The Trouble with Germanwings Flight 9525
April 22, 2015
The reported discovery of the second “black box” of Germanwings Flight 9525, the Airbus 320 that crashed in the French Alps last month, appears to have put the Germanwings story to rest as far as the mainstream media is concerned. In a laconic press release published less than 24 hours after the plane’s Flight Data Recorder was reportedly found by a female gendarme, France’s air safety investigative authority, the BEA, announced that a preliminary reading of its contents confirmed that the flight’s co-pilot intentionally brought about the plane’s fatal decent. The hypothesis that the plane was intentionally crashed by its allegedly suicidal co-pilot, Andreas Lubitz, had first been floated by French prosecutor Brice Robin just two days after the crash. It has dominated the headlines ever since, quickly taking on the aura of established fact.
Numerous aviation experts and professional associations have condemned this rush to judgment and the role of French authorities in fueling it. They include, most recently, the International Federation of Airline Pilots’ Associations (IFALPA), which, in a statement, describes the scenario depicted by the French prosecutor as “beyond our comprehension” and pointedly notes that the conduct of the Germanwings investigation does not meet internationally accepted standards. The IFALPA statement calls attention, in particular, to the damage done to the integrity of the investigation by “leaks of protected information, media pressure, and political considerations.”
What the aviation experts and professional associations undoubtedly know, but the broader public in general does not, is that a known malfunction in a cockpit computer on the A320 family of planes could initiate a controlled descent like that Lubitz is accused of having intentionally brought about and, furthermore, that so long as the computer is running, the pilot or pilots would not be able to override it.
Including Germanwings 9525, no less than three planes of the same type have either crashed or narrowly escaped doing so in the just the last four months. According to published reports, both of the others suffered a computer malfunction.
Thus, on November 5, a Lufthansa Airbus 321 en route from Bilbao to Munich went into a descent shortly before reaching cruising altitude. The A321 is a longer version of the A320. The BFU, Germany’s air safety investigative authority, has established that the descent was automatically programmed by the plane’s Flight Augmentation Computers (FAC), a component of Airbus’s so-called Fly-by-Wire system. Ironically, the Flight Augmentation Computers are supposed to provide protection against pilot errors. In the case of Lufthansa flight 1829, however, the computer system was itself erring due to faulty data from frozen sensors on the exterior of the plane. After an initial loss in altitude of some 4000 feet in about a minute, the crew battled for nearly three quarters of an hour to keep the plane afloat, pulling constantly on the joystick to counteract the programmed descent.
According to the BFU’s preliminary report on the incident, after consultation with technical staff on the ground, the pilots were able finally to regain control of the plane by shutting down one of the data units reporting faulty information. This in turn caused the computer to disengage. (A recent article in the German weekly Der Spiegel tells a still more dramatic, but apparently erroneous, story. According to Der Spiegel, the captain of the aircraft had finally to resort to flipping circuit-breakers in order to cut off electricity to the computer system.)
On December 28, just six weeks after the Lufthansa 1829 incident, an Asia Airlines Airbus 320 en route from Surabaya to Singapore suddenly went into a sharp climb, then stalled and crashed into the Java Sea. Indonesian authorities have refused to issue a preliminary report. But here too a malfunction of the Flight Augmentation Computers appears to have played a role. Citing sources with knowledge of the investigation, Bloomberg has reported that in the case of Air Asia flight 8501, the captain of the aircraft did indeed pull a circuit breaker cutting off power to the Flight Augmentation Computers shortly before the crash. It appears to have been this unplugging of the computer system – perhaps combined with manual inputs from the co-pilot? – that provoked the plane to climb too abruptly and stall.
Given the recent precedents of Air Asia 8501 and Lufthansa 1829, it is hardly surprising that many pilots and aviation experts immediately assumed that Germanwings Flight 9525 had suffered a computer malfunction due to frozen sensors. (See, for instance, the comments to an Aviation Herald synopsis of the BFU report on Lufthansa 1829 here. As chance would have it, the synopsis was posted on March 24, shortly before the ill-fated Germanwings flight departed from Bilbao.)
Now, however, the analysis of the 2nd “black box” by the BEA appears to have confirmed that the French prosecutor’s “suicide” hypothesis is correct, after all. But the problem is that when the prosecutor first affirmed that Lubitz manually reset the target altitude of the aircraft, i.e. to assure its destruction, he appears to have had no way of knowing this. It should be noted that the prosecutor made this affirmation likewise on the basis of information provided to him by the BEA. At the time, the BEA is known to have had at its disposal only the first “black box” or Voice Cockpit Recorder, not the Flight Data Recorder containing the technical details of the flight’s operation.
