Crash of Flight 447

Crash of Flight 447

PBS Airdate: February 16, 2011

NARRATOR: In June, 2009, Air France suffers the worst disaster in its history. Flight 447 crashes into Atlantic, killing all 228 passengers and crew. Exactly what happened remains a mystery.

MARTIN ALDER (Airbus Training Pilot): Why would a well-operated aircraft with a well-trained crew suddenly disappear?

NARRATOR: Now, an independent team of investigators is on a quest to find answers.

JOHN COX (Air Safety Expert): We just can't accept unknowns any longer.

TONY CABLE (Former Accident Investigator): Any accident is a chain of events, and each of the links needs to be in place.

NARRATOR: Combining known facts with new scientific analysis, the team attempts to reconstruct the doomed flight's final minutes.

AIR FRANCE FLIGHT 447 PILOT: We have NAV ADR 1 Fault. We have unreliable airspeed.

NARRATOR: But their investigation raises more questions than answers.

JOHN COX: The idea that a pilot would fly through a thunderstorm? Absolutely not.

NARRATOR: The journey leads them to an unlikely suspect.

TONY CABLE: That is incredible!

NARRATOR: Why did a modern, state-of-the-art airliner drop out of the sky? Right now on NOVA.

May 31^st 2009: Two-hundred-twenty-eight passengers and crew, onboard Air France Flight 447, take off from Rio de Janeiro, Brazil. Destination: Paris.

Three hours into an 11-hour flight, the pilots make routine radio contact with Brazil Air Traffic Control, reporting their location over the Atlantic.

Eight hours later, Flight 447 fails to arrive in Paris. French officials declare a state of emergency.

FRENCH OFFICIAL: We can only pray and hope. At the moment we know nothing.

NARRATOR: It takes another five days before the wreckage is found. Among the debris, the tailfin, and a thousand smaller fragments. Only 50 bodies are recovered. The remains of the other 178 victims and the crucial black boxes are still missing.

The disappearance of Flight 447 remains one of the greatest mysteries in modern aviation history. The official French investigation has released two reports detailing the known facts, but they draw few conclusions about what caused the disaster.

Now, NOVA has assembled an independent team of leading air accident investigators to find answers. The group includes experienced pilots,...

JOHN COX: I have a sense of sadness; I have a sense of mystery. I want to understand it.

MARTIN ALDER: It's very unlikely that one single thing would bring down an aircraft.

NARRATOR: ...a weather expert...

JOHN K. WILLIAMS (Atmospheric Scientist): We really are limited to using mostly satellite data to understand what's going on.

NARRATOR: ...and a structural engineer.

JIM WILDEY (Former Accident Investigator): You're going to be forced to just look at whatever recovered pieces of the structure that you have.

NARRATOR: Completing the team, air accident expert Tony Cable, a veteran of investigations into the deadly Concorde crash, in 2000, and the 1988 terrorist bombing of Pan Am 103, over Lockerbie, Scotland.

Cable begins by scouring Flight 447's air traffic control transcripts for clues to the aircraft's final moments.

TONY CABLE: The only thing to go on, in this case, in the early stage, is to look at the last position report, which, in this case, is the last crew conversation with air traffic control.

NARRATOR: The transcripts reveal nothing out of the ordinary. In the last radio message, at 1:35 a.m., the pilots give their position and altitude.

AIR FRANCE FLIGHT 447 CO-PILOT: Air France four-four-seven, by checking INTOL zero one three three, level three five zero.

NARRATOR: This puts Flight 447 three-hundred-fifty miles off the coast of Brazil, exactly where it is supposed to be. A minute later, at 01:36, Brazil Air Traffic Control tries to reach them again to confirm when the aircraft is due to be handed over to African Air Traffic Control, in Senegal, Africa. There is no reply, but there's no cause for alarm.

MARTIN ALDER: There are periods when you just cannot communicate with the ground station that you want to communicate with.

NARRATOR: Atmospheric interference makes most high frequency radio communications notoriously unreliable.

