What really happened aboard Air France 447

Co-pilot Bonin, who had been pulling back & stalling the plane during the crisis: "But what's happening?"

Pretty much sums it up. I am thinking that perhaps Bonin had shellshock & may not have even realized he was holding the stick back. Perhaps the more experienced Robert didn't think to ask "are you pulling back the stick?" because that would be like asking "did you make sure the computer is plugged into the wall outlet?", i.e. it's so stupid & simple, that can't be "it".

There are a few things I could think that would be worth adding.

- Add a display that shows the current positions of both control sticks. Add an alarm when the two sticks are not within a certain margin of the each other, if both are engaged. Such as if one is full forward & the other is full back.

- Make clearer warnings about the implications of the "alternate law" mode. Such as a warning like "Stalling possible". Also maybe put an alarm in the pilot resting area that would relay when warnings are detected like stall or switching to alternate law.

- Delineate command better, e.g. Captain, Co-pilot #1, Co-pilot #2 so that who is in charge is clear.

Alternate law and normal law introduces two modes. This breaks one of the rules of user experience, especially if it is infrequently encountered. Combined with turning autopilot off on its own, it is bound to cause even more confusion. The plane could have put an alert asking the pilot to go on autopilot, otherwise, it will continue by making educated guesses. (A pilot is no better judge of airspeed than the computer)

Another rule of UX broken is "tell" instead of "announce". The voice should have said "Stall. Dive now" or "Stall. Why are you pulling the stick back?".

The flight computer can reinforce its credibility by demonstrating it has predictive capability. For instance, it can say, "decrease your angle of attack or you will stall in 5 seconds", then "4", "3" "2" "1", "stalling". The voice should demonstrate increased tension and panic as counting down.

It is high time the flight computer act as the "third pilot". It is similar to video judges in competitive sports. Of course people may choose to ignore the computer, but we can then continually review why the computers assessment was wrong and improve on it.

What I don't understand is, how does a plane know it's stalling if the pitot tubes are frozen?

By the way, optical flow meters could have been used as a backup.

over dinner i once asked him "so what's the most exciting or difficult situation you've even been in?"

"hm... nothing i can think of, it is all pretty boring, really"

"i mean c'mon, there's got to be something!"

"you see? if you do things by the book plus a little on the safe side it usually works out that you are never in an exciting situation -- my job is to ensure that even the most unlikely exciting situations become more unlikely."

in this particular instance, it seems that there are a few actions that could've avoided the whole situation had the people in charge had the mentality of "by the book plus a little on the safe side". the most glaring one is that the other planes in the area diverted to avoid the storm. another: the captain should have made clear who is in charge.

of course, this is very easy for me to type from the comfort of my office without any situational stress.

scary!

It seems dangerous to have two joysticks, both capable of controlling the plane, that have no physical or simulated physical link. It means that one pilot could be attempting to control the plane and his actions will have no effect whatsoever if the other seat is panicking (as in this case).

Anyone have any insight into this?

I have read a few other transcripts from crashed planes and this seems to be the most common and significant contributor.

I see variations of this problem almost daily in my day to day work. It strikes me so many times that people flat out refuse to communicate or do do in an extremely ambiguous fashion, people violate responsibility boundaries all the time (faux-technical people forcing technical decisions for e.g.) and that directly results in losses far greater than they should have been if there was any notion of discipline and communication.

Linking the two sticks is one way, another might be to show the state of the two sticks on the display next to the indicator of pitch, perhaps using coloring to highlight when the sticks are being pushed forward or backward. But of course there is already an overload of indicators. Really, improvements in the software/AI might be the best solution.

The PF (Bonin) apparently never became aware of his angle of attack (once the airplane fully stalled, AOA was absurdly high). He did not seem to be aware that his constant inputs had caused the Airbus's THS (trimmable horizontal stabilizer, horizontal flaps on the tail) to deflect to maximum in order to try to keep the nose up. Therefore when he tried to input stick up (nose down) several times briefly, and there was no obvious response (the computer takes a while to reduce THS elevation in response to opposing input), who knows what he thought -- maybe that all readings were incorrect.

Strangely, Bonin was the one pilot who had significant recent glider experience as I recall. The Airbus computer even in "alternate law" functions nothing like a glider (only "direct law" is sort of close to direct input), so maybe that further confused him.

In my opinion, at night, over an ocean, in a storm, with no visibility, in possibly significant turbulance, a modern aircraft cutting off Autopilot for any reason other than computer failure is completely unacceptable. A computer should be able to fly as well as a human under those circumstances.

