On the morning of July 25th, 2000, passengers boarded Air France Flight 4590 from Paris to New York and settled in for what was supposed to be a long flight on a supersonic aircraft. Sadly, their flight lasted less than two minutes. Just after liftoff, the supersonic jet crashed into a hotel in Gonesse, France, killing all 109 people aboard and an additional 4 people on the ground.
Five minutes before Flight 4590 took to the runway, a Continental flight headed to Newark, using the same runway, lost a titanium alloy strip. Normal protocol for a Concorde flight includes a full runway inspection before takeoff; this was not completed (perhaps because the flight was already delayed by an hour). During Flight 4590’s take off, a piece of this debris from the Continental flight, cut and ruptured one of the Concorde’s left tires. As the aircraft accelerated down runway 26R, this tire disintegrated and a piece of it struck the underside of the wing, where fuel tank 5 was located.
A pressure wave inside the tank caused it to rupture forward of the tire strike. Fuel poured from the tank and ignited. The Concorde had already reached a velocity where it could not stop safely by the end of the runway so it lifted off the runway with flames hanging from the left wing. There are some incredible photos that captured this amazing moment, a moment that cost the lives of 113 people, $125 million, and the heretofore stellar reputation of a truly impressive airliner.
Setting the Stage- Back Story of the Concorde Incident Root Cause Analysis
The history of supersonic commercial air travel has its roots in the 1950s and 1960s, the same period that witnessed the Cold War American and Soviet spaceflight rivalry that launched man into space. While the Cold War superpowers jockeyed to conquer the stars, Britain and France set its eyes on the skies with the ambition of air travel faster than the speed of sound–faster than commercial flights had ever flown–a reality.
In the late ‘50s, the US, France, Britain, and the Soviet Union all toyed with the idea of supersonic flights. British and French companies, in large part funded by their governments, developed designs that were ready to go to construction by the early 60s, but the cost of such an ambitious project proved too prohibitive for either to accomplish alone. In 1961, therefore, British Aerospace and France's Aerospatiale came together to produce and develop the project, whose development was negotiated not as a commercial agreement between the respective companies, but as an international treaty between the nations; the treaty was signed in 1962. The Concorde takes its name from this agreement (the word concorde in French (concord in English) means “agreement, harmony, or union”).
Two prototypes began construction in 1965, and were presented to the public in 1969, the same year as their first test flight, at the Paris Airshow. In January 1976, Concorde celebrated its first commercial flight.
As impressive as this accomplishment was on its own, for the French and the British it had always stood for something greater. The Concorde was a symbol of national pride for the post-Imperial countries, a way of remaining on par with the two superpowers that emerged from the Second World War for the two nations that came out of that conflict in desperate search of new sources of identity in a world that had left their greatest glories. Both nations, but especially France, were in need of a source of national pride. Britain’s “finest hour” of bravery during the war was fading into history, and its empire was crumbling. France, for its part, had been humiliated and occupied during the war.
When flight F-4590 crashed near Paris, then, it was a huge blow to the brand as well as to the nations that had nurtured it.
In discussing incidents of this magnitude that involve not only loss of life but also extremely sophisticated and complex technology, it is often difficult to break down an incident to the extent that anyone–not just engineers or people who work in the industry–can understand them. Root cause analysis is a powerful tool for doing so. As we have demonstrated in our coverage of similar incidents in spaceflight, the Cause Mapping approach to root cause analysis analyzes incidents in terms of a detailed chain of cause and effect, promoting a better general understanding of the event at hand as well as multiple opportunities to enact solutions that prevent such catastrophes from happening again.
Root Cause Analysis Concorde Incident Snapshot
To get a better idea of what caused the crash of the Concorde, we built our very own cause map- ThinkReliability’s root cause analysis tool- to order the causes and tie them to organizational goals. Cause Maps break incidents down into their individual contributing elements, and are thus fantastic tools for understanding disasters like these (see space maps) fully and deeply.
