On the 21st of May 2026, the Paris Court of Appeal convicted Airbus and Air France of involuntary manslaughter for their roles in the crash of Air France flight 447, ruling that both companies were “solely and entirely responsible” for the deaths of all 228 people on board.

This verdict reverses a 2023 acquittal.

The court found that Airbus had underestimated known Pitot probe problems and had failed to inform airlines adequately. Further, the court found that Air France had not adequately trained crews for this failure mode.

Airbus and Air France have already stated their intention to appeal.

I talk briefly about this on this week’s Nexus, which you can watch on YouTube.

Now I want to get a bit more into the weeds as to what actually happened.

To remind you, Air France flight 447 was a scheduled passenger flight from Rio de Janeiro, Brazil to Paris, France on the 1st of June 2009. The Airbus A330-203 departed Rio de Janeiro with 228 on board (216 passengers, 3 flight crew and 9 cabin crew).

While in the cruise, after entering the Intertropical Convergence Zone (ITCZ), the aircraft encountered strong turbulence followed by high-altitude ice crystal formations which partially blocked all three Pitot probes. The flight crew struggled to understand what was happening and failed to diagnose the issue. The Pilot Flying and the Pilot Not Flying quickly became overwhelmed and regularly acted against each other. The captain returned to the flight deck about a minute and 37 seconds after the autopilot disconnect to find alarms blaring and contradictory messages. In the final report on the crash, the _Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile _(BEA) concluded that the three pilots never understood that they had bad data from all three sources of airspeed information, as all three Pitot probes were suffering from a fast accumulation of tiny ice crystals.

This case often gets simplified into “the second officer pulled the nose back, stalling the aircraft into the ocean” in a moment of gross incompetence. The reality is not that straightforward. For a better view into the cockpit that day, I recommend  Barbara Faccini’s analysis Four Minutes, 23 Seconds which goes over the detail, though I should note that Faccini’s sequence of events is slightly dramatic for my tastes and strongly biased against Airbus design philosophy in general.

On the surface, the flight crew crashed the Airbus A330 which was suffering from a relatively simple failure: ice crystals had partially obstructed the Pitot probes.  What comes clear in the BEA report is that the pilots were suffering from extreme cognitive overload in a scenario that they were inadequately prepared for.

Aircraft are complex systems and a crash is generally a complex failure: a string of events which cascade into disaster, what is often referred to as the holes in the cheese lining up. The flight crew are generally the final line of defense of a long line of failures, the last slice of cheese, if you will. Blaming them for the end result is easy, especially from an industry point of view, because it means no action is needed. The pilots are no longer flying; thus the problem has been eradicated. It is an overly simple solution which does nothing to answer the question why the pilots failed, let alone deal with systemic weaknesses that led to the failure scenario in the first place.

In most of these cases, to learn how to increase aviation safety, we need to look at how they ended up in that situation in the first place.

There are three pitot probes on the Airbus A330 (and generally), one feeds to the captain’s instruments on the left side, one feeds to the first officer’s instruments on the right side and one, positioned below the captain’s Pitot probe, is a standby, specifically to help or act as a tie-breaker if one of the Pitot probes is blocked.

Pitot probes are critical for aircraft operation, because we need to know our indicated airspeed in order to deal with the physics of flight. Too low and we might stall. Too high and we risk structural damage to the aircraft. So at all times, you want to know the indicated airspeed.

We can see the problem clearly in the final minutes of Air France flight 447, where the pilots were conflicted as to their situation, with the Pilot Flying convinced they were overspeeding and needed to slow down and climb.

The Pitot probe, at heart, is an L-shaped tube facing forward, so that the air flows into it. A pressure sensor measures the air speed, or more specifically, the RAM air pressure.

The problem is a tube can get blocked. This has always been an issue with Pitot probes, they can get blocked by everything from volcanic ash to wasps’ nests. But by far the most common blockage is caused by ice.

Icing at low levels is a well-understood phenomenon. Ice accumulates on the aircraft and accretes in the tube, quickly blocking the Pitot probe. Pitot probes have heaters specifically for this and it is standard to turn those heaters on in icing conditions.

However, there’s another type of icing that has historically received less attention.

From the BEA report:

 When highly specific climatic conditions are met, in particular with the presence of ice crystals in excessive quantities, the conditions for use of the probes can exceed the conditions for qualification and robustness. In this type of situation, a partial obstruction of the total pressure probes in icing conditions and at high altitude (above 30,000 feet) can occur. This results in a temporary and reversible deterioration of total pressure measurement.

This icing happens in the Intertropical Convergence Zone (ITCZ), an equatorial region where the trade winds of the Northern and Southern hemispheres collide, causing a band of heavy showers and thunderstorms.