Per the prosecutor’s account and leaks to the media, the BEA’s investigators are supposed to have “heard” that Lubitz reset the target altitude. But Gérard Arnoux, a recently retired Air France pilot who flew A320s for eighteen years, has noted that the control in question makes “no noise whatsoever.” Indeed, during an appearance on the French current affairs program Le Grand Journal, Arnoux pointed to several anomalies in the prosecutor’s account.
Thus, as proof that Lubitz was alive and conscious during the plane’s descent, the prosecutor has claimed that Lubitz’s “normal breathing” is audible on the recording. (It can be noted in passing that this would not in fact prove that Lubitz was conscious and, under the circumstances, might even be taken as proof to the contrary.) Given the high-level of ambient cockpit noise, however, Arnoux insisted that it would be impossible to hear breathing on the recording.
Finally, Arnoux has noted that if in fact the pilot was locked out of the cockpit, as the prosecutor has suggested, he ought to have been able to gain entry by using an emergency code – unless, that is, the co-pilot intentionally chose to deny entry by using a switch on the control panel. Even in the latter case, however, the emergency code ought to have set off an alarm in the cockpit. But the reconstruction of the last minutes of the flight, as ostensibly based on the cockpit recording, makes no mention of any such alarm.
Arnoux is the president of the Surveillance Committee on Air Safety, a French citizen’s group formed by the families of victims of plane crashes. In the aftermath of the Germanwings crash, he immediately called attention to the possibility of computer-error, citing the recent episodes of pilots’ losing control of Airbuses. He likewise pointedly told the French daily Le Figaro that, contrary to what was said in the media, there were in fact storm clouds reported in the path of the Germanwings flight and these could have caused sensors to freeze.
Apart from the specific anomalies in the BEA’s account of the Germanwings crash, Arnoux has also pointed to a more general structural problem with the BEA itself: namely, the fact that, contrary to international norms, it is not an independent agency, but rather directly subordinate to the French government. In the case of an Airbus, this dependence upon the French government creates a glaring conflict of interest. France is one of the two major shareholders in the Airbus Group, holding some 12% of the company’s stock. The other major shareholder is, incidentally, Germany, which likewise holds 12%.
Arnoux’s comments on Le Grand Journal have provoked controversy in France and the accusation that he was fueling “conspiracy theories.” In response to queries from the weekly L’Express, he appeared to relativize the import of the remarks, now endorsing the prosecutor’s thesis and dismissing the anomalies as merely a problem of “communication.” The article in L’Express, which is ostensibly dedicated to debunking these “conspiracy theories,” refers only to such theories as are so absurd as not to require debunking – like that the flight was shot down by experimental American weaponry. Revealingly, it makes no mention of the more banal possibility that Arnoux and other aviation experts invoked in the immediate aftermath of the crash: namely, that of computer error.
Contacted by the author, Arnoux reiterated his concerns about the lack of independence of the BEA investigation, noting that Airbus is the “sole engine of France’s balance of trade” and hence “untouchable.” Nonetheless, he insisted that he now believes that the theory of pilot suicide provides the best available explanation for the crash. Any other explanation, Arnoux said, would require a highly improbable conjunction of events: firstly, that the plane began its descent on its own (which, as Arnoux acknowledges, is possible); secondly, that Lubitz lost consciousness in the cockpit; and, thirdly, that the system permitting entry to the cockpit malfunctioned. It should be recalled, however, that Arnoux’s own earlier observations call into question whether the captain of the aircraft ever in fact entered the emergency code that could have opened the cockpit door from the outside.
Arnoux’s colleague, Henri Marnet-Cornus, has a more radical view of the BEA’s failings. Himself a former airlines pilot, Marnet-Cornus is the co-author with Gérard Arnoux of a widely-cited report on Air France flight 447, an Airbus 330 that crashed into the Atlantic en route from Rio to Paris in 2009. “How can one trust an agency that tells us in a press conference on March 25 that the analysis of the Cockpit Voice Recorder will take a long time (days or even weeks) and then, the following night, breaks the rules by making a transcript of the recording available to the media,” Marnet-Cornus told the author, “that says that on the recording one hears the noise of a control that does not make any noise?” “I don’t believe what the BEA says anymore,” Marnet-Cornus concluded, “Anything is possible.”