People suggesting that on airliner forums get flamed. But it's true. Most pilots kept up the refrain that a computer cannot safely fly by gps and gyros unless they also have airspeed. Which is true. It's dangerous to fly if you don't have true airspeed (gyros and gps cannot accurate provide relative wind speed). However, if pitot tubes are frozen and the computer no longer has valid airspeed, the pilots no longer have valid airspeed either. Pitch and power is all they can do. The computer can do that just as well. All it needs to know is aircraft weight, which can be entered (maybe it is entered) before takeoff and automatically adjusted to account for fuel consumption.

There are a bunch of factors that contributed to the accident:

Pitots shouldn't have frozen.

Lack of Air France training for controlling an aircraft at altitude with the computer in "alternate law" (mode without full flight envelope protection; it's therefore possible to stall).

The command structure in the cockpit without the Captain (who had just gone on break) actually had Bonin in command, even though the co-pilot in the left seat outranked him... AF has since changed that. CRM (crew resource management) was poor; the co-pilot in the left seat didn't try to take control until way too late. The co-pilot was preoccupied with where the Captain was rather than offering constructive input on how to fly.

Bonin was not adequately aware of what his inputs were doing, or what the plane's Angle of Attack was, and did not react properly to the stall warning which in almost every case at high altitude means drop the nose, not raise it (though without valid airspeed there's a risk of overspeed which can cause a new set of problems).

The Airbus computers had some quirks; stall warnings stop if airspeed drops too low (due to some computer programming logic involving low airspeed, AOA sensors, and the result being silencing the stall warnings).

Nobody believed a passenger aircraft would be so stable during a full stall. This undoubtedly contributed to confusion about whether they were actually stalled. The Airbus's computer setting the trimmable horizontal stabilizer to max nose-up deflection, in response to Bonin's almost constant nose-up input, possibly contributed to the stability during stall.

Angle of Attack information may not have been adequately displayed to the PF (Bonin) -- the black box doesn't record data from the right set of instruments, so nobody knows what Bonin had on his screen.

There was poor notification on the co-pilot's side of what the PF (Bonin) was doing. Unlike traditional aircraft, it is not easy to see what the pilot in the other seat is doing with the stick.

There was poor notification on either side of the cockpit when the other pilot took control. When the co-pilot took control, Bonin almost immediately took control back, and it's not clear either of them knew what the other was trying to do. Apparently there's a light that indicates override, but who would notice such things under that amount of stress?

IOW, it was a disaster from top to bottom. Usually in aircraft accidents there's a chain of events, but in this case there were so many possible contributing causes that other than having better pitots that didn't freeze over, solving any one other problem may not have broken the chain.

The temperature drops 1.98C for every 1,000 feet you go up so you can see quite quickly how fast you can enter an area below the freezing point of water.

Icing of the pitot tube and carburetor are a constant worry at least for prop driven aircraft. Right from day one you're taught what to look for signs of carburetor icing and how to correct it. Water in the fuel is probably #3 on the list.

I never got far enough along to learn about wing icing I ran out of money for lessons but really everyday it's ice, ice, ice!

I even knew about the two modes of the Airbus - because I once watched an episode of "Air Crash Investigation" where the exact same thing as what is described in this accident happen to an earlier flight.

I don't know if I am jumping to judgement, but it sounds like some of these modern pilots aren't really enthusiasts - they are just people who are trained and do their jobs, and do them by the book and then go home (just like bus or taxi drivers).

Hence the stall warning SHOULD NEVER SOUND in "normal law" mode.

Therefore, the only time a pilot should hear the stall warning is when they actually have to intervene.

Ultimately, if the plane was funcioning perfectly well and assuming the pilots weren't complete idiots, the problem was a 'usability' issue.

(think again everytime you see a bug logged as 'usability' and assume it is not important!)

Ideas really can change the world.

Why would they ignore it...

Forgive my ignorance, maybe some pilots can shed some light on this. In the article it mentions that even though the plane was flying in "alternate" mode, my understanding is that it still has limits to what inputs can be given.

That said, even if autopilot is off, why wouldn't the computer have emergency functions to negate strange situations like this? When would pulling completely back on the stick while losing altitude rapidly ever be considered within the range of normal?

It is easy to blame Bonin for being such an idiot and pulling on the stick all the time but it is a natural reaction, just like inexperienced drivers continuing to lock the brakes while skidding off the road. How many die that way every day?

More worrying to me is that the whole plane control is inherently and crazily unsafe. Whatever were the designers thinking, making the two sets of controls without cross-feedback and even 'averaging their inputs' ?!? Whatever were they thinking introducing flabby delays between stick movements and control surfaces? Ever tried to play a computer game with a two seconds delay of the controls?

The actual cause of the crash is this. There were three pilots trying to fly that plane at the same time: the computer, plus the two co-pilots. I guess four, if you include the captain chiming in from the back. Neither of them had any information or understanding or confidence about what the others were doing, due to no particular fault of their own. In such circumstances, adding and withdrawing auto-pilots, plus adding different 'computer modes' is totally insane and only adds to the confusion.

