BEA Appendix List – ChinaView (35 Identified) – Podcast – 1.16.2 ACAR Msgs – Eurocockpit


List of Appendices

The appendices to this report are available, in French, via the BEA website.

Appendix 1 Meteorological study undertaken by Météo France
Appendix 2 TEMSI SOUTH AMERICA chart for 1st June at 0 h 00 between FL 250 and 630
Appendix 3 Transcript of radio communications concerning flight AF447
Appendix 4 Chronology of recovery of bodies and airplane parts
Appendix 5 Reference of procedures associated with some ECAM messages
Appendix 6 ATC flight plan supplied by Air France
Appendix 7 Study of dossier routes and associated fuel
Appendix 8 Extract from Air France manual on fuel policy
Appendix 9 Procedure for flight with unreliable IAS / ADR check

Note:  This explains the different in size and page count between English and French version.

“This interim report has been translated and published by the BEA to make its reading easier for English-speaking people.  As accurate as the translation may be, the original text in French should be considered as the work of reference.”

BEA REPORT (FRENCH) pdf – 128 pages

ENGLISH VERSION pdf – 72 pages


Another 21 bodies rescued from Air France Flight 447 identified (Emphasis mine) 2009-07-02 06:08:21

RIO DE JANEIRO, July 1 (Xinhua) — Brazil’s Federal Police informed on Wednesday that the bodies of other 21 occupants of Air France’s Flight 447, which crashed over the Atlantic a month ago, were identified.

With that, the total number of identified bodies increased to 35. The plane’s pilot and at least one other member of the crew are among those.

The names of the victims will not be disclosed, by request of their families, but it is known that the remains belong to four Brazilians and 17 foreign citizens. The Brazilians are two males and two females; the foreigners are six males and 11 females.

According to the Federal Police, out of the 21 bodies, five were identified through dental records, eight through DNA tests, two through fingerprints and dental records, and six through dental records and DNA tests.

Editor: Yan


66 minutes podcast discussing the interim report with 2 FBW-Airbus pilots

Use the English pdf file to follow along.  Good discussion on the cockpit displays and warnings…


BEA Interim Report – 1.16.2 ACARS messages ATC messages

No ATC messages were received or transmitted by F-GZCP. Only three attempts were made to connect up to the Dakar centre ADS-C system and were recorded on 1st June at 1 h 33, 1 h 35 and 2 h 01. The three requests were refused with a FAK4 code, meaning that the control system had detected the absence of a flight plan for this aircraft or that there was a mismatch between the flight plan filed for this registration number, the flight number and the reported position. Operational messages

The first position message (AOC type message) was transmitted on 31 May at 22 h 39. On 1st June at 2 h 10 min 34, the last position received was latitude +2.98° (North) and longitude -030.59° (West). The position transmitted was the aircraft’s FM position which, in normal conditions, is close to the GPS position. Other operational messages were sent to the aircraft, including aircraft loading data (load sheet), takeoff charts and meteorological information. Maintenance messages

Twenty-six maintenance messages relative to flight AF447 were received. Twenty-four of them were received on 1st June between 2 h 10 and 2 h 15. The first two messages were received the day before at 22 h 45. These were a class 2 fault message and a related MAINTENANCE STATUS TOILET cockpit effect message. The fault message, “LAV CONFIGURATION” (ATA 383100, source VSC*, HARD) represented a toilet configuration difference between the airplane and that included in one of the associated systems. (Emphasis mine) Analysis of the messages received on 1st June from 2 h 10 onwards

The messages received on 1st June after 2 h 10 all transited via the same satellite (Atlantic Ocean West, operated by the Inmarsat Company) and SITA’s ACARS network. The twentyfour raw maintenance messages are listed in the table below:

