On the evening of May 31, 2009, 216 passengers and 12 crew members boarded an Air France Airbus 330 at Antonio Carlos Jobim International Airport in Rio de Janeiro, Brazil. The flight, Air France 447, departed at 7.29pm local time for a scheduled 11-hour flight to Paris. It never arrived. At 7 o’clock the next morning, when the aircraft failed to appear on the radar screens of air traffic controllers in Europe, Air France began to worry, and contacted civil aviation authorities. By 11am, they concluded that their worst fears had been confirmed. AF447 had gone missing somewhere over the vast emptiness of the South Atlantic.
How, in the age of satellite navigation and instantaneous global communication, could a state-of-the art airliner simply vanish? It was a mystery that lasted for two years. Not until earlier this year, when autonomous submersibles located the airliner’s black boxes under more than two miles of water, were the last pieces of the puzzle put together. What doomed the 228 men, women and children aboard Air France 447 was neither weather nor technological failure, but simple human error. Under pressure, human beings can lose their ability to think clearly and to properly execute their training—a well-known failing that has proven all too difficult to eliminate.
Over at Popular Mechanics I’ve got a long piece offering a detailed blow-by-blow account of how one of the co-pilots of the Air France jetliner managed, in the course of just five minutes, to take a perfectly operational airplane from an altitude of nearly seven miles down to impact with the ocean. Here, I’d like to offer a nutshell summary of what happened, and what our understanding implies for the future of air safety.
Air France 447 was operating with three pilots: a captain, who was the most senior crewmember, and two co-pilots. At any given time, two of them were required to be in the cockpit, seated at the pair of seats equipped with controls. Four hours into the flight, the captain went to take a nap, leaving the flying of the plane to the more junior of the co-pilots, Pierre-Cédric Bonin. Sitting beside him was the other co-pilot, David Robert.
The crisis began mere minutes later, when the plane flew into clouds roiling up from a large tropical thunderstorm, and the moisture condensed and froze on the plane’s external air-speed sensors. In response, the autopilot disengaged. For a few minutes, the pilots had no way of knowing how fast they were going, and had to fly the plane by hand—something, crucially, that Bonin had no experience doing at cruise altitude.
The proper thing for Bonin to have done would have been to keep the plane flying level, and to have Robert refer to a relevant checklist to sort out their airspeed problems. Instead, neither man consulted a checklist, and Bonin pulled back on the controls, causing the airplane to climb and lose airspeed. Soon, he had put the plane into an aerodynamic stall, which means that the wings had lost their ability to generate lift. Even with engines at full power, the Airbus began to plummet toward the ocean.
As the severity of their predicament became more and more apparent, the pilots were unable to reason through the cause of their situation. Despite numerous boldfaced clues to the nature of their problem—including a stall-warning alarm that blared 75 times–they were simply baffled. As Robert put it, after the captain had hurried back to the cockpit, “We’ve totally lost control of the plane. We don’t understand at all… We’ve tried everything.”
Psychologists who study performance under pressure are well aware of the phenomenon of “brain freeze,” the inability of the human mind to engage in complex reasoning in the grip of intense fear. It appears that arousal of the amygdala causes a partial shutdown of the frontal cortex, so that it becomes possible to engage only in instinctive or well-learned behaviour.
In the case of Air France 447, it appears that Bonin, in his panic, completely forgot one of the most basic tenets of flight training: when at risk of a stall, never pull back on the controls. Instead, he held back the controls, in a kind of panicked death-grip, all the way down to the ocean. Ironically, if he had simply taken his hands away, the plane would have regained speed and started flying again.
Compounding the problem was a peculiar feature of the Airbus’s cockpit layout. Unlike a Boeing jet, in which one pilot’s movement of the control yoke moves the other pilot’s yoke as well, an Airbus features “asynchronous” controls, meaning that moving one control doesn’t cause the other to move as well. Bonin’s colleagues probably never knew that he had the controls all the way back—perhaps because they never imagined that any certified airline pilot could engage in such a misguided response.
Perhaps the most tragic moment of the entire transcript occurs in the final moments, when Bonin at last tells the others that he has had the controls back the entire time. “No, no, no,” says the captain. But by then it is already too late.
