Storm over the Sahara: The crash of Air Algérie flight 5017
On the 24th of July 2014, a Spanish airliner operating on behalf of Air Algérie disappeared over the Sahara Desert in the middle of the night, plunging from cruise altitude without a distress call. The charred remains of the McDonnell Douglas MD-83 and its 116 passengers and crew were found the next day in a remote area of Mali near the border with Burkina Faso. None of those on board had survived. The mystery of the crash only deepened when investigators from France, Spain, and Mali discovered that the cockpit voice recorder had malfunctioned, recording nothing useful from the ill-fated flight. With no witnesses and no CVR, investigators had to reconstruct the terrifying final minutes of Air Algérie flight 5017 from the flight data and wreckage alone. The picture they managed to reveal was incomplete, but highly disturbing: faced with an escalating series of misleading indications and erroneous actions by the autopilot, the crew panicked and lost control of the plane, spiraling downward to their doom.
Swiftair is a Spanish charter airline founded in 1986 and based in Madrid. Unlike a regular airline, in 2014 it did not directly sell tickets to passengers; instead, it ran on-demand cargo charter operations and organized “wet leases” with other airlines, wherein Swiftair provided a plane, a crew, and maintenance, while the lessee sold tickets and paid the fees. Swiftair was certainly no stranger to wet leases in parts of the world that other European airlines might hesitate to touch — it had extensive operations throughout the Middle East and Africa, and it even flew for many years on behalf of the United Nations mission in Sudan.
One of the airlines with a wet lease agreement with Swiftair was Air Algérie, the state-owned flag carrier of Algeria. To supplement their passenger fleet during the peak summer travel season, Air Algérie had been seasonally leasing a Swiftair McDonnell Douglas MD-83 and its Spanish crew to carry out additional services to and from the airline’s hub in Algiers. The 160-seat twin rear-engine jet, registered EC-LTV, had seen service with several airlines since its manufacture in 1996, and had been with Swiftair since 2012.
EC-LTV was scheduled to carry out a routine flight on the 23rd of July, 2014 from Algiers to Ouagadougou, the capital of Burkina Faso, and then back again in the early hours of the 24th. For the Spanish pilots, who were based in Algiers for the summer, it was a routine trip which they had accomplished many times before. 47-year-old Captain Agustín Comerón Mogio had 13,000 flight hours, of which the vast majority — more than 10,000 — were on the MD-80 series, making him a true veteran of the plane pilots affectionately called the “mad dog.” Joining him that night was 42-year-old First Officer Isabel Gost Caimari, who was no rookie herself, with 7,000 total hours, including 6,200 on the MD-80 series. Both pilots had extensive experience flying in Africa, and Captain Comerón Mogio had even spent time flying in rough and dangerous conditions with the UN mission in Sudan. However, neither was actually a full-time pilot: they only flew when the plane was leased to Air Algérie during the summer, and presumably found other work during the rest of the year. As part of a rotating group of six Swiftair pilots based in Algeria, they had flown together on 43 of the last 45 flights.
After an uneventful flight from Algiers, pilots and plane arrived in Ouagadougou shortly after midnight on the 24th of July. The passengers disembarked, a few routine turnaround tasks were conducted, and a new set of passengers boarded for the red-eye flight back to Algiers. The plane ended up being a little over two thirds full, with 110 passengers and six crew on board when the plane pulled away from the terminal. There were supposed to be 111, but one lucky passenger never showed up for the flight.
Flight 5017 to Algiers lifted off from Ouagadougou at 1:15 a.m., headed north into the Sahara Desert. The terrain beneath their flight path would be inhospitable and remote, with few outposts of civilization. In fact, the route for which they were cleared fell afoul of ETOPS regulations — Extended-range Twin-engine Operational Performance Standards — a set of rules for twin-engine aircraft that normally only applies over the ocean. The MD-83, not being rated for long flights over areas without suitable landing sites, wasn’t supposed to fly more than 320 nautical miles (approximately 1 hour) away from the nearest usable airport, a maximum that would be exceeded on a direct flight from Ouagadougou to Algiers. To accommodate this, its flight plan originally called for the crew to fly east to Niamey, Niger before turning north, thus avoiding the emptiest part of the Sahara. But the plane had arrived in Ouagadougou directly from the north via the waypoints GAO and EPEPO, so the controller simply cleared them to fly back the way they came, and the crew never protested. It was an odd aspect of the flight which, while not directly relevant to its fate, may have suggested something about the operating environment.