Our snapshot of the Concorde incident begins with a detailed picture of the incident–what happened–before we get into asking why. Below you will find our problem summary for the Concorde disaster, including the problem, the time and location, and the industry goals that were affected by the event.
Tell Me About Your Goals, Not Your Problems- Defining Causes During Root Cause Analysis
Approaching an incident from a goals perspective solves several issues that one may otherwise encounter in undressing an incident. First, it prevents a root cause analysis free-for-all that fails to stick to the roots of the incident. Focusing on problems leads to blame and argument rather than to proactive problem-solving.
Focusing on problems also removes the team performing the root cause analysis from the key purpose of the discussion in the first place: to make for a better future for the organization and all involved.
So, instead of asking what went wrong (this can elicit a number of answers, some more productive than others), we start with our goals as they relate to the ideal state of the airline. Naturally, fatalities are bad. Resource loss is also bad, but most people would agree that an organization that loses money but not lives is closer to its ideal state than one that saves money but loses lives.
The number of fatalities- 113- is broken into two separate causes of a safety goal incident because it is useful for us to remember that some were killed because they were on the plane and some were killed because they were in the hotel.
5 Whys to Start One Cause Map
Sometimes, asking ourselves “Why?” over and over again can produce great results when it comes to pinpointing and solving problems. The 5 Whys Technique is a way to kickstart any root cause analysis because it immediately creates building blocks for your cause map.
Why did we have fatalities? Because the Concorde crashed.
Of course, reviewing the “no crashing planes” policy won’t solve our problem. So we ask “Why?” four more times and wind up with something like this:
The 5 Whys Technique is clean and effective because it allows you to begin building out the cause map immediately.
By using this technique in our root cause analysis, we find that the Concorde’s crash was caused by the loss of the two engines on the left side of the aircraft. A piece of debris on the runway caused one of left side tires to disintegrate. When the tires exploded a piece hit the underside of the aircraft, which ruptured one of the fuel cells slightly ahead of the intakes to the engines 1 and 2. The fuel, which ignited, choked out the two engines on the left side, and the Concorde crashed into a hotel in Gonesse, France just 5 km from the runway.
The Cause Map Continues
This approach to root cause analysis is an excellent way to approach any issue because of the basic structure it provides. Continuing with our root cause analysis, we can add cause and effect relationships to the left or right, in between, or vertically from each of the causes on the cause map:
Air France Flight 4590 was the Concord’s only fatal accident in its 31 year history (no other commercial aircraft has matched that record). At the time, with a record of zero accidents per km traveled before the accident, the Concorde qualified as the safest airliner in the world. Nonetheless, the crash of Air France Flight 4590 marked the beginning of the end for the mythic airliner.
Both Continental Airlines and John Taylor, one of its mechanics, were found criminally responsible for their part in the disaster in December 2010, but their convictions were overturned in a French court in 2012, on the grounds that the mistakes that they made did not amount to criminal responsibility.
The first passenger flight in the wake of the accident took to the skies on September 11, 2001, and touched down just before the world trade center attacks for which that date is better remembered.
Air France and British Airways announced the retirement of the Concorde fleet in April of 2003, citing lower passenger numbers after the Air France crash, compounded by the general slump in air travel that followed 9/11 and increased maintenance costs.
High Reliability Organizations- Quick Root Cause Analysis Note on Airlines
Airlines are generally thought of as high reliability organizations because there are over 87,000 flights per day in the United States alone (according to the National Air Traffic Controllers Association), yet we have not seen a fatal major airline crash in the United States since November of 2001 when an American Airlines flight A300 crashed into a residential neighborhood in Queens, New York, not far from the departing airport. Killed 5 on the ground, all 9 crewmembers and 251 passengers, and damaged several homes. In that incident, the airplane had broken up while in flight–having shed its vertical stabilizer, left rudder, and engines, the plane spiraled out of control and landed on a house.