What can we learn from AF447? Above all, the tragedy reinforces an unfortunate truth about air travel that many passengers do not appreciate: that the most dangerous component of a modern commercial jetliner is the brain of the pilot at its controls. The majority of fatal airline accidents (vanishingly rare though they may be) are due to pilot error.
One way that airline manufacturers have tried to work around this problem is to increase the amount of automation, so that planes can largely fly themselves. But this tendency has had an ironic effect: the more pilots rely on automation, the less practiced they are at flying a plane by hand when an emergency requires it.
As a pilot myself, I love taking the controls of an airplane and through it finding a perfect freedom of movement in the sky. I would never want a computer to take that away from me. But the practical reality of moving passengers in perfect safety from point A to point B requires a different perspective. As technology improves, and flight control systems become more sophisticated, the relative inadequacy of we two-legged mammals will only become more apparent. Ultimately, the idea of a relying on a human being in the cockpit may come to seem a sentimentality too expensive to afford.
UPDATE: I’ve added another post, explaining what the flight’s final minutes probably felt like from the passengers’ perspective, here.
It’s almost as if there’s an uncanny valley for automation, where as automated systems get better and better they hit a point where they’re good enough to make things worse, but if they can make it across that valley, they can climb back up very rapidly.
Yes, and now that pilotless planes have established a firm beachhead on the far side of the valley, it may be only a matter of time before the shallow part is empty, and there are only two kinds of planes: unmanned robot planes and unautomated ones for recreational guys like me.
I read the article in Popular Mechanics. Horific, but very interesting psychologically and from a user experience point of view. Really great – thanks.
Thanks, Peter!
What are the benefits of the asynchronous control system?
It seems to only have flaws, perhaps ones not perceived when it was designed but which have now been cruelly exposed by this accident.
That’s a really good question, and one that unfortunately I don’t yet have the answer to. It may simple be that since these joysticks are essentially computer-input devices, rather than old-fashioned mechanical linkages, in order to provide force-feedback you’d have to go an build actuators into the device, increasing complexity and cost–which under normal operation wouldn’t provide any benefit since only one pilot is supposed to be working the controls at any one time. Obviously, a major procedural breakdown took place in this case — but a robust system should be able to deal with such breakdowns.
Or, as the old adage goes: one day, there will be two things in the cockpit: a pilot and a Doberman to bite the pilot if he tries to touch anything.
It seems to me that pilots should fly remotely so they cannot fall victim to the effects of fear in flight – and others, like the captain on this flight, can easily see the controls.
So similar to the Continental Connection Flight #3407 which crashed into a house near Buffalo, NY on Feb. 12, 2009. Pilot error, pulled back on the controls, stalled the plane, killed 49 people on board and one person in the house.
Until the day comes when man is designed out of automation in aviation,there will always be error within the system. That will never happen until man is taken out of the design, manufacture, maintenance and operation equation. Aside from that, due to automation,basic aviation training efforts have been discarded by airlines, who prefer robotic response to problems in flight rather than real understanding. Aviation in and of itself, is not inheritantly dangerous, but it is extremely unforgiving of mistakes. 40 years of fly for the military and airlines has taught me this.
Your article is too simplicistic. Just because an autopilot disengages in flight, doesn’t mean a pilot is going to panic and start doing crazy stuff. In fact, when an autopilot disengages, not much happens. Airbuses are fly-by-wire airplanes with a little stick over by the side window instead of a control yoke. It is not connected to the flight controls. It is connected to a computer. Airbus has a history of rediculous crashes and incidents the date back to the Paris Airshow in the 1980’s, where the Airbus chief test pilot crashed an A320 in front of the entire aviation industry. It still went into service on schedule. Your experience as a weekend renter of Cessna 152’s doesn’t qualify you to judge the abilities of professional airline pilots whose experiences day after day in all types of weather and compromised mechanical situations under different levels of fatigue, far outweigh your own.
If it aint Boeing, I aint going.
Having a mechanical linkage between the “stick” seems a rather simple and inexpensive means of making the control ‘synchronous’. The more modern Boeing jets are also computer controlled. How do they do it? This seems to me a design flaw that cost those 200+ people their lives. If the left seat pilot (Robert) had felt the control stick being pulled back in his control, no way would he have allowed the aircraft to be stalled into a crash.
I don’t agree that passenger planes should be piloted by people remotely. I don’t want somebody with no skin in the game to be controlling the plane I’m flying in.