Heading north toward the border with Mali, flight 5017 climbed toward its cruising altitude of 31,000 feet. Thirteen minutes after takeoff, the tower handed them over to the Ouagadougou area controller: “Contact control on one two zero decimal three.”
“One two decimal three, Algérie four [sic] zero one seven, choukrane,” replied First Officer Gost Caimari, using the Arabic word for “thank you.” Moments later, she contacted area control. “Radar, salam alaikum, Algérie five zero one seven, climbing three one zero.”
“Algérie five zero one seven, cleared EPEPO level three one zero, report EPEPO,” the controller replied.
The flight path out of Burkina Faso ran through an area known as the intertropical convergence zone, where powerful thunderstorms appeared almost every day during that time of year, especially at night. Spotting a thunderstorm directly in their path, the pilots decided to deviate to the west to go around it. “Yes, we’ll call you EPEPO, we are turning left heading 356 to avoid,” First Officer Gost Caimari told the controller.
There were no further communications from flight 5017 until 1:37, when the Ouagadougou controller handed the crew over to his counterpart in Niamey. The Niamey controller heard once from flight 5017, but after that, communications became exceedingly difficult. Due to its deviation around the thunderstorms, the flight was skirting the limits of Niamey’s radar range, and their radio communications were being broadcast through a repeater in eastern Mali that was known to be unreliable even when it wasn’t being actively sabotaged by insurgents. Over the next several minutes, flight 5017 and the Niamey controller would try repeatedly to contact each other, without success.
Only tantalizing hints exist concerning the events that occurred in the cockpit during these critical minutes. But what we do know points to an escalating problem aboard the airplane that had been developing under the noses of the crew.
As flight 5017 tracked around the edge of the thunderstorm, it encountered a poorly understood danger associated with tropical convective activity: high-altitude ice crystals. While “normal” airplane icing is caused by supercooled water droplets striking the plane as it flies in cloud, high-altitude ice crystals are usually invisible to the naked eye, don’t appear on weather radar, and don’t stick to visible parts of the plane. Many pilots, at least in 2014, didn’t even know they existed.
Flight 5017 may well have been in clear conditions when it encountered a cloud of tiny high-altitude ice crystals drifting downwind from the massive anvil east of their flight path. The crystals would mostly have bounced harmlessly off of the plane, but in one critical place they began to build up: inside the sensors that measure the pressure at the engine air intakes.
One of the main ways to measure how much power an engine is generating is to measure the difference between the pressure at the front of the engine and the pressure at the back of the engine. The resulting figure, known as the Engine Pressure Ratio, or EPR, serves as a facsimile for the thrust output. It’s also the variable that the autothrottle uses to determine how much engine power it is applying, and how much it is allowed to apply, in the various phases of flight.
By this point, flight 5017 had leveled off at its cruise altitude, and the crew had selected the “cruise” setting in the autothrottle. This was one of six possible settings — Takeoff, Takeoff Flex, Go-around, Maximum Continuous Thrust, Climb, and Cruise — each of which came with a different maximum EPR that the autothrottle was allowed to command. In cruise, this limit was relatively low, because high power was not needed, and in fact leaving the engines at high power throughout the cruise phase would reduce fuel efficiency and increase wear and tear.
But as ice crystals started to build up in the forward pressure sensors on both engines, airflow into the sensors was obstructed, and the measured pressure started to drop. Because the inlet pressure is the denominator in the ratio, the indicated EPR consequently began to rise, spiking not only above the EPR limit in cruise, but above the maximum EPR that the engines were capable of generating. In order to keep the EPR under the cruise limit, the autothrottle began to reduce thrust in both engines until it reached the maximum allowable value.
