A list of the 24 ACARS messages listed by Air France that were sent from AF 447 between 0210Z and 0214Z on 1 June, 2009, the last information received from the aircraft, was shown on the France 2 TV channel on Thursday June 4. This list, in which incomplete information was shown, was typed up and distributed on the Internet (one must beware of typographic errors in the various versions which I have seen). Thus people started to interpret the messages and inquire about their significance.

I take it that people know what “reading tea leaves” means? Fortune tellers would look at the pattern of leaves left in the cup after the tea had been drunk, and wondering what they say about the future. Similarly, people (including myself, here) have been looking at the (partial) ACARS messages shown on the TV, and have been wondering what they say about the past. I adduce the comparison to propose a healthy dose of scepticism about what one can validly conclude from the currently publicly-available information.

The messages were listed in the following order (omitting messages which consist of maintenance warnings). The four-digit numbers are the Joint Aircraft System/Component (JASC) code, which I interpret from the FAA JASC Table and Definitions Document from February 11, 2002, which is on-line.

* at 3.5 hours before the main events, a 3831 event. Something concerning waste disposal (38 is water and waste, and 3830 is the waste disposal system)

* at 0210, a 2210 event: AP off (22 is Auto Flight and 2210 is the Autopilot system)

* at 0210, a 2262 event (22 is Auto Flight; I have no code 2260)

* at 0210, a 2791 event, flight control switch to alternate law (27 is flight controls; I have no code 2790 or 2791)

* at 0210, two 2283 events, flags raised on CAP and FO Primary Flight Displays (PFD) (22 is Auto Flight, I have no code 2283)

* at 0210, a 2230 event, autothrust off (2230 is the auto throttle system)

* at 0210, a 3443 event, a TCAS problem (34 is navigation; 3443 is the Doppler system. The Doppler system here is used to measure relative motion of another body, in this case another aircraft, for TCAS).

* at 0210, two more 2283 PFD flags

* at 0210, a 2723 rudder travel limiter fault (27 is flight controls, 2720 is the rudder control system). At higher airspeeds, the rudder travel is limited by the Rudder Travel Limiter; far less movement is allowed than at lower airspeeds.

* at 0210, a 3411 event with EFCS 2, reported by EFCS1 (3411 is the pitot/static system. I understand that on these airplanes, the system is divided into the pitot subsystem and the static subsystem).

* at 0210, a 2793 event involving EFCS 1. (27 is flight controls. I understand from colleagues that, on the A330, 2793 is the Flight Control Primary Computer, FCPC, also designated PRIM)

* at 0211, a couple more 2283 PFD flags

* at 0212, a 3410 event. A disagreement between the air data units, the AD part of the ADIRU (34 is navigation; 3410 is flight environment data). An “ADR disagree” can only occur when one of the three ADIRUs has already been designated as faulty by the FCPC, and the two remaining ADIRUs yield discrepant readings (this information from the Aircraft Operating Manual of the A330)

* at 0212, a 3422 event in the standby flight instruments (ISIS) (34 is navigation, 3422 is directional gyro and indicators)

* at 0212, a 3412 event involving IR2, the inertial reference part of ADIRU2 (34 is navigation; 3412 is the outside air temperature sensor and indicator). Reported by IR1 and IR3 and EFCS1.

* at 0213, two 2790 (EFCS) events, FCPC 1 and Secondary FCC (FCSC) 1 faults (27 is flight control; I don’t have the 2790 designator)

* at 0213, a 2283 event, reported by FMGKC1 (22 is autoflight, I understand from colleagues that 2283 is the Flight Management and Guidance Computer, FMGC)

* at 0214 a 2131 event (21 is the air conditioning, 2131 is the cabin pressure controller).

What about the ordering of these messages? First of all, they are time-stamped by the minute, so that orders them into five groups (the 0210 messages, respectively 0211, 0212, 0213, 0214). What about a finer ordering? That is going to be much harder. We don’t know whether this listed order is the order in which the messages were received (but Air France can probably tell us that). We don’t know whether the order in which the messages were received were the order in which they were transmitted (but maybe there is something in the code that can tell us that). We don’t know whether the order in which they were transmitted is the order in which they were generated (maybe Airbus can say something about that, but there might also be some indeterminacy). And, finally, we don’t know whether the order in which they were generated is the order in which the events occurred (that may be hard even for the manufacturer to say, because the rates at which values are sampled are very different, depending on the system).

For the purposes of a speculative interpretation, let me assume here that the events occurred in the order listed above. I do caution that this is quite a significant, and not necessarily correct, assumption. Let me further assume that the messages are veridical. For example, that the “ADR disagree” message really does indicate that the FCPC has ignored air data input from one ADIRU and is judging that the air data input from the other two are not consistent with each other. How significant this assumption is depends on whether one is a sceptic or an optimist about the reliability of these highly complex programmable-electronic systems and one’s trust in their design.

So here goes. The AP went off and flight control went to alternate law. Flags pop up. Autothrust disconnects, something with TCAS and then two more flags. Rudder travel limiter has a problem and then something with the pitot-static system that the EFCS’s have problems with. Sometime over a minute later we are told that the air data from one ADIRU has been designated unreliable by the FCPC and the air data from the other two disagree. Then the laser ring gyro in the ISIS complains, as do the primary and secondary flight computers (these systems are duplicated: it is the number 1 units of each that are complaining), something happens with the FMGC, and then there is a cabin pressure warning.

