The Trouble with Germanwings Flight 9525

April 22, 2015

John Rosenthal

Germanwings Airbus 320, cc Flickr Linus Φόλλερτ

The reported discovery of the second “black box” of Germanwings Flight 9525, the Airbus 320 that crashed in the French Alps last month, appears to have put the Germanwings story to rest as far as the mainstream media is concerned. In a laconic press release published less than 24 hours after the plane’s Flight Data Recorder was reportedly found by a female gendarme, France’s air safety investigative authority, the BEA, announced that a preliminary reading of its contents confirmed that the flight’s co-pilot intentionally brought about the plane’s fatal decent. The hypothesis that the plane was intentionally crashed by its allegedly suicidal co-pilot, Andreas Lubitz, had first been floated by French prosecutor Brice Robin just two days after the crash. It has dominated the headlines ever since, quickly taking on the aura of established fact.

Numerous aviation experts and professional associations have condemned this rush to judgment and the role of French authorities in fueling it. They include, most recently, the International Federation of Airline Pilots’ Associations (IFALPA), which, in a statement, describes the scenario depicted by the French prosecutor as “beyond our comprehension” and pointedly notes that the conduct of the Germanwings investigation does not meet internationally accepted standards. The IFALPA statement calls attention, in particular, to the damage done to the integrity of the investigation by “leaks of protected information, media pressure, and political considerations.”

What the aviation experts and professional associations undoubtedly know, but the broader public in general does not, is that a known malfunction in a cockpit computer on the A320 family of planes could initiate a controlled descent like that Lubitz is accused of having intentionally brought about and, furthermore, that so long as the computer is running, the pilot or pilots would not be able to override it.

Including Germanwings 9525, no less than three planes of the same type have either crashed or narrowly escaped doing so in the just the last four months. According to published reports, both of the others suffered a computer malfunction.

Thus, on November 5, a Lufthansa Airbus 321 en route from Bilbao to Munich went into a descent shortly before reaching cruising altitude. The A321 is a longer version of the A320. The BFU, Germany’s air safety investigative authority, has established that the descent was automatically programmed by the plane’s Flight Augmentation Computers (FAC), a component of Airbus’s so-called Fly-by-Wire system. Ironically, the Flight Augmentation Computers are supposed to provide protection against pilot errors. In the case of Lufthansa flight 1829, however, the computer system was itself erring due to faulty data from frozen sensors on the exterior of the plane. After an initial loss in altitude of some 4000 feet in about a minute, the crew battled for nearly three quarters of an hour to keep the plane afloat, pulling constantly on the joystick to counteract the programmed descent.

According to the BFU’s preliminary report on the incident, after consultation with technical staff on the ground, the pilots were able finally to regain control of the plane by shutting down one of the data units reporting faulty information. This in turn caused the computer to disengage. (A recent article in the German weekly Der Spiegel tells a still more dramatic, but apparently erroneous, story. According to Der Spiegel, the captain of the aircraft had finally to resort to flipping circuit-breakers in order to cut off electricity to the computer system.)

On December 28, just six weeks after the Lufthansa 1829 incident, an Asia Airlines Airbus 320 en route from Surabaya to Singapore suddenly went into a sharp climb, then stalled and crashed into the Java Sea. Indonesian authorities have refused to issue a preliminary report. But here too a malfunction of the Flight Augmentation Computers appears to have played a role. Citing sources with knowledge of the investigation, Bloomberg has reported that in the case of Air Asia flight 8501, the captain of the aircraft did indeed pull a circuit breaker cutting off power to the Flight Augmentation Computers shortly before the crash. It appears to have been this unplugging of the computer system – perhaps combined with manual inputs from the co-pilot? – that provoked the plane to climb too abruptly and stall.

Given the recent precedents of Air Asia 8501 and Lufthansa 1829, it is hardly surprising that many pilots and aviation experts immediately assumed that Germanwings Flight 9525 had suffered a computer malfunction due to frozen sensors. (See, for instance, the comments to an Aviation Herald synopsis of the BFU report on Lufthansa 1829 here. As chance would have it, the synopsis was posted on March 24, shortly before the ill-fated Germanwings flight departed from Bilbao.)

Now, however, the analysis of the 2nd “black box” by the BEA appears to have confirmed that the French prosecutor’s “suicide” hypothesis is correct, after all. But the problem is that when the prosecutor first affirmed that Lubitz manually reset the target altitude of the aircraft, i.e. to assure its destruction, he appears to have had no way of knowing this. It should be noted that the prosecutor made this affirmation likewise on the basis of information provided to him by the BEA. At the time, the BEA is known to have had at its disposal only the first “black box” or Voice Cockpit Recorder, not the Flight Data Recorder containing the technical details of the flight’s operation.

Per the prosecutor’s account and leaks to the media, the BEA’s investigators are supposed to have “heard” that Lubitz reset the target altitude. But Gérard Arnoux, a recently retired Air France pilot who flew A320s for eighteen years, has noted that the control in question makes “no noise whatsoever.” Indeed, during an appearance on the French current affairs program Le Grand Journal, Arnoux pointed to several anomalies in the prosecutor’s account.