The side-sticks operate asynchronously in order to enable the Pilots to over-ride the inputs of each other if required.
Around two years ago there was a story in Flight International about a Lufthansa A320 that had a “slight” problem with the captains sidestick. The captains sidestick had been replaced and the technicians performed an ops check of it. Unfortunately they did not take note of the direction of travel of the ailerons when they moved the sidestick. Upon takeoff there was a slight roll. Naturally the captain made a small correction. However the plane started to roll even more in that direction. Fortunately the FO realized what was going on and took over from the captain.
So rather than there being a physical battle for control over the aircraft – the computer can be asked to favour a particular input. Like everything in aviation – there are advantages and disadvantages.
The icing exposed a massive CRM issue.
Not a teamworked crew but three individuals were sitting in the cockpit.
One technical issue could be improved imho:
The stall warning goes away when horizontal airspeed goes below ~60knts. the PF didn’t realise he was jugling the valid/notvalid ( instead thinking he was on the stall/no stall one edge of stall warning activation)
but with working crew interaction this wouldn’t every have become an issue either.
It’s true that the stall warning turned itself off several times due to very low airspeed, but it’s not clear that this played a role in Bonin’s behavior, as he didn’t seem to ever consider that the plane was stalled; indeed, he seemed more worried about an overspeed condition.
Excellent post, gripping article.
“As a pilot myself, I love taking the controls of an airplane and through it finding a perfect freedom of movement in the sky. I would never want a computer to take that away from me.”
Sure, you say that as a PP-APSEL (Private Pilot, Airplane, Single Engine Land) flying so far and so long. You’d probably change your tune having to hand fly aircraft at tens of thousands of feet going .80M for thousands and thousands of miles.
Oh, definitely not, Fred. I think it would be almost humanly impossible to keep it perfectly within the required altitude margin for all those hours, not to mention tortuously dull. But it couldn’t hurt to hand-fly it as much as is practicable. And probably more fun?
As a crash reconstructionist who has studied human factors in crashes I want to bring up a point. The pilot flying the plane was very confused and in a situation he had never been in before. The pilot flying may have never even realized after a short time he was still pulling back on the controls while he tried in vain to figure out what was going on. Add all the warning alarms and all the bad instrument readings, you can picture the pilot flying just sitting there staring in confusion while he unknowingly pulled back on the controls. Police officers sometimes freeze up when they are confronted with an armed suspect. Their brain says shoot the bad guy, but their finger just won’t pull the trigger. It’s easy to sit back and say the pilots should have done this or that, but remember they were in the middle or the Atlantic in pitch black dark in complete chaos. I know for certain a lot of good pilot training will come out of this crash and passengers can feel safe in the future knowing this will not happen again. My prayers will continue to go to the families who lost love ones.
I really enjoyed the atricle keep them coming.
I wonder if the Air France A330 that crashed off Brazil had been a Boeing if the same tragic result would have happened. I think not as the philosophy of Boeing has always been to keep the pilot(s) in the loop. Airbus has always tried to keep the pilot(s) out of the loop for as you have pointed out ‘pilot error’ is the principal cause of most aviation accidents. However in seeking the perfect solution Airbus have created a complex system that requires the pilot to communicate with the aeroplane through a series of ‘laws’ that is more like a play station than an airliner. These laws, ‘Alpha Floor’ are in fact ‘Alpha Flaws’ and are inherent in every Airbus and because they require the pilot to react, not physically/mentally as he is trained, but analytically trough a computer, they act against all basic instinct. I would think that in rare but none-the-less occurring situations all Airbus aircraft are potentially dangerously flawed and the fact that Airbus and the industry in general know this is, to me, totally amoral.
Very interesting article here, loved reading it as well as your longer feature. Thanks for the coverage. I recently got to reading the short book about the plane that landed in the Hudson and it is really insane to think about how complicated it must be to fly the airbus. On the other hand, the descriptions of the automated features are very reminiscent of video games. Perhaps the pilots of tomorrow will be more habituated to the computer simulated features of the airbus cockpit. That said, i do believe the most likely explanation for air france 447is that the junior copilot did not realize he had pulled back. The whole psychological implications are fascinating and i wonder if there is some sort of brain training or psychlogical therapy to exercise the brain for emergencies. Something sort of like how firefighters practice in real burning buildings so they can have as much of their job as possible rehearsed, in order to free up brain space for the unknown variables of future emergencies… The pilots ought to be much more prepared, obviously…..i hope its happening! I only fly on airbus planes, theyre fun!
