MODERN airliners are are not supposed to fall out of the sky. Especially if they are highly automated, fly-by-wire passenger jets such as the Airbus 330. Like the unsinkable Titanic, the Airbus 330 was considered an unstallable aeroplane. It was equipped with digital systems that unerringly corrected for pilot error as well as any buffeting caused by bad weather. Until one fatal night two years ago, the Airbus 330 had had an exemplary safety record. What caused the Airbus 330 used on Air France flight 447 from Rio de Janeiro to Paris to plunge into the Atlantic, killing all 228 people on board, remains one of the biggest mysteries in aviation history.Accident investigators have their suspicions. Several plausible scenarios have been constructed from the few pieces of mangled wreckage fished from the ocean; the batch of error messages the plane radioed autonomously back to the airline's offices in its final moments; the satellite pictures showing the complexity of the “mesoscale convective system” straddling the plane's flight path; and the known design flaws in the plane's “pitot tubes” used to measure airspeed. But without the flight-data and cockpit-voice recorders, no-one can say for certain what really brought AF447 down. The two “black boxes”, bolted to a rear section of the Airbus 330's fuselage, remain hidden up to 3,000 metres (10,000ft) down in the rugged underwater terrain between South America and West Africa.

The French authorities have tried three times to find AF447's black boxes. This week, they embarked on a fourth attempt. Though planned last November, the current search has taken on new urgency. The judge overseeing the accident has filed preliminary charges of manslaughter against both Airbus and Air France. Without the black boxes, it will remain unclear whether what happened was precipitated by pilot error or equipment failure (or both)—and therefore how to apportion the blame. The damages awarded to the victims' families could run into hundreds of millions of dollars if "willful misconduct" can be proved. Normally, the Warsaw and Montreal Conventions limit the liability in airline accidents to $150,000 per passenger. But if the black boxes are recovered, and the recordings prove beyond doubt that an incorrect speed reading had triggered the accident, the manufacturer, the airline or both could be held responsible for the 228 deaths. Airbus had known about the pitot problem for several years. Meanwhile, Air France had deferred replacing the faulty probes on the plane in question.



At flight level 350 (ie, 35,000ft or 10,600 metres) where AF447 was cruising, the pilot needs to know precisely what the airspeed is because the margin for error is so small. As air density decreases with increasing altitude, a plane has to fly faster the higher it climbs. In other words, the stall speed increases with altitude, and determines the minimum speed the plane can fly at any given altitude and weight. Travel more slowly and the air flowing over the upper surface of the wings becomes detached, causing the plane to lose lift and plunge into a precipitous dive (ie, to stall).



Flying too close to the stall speed is only half the problem. There is also an upper speed limit set by the speed of sound. Like the bow wave of a ship, a plane moving through the air sends out a pressure wave ahead of it. This pushes the air aside so it can flow smoothly over the wings, fuelage and control surfaces. But when the plane approaches the speed of sound (ie, Mach 1), it catches up with its own pressure wave—which then becomes a standing wave comprising a sharp jump in pressure known as a shockwave.



When that happens, the air ahead of the aircraft has no warning that a rapidly moving body is approaching, and slams into the shockwaves formed along the leading edges of the wings. As the shockwaves refract the airflow abruptly upwards, the centre of pressure (the point along the wings where the lift acts) lurches backwards, causing the aircraft (if not designed for supersonic flight) to pitch violently down, and possibly break up in an uncontrollable nose-dive.

As the speed of sound depends on the temperature of the air, which decreases with altitude up to the tropopause at around 17,000 metres, the maximum speed an aircraft can fly at safely (before running into speed-of-sound effects) likewise decreases with altitude. Thus, on a chart of altitude (vertical) versus speed (horizontal), there is a point where the positively sloping plot of the plane's stall speed crosses the negatively sloping line of its maximum safe speed below the speed of sound (Mach 0.86, in the case of an Airbus 330). The apex where the two lines intersect—where the minimum and maximum safe speeds are the same—is known euphemistically as “coffin corner”. At 10,600 metres, a fully loaded Airbus 330 cruises (for reasons of fuel economy) just below this critical point in its flight envelope—with probably no more than 25 knots (46 kph) between stalling (through flying too slow) and breaking up in a shockwave-induced dive (through flying too fast).



The flight path taken by AF447 followed a great circle north-east from Rio de Janeiro through the Intertropical Convergence Zone near the equator. This is where masses of northern and southern air collide to produce a region of low pressure marked by tumultuous thunderstorms rising to 15,000 metres or more. There is nothing out of the ordinary about such tropical weather patterns. Air traffic traverses them dozens of times a day.



In the case of AF447, the plane's weather radar—which can detect water and ice in clouds up to 80km (50 miles) away—would have warned of thunderclouds ahead, allowing the flight crew to thread their way between them at their own discretion. But what the radar could not have warned them of was a much bigger multi-centred storm system masked by a smaller one in front of it.



One suggestion, supported by satellite weather pictures, is that the crew of AF447 may have avoided a typical thunderstorm, or even flown through it, only to run smack into a monster "mesoscale convective system"—a towering complex of multiple cumulonimbus storm cells containing severe updrafts, along with ice particles and pellets of snow. If the pitot tubes momentarily froze over (as they had been known to do) and started issuing conflicting airspeed data, the flight-control system would have automatically disengaged the autopilot and forced the crew to fly manually.



With the plane buffeted violently by the turbulent updrafts, the first thing the pilot would have done would have been to reduce speed to ride out the storm. But with no clear idea of what the actual airspeed was—and with no automatic systems to prevent manual inputs from making the aircraft fly too slowly or too fast when operating so close to its coffin corner—the pilot could have unwittingly pitched the plane into an uncontrollable stall.



What is known is that, in the stricken plane's final moments, the automatic fault-reporting system beamed 24 text messages—its last will and testament—via satellite to the airline's maintenance centre in Paris. The first announced that the autopilot had been disconnected. The second warned that the flight-control system was unable to determine the correct airspeed. The final message—as the plane's digital systems shut down one by one—reported that the cabin had depressurised or was descending with a high vertical velocity.



From the few pieces of wreckage recovered, the pattern of deformation suggests that AF447 slammed into the ocean straight and level and in one piece, only to be shattered into thousands of fragments on impact. By all accounts, it had literally fallen out of the sky as if its wings had melted.