My conclusion: design fault (over engineering)

02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l'heure!

Obviously they were in panic mode and did not take time to think - they were reacting to the "plane go down" message by a "pull back" mode, where they should have been trying to understand why they were losing altitude.

02:08:03 (Robert) Tu peux éventuellement le tirer un peu à gauche. You can eventually pull it a little to the left.

Eventuellement is not the French equivalent of the English. It should be "You could pull a little to the left." Many sentences read like a straight copy and paste from Google Translate.

http://news.ycombinator.com/item?id=3327828

In several of these transcripts you can read the pilots reactions to various warnings (including stall warnings) which might be interesting to look at for comparison.

Is it worth considering making certain fast acting drugs available to professionals that operate in life-threatening environments that would stop or minimize the stress response?

I'm not sure if such a drug exists, one that might reduce stress but not also impair other cognitive functions. But it might well be extremely useful. I can't think of any situations where the stress response is useful in a complex environment.

What a sobering article.

EDIT: Also, I must add that it seems to me just to be able to engage with reality, a bloody string with a weight hanging from the cockpit ceiling would have shown that the airliner was climbing, from the angle it was hanging. Low-tech and it sounds stupid, but with cockpit crew so alienated from physical reality due to computer mediation and no visual cues due to the clouds, it would have immediately shown them what was really happening.

First of all I must say that is very difficult to judge what happened from outside, there is a rush of adrenalin if some important alarm starts at the cockpit, it becomes worst if you are flying in the middle of the night and turbulence. Problems that would be solved or the solution evident seating at home in front of a computer, become suddenly a mistery or insolvable because you lost an stabilicer or any other physical problem to the plane( it has happened before).

The first obvious mistake is going through the thunderstorm in that lattitudes, I personally know the pilots who where flying in front of them and they took a 200miles reruting to avoid that particular thunderstorm ( as other trafics did).

Then the reaction to the lost of information : as has been said the proper way to react is using thrust power % and pitch positions, there are tables for different flight phases , they are located at the quick reference handbook, but they should be located at an sticker close to the instruments( for inmediate use as speed limits for flaps or landing gear). An automatic help for recovering such a problem would be greate but computers do fail regularly in comercial planes( if web servers that are seating in a room fail imagine something that is suffering high doses of vibration, dirt, humidity changes, temperature changes, you name it) and you there MUST be other options.

When flying that high you are at whats called coffin corner, that is you are so high that the wings will easily enter both high speed buffeting and low speed stall( both will produce a lost of altitude control, you fall but can do nothing to avoid it). Also the engines don't have enougth thrust( as fighters do) to support the weight of the plane. So the maneuver they performed seemed to don't make sense at all, why would a pilot pull the stick to put the plane deeper in the cofin corner inside a thunderstorm?.

I think the cause is precisely training( and possibly other interface choices made by airbus helped too ), let me explain: there IS a maneuver inside thunderstorms wich is trained a lot AND will make the pilot PULL the sidestick and apply TOGA power, is called windshear( avoidment). Usually windshear is the wind state that you could find near a thunderstorm close to the airport. Is caused by the first descending burst( thunderstorm madurity) hitting the ground (please google it as it is easier to see a picture than explain it). The result is that the big wind speed changes( in seconds) may put the plane suddenly in a stall situation. Because it happens when you have no altitude left to recover from a stall ( maybe less than 3000 feet or closer than ten miles to the airport), your only possibility is to apply TOGA power and sidestick FULL back( the protections are NOT lost and then the plane takes care of the stall, the pilot takes care of the ground). This maneuver is practiced yearly ( or almost) as one of the most important ones ( with engine fail, traffic avoiding, depresurization), so it is my opinion ( I must say is not shared by many other pilots, many of them say it was the plane or simply don't know) and the simplest cause, that they simply were trying to fight a windshear, after all they were inside a thunderstorm and had to recover the control. That is way they simply couldn't understand ( or even hear the anouncement) why the plane was in stall, because they were folloing the procedure to the point. And procedures are to be followed if you do 't want problems with the plane and the judge( in a posterior investigation)

Also there are problems with the flight controls interface of airbus that have been known from the first a320 accident, and are highly polemic between pilots. Mainly airbus tried to reinvent the wheel at the cockpits,( and the rest of plane systems)in order to save weight. So they removed the link between the pilots controls ( except the rudder-fronwheel ones) and removed the possibility of the throttle levers to move acording to the power possition while in autopilot mode ( as boeing does ), after all only one pilot is taking the controls at a given time right?. But it is wrong, control feedback is fundamental in critical situations and has saved souls in the past. Also knowing the throttle possition at every moment just resting your hand at the levers while they move, gives you an amazing information of how the plane is behaving without having to look at the engine instruments ( there are one mm dots at the indicator showing the virtual "possition" of the levers, or where the thrust is going to move next), or simply overriding the autothrottle with out having to dissengage it. This throttle problem in particular has not caused a serious problem( that I am aware) yet, but give it time... Just imaging an autothrust setting the engines to iddle at 500' and the crew worried about having the runway insight in bad weather. The " don't make me think" principles still apply with airplanes ( and save lives, not only fuel) but airbus doesn't seem to bother too much.