At that time, the autothrottle was in Mach mode (not to be confused with the setting, which is a separate parameter). In Mach mode, the autothrottle modifies engine thrust to hold the plane’s speed at a particular Mach number, expressed as a fraction of the speed of sound (Mach 1) at that altitude. But when the autothrottle reduced power in response to the erroneous EPR data, the actual thrust produced by the engines became insufficient to maintain the Mach number selected by the crew, and the autothrottle couldn’t add more because the indicated EPR was already at the cruise limit. At that point the autothrottle switched to Mach ATL mode, which indicated that it was unable to maintain the selected Mach number, and the plane began to lose speed.
What the crew were doing during this time cannot be known with any certainty. But a small shift in engine power that could only have been the result of crew action indicates that they were aware of a problem related to the engines, even if they hadn’t fully grasped the nature of the situation. For the pilots, the main sign of a problem was that each of the two engines was showing a different EPR reading. It was not obvious that the EPR values were erroneous, and their speed was still close to the normal value for cruise flight. Most likely the pilots were perplexed, but not overly concerned. Besides, they had a lot on their plates: they were still trying to navigate around the thunderstorm and make contact with Niamey. The controller had set up a relay via another aircraft in the area, but still only two of eight attempts by the crew to contact ATC during this period were successful. At 1:44, First Officer Gost Caimari managed to tell the controller, “Algérie five zero one seven, we are maintaining flight level three one zero, we are [unintelligible] to avoid.” Her routine report would be the last anyone heard from Air Algérie flight 5017.
Meanwhile on the airplane, the reduction in thrust while in cruise had put the plane into a state where it was “behind the power curve.” The “power curve” is a mathematical equation describing the amount of thrust needed for a plane in a particular configuration to maintain a particular altitude. The insidious thing about the power curve is that it can very easily turn into a self-reinforcing feedback loop. Above a certain speed, the plane is inherently stable and will maintain altitude with a low power setting. But as the speed of the airplane decreases, the amount of thrust needed to maintain altitude increases. If the thrust needed to maintain altitude at that speed is greater than the autothrottle is capable of commanding, a feedback loop begins. First the speed decreases, reducing lift; as a result, the plane will try to descend. Lift being a function of airspeed and angle of attack, the autopilot, which is charged with maintaining altitude, will then increase the plane’s angle of attack to compensate for the decreased airspeed and maintain the same amount of lift. But higher angles of attack cause more drag, which reduces speed even more. Thus the autopilot must increase the angle of attack still further. The way to get out from this zone — known as the back side of the power curve — is for the pilots to increase engine thrust beyond what the autothrottle is allowed to command, reintroducing energy into the system and stabilizing the airplane. But if the pilots don’t intervene, the airspeed will keep falling and the angle of attack will keep increasing until even maximum engine power becomes insufficient to return to stable flight. At that point the only solution is to turn potential energy into kinetic energy by descending, or else the airplane will stall and fall from the sky.
Throughout the period from 1:39 to 1:45, flight 5017’s airspeed continuously decreased, first causing them to fall onto the back side of the power curve, then into the critical zone where only descending could fix the problem. There were plenty of signs that something was wrong. Both pilots’ fast/slow indicators on their primary flight displays would have indicated “slow,” and there would have been numerous “stabilizer in motion” warnings, unusual for this phase of flight, as the autopilot trimmed the nose up to increase the angle of attack and maintain 31,000 feet. By the time their airspeed had dropped to 210 knots, the position of the needle on the airspeed indicator would have been considerably abnormal for this phase of flight, but the lack of any effort to increase speed shows that the crew had not noticed.
At this point there were two brief throttle lever movements which suggested that the crew had broken out the “EPR erratic or fixed” checklist, which is used to troubleshoot EPR indication problems. Among other things, the checklist calls for the pilots to move the throttle levers back and forth while observing the EPR indications. They were now starting to catch on to the problem, but much too late, as the situation had escalated well beyond a mere EPR indication issue. In fact, flight 5017’s angle of attack had increased to the point where the plane was seconds away from stalling.
As the plane decelerated toward 200 knots, the autothrottle disengaged, possibly because the crew thought it might be the cause of the problem. “Speed low” warnings presumably appeared on both pilots’ flight management displays, but still they made no move to prevent the impending catastrophe. At a speed of 203 knots, sharp buffeting began to rock the plane as the airflow started to separate from the wings, heralding the imminent stall. Four seconds later, the pilots’ stick shakers and aural stall warnings activated, with an automated voice calling out, “STALL! STALL! STALL!”