“Police officers sometimes freeze up when they are confronted with an armed suspect. Their brain says shoot the bad guy, but their finger just won’t pull the trigger.”
its obvious that police officers that act like that should not be carrying a gun, since it will give them a false idea of being able to handle a situation that they in fact cannot!
Whoever sets foot on a cockpit should be tested and trained, in a tough love manner, -…. and only those who do NOT react the above mentioned way, should stay. Am SURE all those smart psychologists can figure out tests and maybe the aviation needs to think about how important those people are and how it trains them. Because the simulator training, just aint enough to test the psychological factors that contribute to this kind of freeze. There ARE people who do NOT freece and those belong in the cockpit. the people who FREEZE do NOT belong in the cockpit, its as simple as that.
http://af447.typepad.com/af447/2011/10/composite-failures.html
Hi there, I like your article and think it is mostly well written.
I would however recommend everyone to also have a look at the official reports. They are available in english and with summaries at the BEA.
After studying the BEA reports briefly, I have a few comments..
Initial reaction
Autopilot disconnected at 02:10:05, and the aircraft immediately rolls right (8,4 degrees, with stick neutral), and initially pilot flying (PF) primarily tries to control roll.
After three seconds the flight directors disappear, and after another two seconds the stall warning already goes off for the first time, at 270kts. That’s five seconds in total.
Then the speed indications are jumping around. Real speed decreases from around 270kts to 223kts at 2:10:35, while the indications are fluctuating with values between 50kts and the real speed on both sides.
Speed indications
Your write that the main cockpit instruments show valid speeds from 02:10:35 (thirty seconds after AP disconnect).
This is not correct. PF primary flight display and the standby ISIS still showed incorrect speeds. Only pilot non flying (PNF) had correct speeds from this time.
PF only had correct speed indication for 28 seconds from 02:11:07 (183kts, decreasing). After that the aircraft was fully stalled and red SPD warning flags were covering the speed tape half the time.
Following flight director
It’s also worth noting that after the PNF told PF to descend the first time, and the fligth almost stabilized, the PF got back a working flight director, that was in HDG and vertical speed mode set to +1300fpm.
Simply following the FD at that point would be enough to stall the aircraft.
TOGA
Your theory about TOGA is not likely. What the PF mentioned about TOGA was that the thrust levers were in the TOGA detent (Take off/Go Around thrust setting).
‘Just release the stick’
You are giving the impression that simply releasing the stick would solve the situation at any time.
This is true in normal flight (In this case initially), but not with angle of attacks like they had once the stall was fully developed. (They were descending with up to -15300 ft/min)
Looking at the readouts from BEA (French accident investigation) it’s clear that both pilots also tried full nose down input after the aircraft was stalled.
The aerodynamic noise caused by the high vertical speed probably also contributed to the PF assuming a high speed. (PF said at 2:12:04 that he thought they were in overspeed)
Hi there, I like your article and think it is mostly well written.
I would however recommend everyone to also have a look at the official reports. They are available in english and with summaries at the BEA.
After studying the BEA reports briefly, I have a few comments..
Initial reaction
Autopilot disconnected at 02:10:05, and the aircraft immediately rolls right (8,4 degrees, with stick neutral), and initially pilot flying (PF) primarily tries to control roll.
After three seconds the flight directors disappear, and after another two seconds the stall warning already goes off for the first time, at 270kts. That’s five seconds in total.
Then the speed indications are jumping around. Real speed decreases from around 270kts to 223kts at 2:10:35, while the indications are fluctuating with values between 50kts and the real speed on both sides.
Speed indications
Your write that the main cockpit instruments show valid speeds from 02:10:35 (thirty seconds after AP disconnect).
This is not correct. PF primary flight display and the standby ISIS still showed incorrect speeds. Only pilot non flying (PNF) had correct speeds from this time.
PF only had correct speed indication for 28 seconds from 02:11:07 (183kts, decreasing). After that the aircraft was fully stalled and red SPD warning flags were covering the speed tape half the time.
