Air France Flight 447

Air France Flight 447 was a scheduled international transatlantic passenger flight from Rio de Janeiro, Brazil, to Paris Charles de Gaulle Airport, France, that crashed into the mid-Atlantic Ocean on 1 June 2009, killing all 228 passengers and crew on board. The incident, which occurred on an Airbus A330, happened because inconsistent airspeed indications and resulting miscommunication between the pilots led to an unrecoverable stall. The Brazilian Navy recovered the first major wreckage and two bodies from the sea within five days of the crash. The aircraft's flight recorders were not recovered from the ocean floor until May 2011, nearly two years after the accident.

France's Bureau of Enquiry and Analysis for Civil Aviation Safety final report, released at a press conference on 5 July 2012, concluded that the aircraft suffered temporary inconsistencies between the airspeed measurements—likely resulting from ice crystals obstructing the aircraft's pitot tubes—which caused the autopilot to disconnect. The crew reacted incorrectly to this, causing the aircraft to enter an aerodynamic stall which the pilots failed to correct. The accident is the deadliest in the history of Air France, as well as the deadliest aviation accident involving the Airbus A330.

On 21 May 2026, Airbus and Air France were both found guilty of corporate manslaughter. Each company was sentenced to pay the maximum fine of €225,000 ($261,112).

Accident

The aircraft departed Rio de Janeiro–Galeão International Airport on 31 May 2009 at 19:29 Brazilian Standard Time (22:29 UTC), with a scheduled arrival at Paris-Charles de Gaulle Airport of 11:03 Central European Summer Time (09:03 UTC) the following day (estimated flight time of 10:34). Voice contact with the aircraft was lost around 01:35 UTC, 3 hours and 6 minutes after departure. The last message reported that the aircraft had passed waypoint INTOL, located 565 km from Natal, on Brazil's northeastern coast. The aircraft left Brazilian Atlantic radar surveillance at 01:49 UTC, and entered a communication dead zone.

The Airbus A330 is designed to be flown by two pilots, but the 13-hour "duty time" (the total flight duration, as well as preflight and post flight duties) exceeded the 10 hours permitted before a pilot had to take a rest, as dictated by Air France's procedures. To comply with these procedures, Flight 447 was crewed by three pilots: a captain and two first officers. With three pilots on board, each pilot could take a break in the A330's crew rest compartment, located behind the cockpit.

In accordance with common practice, Captain Dubois sent First Officer Robert for the first rest period with the intention of taking the second break himself. At 01:55 UTC, he woke up First Officer Robert and said, "... he's going to take my place". After attending the briefing between the two co-pilots, the captain left the cockpit to rest at 02:01:46 UTC. At 02:06 UTC, the pilot warned the cabin crew that they were about to enter an area of turbulence. About two to three minutes later, the aircraft encountered icing conditions. The cockpit voice recorder (CVR) recorded sounds akin to hail or graupel on the outside of the aircraft and ice crystals began to accumulate in the pitot tubes, which measure airspeed. Bonin, the pilot flying, turned the aircraft slightly to the left and decreased its speed from Mach 0.82 to 0.80, which was the recommended speed to penetrate turbulence. The engine anti-ice system was also turned on.

At 02:10:05 UTC, the autopilot disengaged, most likely because the pitot tubes had iced over, and the aircraft transitioned from "normal law" to "alternate law 2 (ALT2)" due to the lack of reliable flight data. The engines' autothrust systems disengaged three seconds later. The autopilot disconnect warning was heard on the CVR.

Bonin took manual control of the aircraft. Without the autopilot, turbulence caused the aircraft to start to roll to the right, and Bonin reacted by deflecting his side-stick to the left. One consequence of the change to ALT2 was the removal of both the dampeners to control inputs, as well as maximum limitations to the A330's safe pitch, yaw and bank angles. Due to this increase in the aircraft's sensitivity to roll, the pilot overcorrected. During the next 30 seconds, the aircraft rolled alternately left and right as he adjusted to the altered handling characteristics of the aircraft. At the same time, he abruptly pulled back on his side-stick, raising the nose. This action was unnecessary and excessive under the circumstances. The aircraft's stall warning briefly sounded twice because the angle of attack tolerance was exceeded, and the aircraft's indicated airspeed dropped sharply from 274 to 52 kn. The aircraft's angle of attack increased, and the aircraft subsequently began to climb above its cruising altitude of 35,000 ft (FL350). During this ascent, the aircraft attained vertical speeds well in excess of the typical rate of climb for the Airbus A330, which usually ascends at rates no greater than 2,000 feet per minute (10 m/s; 37 km/h). The aircraft experienced a peak vertical speed close to 7000 ft/min, which occurred as Bonin brought the rolling movements under control.