Three seconds after that, the airplane stalled. Unable to maintain flight at such a high angle of attack, the MD-83 lost lift and began to descend, slowly at first, but accelerating downward with every passing second. To recover from a stall, pilots are trained to apply max power and pitch the nose down, increasing airspeed and decreasing angle of attack until the airplane leaves the stalled state. But the pilots of flight 5017 didn’t react as their airplane stalled and began to fall out of the sky like a leaf. They didn’t even disconnect the autopilot, which was still pitching the plane up in a futile attempt to return to 31,000 feet, actively making the stall worse.
23 seconds into the stall, the pilots finally disconnected the autopilot, only to grab their control columns and pitch up even more. Despite all the warnings, they must not have realized that they had stalled. Perhaps they didn’t think that the plane was capable of stalling while the autopilot was engaged.
As the stall deepened, the plane began to bank to the left, reaching eighty degrees of bank before pitching steeply downward into a terrifying spiral dive, turning around in a tightening circle as its plunge accelerated. Pilot inputs became erratic, indicative of panic in the cockpit as Comerón Mogio and Gost Caimari fought to regain control. They briefly managed to level the wings and pitch up to a nearly level attitude, but they were still falling, thoroughly stalled, plummeting downward at several thousand feet per minute. Seconds later, the plane again banked sharply to the left and entered another extreme dive, rolling 120 degrees and turning inverted. Pitched almost ninety degrees nose down, the plane’s speed accelerated beyond 400 knots as it dived like a lawn dart toward the Sahara Desert. The pilots started to pull up, reaching sixty degrees nose down and pulling nearly four G’s in the process, but it was too late; there wasn’t enough room to pull out. Still pitched steeply downward, the MD-83 slammed nose-first into the desert at a high rate of speed, obliterating the plane and instantly killing all 116 passengers and crew.
At first, nobody realized that the plane was missing. Communications difficulties were already occurring before it disappeared, and radar coverage in that area was spotty enough that the controller didn’t initially notice that its target was no longer displayed. It wasn’t until the plane failed to check in with Algerian controllers over the Mali-Algeria border that officials finally realized that flight 5017 had gone down somewhere over eastern Mali. Controllers in Niamey initially reported that it had disappeared between the GAO and MOKAT waypoints, and the search was concentrated here in the early hours of the 24th of July. It wasn’t until nearly twelve hours after the crash that authorities in Burkina Faso informed their Malian, Algerian, and French counterparts that they had detected the plane descending rapidly before reaching GAO, and that nomads had reported seeing a plane crash in an area farther south than the initial search area.
Armed with this new information, a helicopter finally located the wreckage of the MD-83 17 hours after the crash in an extremely remote area of Mali, in the province of Timbuktu, near the border with Burkina Faso. It was obvious that none of the 116 people on board could have survived. The site, in a wilderness of sand and low trees some 40 kilometers from the nearest permanent infrastructure of any kind, presented a number of problems. Not only was it hard to get to, it was also dangerous: this part of Mali had been overrun two years earlier by rebel groups and jihadists, and by 2014 the central government still did not have full control over the region. French troops stationed in Mali had to be diverted to guard the crash site and protect the investigators, who began arriving from Mali, France, and Spain the following day.
When the investigators finally arrived, words failed to describe the scene which confronted them. The plane had come in with such force and at such a steep angle that it carved out an airplane-shaped crater one meter deep and 35 meters wide. The wreckage was spread in a fan shape extending eastward for over 400 meters, with tens of thousands of bits of the plane strewn across the desert. Rescue teams couldn’t even find a single human body, only small, unidentifiable fragments.
Although Mali was officially in charge, French experts from the BEA would be doing most of the actual investigating, as their experience with major accidents far exceeded the available local expertise. But even for the BEA, this would prove to be a difficult investigation. The flight data recorder was found intact, but the cockpit voice recorder had been crumpled almost beyond recognition by the incredible impact forces. The recording equipment was completely shattered and the tape had broken in several places. Intensive labor by specialists in France managed to repair most of the damage, only for the investigators to be met with yet another disappointment: the CVR’s erase head had malfunctioned, and audio tracks from the last thirteen flights had been recorded one atop the other. All that remained was an unintelligible mass of sounds and garbled voices. It was possible to make out a few of flight 5017’s known radio calls, but otherwise the recording was a hopeless mess. Attempts by audio specialists to recover anything of value ended in failure.