Following flight director
It’s also worth noting that after the PNF told PF to descend the first time, and the fligth almost stabilized, the PF got back a working flight director, that was in HDG and vertical speed mode set to +1300fpm.
Simply following the FD at that point would be enough to stall the aircraft.
TOGA
Your theory about TOGA is not likely. What the PF mentioned about TOGA was that the thrust levers were in the TOGA detent (Take off/Go Around thrust setting).
‘Just release the stick’
You are giving the impression that simply releasing the stick would solve the situation at any time.
This is true in normal flight (In this case initially), but not with angle of attacks like they had once the stall was fully developed. (They were descending with up to -15300 ft/min)
Looking at the readouts from BEA (French accident investigation) it’s clear that both pilots also tried full nose down input after the aircraft was stalled.
The aerodynamic noise caused by the high vertical speed probably also contributed to the PF assuming a high speed. (PF said at 2:12:04 that he thought they were in overspeed)
Flight 447 did not crash due to pilot error, a design flaw in the Alternate Mode caused this accident and there is nothing any pilot could have done to overcome this flaw. I have over 30 years of experience designing Flight Control Systems for a major aerospace company. I can send a detailed report if you want to understand this better. This is the second Airbus crash due to this flaw.
I believe that the most experienced pilot should have taken control immediately and made it clear that he, alone, was in control.
It appears the stall warnings were not consistent and logical. The warning stopped when the nose was pitched upward and it reappeared when the nose was pitched downward. There was no reliable means for the pilots to determine actual airspeed, critically important at either extreme.
I am an engineer working in human factors – operations research – systems analysis. An analysis of the crash using techniques from those disciplines would find that although all three pilots made mistakes, both the aircraft’s design and processes by which it is flown contain flaws. For example the dual control system appears to contain a feedback design flaw and an input design flaw that an experienced human factors person should have spotted in the conceptual design stage. An aircraft being flown manually without direct input and feedback? Regarding the process of deciding whether to fly through a storm, the problem seems to be that there isn’t one. So what happens if the pilots are not risk averse? Where was the aircraft AI? It doesn’t have one. There are more problems than just the pitot tubes and pilot error.
How is it possible that we know exactly what they were doing in the cockpit? Is this just reconstructed from the transcription?
We know from the cockpit voice recorder (CVR) what they were saying, and from the flight data recorder how they were manipulating the controls.
Instead of patenting my idea, I entered a
NASA associated contest for innovators with
my solution to Air France 447.
The website: contest.techbriefs.com
Date July 1, 2012
Category: Transportation
Title: True Airspeed Vector Direction Display
Humans are prone to make mistakes and computers are prone to failures. the coordination or to say the trust between pilots and computers are not always close. What could be the possible future for aviation?
The Captain went for a break as the aircraft approached a storm and left 2 co pilots in charge.
All pilots showed a severe lack of basic knowledge of flying and didn’t seem to know what the 3 Artifical Horizons are for.
This accident would not have happened with me nor any other pilot that I know.
Dean above, I disagree with you, it was pilot error just like the Boeing 757 that crashed off Peru. There was a dynamic air failure and all dynamic air readings had to be ignored. The pilots should have immediately flown the aircraft using the 3 artificial horizons, power was unaltered when autopilot cut out, they had to ”chill” until the airspeed returned.
The Peru Boeing 757 had the static vents covered during a washing and the tape wasn’t removed. The crew failed to fly the aircraft, they were in a panic to get the autopilot to fly the aircraft, this is a common error
A common failure that I’ve seen with accidents is that the crew allows the aircraft to be taken towards extreme limits and they don’t act immediately to take control as they do during approach and landing. They seem to be asleep at the wheel
If I’ve understood reports correctly, the crew chose to fly through a storm cell rather than divert around it, (as other aircraft on the same route did that night). They should’ve been aware of all the risks that decision would entail, including possible icing of the Pitot tubes. Presumably, it was the captain’s decision and certainly his responsibility but he went off for a nap immediately afterwards, leaving the least experienced crew member in charge. He also failed to return to the cockpit when first called. It appears there was no cabin intercom or other means of indicating that the call to return was urgent. CRM was appalling given the critical situation. When commanded, Bonin, the PF should have relinquished control and given verbal confirmation as a matter of routine protocol, “You have control.” What’s the point of training routines if they go out the window the moment the problems are real rather than simply another simulated exercise?