Then, at 1:48, the flight disappears from Brazilian radar screens, but this is also not considered a problem. The Earth's curvature stops land radar tracking planes over a few hundred miles off shore. Once they're in the mid-Atlantic, every pilot knows they're on their own.

MARTIN ALDER: Crossing somewhere like the south Atlantic, from Brazil to Europe, you're flying well outside the range of land-based radar. You do just feel a little bit more on your own.

NARRATOR: But in the case of Flight 447, air traffic controllers in Africa never pick up the flight.

Over the next six hours, controllers from Senegal to Spain try unsuccessfully to locate the aircraft. Flight 447 is never seen or heard from again.

TONY CABLE: The only information that was available was the last radio contact with the pilots that is pretty close to mid-Atlantic.

NARRATOR: But Tony Cable discovers another critical piece of evidence. The aircraft's flight computer, programmed to send automatic position reports by satellite, continues to transmit data.

At the time, no one monitored the data, but now it reveals a vital clue. After the last radio contact, at 1:35 a.m., Flight 447's computer sends automatic position reports at 01:40, 01:50, 02:00 and, finally, 02:10.

TONY CABLE: The messages show a last automatic position report and then, apparently, the end of the flight.

NARRATOR: These automatic reports proved essential in helping investigators find the wreckage five days later.

And now, the small amount of debris is vital to understanding what happened.

TONY CABLE: It is possible, if you know the wreckage, to work out quite a lot about how it crashed, whether it broke up in the air.

NARRATOR: The question on everyone's mind: was this an accident or a deliberate terrorist act?

The official investigation by French authorities is ongoing, so the team can't look at the physical evidence itself, but they have access to extensive photographic records. This allows them to virtually reconstruct the recovered debris, seen here in orange.

Reconstruction is one of the most important techniques in accident investigation.

JOHN COX: Dealing with wreckage is literally a jigsaw puzzle, but you don't know how many pieces you have, and you usually don't have all of them.

Are both wings attached to the airplane? Is the nose there? Is the tail there? The, quote, "four corners."

You have to take what wreckage you have and reassemble it, so that you can then begin to understand the forces that were acting on the airplane in its last moments of flight.

NARRATOR: Investigators used the same technique to uncover why TWA 800 crashed off New York in 1996. Analysis revealed that the plane exploded in mid-air, then pieces of debris drifted slowly down to the water, with little further damage.

Terrorism was initially suspected, but the cause was later identified as faulty wiring, which triggered a fuel explosion.

Structural engineer Jim Wildey was part of that investigation. Now he faces a jigsaw with most of the pieces missing.

JIM WILDEY: In this case, there is only a limited amount of structure that's recovered. It fortunately does tell enough of a story to, at least, give a clue as to what's going on with the airplane.

NARRATOR: Two of Flight 447's four corners have been recovered: the tailfin and nosecone.

Wildey starts with the nose.

JIM WILDEY: If this piece was to come off the airplane and float to the water by itself, it wouldn't be going fast enough so that when it hit the water it would be damaged, really, in any way.

NARRATOR: Flight 447's nosecone is severely deformed.

JIM WILDEY: What we see here is that this piece has been flattened, it's been crushed, it's been torn. And so, this is a very clear sign that this piece was on the airplane when the airplane hit the water.

NARRATOR: The nose did not drift down slowly from the sky.

The tailfin tells the same story. A mid-air breakup couldn't create the type of damage seen here.

A recovered floor section from the cargo compartment adds another piece of the puzzle.

JIM WILDEY: What we see here is curvature damage on both sides of this piece, with a fracture down the middle. This damage is consistent with the airplane hitting relatively flat and with very high hydraulic pressure coming up from below and deforming this piece, in the manner that's shown here.

NARRATOR: Analysis of the wreckage is clear: when Flight 447 hit the water, it was level and in one piece.

JIM WILDEY: Whatever the cause of the accident is, it better take into account the fact that this airplane is hitting the water relatively flat, at a high rate of speed.

NARRATOR: Wildey's conclusion: Flight 447 didn't explode in mid-air; it fell out of the sky.