Without the cockpit voice recording, the BEA had to rely almost solely on the flight data. But once again, considerable effort was required to get usable information. The equipment which recorded control column positions had been installed as an aftermarket modification by a company that went out of business in the early 2000s without leaving behind any instructions for decoding the recorded data, forcing investigators to build a decoding algorithm from scratch. Some kind of programming problem had also caused the FDR to record the autopilot’s vertical mode as “VNAV capture,” a mode with which this plane was not equipped, whenever it produced a “speed low” warning.
At the end of the day, however, the BEA had enough data to determine the basic cause of the crash. First, tiny, invisible ice crystals blocked the inlets to the front pressure sensors on both engines, causing them to report an erroneously high engine pressure ratio. The autothrottle, which was limited to a particular EPR by the cruise setting, reduced thrust on both engines to keep the indicated EPR within the limit. This caused the actual EPR to drop below what was required to maintain 31,000 feet, triggering a dangerous feedback loop where their speed kept dropping and the autopilot kept increasing the angle of attack in a futile attempt to maintain altitude. The crew appeared to be unaware of what their aircraft was doing throughout this deceleration period, possibly because they were distracted navigating around the thunderstorm and trying to establish communications with Niamey (the FDR recorded 15 separate attempted transmissions, most of which didn’t appear on the ATC recording). Without crew intervention, the autopilot simply kept increasing the angle of attack until the airplane stalled. But the crew apparently never recognized the stall, never applied the recovery procedure, and never regained control of the airplane.
Despite the lack of CVR data, some analysis of the crew’s actions was possible. The FDR had recorded throttle movements shortly before the stall which showed that the crew may have been using the “EPR erratic or fixed” checklist to try to troubleshoot the EPR problem, even though by that point they had much bigger issues to worry about. The checklist may also have confused the crew even more, as their EPR readings were neither erratic nor fixed, but simply (and consistently) erroneous. Investigators noted that their attempts to make the checklist work could have further distracted them during the critical moments before the stall.
The BEA also collected and analyzed more than a dozen other cases of MD-80 series aircraft which experienced engine icing followed by the autothrottle reducing thrust, some of which caused the planes to fall behind the power curve, at least one to the point of stick shaker activation, just moments away from a stall. These cases showed that it was not unusual for pilots not to notice the speed decay until it reached a rather advanced stage. Another similar case even ended in tragedy: in 2005, West Caribbean Airways flight 708 crashed in Venezuela, killing all 162 people on board, after the pilots attempted to fly too high, causing the plane to fall behind the power curve, eventually leading to a stall from which they never recovered.
These previous incidents showed that MD-80 pilots generally were not aware that a plane on autopilot could keep sliding down the back of the power curve all the way into a stall, and interviews after the crash of flight 5017 revealed that even fewer knew the autopilot could stay connected through the stall and keep making nose up inputs until the pilots manually shut it off. Boeing (which took over responsibility for the type in 1997) had issued a bulletin informing pilots of this type of autopilot behavior in the wake of a 2002 incident involving Spirit Airlines, but the West Caribbean pilots never saw it, and Swiftair pilots mostly didn’t know about it either. Disconnecting the autopilot wasn’t even part of the airline’s stall recovery procedure; training scenarios assumed that the approach to stall would occur with the autopilot already off, potentially leading pilots to believe that the plane wouldn’t stall when the autopilot was engaged. Venezuelan investigators had recommended that the MD-80’s autopilot disconnect in the event of a stall warning activation, but the BEA observed that US authorities didn’t even reply to the recommendation, let alone take any action. Regulations in 2014 already required that autopilots disconnect in the event of a stall, but this requirement didn’t apply to the MD-80, which was certified before the rule came into effect.