Time of reception17 Message

2:10:10 – .1/WRN/WN0906010210 221002006AUTO FLT AP OFF

2:10:16 – .1/WRN/WN0906010210 226201006AUTO FLT REAC W/S DET FAULT

2:10:23 – .1/WRN/WN0906010210 279100506F/CTL ALTN LAW

2:10:29 – .1/WRN/WN0906010210 228300206FLAG ON CAPT PFD SPD LIMIT

2:10:34 #0210/+2.98-30.59

2:10:41 – .1/WRN/WN0906010210 228301206FLAG ON F/O PFD SPD LIMIT

2:10:47 – .1/WRN/WN0906010210 223002506AUTO FLT A/THR OFF

2:10:54 – .1/WRN/WN0906010210 344300506NAV TCAS FAULT

2:11:00 – .1/WRN/WN0906010210 228300106FLAG ON CAPT PFD FD

2:11:15 – .1/WRN/WN0906010210 228301106FLAG ON F/O PFD FD

2:11:21 – .1/WRN/WN0906010210 272302006F/CTL RUD TRV LIM FAULT

2:11:27 – .1/WRN/WN0906010210 279045506MAINTENANCE STATUS EFCS 2

2:11:42 – .1/WRN/WN0906010210 279045006MAINTENANCE STATUS EFCS 1

2:11:49 – .1/FLR/FR0906010210 34111506EFCS2 1,EFCS1,AFS,,,,,PROBE-PITOT1X2 / 2X3 / 1X3 (9DA),HARD

2:11:55 – .1/FLR/FR0906010210 27933406EFCS1 X2,EFCS2X,,,,,,FCPC2 (2CE2)/WRG:ADIRU1 BUS ADR1-2 TO FCPC2,HARD

2:12:10 – .1/WRN/WN0906010211 341200106FLAG ON CAPT PFD FPV

2:12:16 – .1/WRN/WN0906010211 341201106FLAG ON F/O PFD FPV

2:12:51 – .1/WRN/WN0906010212 341040006NAV ADR DISAGREE

2:13:8 – .1/FLR/FR0906010211 34220006ISIS 1,,,,,,,ISIS(22FN-10FC) SPEED ORMACH FUNCTION,HARD

2:13:14 – .1/FLR/FR0906010211 34123406IR2 1,EFCS1X,IR1,IR3,,,,ADIRU2(1FP2),HARD

2:13:45 – .1/WRN/WN0906010213 279002506F/CTL PRIM 1 FAULT

2:13:51 – .1/WRN/WN0906010213 279004006F/CTL SEC 1 FAULT

:14:14 – .1/WRN/WN0906010214 341036006MAINTENANCE STATUS ADR 2

2:14:20 – .1/FLR/FR0906010213 22833406AFS1,,,,,,,FMGEC1(1CA1),INTERMITTENT

2:14:26 – .1/WRN/WN0906010214 213100206ADVISORY CABIN VERTICAL SPEED

Note: A position report message (AOC type) was received at 2 h 10 min 34 s, between two maintenance messages. This can be explained by the fact that AOC messages take priority over maintenance messages.

The reception time given is that of the service provider’s server processor

The messages were at least five or six seconds apart, which can be explained by the limited rate of communication by satellite. There are two possible reasons for the longer gaps: either the aircraft did not have any messages to transmit, or it no longer had the means for doing so (loss of satellite communication performance, for example).

The company that operates the satellite used by AF447 has provided the traces of themessages transmitted to the aircraft and seen by the satellite. The information analysed allows us to say that:

  • • the last message was transmitted to the aircraft at 2 h 14 min 28 s and was effectively received, • the twenty-five messages transmitted by the aircraft were correctly received by the ground station,
  • • the gap observed between the message sent at 2 h 13 min 14 s and the one sent at2 h 13 min 45 s is due, at least in part, to a temporary interruption in the communication link between the aircraft and the satellite,
  • • there were no satellite telephone communications during the flight.


Interpretation of the messages

Interpretation of the maintenance-related messages is made delicate by the following factors:

  • • this type of message is only transmitted once, at the first occurrence. It can only indicate that a fault has appeared. If the fault has disappeared, no message is transmitted to indicate this,
  • • some messages concerning the aircraft’s configuration such as stall or overspeed warnings are not recorded,
  • • message-timing by the CMC is accurate to within one minute,
  • • the order in which these messages are transmitted does not necessarily correspond to the associated sequence of events,
  • • the limited rate of communication by satellite does not make it possible to determine directly the time of message reception precisely to the nearest second,
  • • in the CFR, a class 1 fault message is not necessarily accompanied by a cockpit effect, and it is possible that a cockpit effect message is not the consequence of a fault message.

Fault messages are identified by the letters FLR (for “failure”) at the beginning of the message, and cockpit effect messages by the letters WRN (for “warning”):

fault: – .1/FLR/FR0906010211 34123406IR2 1,EFCS1X,IR1,IR3,,,,ADIRU2 (1FP2),HARDcockpit effect: – .1/WRN/WN0906010210 221002006AUTO FLT AP OFF

The information contained in a message differs depending on the type of message. Some of this information may be common:


Analysis of the cockpit effect messages

Note: when cockpit effect type messages are associated with procedures, the latter are referenced in appendix 5.

The cockpit effect messages are described in the order in which they appear on the CFR.  The theoretical symptoms in the cockpit are given for each one taken separately: the ECAM message, the visual and aural warnings, the SD page called up and the local alarms that correspond to it.

AUTO FLT AP OFF (2 h 10)

AUTO FLT AP OFF Cavalry charge Master warning – – no Meaning: This message indicates an autopilot disconnection other than by pressing thepush-button provided for that purpose on the control sticks (instinctive disconnect).


AUTO FLT REAC W/S DET FAULT Single chime Master caution – – no Meaning: This message indicates unavailability of the reaction to wind shear detection function.

o F/CTL ALTN LAW (2 h 10)

F/CTL ALTN LAW (PROT LOST) Single chime Master caution – – no The green symbols showing the attitude protections on the PFD are replaced by ambercrosses. Meaning: This message indicates switching to alternate flight control law.


Symptoms: Disappearance of the display of the characteristic speeds (in particular VLS and green dot) on the Captain and First Officer PFDs, with display of the SPD LIM flag at the bottom of the speed scales. Meaning: This message indicates the unavailability of the FMGEC’s characteristic speed calculation function.

o AUTO FLT A/THR OFF (2 h 10)

AUTO FLT A/THR OFF Single chime Master caution – – no Meaning: This message indicates disconnection of the auto-thrust other than by pressing the button provided for that purpose on the throttle control levers (instinctive disconnect) or that the throttle control levers were moved to the idle notch.

o NAV TCAS FAULT (2 h 10)

NAV TCAS FAULT – – – Flag on PFD and Meaning: This message indicates that the TCAS is inoperative. At this stage of the investigation, this message has not been fully explained.