But why? The aircraft is an A330 built by aerospace giant Airbus. Though there are 700 in service, there hadn't been a single passenger fatality until Flight 447.

This history of reliability rests on a highly computerized flight control system.

JOHN COX: They're highly automated. They're some of the leading edge technology in aviation, even today.

NARRATOR: Powerful computer systems are designed to control everything from air speed and altitude to turning the aircraft. The design philosophy: that automation improves safety.

In a flight simulator, veteran pilot Martin Alder demonstrates the features of these computer systems.

MARTIN ALDER: Gear up.

In a conventional airplane, instead of this side-stick, I'd have quite a big control column here. You need plenty of leverage to apply the mechanical forces you need to move the control surfaces to control the airplane.

NARRATOR: In a conventional airplane, the pilot pulls mechanical levers to operate a hydraulic control system. But on the A330, this heavyweight gear is replaced by an electronic system called "fly-by-wire."

The pilot tells the flight computer what he wants to do, but it is the computer that translates this intention into action and executes the maneuver.

MARTIN ALDER: So if I want to go to the left, stick to the left, round to the left.

NARRATOR: The flight computer adjusts the control surfaces, and the aircraft turns. Maneuvers like this cause the A330 to lose altitude, so the advanced computer compensates by increasing power and pitching the nose up to provide the right amount of lift. The pilot does nothing.

MARTIN ALDER: I take my hands off, and there we are, it's flying round. Vertical speed, 0; 25 degrees of bank; 240 knots; it's going to fly around at 25 degrees of bank, and keep doing this until we get bored.

NARRATOR: The flight computer won't carry out any pilot command that endangers the safety of the aircraft.

MARTIN ALDER: If the pilot were to lose control for some reason, the system would save the airplane.

NARRATOR: With this safety feature, it seems almost inconceivable that the loss of Flight 447 was simply due to pilot error. So did something in Flight 447's path bring it down?

Cable hunts for clues, buried in over 400 pages of data released by the French authorities, and finds one crucial fact.

TONY CABLE: There was thunderstorm activity in that area, quite a large trail across the flight path at the time that A.F. 447 went through.

NARRATOR: At 2:10 a.m., Flight 447 is in the vicinity of an Atlantic thunderstorm, 250 miles wide. Did it cause the crash?

To find out, our investigation turns to John Williams, an aviation weather specialist at the National Center for Atmospheric Research, in Boulder, Colorado.

Williams has access to new satellite images taken by NASA on the actual night of the crash. They show a massive storm developing as Flight 447 approaches.

JOHN WILLIAMS: I'll step through by 30-minute intervals, and you'll see these storm systems starting to grow.

NARRATOR: The final position of Flight 447 is marked on the top of the map.

JOHN WILLIAMS: This storm system is hundreds of miles across and maybe 60 miles wide. Wow, look at the size of that growth right there.

NARRATOR: Pilots are trained to avoid large storms like this.

JOHN COX: The idea that a pilot would fly through a thunderstorm? Absolutely not.

MARTIN ALDER: Pilots, remember, are at the front end of the airplane, the first people to meet any accident. We have a great incentive not to meet accidents.

NARRATOR: So why is Flight 447 flying straight into the storm? In daylight, the thunderclouds would span the horizon, towering from the ocean to 50,000 feet. But at night, pilots can't see them, so they use onboard weather radar. This radar has a limited range of around 50 miles, and it can't see wind or lightning. It works by detecting the water and ice in storm clouds. But ice is five times less reflective than water, and pilots must continually adjust radar settings to see storms of different siz and intensity.

At the National Center for Atmospheric Research, Williams pores through the NASA satellite data from that night and makes an important find, not mentioned in the French reports.

JOHN WILLIAMS: What you can see is that there is a small storm that, as they approached it, may have blocked their radar's view of the larger storm system and the more hazardous storm system behind.

NARRATOR: Williams' new theory: Flight 447s weather radar can't see through the smaller storm to detect the larger storm system building behind.