Thus, as proof that Lubitz was alive and conscious during the plane’s descent, the prosecutor has claimed that Lubitz’s “normal breathing” is audible on the recording. (It can be noted in passing that this would not in fact prove that Lubitz was conscious and, under the circumstances, might even be taken as proof to the contrary.) Given the high-level of ambient cockpit noise, however, Arnoux insisted that it would be impossible to hear breathing on the recording.

Finally, Arnoux has noted that if in fact the pilot was locked out of the cockpit, as the prosecutor has suggested, he ought to have been able to gain entry by using an emergency code – unless, that is, the co-pilot intentionally chose to deny entry by using a switch on the control panel. Even in the latter case, however, the emergency code ought to have set off an alarm in the cockpit. But the reconstruction of the last minutes of the flight, as ostensibly based on the cockpit recording, makes no mention of any such alarm.

Arnoux is the president of the Surveillance Committee on Air Safety, a French citizen’s group formed by the families of victims of plane crashes. In the aftermath of the Germanwings crash, he immediately called attention to the possibility of computer-error, citing the recent episodes of pilots’ losing control of Airbuses. He likewise pointedly told the French daily Le Figaro that, contrary to what was said in the media, there were in fact storm clouds reported in the path of the Germanwings flight and these could have caused sensors to freeze.

Apart from the specific anomalies in the BEA’s account of the Germanwings crash, Arnoux has also pointed to a more general structural problem with the BEA itself: namely, the fact that, contrary to international norms, it is not an independent agency, but rather directly subordinate to the French government. In the case of an Airbus, this dependence upon the French government creates a glaring conflict of interest. France is one of the two major shareholders in the Airbus Group, holding some 12% of the company’s stock. The other major shareholder is, incidentally, Germany, which likewise holds 12%.

Arnoux’s comments on Le Grand Journal have provoked controversy in France and the accusation that he was fueling “conspiracy theories.” In response to queries from the weekly L’Express, he appeared to relativize the import of the remarks, now endorsing the prosecutor’s thesis and dismissing the anomalies as merely a problem of “communication.” The article in L’Express, which is ostensibly dedicated to debunking these “conspiracy theories,” refers only to such theories as are so absurd as not to require debunking – like that the flight was shot down by experimental American weaponry. Revealingly, it makes no mention of the more banal possibility that Arnoux and other aviation experts invoked in the immediate aftermath of the crash: namely, that of computer error.

Contacted by the author, Arnoux reiterated his concerns about the lack of independence of the BEA investigation, noting that Airbus is the “sole engine of France’s balance of trade” and hence “untouchable.” Nonetheless, he insisted that he now believes that the theory of pilot suicide provides the best available explanation for the crash. Any other explanation, Arnoux said, would require a highly improbable conjunction of events: firstly, that the plane began its descent on its own (which, as Arnoux acknowledges, is possible); secondly, that Lubitz lost consciousness in the cockpit; and, thirdly, that the system permitting entry to the cockpit malfunctioned. It should be recalled, however, that Arnoux’s own earlier observations call into question whether the captain of the aircraft ever in fact entered the emergency code that could have opened the cockpit door from the outside.

Arnoux’s colleague, Henri Marnet-Cornus, has a more radical view of the BEA’s failings. Himself a former airlines pilot, Marnet-Cornus is the co-author with Gérard Arnoux of a widely-cited report on Air France flight 447, an Airbus 330 that crashed into the Atlantic en route from Rio to Paris in 2009. “How can one trust an agency that tells us in a press conference on March 25 that the analysis of the Cockpit Voice Recorder will take a long time (days or even weeks) and then, the following night, breaks the rules by making a transcript of the recording available to the media,” Marnet-Cornus told the author, “that says that on the recording one hears the noise of a control that does not make any noise?” “I don’t believe what the BEA says anymore,” Marnet-Cornus concluded, “Anything is possible.”