Though such incidents are by their nature dramatic and thus widely reported when they occur, aviation is generally a high reliability–a safe–industry. Of the of the 34,434 transportation fatalities in 2011, only 494 related to aviation.
Part of the key to high reliability is following procedure- every time. Sometimes, when an organization goes long enough without an incident, members of the organization may begin to question procedure:
“We know this stuff. Do we really have to go through our checklist every time?”
The answer from a root cause analysis perspective?
Yes. Every time.
Bless the Checklist
Without a checklist, an organization begins to lack order. Like in much of what we do, it’s the little things that count.
High reliability organizations rarely undergo root cause analysis because they rarely need to. Instead of assigning blame to individuals rather than the organization, these organizations consider the incident in the context of organizational goals. That way, root cause analysis can focus on solutions rather than blame. Blame can actually reduce accountability, the same way checklists can increase it.
Crashing the Hotel- Root Cause Analysis Notes On Uncertainty
As in all other aspects of life, root cause analysis is a place where we constantly encounter uncertainty. When we come across uncertainty while building a cause map, we simply use a question mark or mark a causality fork with “OR” to indicate a “this or that” relationship between two causes.
When we have all of the necessary evidence, this becomes unnecessary. Uncertainty only matters when we are lacking evidence. For most past incidents, there is an ample amount of evidence to make important determinations.
The complexity of the cause map we build is based on what would be useful to us. In the case of the Concorde crash, we don’t need to examine why the hotel was built where it was, or why the patrons who were unfortunately killed were standing where they were at the time of the incident.
Rather, it would serve us better to acknowledge that there is often uncertainty, unknowable purposes behind things, and many of them may not contribute to the root cause analysis itself because it won’t explain the incident in a useful way.
Concorde Cause Map Poster- Root Cause Analysis That Fits On Your Wall
Because the Cause Mapping approach to root cause analysis draws its power by virtue of being so visually appealing and easy to understand, we have produced a poster of the Concorde Cause Map, containing a basic and detailed analysis of the accident. While the basic Cause Map starts with five Why questions, the detailed analysis of the Concorde accident contains over 100 cause-and-effect relationships. The solutions from the actual investigation are located above the particular cause it controls and are additionally summarized in a numbered table. To order your own Concorde incident poster, click here.
Bring Cause Mapping training to your organization
Schedule a workshop at your location to train your team on how to lead, facilitate, and participate in a root cause analysis investigation
REQUEST A QUOTE
Air France Flight 447 (AF447/AFR447)[a] was a scheduled passenger international flight from Rio de Janeiro, Brazil to Paris, France, which crashed on 1 June 2009. The Airbus A330, operated by Air France, entered an aerodynamic stall, from which it did not recover and crashed into the Atlantic Ocean at 02:14 UTC, killing all 228 passengers, aircrew and cabin crew aboard the aircraft.
The Brazilian Navy removed the first major wreckage and two bodies from the sea within five days of the accident, but the initial investigation by France's Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA) was hampered because the aircraft's flight recorders were not recovered from the ocean floor until May 2011, nearly two years later.
The BEA's final report, released at a news conference on 5 July 2012, concluded that the aircraft crashed after temporary inconsistencies between the airspeed measurements – likely due to the aircraft's pitot tubes being obstructed by ice crystals – caused the autopilot to disconnect, after which the crew reacted incorrectly and ultimately caused the aircraft to enter an aerodynamic stall, from which it did not recover.[page needed] The accident was the deadliest in the history of Air France. It was also the Airbus A330's second and deadliest accident and its first in commercial passenger service.
The aircraft departed from Rio de Janeiro–Galeão International Airport on 31 May 2009 at 19:29 local time (22:29 UTC), with a scheduled arrival at Paris-Charles de Gaulle Airport at 11:03 (09:03 UTC) the following day, after an estimated flight time of 10:34. The last voice contact with the aircraft was at 01:35 UTC, 3 hours and 6 minutes after the 22:29 UTC departure, when it reported that it had passed waypoint INTOL (1°21′39″S32°49′53″W / 1.36083°S 32.83139°W / -1.36083; -32.83139), located 565 km (351 mi) off Natal, on Brazil's north-eastern coast. The aircraft left Brazilian Atlantic radar surveillance at 01:49 UTC.
