The Air France flight accident raises more questions than answers over automatic systems and what steps should be taken if they fail
When Air France flight 447 disappeared over the Atlantic Ocean on 1 June 2009, with the loss of all on board, there was consternation. Modern passenger aircraft are not supposed to fall out of the sky. It was vital to find out what happened.
Three major searches failed to find the aircraft’s data and cockpit voice recorders, but a fourth search in May 2011 discovered both, at a depth of about 12,000 feet, thus enabling the Bureau d’Enquetes et d’Analyses (BEA), the French air accident investigation body, to start piecing together what had gone wrong.
So far, the BEA has issued three interim reports, with a final report expected in the autumn. But the contents of the interim reports give substantial pointers to the cause of the accident, and raise considerable - if predictable - concerns about the relationship between human beings and highly automated systems.
Fly-by-wire passenger aircraft, such as the Airbus 330, largely fly themselves, with the automatic systems depending on computer analysis of the data fed in by the various sensors. Additionally, the automatics have built-in protections, preventing the pilot from making excessive control inputs that might take the aircraft beyond its designed parameters.
It is hardly surprising that the automatics, which are tireless, reliable and precise, are perceived as the safest method of conducting a flight. Indeed, there is ample reason to prefer the automation of any hazardous process to the alternative of control by a human brain, which evolution has not always equipped to provide an unemotional, rational, or consistent response.
But if automatic systems receive inaccurate data, they turn from being reliable to potentially hazardous. This is what happened on AF477, when the 3 pitot tubes - which sense indicated air speed - appear to have simultaneously iced up. Finding that none of the readings agreed with each other, the automatic pilot cut out and handed control back to the crew.
There is debate all over the professional forums about what the pilots should have done next and why they didn’t do it. But, in a nutshell, the pilot flying appears to have lost situational awareness, put the aircraft into a steep climb and stalled it. This was possible because the automatic protections had been lost when control was handed to the pilots. Thereafter, none of the crew seemed to have recognised what was happening and, rather than drop the nose and attempt to regain flying speed, persisted in pulling the aircraft’s nose up even though they were losing 10,000 feet per minute.
And here we have the implicit risks hidden in automation. If the automatics fail, it is up to the human operator to resolve the potential emergency. But if the human lacks direct experience of the system (because the automatics have always done the job), they have less to rely on. And since there is evidence that much decision-making derives directly from the recognition of similarities between current events and past experience, his decision-making capacity may be impaired.
A sufficient back-up plan?
How do you train humans rigorously enough to make the right decisions when automation fails, without incurring the costs (and risks) of disabling the automatics in order to gain hands-on experience? A common answer is to use standard operating procedures and checklists. The aircraft industry uses both, plus simulator training. But these may not cover a particular emergency, or, as may have happened in AF447, the standard operating procedure for one situation may not be the correct solution for what occurs.
And in the difficult and confusing environment of a cockpit ringing with aural warnings, in darkness, possibly in turbulence - the chances of standard procedures and checklists being an adequate substitute for decades of hands-on experience are limited.
Air France light AF447
Airbus 330-203 carried 216 passengers and 12 crew members.
1 June 2009: Aircraft vanishes en route to Rio de Janeiro from Paris
6 June 2009: Wreckage from AF477 confirmed
8 June 2009: Vertical stabiliser salvaged and bodies found
26 June 2009: Initial search ends
2 July 2009: The BEA releases interim report
20 August 2009: First search for flight recorders ends
24 May 2010: Second search for flight recorders ends
1 May 2011: Flight recorders found and recovered
27 May 2011: Second interim report released by BEA
29 July 2011: Third interim report released by the BEA