Symptoms: Disappearance of the Flight Director on the PFDs, Captain and First Officer sides, and display of the red FD flag. Meaning: This message indicates the Flight Director function is selected and unavailable.


F/CTL RUD TRV LIM FAULT Single chime Master caution F/CTL – no Meaning: This message indicates the unavailability of the rudder deflection limitation calculation function. The limitation value remains frozen at the current value at the time of the failure (until the slats extension command is given).


These ECAM messages are not brought to the attention of the crew in flight.


Symptoms: Disappearance of the FPV (bird) on the PFDs, Captain and First Officer sides, and display of the red FPV flag. Meaning: This message indicates that the FPV function is selected and unavailable.


NAV ADR DISAGREE Single chime Master caution – – no Meaning: This message indicates that the EFCSs have rejected an ADR, and then identified an inconsistency between the two remaining ADRs on one of the monitored parameters.

o F/CTL PRIM 1 FAULT (2 h 13)

F/CTL PRIM 1 FAULT Single chime Master caution F/CTL Meaning: This message indicates that FCPC1 (PRIM 1) has stopped functioning. This shutdown could be the result of a command or of a failure.

o F/CTL SEC 1 FAULT (2 h 13)

F/CTL SEC 1 FAULT Single chime Master caution F/CTL Meaning: This message indicates that FCSC1 (SEC 1) has stopped functioning. This shutdown could be the result of a command or of a failure.


This ECAM message is not brought to the attention of the crew in flight.


Symptoms: Flashing of the cabin vertical speed indicator on the SD’s PRESS page. Meaning: This message indicates a cabin altitude variation greater, as an absolute value, than 1,800 ft/min for five seconds.

Analysis of the fault messages

Five fault messages were received by ACARS. They are described in the order in which they appear in the CFR.

o PROBE PITOT 1+2 / 2+3 / 1+3 (9DA) (2 h 10)

ATA: 341115

Source: EFCS2

Identifiers: EFCS1, AFS

Class 1, HARD

This message, transmitted by the FCDC2 (EFCS2), means that the FCPCs (or PRIMs) triggered one of the speed monitoring processes: they have detected a decrease of more than 30 kt in one second of the “polled” speed value. The three ADRs were considered valid by the EFCS2 at the time the monitoring was triggered, because the prior rejection of an ADR would have generated a class 2 fault message and there would therefore have been an asterisk in front of the source. In this case, the “polled” value is the median value.

At the time this monitoring is triggered, the FCPCs open a window during which they operate with alternate 2 law (see following graphic). The rudder deflection limitation function is also frozen, but the associated alarm is inhibited. At the end of the window, if the difference between the values polled at each end of that window is less than 50 kt, the FCPCs return to normal law. Otherwise, they continue in alternate 2 law, the rudder deflection limitation function remains unavailable and the corresponding alarm is generated.

Note: the alternate 2 control law is a load factor law for pitch and a direct law for roll. Only the load factor protection remains available. In certain cases, the high and low speed stabilities may also be lost.


The presence of the F/CTL RUD TRV LIM FAULT message indicates that EFCS monitoring had been activated and that the alternate law had been maintained. The rudder deflection limitation value then remained the same as that before monitoring was triggered. The identifiers are:

  • • EFCS1: the FCDC1 is a clone of FCDC2 and it is therefore probable that the message transmitted by EFCS1 was the same. However, it is not possible to state this categorically at this stage of the investigation because around twenty messages can be generated by the EFCSs with an ATA code starting with 341.
  • • AFS: it does not perform this specific monitoring but can generate a message with an ATA code starting with 341 further to the triggering of another monitoring process that does not explicitly point to the speeds, unlike FCPC monitoring. The fact that the AFS is an identifier nevertheless implies that the monitoring was triggered in the same minute as that of EFCS2 monitoring.

This message, in itself, and the identifiers that are associated with it therefore indicate the triggering of distinct monitoring processes, one of which is explicitly linked to the speeds delivered by the ADRs. The combined triggering of these monitoring processes has the following effects:

  • • at the level of the EFCSs:

o switch to alternate 2 control law,

o unavailability of the rudder deflection limitation function which occurs, when applicable, ten seconds later.

  • • at the level of the AFS:

o unavailability of the autopilot,

o unavailability of the auto-thrust,

o unavailability of the flight director function,

o unavailability of the characteristic speeds calculation function,

o unavailability of the reaction to wind shear detection function.

o FCPC2(2CE2)/WRG:ADIRU1 BUS ADR1-2 TO FCPC2 (2 h 10)

ATA: 279334

Source: *EFCS1

Identifiers: *EFCS2

Class 2, HARD

This message indicates that FCPC 2 no longer considers as valid the information that is

delivered to it by ADR 1 (via bus 2). The ATA code beginning with 27 indicates that the fault was not detected by any other FCPC during the three seconds that followed (otherwise this message would have been classified ATA 34). This message has not been fully explained at this stage of the investigation.


