The Frozen Pitot Tube

Air France Flight 447 and the Paradox of Automation Hand-Off at Thirty-Five Thousand Feet

Cruising at 35,000 feet (Flight Level 350) over the mid-Atlantic Ocean on the night of June 1, 2009, Air France Flight 447 flew into the towering convective cloud tops of the Intertropical Convergence Zone. The Airbus A330-203, registered F-GZCP, carried 228 people from Rio de Janeiro to Paris. While Captain Marc Dubois took his scheduled rest break in the crew bunk behind the cockpit, First Officer Pierre-Cédric Bonin occupied the right seat as pilot flying. First Officer David Robert sat in the left seat as pilot monitoring. At 02:10:05 UTC, high-altitude supercooled ice crystals clogged the narrow drain holes of the airliner's three external Thales AA pitot tubes. The ice blocked the dynamic ram air pressure $P_t$ required to compute indicated airspeed:

When the three air data computers lost consistent airspeed readings compared against static pressure $P_s$, the A330's autopilot and autothrust disconnected automatically with a cavalry-charge chime. Simultaneously, the fly-by-wire flight control computers degraded from Normal Law into Alternate Law 2. Under Normal Law, onboard computers enforce hard aerodynamic envelope protections. Even if a pilot pulls the control stick all the way back, Normal Law refuses to pitch the nose above the critical stall angle of attack ($\alpha_{\text{crit}} \approx 15^\circ$). Under Alternate Law 2, automatic angle-of-attack stall protection vanished completely. Pitch control reverted to direct proportional stick response just as the crew lost valid airspeed displays.

Startled by the sudden hand-off at 35,000 feet—where thin air narrows the "coffin corner" margin between low-speed aerodynamic stall and high-speed Mach buffet—Bonin pulled his right-hand sidestick sharply back. That input pitched the nose up to 15 degrees and sent the plane climbing toward 38,000 feet at 7,000 feet per minute. Although the pitot heating elements melted the ice and restored valid airspeed telemetry within fifty-four seconds, three interacting design traps prevented the crew from recovering the aircraft: High-Altitude Stall Aerodynamics: Climbing to 37,500 feet bled away forward airspeed from Mach 0.80 to under 100 knots. As the wing's angle of attack $\alpha$ exceeded 16 degrees and climbed past 40 degrees, airflow separated completely from the upper wing surface. Lift collapsed, dropping the aircraft toward the ocean at 10,912 feet per minute while the nose remained pitched upward above the artificial horizon. Uncoupled Algebraic Sidesticks: Unlike conventional mechanical control yokes that move in physical unison across both seats, Airbus sidesticks were mechanically independent and summed pilot inputs algebraically ($\delta_{\text{cmd}} = \delta_{\text{left}} + \delta_{\text{right}}$). Sitting in the left seat, Robert could neither see nor feel that Bonin was holding his right sidestick pulled continuously back against the rear stop. When Robert finally pushed his left stick forward to lower the nose, the two opposing inputs canceled out as a DUAL INPUT conflict. * The 60-Knot Stall Alarm Cutout: Under Airbus software logic, whenever measured airspeed dropped below 60 knots, the flight computers flagged angle-of-attack vane values as invalid and silenced the synthetic STALL voice warning. Whenever Bonin pulled the nose higher and slowed the plane below 60 knots, the stall alarm stopped. Whenever he relaxed back-pressure and pushed the nose down, airspeed rose above 60 knots and the STALL alarm blared again—perversely penalizing the exact nose-down recovery motion needed to break the stall.

Even after Captain Dubois re-entered the cockpit at 02:11:42 UTC, the silent stall warning and uncoupled sidesticks masked the 40-degree angle of attack until the intact airliner struck the Atlantic Ocean at 02:14:28 UTC.