This zone is a specific issue because the moist and warm air is pushed upwards, causing unexpected icing at altitudes above 30,000 feet. These ice crystals form rapidly inside the Pitot probes, causing partial blockages.

In the case of Air France flight 447, all three Pitot probes had accumulated these tiny ice crystals, enough that every Pitot probe was relating a different airspeed. The computer, unable to deal with the bad data, cut off the autopilot, forcing the aircraft into Alternate Law and handing manual control to the pilots. But there was no clear ECAM message about the airspeed mismatch, so the pilots suddenly had to make sense of what was going wrong.

The Pitot probe in use on the Airbus A330 was the Thales Avionics P/N C16195AA, which I will refer to as the Thales AA. The Thales AA had a specific problem: the probe was very susceptible to this high-altitude ice crystal icing.

Fourteen years before the accident, Airbus issued a Technical Follow-up note about the issue.

STRONG CUMULO-NIMBUS (Cb) CONTAINING A HIGH DENSITY OF ICE CRYSTALS CAN BE ENCOUNTERED, PARTICULARLY IN THE INTERTROPICAL CONVERGENCE ZONE (ITCZ). IN SUCH AN ICY AND TURBULENT ATMOSPHERE, THE A/C AIR DATA PARAMETERS (PRESSURE DEPENDANT) MAY BE SEVERELY DEGRADED, EVEN THOUGH THE PROBE HEATERS WORK PROPERLY.

IT HAS APPEARED THAT THE CHARACTERISTICS OF SUCH AN ENVIRONMENT COULD EXCEED THE WEATHER SPECIFICATIONS FOR WHICH THE PITOT PROBES ARE CURRENTLY CERTIFIED.

This was the first clear flag that Pitot probe certification did not cover the high-altitude ice crystal formation that aircraft were encountering in the Intertropical Convergence Zone.

In the first issue of the TFU in December 1995, Airbus declared that they were launching the development of a new Pitot probe able to match the new requirements. By the time of the November 1996 release quoted above, the new probe had been tested and gone through certification.

This new Pitot probe was the Goodrich 0851HL, which I’ll refer to as the Goodrich HL. The Goodrich HL was offered as an optional installation in the Airbus A330 and A340.

Another Pitot probe was released by Thales, the C16195BA, which I will call the Thales BA. This probe was developed for the A320 to work better in heavy rain. Like the Goodrich HL, the Thales BA was offered as an optional installation on the A330 and A340 aircraft. However, the Thales BA did not offer the ice crystal resistance as the Goodrich HL.

Between February 2005 and March 2009, Airbus was informed by ten operators of the A330 A340 aircraft that they had suffered unreliable airspeed incidents as a result of ice crystals forming in the Pitot probes while cruising at high altitude.

Airbus issued an advisory that the operators of the A330 and A340 could replace the Thales AA probes with Goodrich HL but they didn’t push the issue or speak to their customers about the risks and solution.

The BEA discovered 36 documented cases of severe airspeed indication problems which Airbus attributed to ice forming within at least two of the three Pitot probes. Thales AA probes were in use in 27 of the incidents, as opposed to only two incidents where the Goodrich HL probes were in use. However, in every case, Airbus maintained that the systems had operated as designed and kept the classification as “major”, which does not constitute a risk to safe flight and does not require notification to the aviation authorities.

This is key to the case against Airbus: they knew that the problem existed but they didn’t take the risk to flight safety seriously.

In the year before the crash, Air France had noticed a recurring issue with unreliable airspeed indications at high altitudes in their fleet of A330 and A340 aircraft, all of which had Thales AA Pitot probes installed in all three positions. They had documented nine incidents between May 2008 and March 2009, with seven triggering stall warnings while in the cruise.

Air France contacted Airbus to ask if replacing the probes with the Thales BA would help. Airbus told them, correctly, that the Thales BA probe was much better in heavy rain but probably would not help much when it came to ice crystals at high altitude in the Intertropical Convergence Zone. What they didn’t say was that the Goodrich HL would help to solve this problem and that it was available as an option. There’s no clear financial or technical motivation for this bureaucratic failure.

The Paris Court of Appeal’s 2026 conviction of involuntary manslaughter rested on exactly this point: Airbus knew the Goodrich HL was the solution (only 2 incidents vs. 27 for Thales AA), had it certified since 1996, but intentionally or negligently failed to recommend this option to Air France when they asked for advice.

Air France decided to replace the Thales AA Pitot probes with Thales BA probes anyway, to deal with low-altitude water-ingestion issues. They began replacing the Thales AA probes in the week before the fatal crash of Air France flight 447, in fact, the Airbus A330 was scheduled to get the Thales BA Pitot probes installed upon its return to Paris. But it never got there.