ATA: 342200

Source: ISIS

Identifiers: –

Class 1, HARD

This message, transmitted by the ISIS, may be the consequence of:

  • • an internal failure at the level of the CAS or Mach elaboration function,
  • • CAS or Mach values that are outside certain limits.

If the CAS is outside those limits, the SPD flag is displayed on the ISIS speed scale. If the Mach exceeds the upper limit, the M flag is displayed instead of the Mach. If it is lower than the lower limit, the Mach value is no longer displayed but this flag does not appear. The display of these flags is not captured by the CMC that the aircraft was equipped with.

o ADIRU2 (1FP2) (2 h 11)

ATA: 341234

Source: IR2

Identifiers: *EFCS1, IR1, IR3

Class 1, HARD

This message has not been fully explained at this stage of the investigation. It was generated by IR 2, but it is possible that the correlation window had been opened by EFCS 1 via a class 2 message.

o FMGEC1 (1CA1) (2 h 13)

ATA: 228334

Source: AFS

Identifiers: –


This message has not been fully explained at this stage of the investigation. The fact that it was “INTERMITTENT” means that the fault was detected for less than 2.5 seconds. Partial conclusion

At this stage of the investigation, the messages analysed allow us to conclude that various monitoring processes were triggered. At least one of them corresponds to an inconsistency in the speed measurements. Several of the cockpit effects messages recorded could correspond to the consequences of these monitoring processes:


Note: the CFR was designed to facilitate maintenance operations; it is therefore not intended to be used for investigation purposes.


In anticipation of BEA not really providing anything new, Eurocockpit offered their own safety recommendations and corrective actions prior to the BEA Press Conference.  They are not always right however they seem to have inside sources!


AF 447: the accident, the safety recommendations and corrective actions

publié le 2 juillet 2009 à 11:30 par EuroCockpit. (English Translation)(Emphasis mine)

Under Annex 13 of ICAO, a “preliminary report” should be established within 30 days following an accident to “promptly disseminate the information obtained in the early stages of investigation.” As everyone can read on page 4 of ICAO document 9156 (eg preliminary report), this type of reporting should describe the facts, but also include recommendations and corrective actions taken or security to the study

It is itself does not qu ‘Eurocockpit impudence to think they can issue a “preliminary report” when it returned to its extreme Sufficiency and his team of investigators from many diffuse, today July 2, such a report describing the facts without forgetting to specify the corrective measures and safety recommendations adopted or under considerationWe will therefore, for our part, to postpone the facts that we can and offer some modest corrective actions or recommendations which, in the present state of our information, we have emerged – a minimum – relevant …!

As ‘systematically the NTSB said in its very preliminary reports seriously and that our approach is therefore different, we note here that the following items, despite all our checks, contain errors and that they would be corrected when the report Final accident will be available

On 1 June 2009, around 4:14 am Paris time (2:14 UTC), an Airbus A330, registration F-GZCP, operated by the Company on the Air France flight AF 447 Rio (GIG) – Paris (CDG) has disappeared over in the South Atlantic. 216 passengers and 12 crew members perished in the accident. Debris of the aircraft and that 51 bodies have so far been found and recovered during the search operation launched by Brazil and France. The flight recorders (black boxes) have still not been located and, probably based on several thousands of meters under water for a month, are unlikely to be recoverable.

In the last minutes before the disappearance of the aircraft, the system of automatic pilot – ACARS – chronologically sent to Air France a number of written messages. These messages were of two kinds of messages and failure messages (consecutive) alarm.

The analysis of these messages shows that aircraft systems have been successively detected in failure, leading to a situation such that there had lost control of the aircraft.

Annex 1, below, explains in detail the succession of failures and alarms to which the crew was confronted. This schedule, very technical, is explained as much as possible. This desire for simplification in the explanation does not of course an absolute technical rigor.

At this stage of thinking and taking into account the facts known, the reading of this Annex, however, lead to two factual findings: the crew was forced to cope with a situation covered by the inevitable: many questions must be asked at BEA to begin …

As such, Annex 2 contains questions that seem relevant to its extreme Sufficiency, if he is able to monitor and respond to the theories that smokers heard by them or by it is not a veil pudique too easily thrown on a truth that seems to bother many people …

Annex 3 contains safety recommendations and corrective measures in the light of these facts and considerations, seem to be taken or made in the study, quickly …

Finally an annex 4 provides an alphabetical glossary to help the understanding of technical terms and explain their meaning. Eurocockpit hope you enjoy reading, then a press conference at BEA.


1.  2h10 UTC

Fault messages EFCS2 34-11-15 PROBE-PITOT… et EFCS1 27-93-34 FCPC2/WRG… were issued by the aircraft.

  • The failure EFCS2 34-11-15 PITOT PROBE-1 +2 / 2 +3 / 1 +3 (9DA) indicates the failure of pitot tubes information that “total pressure” to ADR to calculate speed. This failure causes the loss of transmission of this pressure or total transmission of an erroneous value. This leads to erroneous calculation of speed by the ADR and probably different between the ADR, which can not discriminate among them a possible ADR valid.