MARTIN ALDER: You could find yourself in a position, with this absorption of the signal, where you are almost into the storm before the signal strength actually reflects the reality.

NARRATOR: This is crucial in understanding what happened to Flight 447. It's possible that by the time the pilots detect the now-massive storm, they are already in it.

MARTIN ALDER: You have no option but to take the least worst exit: the crew must ride it out.

NARRATOR: They face two potential threats. The first: lightning. On average, every airplane is struck once a year. But modern airliners are made of conductive materials that protect against even the most severe lightning, as seen in this incident captured on home video in Australia.

Spectacular, but the lightning passes harmlessly through the outer skin. The plane landed safely, with no significant damage.

The last confirmed commercial plane crash in the U.S., directly attributed to lightning, occurred in 1967.

JOHN COX: The thought that lightning could have a serious effect in the accident of Air France 447 is extraordinarily remote, and there's absolutely no evidence of it.

NARRATOR: The second threat is more serious: turbulence. One cause is up-drafts, rising pockets of air, punching up through storms; the white areas on this map.

JOHN WILLIAMS: There's one here and one here, just off the flight track of Air France 447. Hitting an up-draft would be like a jackhammer hitting you from below. It could really give the aircraft a jolt.

NARRATOR: As Flight 447 heads for turbulence, the automatic systems should keep everything under control.

The pilot's next move would be standard procedure. Anticipating turbulence, he would ask the passengers to fasten seatbelts. Then, as a safety measure, he would dial in a slightly lower speed, to reduce the stresses on the aircraft. An automatic system called auto-thrust takes over.

MARTIN ALDER: The auto-thrust would reduce the power on the engines to slow down towards your target speed.

NARRATOR: Everything happens automatically. The pilot's manual thrust levers don't move. As turbulence hits, sudden up-drafts throw the aircraft up and down, but the flight computer changes pitch and engine power to compensate, keeping the aircraft at a safe speed. All the pilots have to do is monitor the instruments.

MARTIN ALDER: The systems automatically will tell you if they get out of limits, but you could be looking at the systems from time to time, just to check that they are well inside the limits.

NARRATOR: The team has traced Flight 447's progress to its last known position.

The next clue comes from the official French report, one that reveals what happened next in chilling detail. As the aircraft is navigating through the storm, at 2:10 a.m., the flight computer send a flurry of fault messages to Air France headquarters in Paris.

JOHN COX: We were fortunate that the aircraft, being one of the most modern, has a maintenance feature that automatically reports system anomalies. And it does it through a data link system called ACARS.

NARRATOR: Normally, these ACARS messages are designed for basic aircraft maintenance, so ground crews can fix minor faults quickly, when the aircraft is on the ground.

MARTIN ALDER: In simplistic terms, it's almost like S.M.S. texting for airplanes. It's a way of sending simple text messages or numerical messages from the aircraft to the ground and back again. And it's used to send some very basic information.

NARRATOR: Airline crews on the ground don't monitor the data in real time. Often, the messages are downloaded just prior to the aircraft's arrival.

But now, Flight 447's ACARS system messages reveal an incredible chain of events.

MARTIN ALDER: It really is the last will and testament of the aircraft.

NARRATOR: Flight 447 suffers 24 critical faults in just four minutes and 16 seconds.

MARTIN ALDER: You can just see an aircraft almost dying in front of you.

NARRATOR: Tony Cable decodes the data, to reconstruct events second by second.

The first one appears at 2:10 a.m. and 10 seconds.

TONY CABLE: The first ACARS message that appears is "Autopilot Off," and that indicates that the autopilot has disengaged on its own. There is a master audio warning, which is a real attention-getter.

NARRATOR: With the autopilot off, the pilot must take manual control of the plane.

Thirteen seconds later, another critical message: "Flight Control Alternate Law." This means that the automated system which prevents pilots from making unsafe maneuvers switches off.

Twenty-four seconds later, another alarm: "Auto-Thrust Off."

