Spiegel Online International

By Gerald Traufetter

The crash of Air France flight 447 from Rio to Paris last year is one of the most mysterious accidents in the history of aviation. After months of investigation, a clear picture has emerged of what went wrong. The reconstruction of the horrific final four minutes reveal continuing safety problems in civil aviation.

One tiny technical failure heralded the impending disaster. But the measurement error was so inconspicuous that the pilots in the cockpit of the Airbus A330 probably hardly noticed it.

Air France flight 447 had been in the air for three hours and 40 minutes since taking off from Rio de Janeiro on the evening of May 31, 2009. Strong turbulence had been shaking the plane for half an hour, and all but the hardiest frequent flyers were awake.

Suddenly the gauge indicating the external temperature rose by several degrees, even though the plane was flying at an altitude of 11 kilometers (36,000 feet) and it hadn't got any warmer outside. The false reading was caused by thick ice crystals forming on the sensor on the outside of the plane. These crystals had the effect of insulating the detector. It now appears that this is when things started going disastrously wrong.

Flying through thunderclouds over the Atlantic, more and more ice was hurled at the aircraft. In the process, it knocked out other, far more important, sensors: the pencil-shaped airspeed gauges known as pitot tubes.

One alarm after another lit up the cockpit monitors. One after another, the autopilot, the automatic engine control system, and the flight computers shut themselves off. "It was like the plane was having a stroke," says Gérard Arnoux, the head of the French pilots union SPAF.

The final minutes of flight AF 447 had begun. Four minutes after the airspeed indicator failed, the plane plunged into the ocean, killing all 228 people on board.

Few airline crashes in recent years have subsequently unnerved passengers to quite the same extent. "How was it possible that an Airbus from such an apparently safe airline could simply disappear?" they wondered.

Passengers on the Rio-Paris route are still uneasy as they board their plane. After the accident, the flight number was changed to AF 445. Many frequent flyers have since opted for daytime flights across the Atlantic because pilots can recognize storm fronts more easily during the day.

Another large-scale search for the stricken plane's "black box" flight recorders is due to begin in the coming weeks. Once again some 2,000 square kilometers (800 square miles) of mountainous ocean floor will be swept, some of it by a submarine from from the northern German city of Kiel. "We shouldn't speculate about the causes of the accident until the search has been completed," says Jean-Paul Troadec, the director of the French air crash investigation agency BEA.

Other experts are less guarded in their comments. "We know pretty well why the accident happened," says union boss Arnoux.

'An Accident Like This Could Happen Again'

Over the course of several months of investigation, experts have gathered evidence that allows them to reconstruct with relative accuracy what happened on board during those last four minutes. It has also brought to light a safety flaw that affects all jet airplanes currently in service. "An accident like this could happen again at any time," Arnoux predicts.

Experts reconstructed dozens of incidents involving Airbus planes to try to piece together the puzzle of this particular disaster. Plane wreckage and body parts give crucial clues as to what brought the plane down. Crash investigators also conducted detailed analyses of the 24 automatic fault messages that the aircraft sent to Air France headquarters by satellite in the run-up to the accident. One particular message -- the very last one transmitted before impact -- could solve the mystery surrounding flight AF 447.

A half moon lit up the Atlantic Ocean on the night of May 31, offering reasonably favorable conditions for a flight through the dangerous intertropical convergence zone. That's where violent thunderstorms rage and columns of thick clouds bar the way like an aerial obstacle course. In addition to the on-board radar, the moon helps pilots identify dangerous cloud formations and take appropriate measures.

On the night of the tragedy, other planes diverted their flight paths and took a detour around the danger zone.

Why then did flight AF 447 head straight into the deadly storm system? Is it possible that the tragedy began even before the plane took off?

Galeão Airport, Rio de Janeiro, 6pm local time: Preparation for takeoff

Captain Marc Dubois, 58, goes through the flight plan of AF 447: He enters a starting weight of 232,757 tons into the on-board computer, 243 kilograms less than the maximum permissible weight for the A330. As well as the passengers' luggage, the ground crews load 10 tons of freight into the cargo bay. Dubois has more than 70 tons of kerosene pumped into the fuel tanks. That sounds a lot more than it actually is, because the plane consumes up to 100 kilograms of kerosene every minute. The fuel reserves don't give much leeway.

It's only by means of a trick that the captain can reach Paris with more than the legal minimum reserves of kerosene that must be in the plane's tanks upon arrival in the French capital. A loophole allows him to enter Bordeaux -- which lies several hundred kilometers closer than Paris -- as the fictitious destination for his fuel calculations.

"Major deviation would therefore no longer have been possible anymore," says Gerhard Hüttig, an Airbus pilot and professor at the Berlin Technical University's Aerospace Institute. If worse came to worst, the pilot would have to stop and refuel in Bordeaux, or maybe even in Lisbon. "But pilots are very reluctant to do something like that," Hüttig adds. After all, it makes the flight more expensive, causes delays and is frowned upon by airline bosses.

After takeoff, Dubois quickly takes the plane up to a cruising altitude of 35,000 feet (10.6 kilometers), an altitude known as "flight level 350." According to his kerosene calculations, he has to climb far further, to above 11 kilometers, where the thin air reduces his fuel consumption.

It's not known whether he actually reached this altitude. Three hours after leaving Rio, Captain Dubois contacted Brazilian air traffic control for the last time. "Flight level 350," he reported. It was to be his last communication with the outside world.