This failure has generated cockpit likely multiple concurrent alarms. These alarms, visible also in the list of ACARS messages sent automatically by the aircraft, are as follows:

    • AUTO FLT AP OFF: disconnection of the autopilot. This disconnect is the difference of velocity values calculated by the ADR 1 and ADR 2 following the failure of the pitot probes. The FMGEC are the first to react to this failure and trigger disconnection of the autopilot as they have enough information to speed valid or relevant for the autopilot to continue to ensure safe control of the trajectory. To avoid a bad guide device based on inaccurate data, the autopilot is disconnected by the FMGEC. An audible alarm type “cavalry charge” sound continuously in the cockpit and a red master warning lights flashing continuously in the cockpit. The crew therefore had to take immediate control of the manual steering of the aircraft, which monopolizes much attention and resources.
    • AUTO FLT A/THR OFF:  disconnection of the self-thrust, the system automatically thrust engine which has the primary function of maintaining cruise speed (or Mach number) selected. This disconnect results from the same problem of calculating speed from ADR following the failure of the pitot probes. The FMGEC also respond by ordering the immediate and automatic disconnection of the A / THR because there is insufficient information available or relevant speed to ensure the correct control of the thrust due to the inconsistency of at least two ADR. An audible warning ‘gong monocoup “sounds and a light amber master caution” lights up and flashes to the cockpit. The thrust of the engines was probably frozen at the value as before disconnection, on Airbus A330, the thrust levers are fixed and serrated in the “climb” throughout the cruise. In other words, the position of the thrust levers do not reflect the value of thrust (sic) … The result is a message “THR LK” flashing amber annunciator panel mode (FMA) on the main screen steering (PFD) for each driver, an alarm amber “ENGINE THRUST LOCKED” repeated every 5 seconds ECAM appearance with the message “THR LEVERS MOVE” and the simultaneous repetition of the alarm sound “gong monocoup” every 5 seconds … The crew was forced to resume manual control of the thrust of the engines emitting guts “climb” the thrust levers to silence the alarm. In doing so, the instantaneous value of the thrust has necessarily been modified to reach the value corresponding to the position of joysticks and out of step “climb” means either a flare close to the maximum “climb”. Therefore in accordance with the message “THR LEVERS MOVE”, which was accompanied by the repetition of an audible alarm every 5 seconds up action of the crew, it could not maintain the surge in force before disconnection Automatic A / THR. The control of the aircraft has probably found complicated.
    • FLAG ON CPT PFD FD: the flight director (FD) of the captain, having levels of guidance from FMGEC is no longer available. The failure of the Pitot causing miscalculation of the speed by the various ADR, FMGEC not able to calculate the levels of guidance trajectory normally presented to the crew by the “flight director (FD). It disappears from the screen therefore Steering (PFD) of the commander. This loss of FD is related to failure (partial or total) of two ADR.
    • FLAG ON F/O PFD FD:  the flight director of officer is similarly unavailable. Private on 2 FD PFD, the crew was obliged to control the trajectory of the airplane while it no longer had the presentation of the trajectory required on the PFD.
    • F/CTL ALTN LAW: the laws of the flight degrade and pass the law “normal” to an alternative type 2 (Alternate Law 2) because of erroneous values and divergent anemometric transmitted by ADR following the failure Pitot. This mode of computers of the flight results in the loss of a number of “safeguards” to prevent the aircraft out of the flight envelope in which, only, it is still controllable in flight … Thus, in alternate law Type 2, the following safeguards are lost: low speed (low energy), high speed (high speed – because of ADR disagree), attitude (pitch attitude), high impact (high aoa – because of ADR disagree), and slope (bank angle). Piloting the plane is seriously complicated and the device is capable, fault protection, out of the flight envelope by picking (at low speed disbonding nets air on the surface of the wing or speed too high Transonic phenomenon on the wing).
    • F/CTL RUD TRV LIM FAULT: limiting deflection of the rudder (rudder) is lost. This limitation is directly and proportionately related to the speed of the device (lower travel at high speed). The loss of information from reliable speed therefore leads EFCS could no longer determine the limits of travel required. The system was therefore down and flat rate travel is limited to a fixed value.
    • FLAG ON CAPT PFD SPD LIMIT: disappearance of references and bandeaux minimum speed and maximum screen steering (PFD) of the commander. The calculation and presentation of high and low limits of speed (low stall speed MMO Max, etc..) Corresponding to the flight envelope determined by the FMGEC are invalid.
    • FLAG ON F/O PFD SPD LIMIT: same phenomenon in the first screen. The crew does more than the materialization of its instruments on the envelope and the limits of the flight envelope of the aircraft at the altitude at which it flies. Cruise, so at high altitude, this area of flight is reduced and the margin between the minimum speed and maximum speed is very low.
    • AUTO FLT REAC W/S DET FAULT: calculation of protection against wind shear (windshear), prepared by the FMGEC from information including speed variations in speed, is invalid due to the loss of reliable information of velocity and discharge at least two of the ADR system AUTO FLIGHT.
    • NAV TCAS FAULT: the collision avoidance (Traffic Collision Avoidance System) is down since the failure of ADRs due to the failure of the Pitot tube, causes the loss of this system by failure of the transponder 1 (if select – because of the failure of ADR 1) or transponder 2 (Select if – due to the failure of ADR 2). The loss of mode C leads to loss of function TCAS.
  • The failure EFCS1 27-93-34 FCPC2 (2CE2) / WRG: ADIRU1 BUS 2 TO ADR1-FCPC2 appears in the same minute. It is obviously the consequence of the failure of Pitot. This failure was accompanied on the STATUS page of the screen SD (system display) in the cockpit, by the messages MAINTENANCE STATUS EFCS EFCS 1 and 2. These messages indicate fluctuations and inconsistencies ADR.