The Airbus A330 is designed to be flown by a crew of two pilots. However, because the 13-hour "duty time" (flight duration, plus pre-flight preparation) for the Rio-Paris route exceeds the maximum 10 hours permitted by Air France's procedures for pilots to operate an aircraft without a break, Flight 447 was crewed by three pilots: a captain and two first officers. With three pilots on board, each of them can take a rest during the flight, and for this purpose the A330 has a rest cabin, situated just behind the cockpit.
In accordance with common practice, the captain had sent one of the co-pilots for the first rest period with the intention of taking the second break himself. At 01:55 UTC, he woke the second pilot and said: "... he's going to take my place". After having attended the briefing between the two co-pilots, the captain left the cockpit to rest at 02:01:46 UTC. At 02:06 UTC, the pilot warned the cabin crew that they were about to enter an area of turbulence. Probably two to three minutes after this the aircraft encountered icing conditions (the cockpit voice recorder recorded what sounded like hail or graupel on the outside of the aircraft, and the engine anti-ice system came on) and ice crystals started to accumulate in the pitot tubes (pitot tubes are devices that provide critical information about how fast the aircraft is moving through the air). The pilots turned the aircraft slightly to the left and decreased its speed from Mach 0.82 to Mach 0.8 (the recommended "turbulence penetration speed").
At 02:10:05 UTC the autopilot disengaged because the blocked pitot tubes were no longer providing valid airspeed information, and the aircraft transitioned from normal law to alternate law 2. The engines' auto-thrust systems disengaged three seconds later. Without the auto-pilot, the aircraft started to roll to the right due to turbulence, and the pilot reacted by deflecting his side-stick to the left. One consequence of the change to alternate law was an increase in the aircraft's sensitivity to roll, and the pilot's input over-corrected for the initial upset. During the next 30 seconds, the aircraft rolled alternately left and right as the pilot adjusted to the altered handling characteristics of his aircraft. At the same time he made an abrupt nose-up input on the side-stick, an action that was unnecessary and excessive under the circumstances. The aircraft's stall warning sounded briefly twice due to the angle of attack tolerance being exceeded, and the aircraft's recorded airspeed dropped sharply from 274 knots (507 km/h; 315 mph) to 52 knots (96 km/h; 60 mph). The aircraft's angle of attack increased, and the aircraft started to climb above its cruising level of FL350. By the time the pilot had control of the aircraft's roll, it was climbing at nearly 7,000 feet per minute (36 m/s) (for comparison, typical normal rate of climb for modern airliners is only 2,000–3,000 feet per minute (10–15 m/s) at sea level, and much smaller at high altitude).
At 02:10:34 UTC, after displaying incorrectly for half a minute, the left-side instruments recorded a sharp rise in airspeed to 223 knots (413 km/h; 257 mph), as did the Integrated Standby Instrument System (ISIS) 33 seconds later (the right-side instruments are not recorded by the recorder). The icing event had lasted for just over a minute. The pilot continued making nose-up inputs. The trimmable horizontal stabilizer (THS) moved from three to 13 degrees nose-up in about one minute, and remained in that latter position until the end of the flight.