View Situation Reports
  • divingfe

    Whether or not, the agency erred in a premature assumption, the above scenario-assuming that the FAC computers programmed themselves for a descent, or some such- also assumes that the copilot had lost consciousness/fallen asleep or…., AND that the cockpit door unlock mechanism also coincidentally malfunctioned. As sad as it is to contemplate, the simultaneous occurrence of these factors, coupled with the coincidental?? exit from the cockpit of the other pilot… leaves little room for doubt that, unfortunately, the copilot probably set the aircraft on its fatal course. Now, the air agencies announcements, may have been premature, but the conclusions are, nonetheless, backed up by the data( or lack thereof) from both recorders, as far as they go.
    As far as the Air France episode, and the Air Asia accident, a most logical, and unfortunately, repetitive scenario, in swept-wing jet history, both jets almost certainly got themselves into a meeting of the buffet boundary at [high] altitude, caused by using powerful engines (especially on all “twin” jets) to “out-climb the wing”, where high speed and low speed stall speeds converge, especially aggravated by enhanced G-forces in turbulence. The use of “chasing airspeed”,, and trying to “out climb the weather” rather than maintaining a constant attitude and a known, pre-set,turbulence-power setting.
    A lack of a complete and thorough understanding of the vagaries of the nowadays, very complex auto-flight systems and their various input sources, in this modern age of “push-the-correct-button,-get a banana” training, leaves the pilots in much the same circumstances as the poor passengers. This left them in an initially unrecoverable stalled condition, which can only be rectified by descent(controlled or otherwise) to a much lower altitude where the low speed and high speed stall boundaries are much more widely separated. Additionally, recoveries from such conditions have historically only occurred when at lower altitudes AND visual reference to the horizon occurs. I have just counted 50 years in aviation professionally this month, and as early-on as 1970, was teaching potential jet pilots of this [used to be called] “UPSET” condition; with the help of a wonderful FAA training film, made during the LBJ era, and, coincidentally, narrated by none other than Rod Serling of ‘Twilight Zone’ fame, whose brother, Robert, was a well known aviation author in his own right. That film, at least then, and perhaps still, was not available for public consumption, as it might have (and still?) caused undue worry on safety of jets, to the flying public.
    Apart from the now, finally, concern arising,about pilots “losing touch” with their aircraft due to the complex and all-pervasive auto-flight systems (which by the way are REAL fuel-savers), a greater emphasis on comprehensive and continuing training would, of course, be advantageous, but this went by the wayside in the 70s, on the theory that the pilots don’t need to know HOW something works, they only need to know HOW to work it. That has led to the aircraft designers, and the airline companies into a situation, where the very fine reliability of the aircraft has led to complacence on all sides.
    More to the point (forgive the long-winded tirade). the instances of [supposed] pilot suicide are so rare, compared to the millions of flight-hours each year… that we in the industry must pretty well leave the perception of an incipient problem up to teamwork, training, observation, and when these extremely rare unfortunate circumstances occur, to take a deep breath, console the grieving, and move on. We have become so infatuated with 9/11 security, that it has become a driving motivation of aviation, rather than a sideline, and DRAMA becomes an end in its own. There are no more (and probably much, much, less) instances of “rogues” in the pilot seats, than in any other profession, including politicians, lawyers, policemen, doctors, etc. What needs to be emphasized, in terms of saving more aviation lives, is more emphasis on detailed, comprehensive training, expensive to the airline companies, as it may be. That helps, more than anything else, to weed out the weak sisters (and I think female pilots are fine!!!) It also might help to re-consider the decision of many years ago, of getting rid of the flight engineers, in transport category aircraft, both in terms of systems operation and understanding, and as a 3rd body in the cockpit for many types of emergencies/abnormalities.
    Thank you for indulging me. Regards.

    • KRV Rao

      Thank you for the insights. The article isn’t nearly long enough! I will now start rummaging the internet for that training video you mentioned.

  • arun kumar

    While there are many possibilities for the Germanwings crash, the fact that the investigation is dedicating majority of its efforts and focus on collecting evidence that can prove Lubitz’ deliberate action indicates that the investigation is not fair. Apart from ‘No Evidence So Far’ what concrete evidence from FDR/CVR has been obtained that conclusively proves the plane had no system malfunction? For system failure, ‘No Evidence’ and ‘No Indication’ is widely accepted but for everything else, they wish to collect and provide concrete evidence. Here are my views:

  • Jersey_Prophet

    A co-pilot who locks out the pilot from the cockpit, then initiates a descent and and you think it’s a problem with the plane? No mention of an alarm in the transcript? Maybe the alarm malfunctioned. What about the pilot desperately banging on the door?

    I acknowledge other incidents where the computer malfunctioned, but to try to assign responsibility away from the human in this particular case strains credulity to the breaking point.

    • J_____L

      No, it’s the other way around. This whole particular case strains credulity to the breaking point.

  • Frank Sterling

    The author is, at best, completely naive if he thinks that the IFALPA (or any other pilots’ association for that matter) has any agenda other than to further the best interests of pilots and protect their reputations individually and as a group. There is nothing wrong with that but to infer that what is essentially a trade group is an authoritative source is really poor journalism.

  • FS3

    Besides the fact that our only available data comes from flightradar24 – and there are MULTIPLE versions circulating – it should be clear that 4U9525 did not touch the ground in one piece. It exploded midair – either by an internal explosion – or it was shot down by the French AF, see here out of 6 parts:

    B.t.w.: Look what’s the name of the gendermarie woman that allegedly did find the 2nd flight recorder: Alice Coldefy. Her namesake Admiral Alain Coldefy is the Vice President of Political Affairs for France at the EADS Company…

  • John van den Heuvel

    I for one will not fly any Airbus A320 or a derivative of same.

    • Johnny Mac

      Exactly. The most likely cause was a mechanical fault of the variety that has plagued the Airbus A320 model. It is no secret that the ‘fly-by-wire’ system has been known to cause these planes to nose dive at 4000ft per minute, and the officially suggested workaround is literally to disconnect the computer!

  • Peter

    Germanwings has not learned anything from the crash, today (25.06.2015) there have been 2 unknown womens in the cockpit during the whole flight!!! (4U772 from Cologne to Prague)


Lost your password?