At 02:10:34 UTC, after displaying incorrectly for half a minute, the left-side instruments recorded a sharp rise in airspeed to 223 kn, as did the integrated standby instrument system (ISIS) 33 seconds later. The right-side instruments were not recorded by the flight data recorder. The icing event had lasted for just over a minute, yet Bonin continued to make nose-up inputs. The trimmable horizontal stabilizer (THS) moved from 3 to 13° nose-up in about one minute, and remained in the latter position until the end of the flight.

At 02:11:10 UTC, the aircraft had climbed to its maximum altitude around 38000 ft. At this point, the aircraft's angle of attack was 16°, and the engine thrust levers were in the fully forward takeoff/go-around (TOGA) detent. As the aircraft began to descend, the angle of attack rapidly increased toward 30°. A second consequence of the reconfiguration into ALT2 was that the stall protection no longer operated, whereas in normal law, the aircraft's flight-management computers would have acted to prevent such a high angle of attack. The wings lost lift and the aircraft began to stall.

Confused, Bonin exclaimed, "I don't have control of the aircraft any more now", and two seconds later, "I don't have control of the aircraft at all!" Robert responded to this by saying, "controls to the left", and took over control of the aircraft. He pushed his side-stick forward to lower the nose and recover from the stall; however, Bonin was still pulling his side-stick back. The inputs cancelled each other out and triggered an audible "dual input" warning.

At 02:11:40 UTC, Dubois re-entered the cockpit after being summoned by Robert. The angle of attack had then reached 40°, and the aircraft had descended to 35000 ft with the engines running at almost 100% N1 (the rotational speed of the front intake fan, which delivers most of a turbofan engine's thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft's computer because of the high angle of attack. The aircraft had its nose above the horizon, but was descending steeply.

Roughly 20 seconds later, at 02:12 UTC, Bonin decreased the aircraft's pitch slightly. Airspeed indications became valid, and the stall warning sounded again; it then sounded intermittently for the remaining duration of the flight, stopping only when the pilots increased the aircraft's nose-up pitch. From there until the end of the flight, the angle of attack never dropped below 35°. From the time the aircraft stalled until its impact with the ocean, the engines were primarily developing either 100% N1 or TOGA thrust, though they were briefly spooled down to about 50% N1 on two occasions. The engines always responded to commands and were developing in excess of 100% N1 when the flight ended. Robert responded to Dubois by saying, "We've lost all control of the aeroplane, we don't understand anything, we've tried everything". Soon after this, Robert said to himself, "climb" four consecutive times. Bonin heard this and replied, "But I've been at maximum nose-up for a while!" When Dubois heard this, he realized Bonin was causing the stall, and shouted, "No no no, don't climb! No No No!" When Robert heard this, he told Bonin to give him control of the aircraft, and Bonin initially obliged.

The aircraft was now too low to recover from the stall. Robert pushed his side-stick forward to try to regain lift in order to get out of the stall; however, shortly thereafter, the ground proximity warning system sounded a "sink rate" alarm followed by "pull up" alarms. In response, Bonin (without informing his colleagues) pulled his side-stick all the way back again, and said, "We're going to crash! This can't be true. But what's happening?" The last recording on the CVR was Dubois saying, "(ten) degrees pitch attitude."

Both flight recorders stopped recording at 02:14:28 UTC, 3 hours and 45 minutes after takeoff. At that point, the aircraft's ground speed was recorded as 107 kn, and the aircraft was descending at 10912 ft/min, a vertical speed of 108 kn. Its pitch was 16.2° nose-up, with a roll angle of 5.3° to the left. During its descent, the aircraft had turned more than 180° to the right to a compass heading of 270°. The aircraft remained stalled during its entire 3-minute-30-second descent from 38000 ft. The aircraft struck the ocean belly-first at a speed of 152 kn, comprising vertical and horizontal components of 108 kn and 107 kn, respectively. All 228 passengers and crew on board died on impact from extreme trauma and the aircraft was destroyed.