This failure indicates that EFCS (management system of the flight) the calculation FCPC2 (or ultimately wiring and transmitting the information from the ADR of ADIRU1) as defaulter. This message indicates that the probability of failure the most important is the FCPC2 which receives more information from the ADR 1 and 2, which were rejected. The ADIRU 1 does not send information PRIM 2 (FCPC2).

In the second choice of probability, the system suggests a problem with cabling (wiring). Misinformation speed from ADR were analyzed as a possible failure of the wiring against the amplitude values measured by the FCPC2. This message is intended only for maintenance and it shows what it will look at the arrival of the aircraft, as probable cause for the crash. It is a failure due to failure of the Pitot affecting ADR and by domino effect, the systems that require the speed information from the ADR.

The above is what the crew was confronted during the first 60 seconds of the drama …

The initial failure Pitot has led to multiple audible and visual alarms that sound for some continuously or every 5 seconds … This failure but has also necessitated the resumption of flight of the aircraft and the control of the thrust manually, with a delicate handling of the thrust levers, even though the guidance information of the trajectory and speed were to disappear steering screens.

To this are added the alarm messages and checklists that have appeared on the screen cascade central E / WD (Engine / Warning Display) from the cockpit.

The crew has been forced to analyze this situation a few seconds overloaded and was forced to fly the plane by treating potentially (and in the order he had himself come to be determined):

  • a loss of speed resulting in the implementation of the emergency “IAS questionable. Maneuver which Air France said, by memorandum of June 5 …, it should not be performed on a cruise …
  • a check flight with anemometric erroneous indications of 4 pages available in a booklet …
  • one checklist ADR CHECK PROC
  • one checklist ADR 1+2, 2+3 ou 1+3 FAULT
  • one checklist ADR 1+2+3 FAULT to go find and read in a pamphlet as the outage of 3 ADR is not presented on the screen, the latter indicating that the failure of 2 ADR. The alarm system of the A330 is indeed unable to distinguish between the failure of 2 of the ADR and ADR 3 … This necessarily requires the crew to quickly determine what procedure should be applied: 2 ADR down because that is the case or 3 ADR down because the same message “2 ADR failed” displayed on the screen is wrong …
  • one STALL alarm (see Glossary – Appendix 4) in all the previous incidents had led to the succession of messages and most likely also suffered by the crew of the AF 447
  • one checklist F/CTL RUD TRV LIM FAULT
  • one checklist F/CTL ALTN LAW (PROT LOST)
  • one checklist AUTO FLT A/THR OFF
  • one checklist NAV TCAS FAULT
  • one checklist AUTO FLT REAC W/S DET FAULT

All this suddenly, at night, at 4:10 in the morning, probably in BMI (without external visual reference), in manual and in the midst of alarms sound and visual multiple …

It should be noted that the crew has also been confronted with contradictory information:

Thus, the emergency action (to return memory) requires the respect and respond to the stall warning: “Act in respect ALT LAW STALL alarm.”

However, the checklist F / CTL ADR disagree about, after treatment and the STATUS final page, a message error stall alarm (Undu RISK OF STALL WARN) …

Under these conditions combined, the sudden task of the crew would be impossible for the human spirit.

2.  2h11 UTC

Messages failure ISIS (22FN-10FC) MACH SPEED OR FUNCTION EFCS1 and IR2, IR1, IR3 – ADIRU2 (1FP2) were issued by the aircraft.

The failure ISIS instrument rescue pilot, is the speed / Mach of this instrument. Information and Mach speed is lost, which is due to the loss of total pressure information provided directly by the Pitot probe standby. Which implies the failure of the Pitot probe Standby, probably concomitantly with the breakdown of Pitot probes commander and first officer.

This message leaves suspected anomaly / inconsistency in ADR 3 (powered by the standby pitot) neither has yet led to the isolation of ADR in default or the appearance of the message ADR disagree. The crew had more valid information on its speed or primary flight displays on the screen or exits. Management and control of the aircraft that they were more delicate.

The failure mentioning IR2 is most disconcerting. The IR2 is one of the three inertial (laser gyro) that provide information about attitudes, FPV, of track, heading, acceleration, roll rate, ground speed and position the aircraft. With the ADR2, it is a body called ADIRU2.

Each party, ADR and IR, may normally operate independently in case of failure. In this case, the message of failure is not a message IR2 FAULT. This is not a total failure of IR2. This is most likely a loss of signal ADR2 of the resumption of a test sequence of ADR2 have yet to confirm a possible divergence between the ADR (ADR disagree) and isolation of trying ADR default.