TONY CABLE: It means that the system that normally automatically controls engine thrust to maintain airspeed and altitude, is no longer working.

NARRATOR: The aircraft's automatic safety systems are shutting down, one by one.

TONY CABLE: It must have been a very busy and confusing situation on the flight deck.

NARRATOR: Finally, at 2:14 and 26 seconds—just four minutes after the problems began—one final, ominous message appears.

TONY CABLE: The "Advisory Cabin Vertical Speed" message means that the pressurized cabin is descending at a high rate, in other words, the aircraft is descending at a high rate.

NARRATOR: Seconds later, Flight 447 crashes into the Atlantic. What could cause such a cascade of system failures?

TONY CABLE: The reason for the autopilot kicking out is something that clearly needs to be established.

NARRATOR: Tony Cable scans the ACARS data in search of the root cause. And he believes that all the failures can be traced back to just one of the 24 fault messages.

This one message suggests that the computer lost the ability to calculate its airspeed.

TONY CABLE: The loss of air speed information is potentially very, very serious.

NARRATOR: Without this, the automatic flight controls can't function, so the system shuts down.

To find out why, the team turns their attention to the equipment that measures airspeed.

All airliners measure airspeed using "pitot" probes, forward-facing hollow tubes of metal, just below the cockpit. Automated flight controls can't operate without accurate airspeed data, so the A330 has three pitots to provide backup. But on Flight 447, the fault message suggests major pitot problems.

JOHN COX: We know that the airspeed indication systems, all three of them, were compromised.

NARRATOR: In the wind tunnel, Tony Cable tries to find out why.

TONY CABLE: Okay, Cliff, can you take it up to, 30 knots, we'll try this time?

NARRATOR: A sensor inside the pitot tube measures the pressure of the air rushing into its open end. The computer converts the pressure into airspeed, in this case, around 30 knots.

TONY CABLE: And now?

NARRATOR: But Cable can trigger a malfunction, just by blocking the tube. The measured airspeed drops to zero.

TONY CABLE: Gone to zero? Okay.

NARRATOR: But what can block a pitot tube at 35,000 feet?

MARTIN ALDER: The pitot tube sticking out into the airstream means that it's vulnerable to being hit by ice and rain. It's a small device—small things pick up ice quicker than big things—so the pitot tube is a prime candidate for picking up icing.

NARRATOR: To combat ice, the pitot tubes are designed with powerful heaters intended to handle any conditions, including full-blown storms. So what caused them to fail?

The answer could lie within the storm itself.

JOHN WILLIAMS: One of the things that we're interested in is what were the conditions at 35,000 feet? What kind of ice or liquid was there at that altitude?

NARRATOR: John Williams turns again to the new NASA satellite images.

JOHN WILLIAMS: One of the first things we want to do is try to figure out what the temperatures were at that level.

NARRATOR: He creates a cross-section, showing the temperature at different altitudes.

JOHN WILLIAMS: What it shows, starting at the surface and going up to the top of the atmosphere—they were flying at this level here, and you can see that the temperatures were about 40-below at the time and location of the accident.

NARRATOR: Minus 40 may seem extremely cold, but, in fact, it's much warmer than is usual at 35,000 feet.

These unusual temperature readings suggest than an unusual phenomenon may have occurred.

JOHN WILLIAMS: What we've found out from this analysis is that it's possible that there was supercooled liquid water at the altitude of the aircraft.

NARRATOR: Supercooled water is a weird quirk of physics where extremely pure water remains liquid at temperatures well below freezing.

In 32 years experience, Tony Cable has never actually seen this phenomenon up close.

The purified water in these bottles is well below its normal freezing point, but it's still liquid. Ice crystals can only grow around tiny particles like impurities or bubbles. When Cable inserts a metal tube...

TONY CABLE: Hey!

NARRATOR: ...instant ice.

TONY CABLE: That is incredible.

JOHN WILLIAMS: The fact that air is really clean over the oceans suggests that if there is supercooled liquid water in the atmosphere, and an aircraft flies through that, those little droplets are ready to freeze as soon as they hit a surface.