Air France understood that this was a serious issue and had taken action to mitigate the issue on a hardware level. However, they inexplicably didn’t see any point in training their pilots to deal with this issue that they knew was repeatedly occurring. The pilots in the flight deck of Air France flight 447 had not received training in high-altitude manual handling and were not offered guidance for dealing with unreliable airspeed scenarios in the cruise, despite the fact that Air France had considered both of these scenarios to be important enough to upgrade all of the Pitot probes.

If the pilots had received adequate training for manual handling at high altitude and unreliable airspeed indications in the cruise, with a specific focus on the Intertropical Convergence Zone, they would have had the tools to deal with the abrupt situation that day and this could have turned out very differently.

The BEA report concluded that the failure of the crew to respond correctly was enabled by the design, training and feedback failures upstream by Airbus and Air France.

That is the heart of the issue. Airbus did not push for the Goodrich HL as a replacement for the Thales AA, despite knowing that the Goodrich HL was better at dealing with the ice crystal accretion in the Intertropical Convergence Zone. Air France were working to replace the Pitot probes but they were not training their pilots to deal with the scenario that they knew was occurring. And in the end, the pilots failed to deal with the situation effectively, exhibiting lack of training and terrible CRM.

However, there is a very big jump from negligence such as this to holding the two companies liable for the 228 deaths.

The French pilots’ union, the SNPL, supports the conviction, as it affirms that the accident wasn’t reducible to crew error. From their 21st May 2026 press release:

 Since the investigation began, the SNPL has joined the proceedings as a civil party in order to give a voice to the pilots and to help establish
the technical and operational truth. The Union has always considered it unacceptable to place the sole responsibility for the outcome of this accident on the pilots, without taking into account the full range of systemic failures that led to the disaster.

I agree with this statement. This accident cannot simply be blamed on the flight crew. It is clear that there were multiple causes, as is typically the case in a crash. However, it is hard to see how aviation safety is enhanced by finding someone else to pin the blame on.

The fine is symbolic: if the convictions stand, each company will pay 225,000€, which can probably get lost in a day’s operating expenses. However, Global Compliance News points out that under French law, when a company is convicted of a criminal offence, available sanctions include debarment (up to five years) from public procurement, prohibition (up to five years or permanently) on making public offerings and listing securities on the stock exchange, and prohibition (up to five years) on receiving any public aid from any public body or financial assistance from any public or private body carrying out a public service mission.  Under the UK’s Procurement Act 2023, a corporate manslaughter conviction is mandatory grounds for exclusion from UK public contracts for up to five years, though whether the Cabinet Office’s Procurement Review Unit would treat the French conviction as equivalent is an open question. For a defence-aerospace manufacturer like Airbus, the procurement question is not trivial.

There’s also the damage to Just Culture: the idea that everyone works together in an investigation in order to make aviation safer than ever. It is frustrating that it took a crash and the loss of 228 lives for Airbus, Air France and EASA to spring into action. But it is also true that multiple changes were made after the accident. The European Aviation Safety Agency (EASA) updated the requirements: it is no longer permitted to operate the A330/A340 with a Thales AA Pitot probe fitted in any position. Position 1 and 3 (Captain and Standby) must be Goodrich HL, with the option of using the Thales BA in position 2 (First Officer).  The rest of the aviation world quickly followed EASA’s mandate on this.

Airbus developed a new back-up system to help flight crew in the situation where all three probes are partially blocked and supplying bad data. Air France have improved their training.

The point is that it was not necessary to accuse and convict Airbus and Air France of involuntary manslaughter to get these changes. However, the fear of conviction may make it much more difficult for corporates to work with investigators following a serious crash, if instead they need to be concerned that sharing information will end up with them in court on criminal charges.

This contrasts with the case against Boeing, another instance where a manufacturer was aware of a problem with a flight-critical sensor system and decided it wasn’t urgent enough to mandate the fix until two crashes forced the issue. However, the Boeing case was based on the conspiracy to defraud the FAA over MCAS. Airbus was negligent in not escalating the issue to EASA but there is no evidence that they conspired to defraud the aviation authorities.

The concern now is what this conviction, if upheld on appeal, will do to the next investigation. Aviation safety has always relied on manufacturers and operators sharing what they know honestly, including the parts that look bad. Prosecuting a company for hiding information or providing fraudulent information supports that system. Prosecuting a company of manslaughter on the basis of information that they disclosed themselves does not.

It has been seventeen years. The Thales AA Pitot probe is gone. Pilots train for unreliable airspeed at high altitudes as standard. The certification framework for Pitot tubes has been rewritten. High-altitude ice crystal icing is better understood. None of that required this verdict. The court has said the changes should have happened sooner, which is true, and that the failure to make those changes sooner was criminal, which is less clear cut. The families of the 228 people on board have asked to see Air France and Airbus held accountable, and I can understand their feelings. But every safety improvement listed above came out of an investigation that the convicted companies cooperated with. The next one may not get that cooperation.