At 02:11:10 UTC, the aircraft had climbed to its maximum altitude of around 38,000 feet (12,000 m). There, its angle of attack was 16 degrees, and the engine thrust levers were in the fully forward Takeoff/Go-around detent (TOGA). As the aircraft began to descend, the angle of attack rapidly increased toward 30 degrees. A second consequence of the reconfiguration into alternate law was that stall protection no longer operated. Whereas in normal law, the aircraft's flight management computers would have acted to prevent such a high angle of attack, in alternate law this did not happen. (Indeed, the switch into alternate law occurred precisely because the computers, denied reliable speed data, were no longer able to provide such protection – nor many of the other functions expected of normal law). The wings lost lift and the aircraft stalled.[page needed]
At 02:11:40 UTC, the captain re-entered the cockpit. The angle of attack had then reached 40 degrees, and the aircraft had descended to 35,000 feet (11,000 m) with the engines running at almost 100% N1 (the rotational speed of the front intake fan, which delivers most of a turbofan engine's thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft's computer due to the high angle of attack. In other words, the aircraft had its nose above the horizon but was descending steeply. Roughly 20 seconds later, at 02:12 UTC, the pilot decreased the aircraft's pitch slightly, airspeed indications became valid and the stall warning sounded again and sounded intermittently for the remaining duration of the flight, but stopped when the pilot increased the aircraft's nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35 degrees. From the time the aircraft stalled until its impact with the ocean, the engines were primarily developing either 100 percent N1 or TOGA thrust, though they were briefly spooled down to about 50 percent N1 on two occasions. The engines always responded to commands and were developing in excess of 100 percent N1 when the flight ended.
The flight data recordings stopped at 02:14:28 UTC, or three hours 45 minutes after takeoff. At that point, the aircraft's ground speed was 107 knots (198 km/h; 123 mph), and it was descending at 10,912 feet per minute (55.43 m/s) (108 knots (200 km/h; 124 mph) of vertical speed). Its pitch was 16.2 degrees (nose up), with a roll angle of 5.3 degrees left. During its descent, the aircraft had turned more than 180 degrees to the right to a compass heading of 270 degrees. The aircraft remained stalled during its entire 3 minute 30 second descent from 38,000 feet (12,000 m) before it hit the ocean surface at a speed of 152 knots (282 km/h; 175 mph), comprising vertical and horizontal components of 108 knots (200 km/h; 124 mph) and 107 knots (198 km/h; 123 mph) respectively. The Airbus was destroyed on impact; all 228 passengers and crew on board died.
Air France's A330s are equipped with a communications system, Aircraft Communication Addressing and Reporting System (ACARS), which enables them to transmit data messages via VHF or satellite.[b] ACARS can be used by the aircraft's on-board computers to send messages automatically, and F-GZCP transmitted a position report approximately every ten minutes. Its final position report at 02:10:34 gave the aircraft's coordinates as 2°59′N30°35′W / 2.98°N 30.59°W / 2.98; -30.59.[c]
In addition to the routine position reports, F-GZCP's Centralized Maintenance System sent a series of messages via ACARS in the minutes immediately prior to its disappearance.[dead link] These messages, sent to prepare maintenance workers on the ground prior to arrival, were transmitted between 02:10 UTC and 02:15 UTC, and consisted of five failure reports and nineteen warnings. Until the black box flight recorders were recovered two years later, these messages represented the only recorded data available to the investigators. They offered a tantalizing but incomplete picture of what had happened to Flight 447.
Among the ACARS transmissions at 02:10 is one message that indicates a fault in the pitot-static system. Bruno Sinatti, president of Alter, Air France's third-biggest pilots' union, stated that "Piloting becomes very difficult, near impossible, without reliable speed data." The 12 warning messages with the same time code indicate that the autopilot and auto-thrust system had disengaged, that the TCAS was in fault mode, and flight mode went from 'normal law' to 'alternate law.'
The remainder of the messages occurred from 02:11 UTC to 02:14 UTC, containing a fault message for an Air Data Inertial Reference Unit (ADIRU) and the Integrated Standby Instrument System (ISIS). At 02:12 UTC, a warning message NAV ADR DISAGREE indicated that there was a disagreement between the three independent air data systems.[d] At 02:13 UTC, a fault message for the flight management guidance and envelope computer was sent. One of the two final messages transmitted at 02:14 UTC was a warning referring to the air data reference system, the other ADVISORY was a "cabin vertical speed warning", indicating that the aircraft was descending at a high rate.