NARRATOR: Supercooled liquid water could overwhelm heating elements in the pitot tubes and freeze them in seconds.

MARTIN ALDER: It is possible that the aircraft encountered conditions which were more severe than those to which it had been designed. The pitot heads may not have been sufficient to cope with these severe conditions.

NARRATOR: The team discovers that pitot tube failure is not uncommon. In the six years leading up to the loss of Flight 447, the French authorities identified 32 failed pitot events involving A330s or similar A340s.

And in 2009, the number of incidents is alarming.

TONY CABLE: It was in the order of one a week, for getting on for two months, in the period leading up to the first of June.

NARRATOR: Just six days before the crash, two pitot tubes fail on a similar A330 flight from Rio to Paris. The pilots manage to keep control of the aircraft.

All the failing pitot tubes meet existing safety standards. Still, in late 2007, Airbus recommends that all A330s receive improved pitots.

Air France is in the process of upgrading its entire fleet, when Flight 447 runs into the Atlantic storm. When the aircraft's pitot tubes fail, the automatic systems shut down, forcing the crew to take manual control.

JOHN COX: When things go very wrong, the last line of defense is the aviator.

NARRATOR: After more than three hours on autopilot, the crew suddenly face information overload.

JOHN COX: That crew faced an almost unheard of series of failures, one right behind the other, and for them to sort through it would have been very difficult that night.

Why is the airplane doing what it's doing? What are all these failures? Why are they all coming at one time?

NARRATOR: Bombarded by faults, the crew must cope with the most serious problem of all: maintaining a safe airspeed.

At high cruising altitudes, the speed range that all commercial aircraft fly inside gets very narrow.

MARTIN ALDER: Our speed range is quite limited. Typically it could be ten knots either side of the cruise speed.

NARRATOR: If Flight 447 speeds up or slows down by as little as 10 knots, it could suffer a potentially lethal condition known as a stall.

Tony Cable demonstrates what happens.

TONY CABLE: Okay, Cliff, you ready to go?

NARRATOR: An aircraft gets its lift from smooth, streamlined airflow over the wings. If the aircraft slows, the angle of the wing must be increased to maintain lift, but too slow, and there's an angle where the airflow breaks up.

JOHN COX: If you disrupt that flow, the wing cannot produce lift. And that's really all a stall is, is it's a disruption of the airflow across the top of the wing.

TONY CABLE: If it slows down, there's a tendency for the nose to come up, and, at a fairly shallow angle, the wings will stall, the airflow breaks down, there's a loss of lift and the aircraft begins to descend.

NARRATOR: But if too slow is a problem, so is too fast. If they don't know their airspeed, a pilot can over-compensate by speeding up.

As an ordinary commercial airliner gets too fast, a shockwave develops on the wings. This can also disrupt airflow, triggering a stall.

In either scenario, stalled wings could mean a dramatic, uncontrolled descent. The pilots must avoid slowing down or speeding up by as little as 10 knots. But with their pitot probes frozen, they have no way of knowing their precise airspeed.

JOHN COX: The ability for the crew to recognize if they were at the proper speed is going to be a much more complex problem now.

NARRATOR: But can this complex problem be solved?

In the simulator, Martin Alder recreates the known technical failures on Flight 447. He wants to know if two experienced pilot instructors can maintain speed and avoid a stall, using standard operating procedure.

The pilots don't know what they are about to face. Like Flight 447, they are cruising at 35,000 feet, at night, over the ocean. Alder unleashes a storm.

MARTIN ALDER: I like the look of that one. So now, activating...

NARRATOR: Thunderclouds loom ahead on the radar.

SIMULATOR CO-PILOT: Probably a line of thunderstorms.

NARRATOR: The captain plans a detour and prepares for turbulence.

SIMULATOR CAPTAIN: So, turbulence airspeed, then I'm selecting decimal seven six.

NARRATOR: As is likely on Flight 447, the pilot selects a slightly lower speed, to reduce stress on the aircraft. Auto-thrust automatically reduces engine power.