I hope to have clarified a bit the problem from the Point of view of an airline pilot.

Pd. Sorry for all the misspellings, I am writting from my iphone. I'll edit at home.

  • Normal operation: Captain and First Officer inputs are algebrically summed.
  • Autopilot disconnect pushbutton is used at take-over button.
  • Last pilot who depressed and holds take-over button has priority; other
    pilot’s inputs ignored.
  • Priority annunciation:
    - in front of each pilot on glareshield - ECAM message
    - audio warning.
  • Normal control restored when both buttons are released.
  • Jammed sidestick:
    - priority automatically latched after 30 seconds
    - priority reset by depressing take-over button on previously jammed
      sidestick.

I heard from fatal command mistakes with pilots an Asian country and now everyone has to speak English. Is this again some stupid patriotism thing (i am German, i know the French attitudes), but i seriously thought to prevent command errors everyone has to speak the international aviation language.

02:14:25 (Bonin) Mais qu'est-ce que se passe? But what's happening?

02:14:27 (Captain) 10 degrès d'assiette... Ten degrees of pitch...

Exactly 1.4 seconds later, the cockpit voice recorder stops.

Initially, the captain's non-fear of the storm was based on incorrect weather data based on a mis-configured radar system. His data seemingly grossly underestimated the severity of the weather: had he had the correct data originally he would almost definitely, like every other pilot in the region, known to avoid the area to which they eventually flew into. As soon as the radar was configured correctly, the pilots banked left to avoid it as best they could. How common a misconfigured radar is and how easily it is done is perhaps the most vital piece of information here. No aircraft should be allowed to fly with such important data being incorrect, ever. This needs to be checked and re-checked far better in future. It is the original link in this fatal chain. It was wrong data, not a wrong human assessment of data, that started off this crash sequence. Given the original radar data, the captain made the right call. And there's nothing obsentibly wrong with him going to take a nap, insofar as that's typical protocol.

Due to flying into the wrong weather-zone, the autopilot turns itself off. And that's that from there. Given that this is such a rare event it's notification is relatively minor within the grand scheme of fear and confusion that one would expect to exist for such an event that so drastically affects flying itself. There exists such a massive difference between autopilot and pilot-driven flying that there needs to be an unignorable physical presentation difference between the two: perhaps gently vibrating the control stick, changing the entire colour of the cabin (to, say, orange) using some LEDs and even changing the posture of a pilot's seat to a more upright position to subtly but distincly make for a different "feel" to computer-led flying. You'd just know based on these indicators alone. Perhaps it'd be harder to mentally block the stall warnings based on the notion that "we can't be stalling, the airliner won't let us" when it feels like you're personally in control of the whole airliner. They didn't just "ignore" the 70+ stall warnings, they completely ignored the very idea that it was possible for them to be stalling at all.

Addressing either of these two issues alone could have helped save AF447. Evaluating the other problems presented, like why two pilots can input vastly different instructions through their joysticks with both being in ignorance of one another clearly needs to be addressed (perhaps even a weighted average towards the more experienced pilot's input rather than a straight up average?); why there existed no clear chain-of-command; why the captain didn't get back quickly enough and how to "force" captains to be quicker; the best way to brief exactly what you've been doing more quickly; and perhaps a new technology that's basically "Clippy" for flying, that could say things like "You're in a stall, consider pointing down?"

This was a tragic mistake that ought not to have happen. Based on so much, let's not so easily condemn the pilots actions to stupidity and instead take a moment to consider the sheer horror they suffered after commanding such a massively complex machine in such challenging conditions with so much noise, lights and general "WTF"-ness.

Consider that environment the next time you get frustrated investigating a non-obviousl compile error in your quiet, air-conditioned, well-lit office.

http://www.nytimes.com/2011/05/08/magazine/mag-08Plane-t.htm...

First off, I find it surprising that there are two people controlling an air plane. I always thought that one guy had the reins and other guys helped him out.

Now I learn that there are computers in between the two guys averaging them out!

http://www.pbs.org/wgbh/nova/space/crash-flight-447.html

Would passengers have died instantly upon impact with the water? (It appears not)

[1] http://en.wikipedia.org/wiki/OODA_loop

I expect blunders like that from drunk drivers.