This failure is associated with ACARS messages following warning:

  • FLAG ON CAPT PFD FPV : the FPV of the captain, which indicates the soil slope and road instantaneous, ie the trajectory of the aircraft is unavailable. Although the attitude is probably valid (information base and tilt of the plane), the calculation of drift (drift) and / or path is invalid.
  • FLAG ON F/O PFD FPV  : it is the same message as above, but on the screen of the first primary.

The most likely explanation for the appearance of these messages follows the attempt of the crew, forced to resume the flight manual, view the FPV to obtain information on the trajectory of primary flight displays ( PFD). It is common within Air France, the FPV is Selected by the pilots when they are under manual control with the FD off. The situation, imposed on the crew, with an autopilot and FD unavailable undoubtedly led the pilots to attempt to select the mode to help FPV.

It has also been unavailable although the development of the inertial or FPV indication (part of ADIRU IR), and is not related to the ADR, which was itself affected by the failure of the Pitot tube. Without this feature FPV materializing the trajectory, the manual control of the airplane was difficult, especially as the attempt probability of selecting this feature demonstrates the usefulness of the crew was for the FPV.

The crew therefore private information found speed on the instrument of relief and trajectory information on the screens steering.

3.  2h12 UTC

The NAV ADR DISAGREEMENT message was transmitted to 2:12, which does not mean it is a failure occurring at 2:12. This message is a message of alarm, on the disagreement between ADR speed, not a message of failure. It follows logically from the failure of the Pitot leading to differing values of velocity calculated by the ADR, which confirm and, by this warning message, the calculated values of otherness. DISAGREEMENT ADR message is transmitted by ACARS when the system manages to detect this situation and report.

The initial failure was that of pitot and this message is a consequence that also confirms the emergence of ADR DISAGREEMENT checklist mentioned above. It is possible that this message is the result of internal systems to discriminate against defects due to ADR, including spots, IR2 and ISIS precedents. The divergence was confirmed by testing the insulation systems under investigation, the message says ADR DISAGREEMENT this discrepancy and ultimately declare the isolation of ADR in default.

4.  2h13 UTC

The message of failure FMGEC1 INTERMITTENT (INTM) fault is generated and is accompanied by the following alarms:

  • F/CTL PRIM 1 FAULT : failure of the primary computer 1 of the flight
  • F/CTL SEC 1 FAULT : Secondary failure of computer 1 of the flight

This failure is intermittent FMGEC1 logically linked to the failure Pitot causing dysfunction ADR and therefore the FMGEC which the FE (flight envelope) is affected by possible variations inconsistent speed from ADR. These inconsistencies may explain failures in computers PRIM 1 and SEC 1, using information FMGEC. The SEC, for example, controls and monitors the channel for limiting deflection of the rudder which was reported from 2:10 FAULT (F / CTL FAULT RUD TRV LIM).

5.  2h14 UTC

No failure message will be sent by the aircraft. Only two alarm messages are transmitted:

  • MAINTENANCE STATUS ADR2 : ADR2 is the gradient operation, which is a confirmation of the situation resulting from the failure of initial Pitot.
  • ADVISORY CABIN VERTICAL SPEED : the rate of pressurization of the cabin is normal. This message indicates a change in cabin altitude exceeds 1800 feet per minute.

Put simply, the pressure is to “inflate” the cabin of an aircraft by admitting outside air warmed by heat exchange with certain aircraft systems, and regulate the rate of leakage through a valve located at the rear of the unit. In doing so, the cabin is called “pressure” and the air that we breathe contains enough oxygen molecules to avoid hypoxia that we suffer at the cruising altitude of airliners. The fictitious altitude within the cabin is lower than that of the aircraft. At an altitude of 35 000 ft (feet), allows the pressure to maintain the altitude of the cabin at about 8000 ft. The parameter evolution of this fictional cabin altitude is measured in feet per minute.

Contrary to what has been thought, the alarm message is not indicative of explosive depressurization that it is not an alarm “excess cab alt” which would have meant excessive cabin altitude (above to 9550 ft). This is really a warning, shown to the cockpit by flashing the setting Cabin V / S on the screen pressure, indicating that the cabin altitude is changing according to a variation considered excessive. This variation may occur in line with the rise of the cabin or down more than 1,800 ft / min. Several scenarios can occur:

  • The failure of 3 ADR might lead to loss of pressurization systems controllers and let it grow abnormally.
  • The eventual passage of overspeed the aircraft, at a loss of control, could deteriorate even snatch some structural elements, while creating a leak pressurization explaining the rapid change of cabin altitude, the latter rapidly depressurize before the eventual failure of the plane and the end of transmissions following the disintegration of the device.
  • The descent of the aircraft causes a descent of the altitude of the cabin commissioned by the main controller pressurization (the other being functionally pending). This occurs at each descent so that the door opening, on the ground, the pressure outside the aircraft is the same as the inside of the cabin. It is therefore regulating the descent of the cabin altitude as the aircraft descends. Where the aircraft is descending very fast, the controller would try to pressure very quickly get the altitude of the cabin. This variation is by design limited to 750 ft / min, which can not generate an alert corresponding to a value greater than algebraically 1800 ft / min. If the aircraft was not descending but unfortunately falls, then he would join the altitude of the cabin before the pressurization controller was able to get enough cab. In this case, the reversed pressure: the pressure outside the aircraft becomes greater than that of the cabin. To prevent the implosion of “safety valves” and “negative relief valve” open in case of negative pressure (0.25 psi). In this case, the rate of change in the cabin after the fall of the aircraft to difference and the rate may be much higher than 1800 ft / min. This could mean that the message transmitted by the aircraft.
  • Signal loss ADR by rejecting ADR internal failure following partial or total, may have led to the emergence of this alarm.