SIMULATOR CAPTAIN: Hi, ladies and gentlemen, the captain speaking. We are just approaching an area where there are a few rain showers around. We've got the seatbelt sign on for approximately 10 minutes, or so.

NARRATOR: As they edge around the storm, Alder triggers the critical moment of Flight 447: he fails all three airspeed indicators.

SIMULATOR CO-PILOT: Okay, we have NAV ADR 1 fault. We have unreliable airspeed.

NARRATOR: The automatic flight control systems shut down.

SIMULATOR CO-PILOT: We're flying with no auto-pilot or auto-thrust.

SIMULATOR CAPTAIN: Okay. Autopilot's off. I have control.

SIMULATOR CO-PILOT: You have control.

NARRATOR: If their actual airspeed rises or falls by as little as 10 knots, they could suffer a catastrophic loss of control. But the pilot uses standard procedures, learned in training. He moves the throttle levers to set thrust at exactly 85 percent.

SIMULATOR CAPTAIN: And I'm selecting...I've got 85 percent set.

NARRATOR: Then, he raises the elevators to pitch the nose up at precisely five degrees. With engines at 85 percent power, and five degrees upward pitch, the aircraft should always settle at the same safe speed.

MARTIN ALDER: It's quite possible to fly the aircraft to actually quite high standards of accuracy, something in the region of about five knots or so of the, of the desired target speed would be quite achievable for most crews.

NARRATOR: Without airspeed indicators, pitch-and-power is a pilot's lifeline. These pilots ignore any fault messages until they are safely in control.

SIMULATOR CAPTAIN: I've got five degrees on the standby, four degrees on the other.

MARTIN ALDER: Flying the airplane is the prime objective. No matter how attractive the messages might be to anybody on the flight deck, you both concentrate in ensuring that the person who should be flying the airplane is flying it, and flying it in the manner which is safe.

SIMULATOR CAPTAIN: Okay, so we've got what I think is basic control of the attitude, we're bumping a little bit with the weather, but, generally, that's safe.

NARRATOR: With no reliable airspeed indicators, maintaining pitch and power can get them to the nearest airport. The emergency is over.

MARTIN ALDER: That's it, it's finished.

NARRATOR: Martin Alder's simulation shows that a safe speed can be maintained even if all three pitot probes fail. So what could have stopped the crew of Flight 447 from using this technique?

Airbus pilot John Cox believes he has identified the answer.

JOHN COX: If they were just entering an area of choppy air, they may very well have been slowing the airplane down.

NARRATOR: When Flight 447 first enters the storm, standard procedure suggests they would reduce speed, so auto-thrust decreases engine power automatically.

But the pilots don't receive one important visual signal from the thrust levers.

JOHN COX: The thrust levers themselves, the throttles, don't move. Unlike some other airplanes, where you can feel the throttle in your hand moving, with Airbus aircraft, that throttle doesn't move with auto-thrust engaged, so you have to look at specific engine power indications.

NARRATOR: The power indication is displayed here, on the central control panel. But if auto-thrust switches off while the engines are in low power, the crew might lose track of the low thrust level.

JOHN COX: If you're very task-saturated, your concentration's going to be directly in front of you. What's the power output of the engines? You're going to have to physically turn your attention and look to the center console area.

This is not going to be done as frequently as looking at, at the things right in front of you. It, it's certainly going to be in the scan; the question is, "How often?"

NARRATOR: The aircraft is now nearer the lower end of its safe speed range. But overloaded by fault warnings, the crew might not realize they need to increase power.

JOHN COX: Was this crew one that was very attentive and picked up this information very early? Were they very slow to pick up the information? We don't know.

Were the demands so high that they were unable to, to keep up with it? We don't know.

NARRATOR: Tony Cable finds support for this theory. In 10 previous incidents of pitot probe failure, the crew fails to immediately control thrust.

TONY CABLE: In quite a number of them, it's clear that the crews were very slow to get onto manual throttle operation.