Why might AP go off and flight control go to alternate law? One possibility is (1) you’re being severely shaken around, or (2) for some reason the AP couldn’t maintain altitude. Another possibility is that (3) there was a system problem. Then the autothrust (AT) goes off. That would happen if, for example, that auto flight systems cannot maintain stable air speed (AS) and altitude. I don’t know what the TCAS notification would signify. Then there is a rudder travel limiter fault. That device has AS as input, so maybe there is an issue with AS sensing. Then EFCS1 thinks EFCS2 has problems with pitot-static sensing. The pitot system colludes with the static system to measure AS, and the static system is also used to measure altitude. Then EFCS 1 complains about FCPC (I take it that would be FCPC 1, also known as PRIM 1). Then two of the three remaining air data units disagree and can’t reconcile (we don’t know when the first was voted out by the FCPC 1). At a similar time, the DG in the stand-by flight instrument system complains. At a similar time, the inertial reference part of ADIRU 2 is faulted by the other two. Then unspecified faults with FCPC1 and FCSC 1, but it’s not clear which system component is reporting those faults. Then another flight control issue, and finally the cabin pressure controller squeaks.

There are some patterns here. One pattern is there is a lot of stuff involved with AS and altitude, and at least one with the outside-air-temperature sensors. The commonality here is the pitot and static systems and their interaction. Then later comes the DG in ISIS, followed by IR2 being voted out and then FCPC and FCSC faults and cabin pressure.

What could be up with the P-S systems? One possibility is that they are getting all iced up. That would be why AP and AT think they can’t maintain altitude. That might also explain the outside-air-temperature probe complaint, if it were being iced also. But manufacturers and regulators know about ice; it must have been extraordinarily severe to overwhelm the sensor heating systems.

Another possibility that some have mooted on the internet is that the aircraft was being blown around a lot in severe to extreme turbulence, but I don’t see how thereby one would get discrepant readings: rather, all probes would vary wildly, but coordinated, as individual gusts hit all three at more or less the same time. So I really don’t see that as a plausible reason for the P-S system issues.

The IR units are self-contained: they are calibrated sometime way back when and that’s it for the remainder of the flight. So when they start complaining, it is either a system fault or you are already out of control and moving them around more than they judge appropriate.

Severe icing alone overwhelming the sensor systems, though, does not by itself lead to an accident. The AC could be controlled with pitch and power, and the Aircraft Operating Manual explains exactly what pitch and what power setting in some detail, if one has an “ADR disagree” warning.

Severe turbulence, though, could cause a control problem if there are shears of more than 50-60 kts differential, because that is approximately the width of the speed band for that flight at its cleared flight level – this has been verified, using a conservative estimate of the aircraft’s weight at the time, by experienced A330 pilots (by “speed band”, I mean the difference between “maximum Mach operating” speed and stall speed). However, turbulence of that sort, while supposedly possible, is very, very unusual.

How do you get that severe icing overwhelming the PS systems? Temperature at that altitude is well below the freezing point for water, so clouds are generally formed from ice crystals. The properties of these are well known and the air data systems and their certification is aimed to cope with them, unless there is an entirely new phenomenon manifesting itself here. Ice crystals don’t show up on weather radar, so even with careful use of weather radar one might not fathom the presence of a storm whose water content is crystalline ice, no matter how violent that storm is.

The behavior of supercooled water droplets doesn’t seem to be as well understood. Water can become supercooled, even as low as -40°C (which would be a typical temperature for the flight level at which AF 447 was flying), especially in strong convective atmospheric currents. Water requires a certain amount of energy to crystallise, and if the air is cooling fast, adiabatically, that energy just might not be there. And if there is enough water, at -40°C, colliding with your sensors and freezing on impact, it may overwhelm the sensor heating and cause air data problems. However, supercooled drops are water and would show up on weather radar. One would expect a crew to avoid such an area being “painted” on their radar, especially in the Intertropical Convergence Zone (ITCZ) in which such storms are frequent, indeed expected. It is common for pilots to deviate many tens of miles from the planned track to avoid such storms, for avoiding the storm is the main priority, and use of the oceanic tracks is designed to accomodate such deviations.

So the severe-icing root-cause hypothesis is not puzzle-free.

What about some sudden, catastrophic structural-failure event such as the sudden in-flight break-up of TWA 800 in 1996? Any such hypothesis must accomodate the fact that parts of the electronics were muttering to themselves in a fairly orderly fashion, and transmitting those mutterings over a SATCOM link, for some four minutes. I don’t see how. (It is obvious that structural-failure occurred – the aircraft’s vertical stabiliser has been found separated – but, one would conclude, later in the accident sequence.)

That is enough tea-leaf reading for one note. We might hope that the BEA will explain the exact meaning of the ACARS messages, and its conclusions about their true ordering, in the interim report which, by ICAO rules, must appear within 30 days of the accident (so, by 1 July 2009).

If anyone has more detail on the exact JASC codes used by the airline and (very important!) can demonstrate to me that that information is reliable, I would be very glad to hear from you.