6.  Discussion

The end of transmissions at 2:14 UTC, marks the end of facts which are available at this stage, with the exception of debris have been recovered so far. The conditions pull some debris, including drift, provide some information on the very last moments of flight.

It must still be resolved in that ACARS messages clearly and logically point to the failure of Pitot causal element in the sequence of messages. Notwithstanding the IR2 message stating that it is up to the BEA to explain this sequence is very similar to previous incidents have been due to the failure Pitot.

We feel extremely likely that, faced with this situation sudden, relatively inextricable, the crew lost control of the airplane and a high stall speed is the most plausible explanation of the end of the flight.

While the storms of the tropics are highly developed and should be treated with respect. There is however no need to invoke, as Mr Feldzer, the enormity of these, not more developed than usual on June 1, says Meteo France, to try to explain the accident. Many devices have taken the same road that night and nothing, except a desire unhealthy but legal and economic logic, not be allowed to say that this crew was incompetent to the point of going into a storm. Nothing, because nobody has the slightest evidence of the real trajectory of the aircraft after his last carry, 45 minutes before the ACARS messages …

All, however, to suggest that near the storm area and upon probable circumvention of ice crystals at high altitude could be encountered by aircraft flying in IMC (without external visual reference) avoiding thunderstorm by radar. Any indication that this is the reason, known and announced by Airbus for years, the dysfunction of Pitot.

Admittedly, Mr Gourgeon has publicly stated on a television channel in the journal 20:00, Pitot that were not the cause of the accident and a few minutes later, he did not know what was the cause of the accident (sic) …

Of course, the BEA reported that “nothing” could not link the disaster to failure of the Pitot probes … (Not even the ACARS messages ?…)

While Airbus claims the perfect safety and design of its aircraft even with the Pitot-type AA and the dysfunctions that persist since 1994.

While the Authority and provide EASA that the A330 is airworthy and can be operated safely in any type Pitot …

Admittedly, it was also invoked a big problem toilet to support ACARS message type 2 (smaller) of 31 May 22:45 UTC. Without doubt the hawkers who spread a rumor also distressing that technically crazy were they trying to send, for convenience, in these “amenities” of the more annoying …

But should we really be fooled after reading of all these messages ACARS?

Should we therefore accept that the economic and legal interests, what some call the same reasons of state, prevailed upon the truth which is due to families destroyed and the security which is due to the crews and their future passengers?

Eurocockpit leaving each judge and invites journalists to ask questions of the BEA (see Annex 3) to begin … and best wishes to consider the necessary corrective actions (see Annex 4) …



  • Replace all of Pitot probes by the AA type BA
  • quickly change maneuvers and emergency checklists inadequate or too complex when wind anomaly
  • train crews in situations of failure anemometric high-altitude train
  • AIRBUS crews flying to the output of unusual positions, especially at high altitude
  • crews provide the most modern and most effective enabling the selection of the roads safer and avoidance of potentially dangerous areas. Present at the stage of flight preparation, the study of alternative routes classified by intensity of significant weather phenomena
  • Increase the time of flight preparation in the range of work
  • change the airlines by creating a Security Directorate reporting directly to the President, with a real authority on the transverse ground services (calls, maintenance, etc..) and the sailors, led by pilots in fixed-term appointed to these senior managerial functions
  • build the and powers of the crew CHSCT in terms of flight safety and access to feedback # make a parliamentary inquiry to shed light on:
  • Causes and origins of this accident
  • instead of security in the airline compared to that attributed to the search for better returns
  • the organization and independence of BEA, its links with the Trust and some operators and / or manufacturers
  • organization and links between the administration and supervision of some operators / manufacturers.



  • Is there any evidence or any item, including the content of ACARS messages, which shows that the Pitot probes are not implicated in this accident?
  • The earlier incidents, including those related to the aircraft of Air France F GNIH-and F-GLZN, they have similarities with the flight AF 447 in respect of ACARS messages received by Air France?
  • In September 2008, a constraint or a technical data it was opposed to the replacement of probes Pitot type AA by BA probes on the A340 / A330?
  • Have there been any incidents of loss of anemometric signs or indications anemometric wrong with Airbus A340 / A330 equipped with pitot-type probes BA?
  • All incidents of loss indications anemometric is being produced with Pitot probes of AA-or is there have been other types of Pitot probes in question and on what date?
  • The succession of incidents pitot probes, the planned operation of this feedback, the task of supervision and control authorities (DGCA, EASA, BEA …), there is a history detailed written on this subject by the Manufacturer and rising to nearly 15 years, the evidence available internally at Air France, it does not replace the pitot probe type sensors AA by BA as they were available on the market and, hence, immediately after the accident?

The BEA has “seized” documents prohibiting Air France to make a copy or a copy of the CHSCT.


Moving Sidewalk

BEA Moving Sidewalk - Make It Up As We Go...