We'll never know what it was like to be aboard Air France Flight 447 as it plunged into the Atlantic Ocean on May 31, apparently killing all 228 aboard. For now, the closest we may get is listening to the passengers on a similar Airbus 330 jet whose flight computer put it into an uncommanded dive over northwestern Australia last October.
Qantas Flight 72 had been airborne for three hours, flying uneventfully on autopilot from Singapore to Perth, Australia. But as the in-flight dinner service wrapped up, the aircraft's flight-control computer went crazy. The plane abruptly entered a smooth 650-ft. dive (which the crew sensed was not being caused by turbulence) that sent dozens of people smashing into the airplane's luggage bins and ceiling. More than 100 of the 300 people on board were hurt, with broken bones, neck and spinal injuries, and severe lacerations splattering blood throughout the cabin. (Read a Q&A on how to survive a plane crash.)
"It was horrendous, absolutely gruesome, terrible," passenger Jim Ford told Australian radio. "The worst experience of my life." Passenger Nigel Court said he was terrified to watch people not wearing seat belts including his wife fly upward. "She crashed headfirst into the roof above us," he told a reporter. "People were screaming," said Henry Bishop of Oxford, England. A Sri Lankan couple said they were thrown to the ceiling when their seat belts failed. "We saw our own deaths," said Sam Samaratunga, who was traveling with his wife Rani to their son's wedding. "We decided to die together and embraced each other."
After seemingly an eternity in reality, the nosedive lasted 20 very long seconds the flight crew wrested control of the plane from its wayward computer and made an emergency landing at a remote military and mining airstrip 650 miles short of Perth. (Watch TIME's video of the rescue of US Airways flight 1549.)
Following an investigation of the A330's uncommanded dive, Australian aviation officials, assisted by U.S. and French authorities, blamed a pair of simultaneous failures for the near disaster. The plane has three air data inertial reference units (ADIRUs), which are designed to help the plane's flight-control computer fly the plane safely. The system is intended to eliminate the possibility of electronic error: the flight computer, which is always monitoring the trio, can disregard one ADIRU if it begins relaying information that conflicts with the other two.
But that's not what happened when one of them went awry on Oct. 7 and began sending erroneous data spikes on the plane's angle of attack (AOA) the angle between its wings and the air flowing over them to the flight-control computer. "For some reason, the damn computer disregarded the healthy channels," says Hans Weber, an aviation expert who heads Tecop International, an aviation-consulting firm in San Diego. "Instead, it acted upon the information from the rogue channel." The computer, responding to the faulty data, put the plane into a dive. (Read "Is There a Cause for Fear of Flying?")
In its preliminary investigative report, released on March 6, the Australian Transport Safety Bureau said Airbus had initially said it didn't know of any other similar events. But when the same thing happened again, involving a different aircraft, on Dec. 27, Airbus combed its computerized flight files and found data fingerprints suggesting similar ADIRU problems had occurred on a total of four flights. One of the earlier instances, in fact, included a September 2006 event on the same plane that entered the uncommanded dive in October (the other three flights had continued safely on). The same VCR-sized ADIRU was to blame in both those cases, although it had supposedly undergone a needed realignment following the 2006 event. All three planes carried the same brand and model of ADIRU, as do 397 of the 900 330s and 340s in the Airbus fleet.
It is not yet known whether Air France 447, an A330, carried the troublesome variety of ADIRU. But if it did, and if the Air France plane plummeted into an uncommanded dive while traveling through a downdraft generated by storms a common occurrence over the region of the Atlantic Ocean where the plane went down it could have been doomed as it entered a steep dive and likely broke up.
Aviation authorities around the world have ordered inspections and procedures to try to eliminate the problem. "In these fly-by-wire systems, one never really knows if one has checked out all possible combinations of events to make sure that the computer properly reacts," Weber says of modern flight control. Fly-by-wire systems use computers and wires instead of mechanics and hydraulics to control a plane's flight. Electronic systems are more reliable than mechanical processes but are prone to software errors that can't always be anticipated. "There could be some other sequence of events that could cause another bad software reaction," says Weber.
The Australians' March report concluded that the October dive was due to a series of events that, when combined, was "close to the worst possible scenario that could arise from the design limitation in the AOA processing algorithm." Airbus also told investigators that this particular mathematical formula for flying the plane is found only on its A330 and A340 models. "Different algorithms were in use on other Airbus types, which were reported to be more robust to AOA spikes," the report said. "The manufacturer advised that AOA spikes matching the above scenario would not have caused a pitch-down event on Airbus aircraft other than an A330 or A340."