Tom Hanks about the airliner that landed in the Hudson river, but I dug out the final accident report and paged through it. I like reading accident reports. No one was killed, but five people were injured.

        The most interesting thing in the report is that good luck probably contributed to no one getting killed. The plane was scheduled to fly overland NC (US Airwasys flight 1549) so it was not required to have extra front slides that are required for an extended flight over water, but as luck would have it, the plane was so equipped.

        After the ditching the back slides didn't work and people crowed onto the wings. The report says the wings were standing room only and this is confirmed by a picture showing the wings full. But the wings were only able to hold about 80 of the 140 passengers. Where were the other 60 passengers and crew to go? They went were called to the front of the cabin and went out into front slides from where they were picked up by the boats.

        If the plane had not had this special overwater slides in front, the report says the passengers would have been instructed to jump into the water and hold on to a little floating slide that the crew would cut free. But this was Dec in NYC and the water temp was 41 F. Yikes! Undoubtedly the shock of full immersion in 41 degree weather would have caused some passengers to drown.

        Another good piece of luck was that there are a lot of ferries that cross the Hudson and the first ferry was at the plane in three minutes, and in the next ten minutes six more ferries arrived plus a couple of other boats.

        Some of the people on the wing were up to their waist in the cold water. (Didn't see any detail as to how the people got off the plane into the ferries.) A lot of water came into the back of the plane. A lot of passengers took life vests from under seats other than their own, and about 20% exited the plane with no life vests. Sully and the first officer seeing this searched the plane for life vests and passed them to those outside.

        There are two recommended ways to brace: either put you head all the way down to your lap (if possible) and grab your ankles or lean into the top of the seat in front with your elbows. Turns out that two people who leaned into the seat in front broke their shoulder as their arms were driven back. The thinking of those who recommended this brace position was that the seat would go forward reducing the stress of the passenger leaning on it. But the seats in this plane had a locking mechanism designed to prevent them tipping forward, so they didn't go forward. The report said in effect said, oh shit, that was never considered!

        One of the flight attendants had her leg cut bad by a piece of metal that come up through the floor right in front of her jump seat.

        The crew had no way of knowing this but the engines were never going to restart because each had ingested two large canadian geese, and these birds had done serious damage not just to the bypass fan, but to the core of the engines.

        Turns out that Airbus screwed up. The double engine restart procedure that the first officer was following didn't apply. Airbus had written the procedure for loss of both engines at altitude, there was no procedure for loss of both engines low (plane was about 3,000 ft) due to a bird strike! The first officer doesn't know this, he is going through the engine slow engine restart procedure with its 30 sec waits until he gets to step three which says the speed must be above 300 knots, whoops, because the restart is going to try and whirlwind the motors.

        I've heard the movie goes into whether Sully he made the right choice heading for the Hudson rather than returning to Laugardia or heading for Titerborough in NJ. He did. About 20 simulations were run and only about half succeeded. The plane was five miles from Laguardia and heading away from it, so to get back it would have to make a 180 degree turn. Titerborough was eight miles away. The Hudson was right in front of the plane. I am told a lot of the movie Sully deals with whether or not Sullenberger made the right decision to not try to return to Laguardia.

         To get back to Laguardia the simulations showed a turn had to be made immediately after the bird strike which is unrealistic. When the turn was delayed for 35 sec while the crew figured out what had happened, the plane didn't make it back. On top of that it would have had to fly over manhattan and as Sully said once the turn was made the decision was irrevocable.

        I read the glide ratio is 15-17 for an airliner like this (less when turns are included). Since the plane was about a half mile up, it this gives the plane a glide range of 7-8 miles. Titerborough was 8 miles away. Laguardia was five miles away, but the plane was heading away from it and a 180 degree turn was required. The Hudson was basically right in front of the plane.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

        Just happened, no crash, no injuries, but very interestng. A dramatic passenger video showing the plane shaking violently. This continued for 90 minutes after a loud bang and the plane turned around and returned to Perth Airport. This happened 30,000 feet cruise, in daylight, with 359 passegers on board.

      https://thepointsguy.com/2017/06/airasia-x-pilot-asks-for-prayer/

        No hard info on the cause yet, but there was a burnng smell in the cabin after the bang. The flight attentents asked if any left side passengers had seen anything strange with the left engine. Some passengers say they saw an explosion on the left wing, and it looked to them like the left engine was shaking. There were hints it might have thrown a compressor blade. The pilot told the passegers after the bang they were flying on only one engine. The airline is saying only that it was a technical problem.