Weather conditions in the mid-Atlantic were normal for the time of year, and included a broad band of thunderstorms along the Intertropical Convergence Zone (ITCZ). A meteorological analysis of the area surrounding the flight path showed a mesoscale convective system extending to an altitude of around 50,000 feet (15,000 m) above the Atlantic Ocean before Flight 447 disappeared. During its final hour, Flight 447 encountered areas of light turbulence.
Commercial air transport crews routinely encounter this type of storm in this area. With the aircraft under the control of its automated systems, one of the main tasks occupying the cockpit crew was that of monitoring the progress of the flight through the ITCZ, using the on-board weather radar to avoid areas of significant turbulence. Twelve other flights shared more or less the same route that Flight 447 was using at the time of the accident.
Search and recovery
Flight 447 was due to pass from Brazilian airspace into Senegalese airspace at approximately 02:20 (UTC) on 1 June, and then into Cape Verdean airspace at approximately 03:45. Shortly after 04:00, when the flight had failed to contact air traffic control in either Senegal or Cape Verde, the controller in Senegal attempted to contact the aircraft. When he received no response, he asked the crew of another Air France flight (AF459) to try to contact AF447; this also met with no success.
After further attempts to contact Flight 447 were unsuccessful, an aerial search for the missing Airbus commenced from both sides of the Atlantic. Brazilian Air Force aircraft from the archipelago of Fernando de Noronha and French reconnaissance aircraft based in Dakar, Senegal led the search. They were assisted by a Casa 235 maritime patrol aircraft from Spain and a US Navy Lockheed Martin P-3 Orion anti-submarine warfare and maritime patrol aircraft.
By early afternoon on 1 June, officials with Air France and the French government had already presumed that the aircraft had been lost with no survivors. An Air France spokesperson told L'Express that there was "no hope for survivors", and French PresidentNicolas Sarkozy announced that there was almost no chance anyone survived. On 2 June at 15:20 (UTC), a Brazilian Air Force Embraer R-99A spotted wreckage and signs of oil, possibly jet fuel, strewn along a 5 km (3 mi) band 650 km (400 mi) north-east of Fernando de Noronha Island, near the Saint Peter and Saint Paul Archipelago. The sighted wreckage included an aircraft seat, an orange buoy, a barrel, and "white pieces and electrical conductors". Later that day, after meeting with relatives of the Brazilians on the aircraft, Brazilian Defence MinisterNelson Jobim announced that the Air Force believed the wreckage was from Flight 447. Brazilian vice-president José Alencar (acting as president since Luiz Inácio Lula da Silva was out of the country) declared three days of official mourning.
Also on 2 June, two French Navy vessels, the frigate Ventôse and helicopter-carrier Mistral, were en route to the suspected crash site. Other ships sent to the site included the French research vessel Pourquoi Pas?, equipped with two mini-submarines able to descend to 6,000 m (20,000 ft), since the area of the Atlantic in which the aircraft went down was thought to be as deep as 4,700 m (15,400 ft).
On 3 June, the first Brazilian Navy ship, the patrol boatGrajaú, reached the area in which the first debris was spotted. The Brazilian Navy sent a total of five ships to the debris site; the frigateConstituição and the corvetteCaboclo were scheduled to reach the area on 4 June, the frigate Bosísio on 6 June and the replenishment oilerAlmirante Gastão Motta on 7 June.
Early on 6 June 2009, five days after Flight 447 disappeared, two male bodies, the first to be recovered from the crashed aircraft, were brought on board the Caboclo along with a seat, a nylon backpack containing a computer and vaccination card, and a leather briefcase containing a boarding pass for the Air France flight. The following day, 7 June, search crews recovered the Airbus's vertical stabilizer, the first major piece of wreckage to be discovered. Pictures of this part being lifted onto the Constituição became a poignant symbol of the loss of the Air France craft.[page needed]
The search and recovery effort reached its peak over the next week or so, as the number of personnel mobilized by the Brazilian military exceeded 1100.[e] Fifteen aircraft (including two helicopters) were devoted to the search mission. The Brazilian Air Force Embraer R99 flew a total of more than 100 hours, and electronically scanned more than a million square kilometers of ocean. Other aircraft involved in the search scanned, visually, 320,000 square kilometres of ocean and were used to direct Navy vessels involved in the recovery effort.