Another thing that the BEA noticed was the very short time between the stall warning and the actual stall. Regulations in force when the MD-80 underwent the certification process in 1977 required that stall warnings activate or other clear signs of a stall appear at a speed at least 7% above the stall speed to provide adequate time for the pilots to act. In the case of flight 5017 that would have been 19 seconds before the stall. But characteristic stall buffet only began seven seconds before the stall and the stick shaker didn’t activate until three seconds before the stall. It turned out that a test flight during the certification process had revealed this low margin of warning at high altitudes, but McDonnell Douglas wrote in its post-test report that the stall characteristics met requirements, without mentioning the fact that the margins clearly were too thin at high altitudes. Regulations at the time allowed the margin to be reduced if the stall warnings “possessed adequate characteristics of clarity, duration, and distinguishability,” but neither McDonnell Douglas nor the FAA had mentioned this exception while certifying the MD-80. Investigators were left to question why the FAA had certified the MD-80’s stall protection systems even though the data clearly showed that the requirements were not met — although by 2014, the individuals involved in that decision were surely long retired or dead. Fortunately, the too-easy exception has been removed, and planes today must provide a warning at a 5% or 5 knot margin above the stall, whichever comes sooner.
Investigators also looked at why the pilots never activated the engine anti-icing system. This system circulates hot air throughout the various parts of the engine where ice may build up, including the pressure sensors, and pilots are required to activate it if the temperature is less than 6˚C and moisture is visible in the air. Pilots also use the presence of ice on the windscreen wipers as a sign that icing conditions are present. But studies of high-altitude ice crystals have shown that they can appear in clear conditions downwind of storms, where pilots may not be able to see any moisture with the naked eye or on radar, and the crystals will not accumulate on the windscreen wipers (only supercooled water droplets will adhere to surfaces in this way). Unaware of the danger, the crew of flight 5017 probably never activated the engine anti-icing system because they didn’t think it was necessary.
The final mystery was why the pilots didn’t apply the stall recovery procedure — a question to which there will never be any clear answers. Certainly a lack of understanding of the autopilot’s behavior in a stall situation contributed; most likely so did the startle effect, which would have delayed the pilots’ reaction while they tried to figure out what was going on. And it was true that neither pilot had received training on approach to stall and stall recovery in more than two years. But it was hard to imagine how a captain with so many flight hours, who had a good training record and was respected by all who flew with him, could fail to adhere to the simple and critical rule: in a stall, pitch down. Indeed, there have been many cases of pilots reacting to stalls incorrectly and letting their planes go out of control. But even in cases with an intact CVR recording, it still isn’t always possible to determine why pilots reacted the way they did. And it is certainly impossible without one.
In their final report, the BEA issued a number of recommendations aimed at improving the safety of the MD-80 series and of airliners in general. One of these was that the MD-80 flight manual be revised to warn of the dangers of high-altitude ice crystals, and to provide some means of quickly detecting an erroneous EPR indication, such as a table of figures associating EPR and engine core rotation speed (N1). The BEA also recommended that Boeing modify the pressure sensors so that they are always heated regardless of whether the engine anti-icing system is active or not, and/or that the procedures be revised so that pilots turn on engine anti-icing when the temperature is below 6˚C regardless of whether moisture is visible. Other recommendations included that documentation be updated to mention the behavior of the stall warning system and the autopilot in high-altitude stalls; that MD-80 pilots be taught about these features; that Boeing study whether it can change the autopilot logic to cause disengagement before a stall; and that Niger, Burkina Faso, and Mali come up with a search and rescue coordination plan validated by frequent joint exercises. The BEA noted that the problems with the CVR should soon be consigned to history, as international rules required all analog CVRs to be replaced with digital versions by January 1st, 2016. But on a less positive note, investigators acknowledged that major changes to the MD-80’s systems and documentation were unlikely given that the type was in use by a “diminishing number of operators,” a fact which often weighs cost-benefit analyses against making new safety improvements.
Today, the tract of empty desert where Air Algérie flight 5017 met its end is quiet once more, undisturbed save for occasional passing nomads. One wonders, do they know of the unspeakable horror that took place there that summer night? Do they know of the 116 souls who perished in those soot-stained sands? Do they wonder what those people thought as their plane spiraled out of the sky, its terrified pilots trying desperately to save them, not knowing that their last words and deeds would be lost to time? If so, we may wonder the same. One hopes that after the last MD-80 lands for the last time, after the crash has faded into history, that the desert itself might remember.
_______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 190 similar articles.
You can also support me on Patreon.