NARRATOR: In five cases, crews don't take control of thrust for more than 60 seconds. For Flight 447, that would mean rapid deceleration and the risk of a sudden stall.

MARTIN ALDER: Ten to 15 knots would not be unusual. If you decelerate at a knot a second, that's 15 seconds. The aircraft would slow down to a much lower speed, and you could approach a stall quite quickly, in that manner, at altitude.

JOHN COX: There is a good possibility that at some point in the last four minutes, that there was a stall event.

NARRATOR: The result: a rapidly descending aircraft. However, a stall is not necessarily fatal. There are recovery techniques.

TONY CABLE: The procedure is full thrust on both engines, reduce the pitch attitude, and the aircraft will then resume normal flight.

NARRATOR: By pitching the nose down, the pilot restores smooth airflow over the wings and escapes the stall. But a stall can be an extreme event.

JOHN COX: If they were in a condition that it fully stalled, oftentimes when the nose breaks, they'll roll off on a wing. And that's a pretty aggressive maneuver, when the airplane does that.

NARRATOR: If one wing stalls before the other, Flight 447 would roll violently to one side, more like a fighter jet than a passenger airliner.

Most airline pilots have limited experience dealing with this type of event. And complex automatic flight controls mean they do little hands-on flying.

For Tony Cable, this reliance on automation highlights a larger flight safety issue.

TONY CABLE: In recent years the single biggest cause of accidents has become loss-of-control accidents.

NARRATOR: Modern aircraft are packed with automated flight controls. But are these automatic systems creating modern pilots who are ill-equipped to recover manual control in a crisis?

TONY CABLE: It has raised the question about whether the situation is actually being made worse by the increase in automation, whereby crews don't get a great deal of opportunity to manually fly the aircraft.

NARRATOR: Standard airline flight simulators don't have the freedom of movement to recreate a severe stall.

MARTIN ALDER: It moves up and down something like five to ten feet on jacks, and that's the limit of its movement.

NARRATOR: This evidence suggests that if Flight 447 did suffer a critical stall, the crew faced an extreme challenge.

A year after the accident, the search for Flight 447's black boxes continues. It's like looking for a shoe box in an area twice the size of New York City, 15,000 feet under water.

JOHN COX: The only way that we're going to find complete and total understanding of what happened to that airplane is if we're fortunate enough to get the cockpit voice recorder and digital flight data recorder.

NARRATOR: However, using the available evidence, our independent team has pieced together the possible chain of events. No single link is fatal in itself, but together they provide a plausible scenario for the mystery of Flight 447. Around 2:10 a.m., Flight 447 flies into a huge Atlantic storm. A possible reason: it is hidden from the aircraft radar by a smaller storm.

MARTIN ALDER: We believe that the aircraft was probably in an area of turbulence, which would have been challenging to fly.

NARRATOR: It's possible the storm contains supercooled water that ices up the aircraft.

JOHN WILLIAMS: What's possibly unusual, in this storm, is to have supercooled liquid water this high up in the atmosphere.

NARRATOR: As a result, vital airspeed indicator systems freeze.

TONY CABLE: There is little doubt that the airspeed systems failed in some fashion, probably due to icing, and that the aircraft went out of control from that point.

NARRATOR: The automatic flight systems fail, forcing the pilots to take control.

JOHN COX: They were faced with multiple warnings, multiple system failures, at night, over water; an unbelievably challenging environment.

NARRATOR: In similar prior incidents, pilots don't follow standard procedure and take immediate control of the vital thrust levers.

TONY CABLE: Crews can be very slow to get on to operating the throttles manually, which is very essential, of course, to maintain a decent airspeed.

NARRATOR: If they lose or gain too much airspeed, a high altitude stall would be outside most airline pilots' experience.

MARTIN ALDER: It got from 35,000 feet, lost a huge amount of height in a short period of time and hit the water.

NARRATOR: It is a compelling theory, but without the black boxes and their vital data, there can be no definitive proof.

JOHN COX: We do need to solve it. Aviation does not do well with unsolved mysteries. We need to understand what happened that night out over the Atlantic.