By 16 June 2009 a total of 50 bodies had been recovered from a wide area of the ocean. The bodies were transported to shore, first by the frigates Constituição and Bosísio to the islands of Fernando de Noronha and thereafter by air to Recife for identification. Pathologists identified all 50 bodies recovered from the crash site, including that of the captain, by using dental records and fingerprints. The search teams logged the time and location of every find in a database which, by the time the search ended on 26 June, catalogued 640 items of debris from the aircraft.
The BEA documented the timeline of discoveries in its first interim report.
On 5 June 2009, the French nuclear submarineÉmeraude was dispatched to the crash zone, arriving in the area on the 10th. Its mission was to assist in the search for the missing flight recorders or "black-boxes" that might be located at great depth. The submarine would use its sonar to listen for the ultrasonic signal emitted by the black boxes' "pingers", covering 13 sq mi (34 km2) a day. The Émeraude was to work with the mini-subNautile, which can descend to the ocean floor. The French submarines would be aided by two U.S. underwater audio devices capable of picking up signals at a depth of 20,000 ft (6,100 m).
Following the end of the search for bodies, the search continued for the flight data recorder and the cockpit voice recorder, the so-called "black boxes". French Bureau d'Enquetes et d'Analyses (BEA) chief Paul-Louis Arslanian said that he was not optimistic about finding them since they might have been under as much as 3,000 m (9,800 ft) of water, and the terrain under this portion of the ocean was very rugged. Investigators were hoping to find the aircraft's lower aft section, since that was where the recorders were located. Although France had never recovered a flight recorder from such depths, there was precedent for such an operation: in 1988, an independent contractor recovered the cockpit voice recorder of South African Airways Flight 295 from a depth of 4,900 m (16,100 ft) in a search area of between 80 and 250 square nautical miles (270 and 860 km2). The Air France flight recorders were fitted with water-activated acoustic underwater locator beacons or "pingers", which should have remained active for at least 30 days, giving searchers that much time to locate the origin of the signals.
France requested two "towed pinger locator hydrophones" from the United States Navy to help find the aircraft. The French nuclear submarine and two French-contracted ships (the Fairmount Expedition and the Fairmount Glacier, towing the U.S. Navy listening devices) trawled a search area with a radius of 80 kilometres (50 mi), centred on the aircraft's last known position. By mid-July, recovery of the black boxes still had not been announced. The finite beacon battery life meant that, as the time since the crash elapsed, the likelihood of location diminished. In late July, the search for the black boxes entered its second phase, with a French research vessel resuming the search using a towed sonar array. The second phase of the search ended on 20 August without finding wreckage within a 75 km (47 mi) radius of the last position, as reported at 02:10.
The third phase of the search for the recorders lasted from 2 April until 24 May 2010, and was conducted by two ships, the Anne Candies and the Seabed Worker. The Anne Candies towed a U.S. Navy sonar array, while the Seabed Worker operated three robot submarinesAUV ABYSS (a REMUS AUV type). Air France and Airbus jointly funded the third phase of the search. The search covered an area of 6,300 square kilometres (2,400 sq mi), mostly to the north and north-west of the aircraft's last known position. The search area had been drawn up by oceanographers from France, Russia, Great Britain and the United States combining data on the location of floating bodies and wreckage, and currents in the mid-Atlantic in the days immediately after the crash. A smaller area to the south-west was also searched, based on a re-analysis of sonar recordings made by Émeraude the previous year. The third phase of the search ended on 24 May 2010 without any success, though the BEA says that the search 'nearly' covered the whole area drawn up by investigators.
2011 search and recovery
In July 2010, the U.S.-based search consultancy Metron, Inc. had been engaged to draw up a probability map of where to focus the search, based on prior probabilities from flight data and local condition reports, combined with the results from the previous searches. The Metron team used what it described as "classic" Bayesian search methods, an approach that had previously been successful in the search for the submarine USS Scorpion and SS Central America. Phase 4 of the search operation started close to the aircraft's last known position, which was identified by the Metron study as being the most likely resting place of flight 447.
Within a week of resuming of the search operation, on 3 April 2011, a team led by the Woods Hole Oceanographic Institution operating full ocean depth autonomous underwater vehicles (AUVs) owned by the Waitt Institute discovered, by means of sidescan sonar, a large portion of the debris field from flight AF447. Further debris and bodies, still trapped in the partly intact remains of the aircraft's fuselage, were located at a depth of 3,980 metres (2,180 fathoms; 13,060 ft). The debris was found to be lying in a relatively flat and silty area of the ocean floor (as opposed to the extremely mountainous topography that was originally believed to be AF447's final resting place). Other items found were engines, wing parts and the landing gear.
The debris field was described as "quite compact", measuring 200 by 600 metres (660 by 1,970 ft) and located a short distance north of where pieces of wreckage had been recovered previously, suggesting that the aircraft hit the water largely intact. The French Ecology and Transportation Minister Nathalie Kosciusko-Morizet stated the bodies and wreckage would be brought to the surface and taken to France for examination and identification. The French government chartered the Île de Sein to recover the flight recorders from the wreckage. An American Remora 6000 remotely operated vehicle (ROV)[g] and operations crew from Phoenix International experienced in the recovery of aircraft for the United States Navy were on board the Île de Sein.
Île de Sein arrived at the crash site on 26 April, and during its first dive, the Remora 6000 found the flight data recorder chassis, although without the crash-survivable memory unit. On 1 May the memory unit was found and lifted on board the Île de Sein by the ROV. The aircraft's cockpit voice recorder was found on 2 May 2011, and was raised and brought on board the Île de Sein the following day.
On 7 May the flight recorders, under judicial seal, were taken aboard the French Navy patrol boat La Capricieuse for transfer to the port of Cayenne. From there they were transported by air to the BEA's office in Le Bourget near Paris for data download and analysis. One engine and the avionics bay, containing onboard computers, had also been raised.
By 15 May all the data from both the flight data recorder and the cockpit voice recorder had been downloaded. The data was subjected to detailed in-depth analysis over the following weeks, and the findings published in the third interim report at the end of July. The entire download was filmed and recorded.
Between 5 May and 3 June 2011, 104 bodies were recovered from the wreckage, bringing the total number of bodies found to 154. Fifty bodies had been previously recovered from the sea. The search ended with the remaining 74 bodies still unrecovered.
The aircraft involved in the accident was an Airbus A330-203, with manufacturer serial number 660, registered as F-GZCP. This airliner's first flight was on 25 February 2005, and it was Air France's newest A330 at the time of the crash. The aircraft was powered by two General Electric CF6-80E1A3 engines with a maximum thrust of 68,530/60,400 lb (take-off/max continuous) giving it a cruise speed range of Mach 0.82–0.86 (871–913 km/h, 470–493 knots, 540–566 mph), at 35,000 ft (10.7 km altitude) and a range of 12,500 km (6750 nmi, 7760 statute miles). On 17 August 2006, this A330 was involved in a ground collision with Airbus A321-211 F-GTAM, at Charles de Gaulle Airport, Paris. F-GTAM was substantially damaged while F-GZCP suffered only minor damage. The aircraft underwent a major overhaul on 16 April 2009 and at the time of the accident had accumulated about 19,000 flying hours.
Passengers and crew
The aircraft was carrying 216 passengers, three aircrew and nine cabin crew in two cabins of service. Among the 216 passengers were 126 men, 82 women and eight children (including one infant).